I was testing my mail server's STARTTLS configuration when I stumbled onto this page : https://starttls.info/about. The following excerpt puzzles me:
When you send an email through your outgoing mail server, that email will potentially do multiple hops between different mail servers before reaching its destination. All of these intermediate servers will have to have strong STARTTLS support, in order for your message to not be exposed at one or more stages of its journey.
It was my understanding that the process of sending an e-mail was the following:
- The mail server performs a DNS lookup to get the recipient's domain name's MX.
- The mail server initiates a connection to the obtained IP on port 25 (SMTP).
- If both servers support opportunistic encryption, a secure connection is established.
- The e-mail is delivered to the recipient (EHLO, MAIL FROM:, RCPT TO:, DATA, .)
Now where in all this is there an opportunity for the e-mail to bounce around multiple servers?