[GH-ISSUE #979] Add TLS support for Receiving Emails #682

New issue

Closed

opened 2026-02-25 23:43:15 +03:00 by kerem · 4 comments

kerem commented

2026-02-25 23:43:15 +03:00

Owner

Originally created by @JohannesFleischer on GitHub (Mar 26, 2024).
Original GitHub issue: https://github.com/healthchecks/healthchecks/issues/979

I have set up a self-hosted Healthchecks instance and noticed that when pinging the server via smtp, it is only possible to send unencrypted emails because TLS is not supported.

This allows an attacker to perform a replay attack, making it look like a service is still running when it is not.

This is why I would love to see TLS support for this feature.

Originally created by @JohannesFleischer on GitHub (Mar 26, 2024). Original GitHub issue: https://github.com/healthchecks/healthchecks/issues/979 I have set up a self-hosted Healthchecks instance and noticed that when pinging the server via smtp, it is only possible to send unencrypted emails because TLS is not supported. This allows an attacker to perform a replay attack, making it look like a service is still running when it is not. This is why I would love to see TLS support for this feature.

kerem

2026-02-25 23:43:15 +03:00

closed this issue
added the
feature
label

kerem commented

2026-02-25 23:43:16 +03:00

Author

Owner

@aque commented on GitHub (Mar 30, 2024):

I suggest not exposing smtpd directly and use postfix or similar as a frontend. Aside from TLS, you can use their features to secure the smtp service like HELO restrctions and DKIM checking. I have my smtpd service listening on localhost:2525 and setup a postfix transport file with healthchecks.domain.tld smtp:[127.0.0.1]:2525.

@aque commented on GitHub (Mar 30, 2024): I suggest not exposing smtpd directly and use postfix or similar as a frontend. Aside from TLS, you can use their features to secure the smtp service like HELO restrctions and DKIM checking. I have my smtpd service listening on localhost:2525 and setup a postfix `transport` file with `healthchecks.domain.tld smtp:[127.0.0.1]:2525`.

kerem commented

2026-02-25 23:43:16 +03:00

Author

Owner

@JPaulMora commented on GitHub (Apr 10, 2024):

Would it be a good idea to make smtp listen on localhost only by default?

@JPaulMora commented on GitHub (Apr 10, 2024): Would it be a good idea to make smtp listen on localhost only by default?

kerem commented

2026-02-25 23:43:16 +03:00

Author

Owner

@aque commented on GitHub (Apr 10, 2024):

You can do that by adding --host localhost.

@aque commented on GitHub (Apr 10, 2024): You can do that by adding `--host localhost`.

kerem commented

2026-02-25 23:43:16 +03:00

Author

Owner

@cuu508 commented on GitHub (Nov 21, 2025):

I'm not planning to work on adding TLS support.

Our SMTP listener is pretty rudimentary. As @aque says, a proper frontend would do better job of sanitizing incoming messages, checking DKIM, rate limiting, integrating with LetsEncrypt and so on.
The smtp library we use, aiosmtpd, has not had real commits for more than a year. I do not know if it has ever been fuzz tested. Exposing it to the public internet may be a security risk. Or maybe it is solid and safe. I don't know.

@cuu508 commented on GitHub (Nov 21, 2025): I'm not planning to work on adding TLS support. * Our SMTP listener is pretty rudimentary. As @aque says, a proper frontend would do better job of sanitizing incoming messages, checking DKIM, rate limiting, integrating with LetsEncrypt and so on. * The smtp library we use, aiosmtpd, has not had real commits for more than a year. I do not know if it has ever been fuzz tested. Exposing it to the public internet may be a security risk. Or maybe it is solid and safe. I don't know.