Update TLS connections to 1.2 for SES using SMTP

AWS has recently implemented an update regarding the TLS requirement for all AWS service API endpoints. The minimum TLS version now required is TLS 1.2. https://aws.amazon.com/blogs/security/tls-1-2-required-for-aws-endpoints/

Based on the information you've given, it appears that Amazon SES has received SMTP traffic with TLSv1 from the source IP address 147.29.25.156. To avoid any disruptions, it is advised to update your SMTP clients behind the mentioned source IP address which is interacting with Amazon SES to support TLSv1.2 or later.

I received the same message from AWS. My client's .NET business applications also use SMTP to connect to Amazon SES to send transactional messages. NOTE: Amazon S3 is not in the mix for my client's use case.

My understanding is the following:

• If you have not explicitly set a TLS version in your application code, then your applications will use the TLS version that is the server's default at the O/S level.
• If you have explicitly set a TLS version in your application code, remove those lines of code and let the environment's TLS version default prevail.
• Make sure TLS 1.2 is enabled in your environment. For a Windows server environment, see the following: https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-server

I have implemented the registry entries recommended by the link above. And our .NET code never explicitly set a TLS version. HTTP2 had been disabled at the server level a few years ago to solve some other issue, so that's why our SES messages indicate "TLSv1". HTTP2 has been re-enabled. However, I don't know how to verify that the messages in the Amazon SES message log (ie. the message entries in the email sent by AWS) are now indicating something other than TLSv1 ... I am assuming the entry will display "TLSv2" if TLS 1.2 was used to connect to Amazon SES?

I thought I'd share my solution in my particular case if anyone is facing a similar situation:

This was what I was doing to initiate an email to Amazon SES before I made any changes.

C# .NET Framework 4.6.1

using System.Net.Mail;

//Example call to email service
using (SmtpClient mySmtpClient = new SmtpClient())
{
    mySmtpClient.DeliveryMethod = SmtpDeliveryMethod.Network;
    mySmtpClient.UseDefaultCredentials = false;
    mySmtpClient.EnableSsl = true;
    mySmtpClient.Host = "email-smtp.us-east-2.amazonaws.com";
    mySmtpClient.Port = 587;
    mySmtpClient.Credentials = new NetworkCredential(smtpAuth, smtpPass);
} 

My solution was to first update to .NET version to 4.7.2. I also researched and found that SmtpClient is no longer recommended for emailing in .NET.
They recommended MailKit. I refactored all my email service calls to use MailKit instead so now a call looks like this:

            using (var mySmtpClient = new MailKit.Net.Smtp.SmtpClient())
            {
                if (smtpPort == 587)
                {
                    mySmtpClient.Connect(smtpClient, smtpPort, SecureSocketOptions.StartTls);
                    Console.WriteLine("client.SslProtocols = {0}", mySmtpClient.SslProtocols);
                }
                else
                {
                    mySmtpClient.Connect(smtpClient, smtpPort, true);
                }

                mySmtpClient.Authenticate(smtpAuth, smtpPass);

                mySmtpClient.Send(message);
                mySmtpClient.Disconnect(true);
        }

Note that in the console.write I get the following results:

"Tls12 | Tls13"

This verifies that it's establishing the StartTls correctly from my application...hopefully :)