Secure email

Vince said:
It's worth finding out :) Will make it much easier to point you in the right direction :) 0365 may not be the easy choice depending on what they ask for.
Click to expand...

I said I was a noob! When I check my email I do it in Chrome. The address is https://outlook.live.com/mail/0/inbox

My email address is me at my domain name which is hosted on Dreamhost.

Does that answer your question? Haha

I am guessing that is webmail? Could be wrong.
 
jpod said:
I said I was a noob! When I check my email I do it in Chrome. The address is https://outlook.live.com/mail/0/inbox

My email address is me at my domain name which is hosted on Dreamhost.

Does that answer your question? Haha

I am guessing that is webmail? Could be wrong.
Click to expand...

That doesnt mean much tbh as you can send emails from your own domain in some sketchy ways via google / microsoft. The MX records will tell us where things go :)
 
jpod said:
I said I was a noob! When I check my email I do it in Chrome. The address is https://outlook.live.com/mail/0/inbox

My email address is me at my domain name which is hosted on Dreamhost.

Does that answer your question? Haha

I am guessing that is webmail? Could be wrong.
Click to expand...

oh in that case it might already be 0365 if Dreamhost do it. :) Looks like they are doing hosted.
 
your email resolves to Microsofts Hosted Exchange platform aka O365. Now all you need to work out is if you run a hybid i.e. do you have an AD server local?



Your host, like all other hosts, simply rebrand "whitelabel" Microsofts Hosted Exchange Platform. In terms of integration it shouldn't be too hard to link things up. I'll have a little read of the NHS documentation also.

So if you go here:

https://support.nhs.net/knowledge-base/technical-pre-requisite-tasks/

You can see the following chart of pre req's:



To me it looks like they are just enforcing TLS so on O365 you should be good to go, other checks for non o365 seem to be around checking for open relay, split tunnel vpn? not sure why as all that is doing is forcing remote clients out over local for internet based services. Likely this is to protect NHS bandwidth. But pretty much they are enforcing TLS.

It appears to me that once you sign up and you meet requirements from a server and client version in terms of tls that they will then, for 10 mailboxes pre authenticate emails. This TLS is forced on a receive connector option in exchange. After that the pre authenticated mailbox after registration will likely add your email into delivery restrictions in the mailbox itself in exchange that looks like this:



I dont think they will force partners onto their platform just force clients to pre auth via a form and then meet tls requirements.
 
Last edited:
Vince said:
your email resolves to Microsofts Hosted Exchange platform aka O365. Now all you need to work out is if you run a hybid i.e. do you have an AD server local?

.......

Your host, like all other hosts, simply rebrand "whitelabel" Microsofts Hosted Exchange Platform. In terms of integration it shouldn't be too hard to link things up. I'll have a little read of the NHS documentation also.

So if you go here:

https://support.nhs.net/knowledge-base/technical-pre-requisite-tasks/

You can see the following chart of pre req's:


To me it looks like they are just enforcing TLS so on O365 you should be good to go, other checks for non o365 seem to be around checking for open relay, split tunnel vpn? not sure why as all that is doing is forcing remote clients out over local for internet based services. Likely this is to protect NHS bandwidth. But pretty much they are enforcing TLS.
Click to expand...

Just so I understand this correctly. When you say good to go....does that mean I am already running TLS and my current set up is the equivalent in security?

Or does that mean there is some work to take place - AD server local (I know the tune but not the words here.......) and with that work it will be the equivalent in security and local colleagues should not fear emailing patient info back and forth?

I am sorry to have an utter noob understanding - I am a much better dentist! I may be AFK for a while shortly. Many thanks to all btw.
 
jpod said:
Just so I understand this correctly. When you say good to go....does that mean I am already running TLS and my current set up is the equivalent in security?

Or does that mean there is some work to take place - AD server local (I know the tune but not the words here.......) and with that work it will be the equivalent in security and local colleagues should not fear emailing patient info back and forth?

I am sorry to have an utter noob understanding - I am a much better dentist! I may be AFK for a while shortly. Many thanks to all btw.
Click to expand...

I added a bit to my previous post. Really it boils down to (and I cant get to this bit for obvious reasons) sign up to the service, you can then enter 10 email addresses to pre auth against a single address at the nhs side. (there side is already set up and enforces tls via a receive connector, basically that bit you don't need to worry about.) I am pretty sure you will register your addresses and then they will pre authenticate those email addresses against the address provided by them to you. At which point providing your server supports TLS you can simply send an email, if the tls handshake is successful your email will arrive to them.

If you are unsure and wanted to have a chat with somebody to get things clear without all the techie that talking on a forum brings out then i'm happy to post my number for you in dm where you sent me your email and I can explain how all this works in simple terms and what steps you might need to take or to answer questions once you have provided them your emails. Im fairly sure though from reading the documentation that they aren't forcing your platform, but are forcing the level of security needed to communicate with them.
 
Last edited:
Vince said:
I added a bit to my previous post. Really it boils down to (and I cant get to this bit for obvious reasons) sign up to the service, you can then enter 10 email addresses to pre auth against a single address at the nhs side. (there side is already set up and enforces tls via a receive connector, basically that bit you don't need to worry about.) I am pretty sure you will register your addresses and then they will pre authenticate those email addresses against the address provided by them to you. At which point providing your server supports TLS you can simply send an email, if the tls handshake is successful your email will arrive to them.
Click to expand...

Final noob question before I give you a break and I get some UV...I assume other non dental folk will be able to email to my regular email address - is that correct?
 
jpod said:
Final noob question before I give you a break and I get some UV...I assume other non dental folk will be able to email to my regular email address - is that correct?
Click to expand...

Correct - TLS is deterministic for that very reason :) Also - Sorry I keep updating posts, more again above!

edit: It's also worth pointing out that they do say that in terms of routing that changes may need to be made, reading between the lines that will be checking against smtp open relay, there are online checks and I can check your email/server to see if allows open smtp relay, generally this is a no-no when setting up any email system. But unless you correctly route traffic in and out of your firewall it's perfectly possible to be running hybrid 365 while being an open relay (most unlikely in this instance as you would also need an exchange server your end).
 
Last edited:
Vince said:
Correct - TLS is deterministic for that very reason :) Also - Sorry I keep updating posts, more again above!
Click to expand...

Vince thank very much indeed. I will have a read and thank you for your kind offer.

I am grateful to be able to ask advice from you all and it increases my IT-IQ, thank you. :D
 
jpod said:
Vince thank very much indeed. I will have a read and thank you for your kind offer.

I am grateful to be able to ask advice from you all and it increases my IT-IQ, thank you. :D
Click to expand...

NP and good luck I am glad for you that it's just TLS And not S/MIME as S/MIME requires quite a lot of fairly complex setup. Where as the receiving server forcing TLS is trivial in all honestly so long as you meet platform requirements.
 
You must log in or register to reply here.
Back
Top Bottom