EHLO response from mail server for starting encrypted TLS protocol when connecting to SMTP to send mail appears modified from STARTTLS to AUTH PLAIN when sent through tor instead of plain TCP.

In consequence, email account credentials can only be sent in easily interceptable plain text when tor is used.

Basic problem: Thunderbird suddenly (around 08.2015) cannot connect to postfix/smtp by STARTTLS any more through tor, complaining STARTTLS would not be advertised.

Another MUA can connect to postfix/smtp by STARTTLS in plain TCP without tor without problems.

postfix is configured to advertise STARTTLS.

So I telnetted postfix/smtp twice,

  • directly from localhost or from another remote ip,
  • through tor by proxychains.

telnet directly from localhost or from remote ip:

> telnet localhost 25
Connected to localhost.
Escape character is '^]'.
220 x.y.com ESMTP
EHLO a.b.com
250-SIZE 10485760
250 DSN
221 2.0.0 Bye
Connection closed by foreign host.

In plain TCP, STARTTLS is advertised OK, both for connections from localhost and from remote.

Consequence: The MUA (mail user agent) initiates a TLS session to send credentials and email encrypted to the server, man in the middle (rsp. tor exit node) sees only an encryted stream.

telnet through tor by proxychains:

> proxychains telnet x.y.com 25

ProxyChains-3.1 (http://proxychains.sf.net)                                                                                                                   
|DNS-response| x.y.com is XX.XX.XX.XX
Trying XX.XX.XX.XX....
Connected to x.y.com.
Escape character is '^]'.
EHLO a.b.com
220 csds.local ESMTP
221 Bye
Connection closed by foreign host.

I get a different answer through tor, and the STARTTLS advertisement is missing. Instead 250-AUTH PLAIN LOGIN appears.

Consequence: The MUA either complains that TLS is not possible and nudges the user to fall back to plain text credentials or falls back to plaintext authentication and transmission automatically, in the latter case eventually without notifying the user, thus leaking the users credentials.

In both cases email content and USER CREDENTIALS would be revealed in plaintext to a man in the middle (rsp. the tor exit node).

I tried this with different tor identities.

To acertain whether this behaviour is indeed a function of the tor network, it is neccessary to exclude any other source. These are predominantly postfix, proxychains and any software run on my server.

If it is tor, the culprit is most probably the exit server. So: does the tor exit server used by proxychains change with a tor identity change?

But I suspect a misbehaviour of postfix in the first place.

How can I determine if this behaviour is dependent on postfix configuration or a function of tor, filtering STARTTLS?

Or something else?

If it is postfix, how can I fix it?

  • I'm guessing that your localhost is not x.y.com. telnet to x.y.com instead of localhost and see what it shows.
    – psusi
    Oct 2, 2015 at 13:30
  • I replaced the actual urls and ips in this post. x.y.com stands for the url of my postfix smtp server, which is actually something else. XX.XX.XX.XX stands for the ip of my postfix smtp server, which is actually something else.
    – mailman
    Oct 2, 2015 at 14:23
  • I varied not the target of the telnet connection, which is in all cases my postfix/smtp server, but the source, which is in one case localhost on the server, in the other case a remote computer of mine. The localhost-to-target connection and a remote-to-target connection was made through plain TCP/IP, the other connection remote-to-target was made through tor.
    – mailman
    Oct 2, 2015 at 14:33
  • It looked like you were using the hostname in one case and the IP address in the other, and the hostname may not be resolving to the IP address you think it should.
    – psusi
    Oct 2, 2015 at 19:27
  • @psusi: pls elaborate
    – mailman
    Oct 2, 2015 at 22:25

1 Answer 1


Tor itself will block SMTP, what you are getting is a fake SMTP server (notice the csds.local instead of your actual hostname/FQDN) that is probably ran by the exit node to block mail.

  • Tor block SMTP on port 25 and delivers a fake response. Switching to another port helps.
    – mailman
    Oct 26, 2015 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.