Add TLS support for Receiving Emails

[JohannesFleischer]

I have set up a self-hosted Healthchecks instance and noticed that when pinging the server via smtp, it is only possible to send unencrypted emails because TLS is not supported.

This allows an attacker to perform a replay attack, making it look like a service is still running when it is not.

This is why I would love to see TLS support for this feature.

[aque]

I suggest not exposing smtpd directly and use postfix or similar as a frontend. Aside from TLS, you can use their features to secure the smtp service like HELO restrctions and DKIM checking. I have my smtpd service listening on localhost:2525 and setup a postfix transport file with healthchecks.domain.tld smtp:[127.0.0.1]:2525.

[JPaulMora]

Would it be a good idea to make smtp listen on localhost only by default?

[aque]

You can do that by adding --host localhost.