Cleartext submission is retired

Answer Cleartext submission is retired. RFC 8314, published in January 2018, says that sending mail and passwords in the clear for submission and access is obsolete. Use TLS. A solo ad that still hands the message, or the account password, to a server with no encryption is behind a specification that is older than the offer.

The note that started this: RFC 8314, Cleartext Considered Obsolete, RFC 8314.

Yesterday's note was about the list rule on a holiday. Today is about the pipe. Buyers obsess over the subject line because they can see it. The session that carries the subject line is invisible, and it is where a password and a list of recipients can leak to anyone on the path. Solo ad pricing that ignores the session is a price for a letter and a shrug about the envelope around the login.

RFC 8314 is titled as a retirement. Cleartext considered obsolete. It is about email submission and access, the places a user talks to a server, not about every hop on the public internet. The instruction is plain enough for a quote. Do not submit the message in the clear. Do not submit the password in the clear. Implicit TLS on port 465, and STARTTLS on the submission port 587, are the shapes the document points to. A seller who answers with the word port and no mention of TLS has named a number and skipped the point.

What does RFC 8314 change for a sender?

It says cleartext is obsolete for email submission and access. Mail and passwords should be submitted over TLS. The specification was published in January 2018.

Obsolete here is a standards word. It means the old way is no longer the accepted way. It does not mean every forgotten script on earth has been turned off. Scripts linger. Shared hosting panels linger. A solo seller who built a sending rig in a hurry can still be on the lingering side. Your job is to refuse to rent that rig.

Access matters as much as submission. The mailbox the seller reads, the panel where the list lives, and the tool that holds the creative are all doors. A password typed into a cleartext door is a password shown to the network. You may never see that door. You can still ask whether the platform requires TLS for the login and for the send. A platform that cannot say yes is a platform from before this document, which means from before 2018.

• The platform requires an encrypted session for login.
• The platform requires an encrypted session for submission.
• The seller can say 465 or 587 without guessing.
• A custom script is held to the same rule as the platform.

Which ports does that specification point at?

It points senders to implicit TLS on port 465 and to STARTTLS on port 587 for submission. Port 25 is not the submission path this document is repairing.

Implicit TLS means the encryption starts as the connection starts. STARTTLS means the connection begins and then upgrades, if both sides agree and nothing strips the offer. Both can be done well. Both can be done badly. The buyer is not there to audit the handshake. The buyer is there to notice if the seller's only answer is port 25 and a laptop, which is the path the previous note already separated from submission.

Ask the question in ordinary language. Is the session encrypted before the message and the password move? If they need a manual, they can read this RFC. If they need a vendor, they can use one that already did. You are not paying them to rediscover 2018 during your send.

Does encrypted submission mean the solo ad will reach the inbox?

No. Encryption protects the session between the sender and the submission server. It does not decide inbox placement, and it does not make a rented list wanted.

This is the sentence sellers skip when they discover a standards document that sounds like a shield. TLS stops a snoop on that session. It does not introduce you to the reader. It does not forgive a bought list. It does not move mail out of a spam folder. A buyer who hears encrypted and translates it into delivered has bought a padlock and called it a friendship.

Put the padlock on anyway. Then go back to the list, the domain, and the complaint line. Cleartext is retired. The rest of the order is still due.