3

I use the same server for sending my emails and web hosting. I send user registration and support forum mails from my server and occasional marketing mails or newsletters.

I read on a CloudFlare blog that if I use the same server for email and web hosting the headers of the mails sent will contain my IP which will make me exposed to DDos attacks but my hosting provider says that there is no such threat with IP's in mail headers.

I am confused if it's okay to use the same server for both web and mail and does having my server's IP in the mail header really does increase the risk of DDos.

5

You can use CloudFlare to hide your server's real IP address. This article is saying that if you use CloudFlare and send email from your web server, it could expose your real IP. Assuming that you are not using CloudFlare or another similar service, the risk described in the article is not relevant to your situation and can be ignored.

  • Thanks for the reply Neil.I do intend to use cloudflare for the CDN purpose.But I also feel that using or not using cloudflare wouldn't make a difference against DDos if my IP gets exposed anyhow.Don't you think ? – John Mar 11 '16 at 4:57
  • It would not, that's why they're telling you not to send your mail from the same server on the blog. To follow the analogy in the blog post: "Signing up for CloudFlare is like taking your number out of the phone book, and putting in CloudFlare’s number under your name." If you then proceed by phoning people from your real phone number, visible on caller ID, there was not much point to the first step as everyone you call will know your real phone number. Of course if you weren't hiding your IP in the first place, preventing it from being exposed through your emails wont give you any protection – Fluffy Mar 11 '16 at 8:56
  • @John Cloudflare definetly makes a difference against DDoS as long as your server IP is hidden. If an attacker knows your backend IP he's able to attack that and thus bypassing Cloudflares network and defeating its purpose. There are several alternatives for sending E-Mails, like using an external SMTP server or an API like Mailgun/Mandrill/Amazon SES/etc. – Skyküff Mar 11 '16 at 10:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.