Email security - Post-quantum key exchange for MX deployments

<p>Cloudflare Email Security now supports post-quantum hybrid key exchange with X25519MLKEM768 on the SMTP connections we make to receive and deliver mail. Deploying Email Security in front of a provider that supports post-quantum hybrid key agreement (like Google Workspace) will create a TLS 1.3 connection using post-quantum key agreement.</p> <p>Inbound MX connections and outbound delivery connections now negotiate the <a href="https://developers.cloudflare.com/ssl/post-quantum-cryptography/#hybrid-key-agreement">X25519MLKEM768</a> hybrid key agreement when the peer supports it, protecting SMTP traffic against <a href="https://blog.cloudflare.com/pq-2024/" target="_blank" rel="noopener">harvest-now, decrypt-later<span class="external-link"> ↗︎</span></a> attacks.</p> <p>Support is backwards compatible and enabled automatically for all customers. Senders and receivers that do not yet advertise post-quantum key agreement continue to connect with classical key exchange.</p> <p>This applies to all Email Security packages:</p> <ul> <li><strong>Advantage</strong></li> <li><strong>Enterprise</strong></li> <li><strong>Enterprise + PhishGuard</strong></li> </ul>