Page 131 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
After a 220 response to STARTTLS, the client begins the TLS handshake before sending any further SMTP command. A successful TLS handshake resets SMTP to its initial state; both peers discard pre-TLS protocol knowledge and the client sends a new EHLO.
Read the checklist
An SMTP server advertising SMTPUTF8 accepts UTF-8 wherever the SMTP mailbox grammar permits a mailbox value. A client may send internationalized mailbox names and UTF-8 headers only after the server advertises SMTPUTF8 in its EHLO response.
Read the explainer
The RCPT NOTIFY parameter requests DSNs for SUCCESS, FAILURE, or DELAY; NEVER must appear alone and requests no DSN for that recipient. The RCPT ORCPT parameter preserves the original recipient address that corresponds to the actual delivery recipient.
Read the guide
An enhanced mail status code contains three dot-separated fields: delivery class, problem subject, and specific detail. Class 2 means success, class 4 means a persistent transient failure that may succeed later, and class 5 means a permanent failure requiring a change.
Read the playbook
A multipart body is divided by boundary lines into parts, each containing its own content headers, a blank line, and a body. The multipart Content-Type requires a boundary parameter, and the chosen delimiter must not occur as a delimiter line inside any encapsulated part.
Read the briefing
The UTF-8 address type has native, unitext, and ASCII-safe xtext forms; native UTF-8 cannot be used through a server that lacks SMTPUTF8. A message/global-delivery-status part uses UTF-8 and should preserve non-ASCII recipient addresses in the native UTF-8 address form.
Read the checklist
Authentication-Results assertions are trustworthy only when producer and consumer are connected through the receiving administrative domain’s configured trust boundary.
Read the explainer
One-click unsubscribe requires one List-Unsubscribe header containing an HTTPS URI and one List-Unsubscribe-Post header whose value is List-Unsubscribe=One-Click.
Read the guide
An SMTP mail object has an envelope containing the reverse path, recipient paths, and extension parameters, plus separately transmitted message content.
Read the playbook
Port 587 identifies ESMTP message submission, while port 25 may be used only when a site explicitly distinguishes submission agents from transfer agents. A submission agent requires authentication by default unless the session is already independently authenticated or authorized.
Read the briefing