Skip to main content

Use of Insecure SMTP Channel


Ensure confidentiality and integrity of data during transmission


  • Usage of Elixir (v1.10+) for building scalable and fault-tolerant applications
  • Usage of Swoosh library for email sending


Non compliant code

def send_email(email) do
{:ok, pid} = Swoosh.Adapters.SMTP.start_link(port: 25, tls: :none)
email |> MyApp.Mailer.deliver(pid)

The code above is vulnerable because it sends an email using the Swoosh SMTP adapter without encryption (tls: :none). This means that all data sent in the email can be easily intercepted and read by any party that can listen on the network.


  • Enable SSL/TLS in the SMTP settings.
  • Ensure the use of valid and trusted certificates.
  • Perform periodic reviews and updates of security configurations.

Compliant code

def send_email(email) do
{:ok, pid} = Swoosh.Adapters.SMTP.start_link(port: 465, tls: :always, ssl_opts: [{:versions, [:'tlsv1.2']}])
email |> MyApp.Mailer.deliver(pid)

The secure code uses the SMTPS protocol which operates on port 465 and uses SSL/TLS to encrypt the communication channel. The 'ssl_opts' option is set to use TLS version 1.2 which is currently considered secure.