3

I use the same server for sending my emails and web hosting. I send user registration and support forum mails from my server and occasional marketing mails or newsletters.

I read on a CloudFlare blog that if I use the same server for email and web hosting the headers of the mails sent will contain my IP which will make me exposed to DDos attacks but my hosting provider says that there is no such threat with IP's in mail headers.

I am confused if it's okay to use the same server for both web and mail and does having my server's IP in the mail header really does increase the risk of DDos.

Improve this question

1 Answer 1

Reset to default
5

You can use CloudFlare to hide your server's real IP address. This article is saying that if you use CloudFlare and send email from your web server, it could expose your real IP. Assuming that you are not using CloudFlare or another similar service, the risk described in the article is not relevant to your situation and can be ignored.

Improve this answer
3
  • Thanks for the reply Neil.I do intend to use cloudflare for the CDN purpose.But I also feel that using or not using cloudflare wouldn't make a difference against DDos if my IP gets exposed anyhow.Don't you think ?
    – John
    Mar 11, 2016 at 4:57
  • It would not, that's why they're telling you not to send your mail from the same server on the blog. To follow the analogy in the blog post: "Signing up for CloudFlare is like taking your number out of the phone book, and putting in CloudFlare’s number under your name." If you then proceed by phoning people from your real phone number, visible on caller ID, there was not much point to the first step as everyone you call will know your real phone number. Of course if you weren't hiding your IP in the first place, preventing it from being exposed through your emails wont give you any protection
    – Fluffy
    Mar 11, 2016 at 8:56
  • @John Cloudflare definetly makes a difference against DDoS as long as your server IP is hidden. If an attacker knows your backend IP he's able to attack that and thus bypassing Cloudflares network and defeating its purpose. There are several alternatives for sending E-Mails, like using an external SMTP server or an API like Mailgun/Mandrill/Amazon SES/etc.
    – Skyküff
    Mar 11, 2016 at 10:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .