3

I'm considering sending more than 100,000 emails as fast as possible to different users of my website. These is not spam but requested emails. I'm using my own mail server (Exchange 2010).

May I have into account any security concerns?

For example, I think that:

  • My IPs may be blacklisted by remote mail servers (if for example I send too much emails to Gmail receivers...)
  • An attacker may see that I am sending lots of emails and try to phish my customers

Any other security concerns?

  • 2
    Related: stackoverflow.com/questions/3905734/… – André Borie Aug 31 '16 at 18:01
  • 1
    Your second point, about phishing, is not relevant to the problem you are asking about (even using MSExchange). But, of course that does not mean you shouldn't take appropriate measures to protect your data and prevent your service from being spoofed. – symcbean Aug 31 '16 at 18:24
  • Your question about Phishing is quite a different subject. You can post a new question with more context for this. – Bryan Field Aug 31 '16 at 18:28
  • Isn't your main question about Email Sending Reputation? That's not really a Security issue per se, so you might want to tweak the wording there. – Bryan Field Aug 31 '16 at 18:29
  • 1
    stackoverflow.com/a/3905805 – Robert Harvey Sep 23 '16 at 20:17
5

Mail receivers often track sender spam reputation per IP address. If you use a third-party provider to send the emails, then it is their IP which will take the reputation hit not yours. This is important to understand, as you don't want your all-important company Email Server to be on the same IP that sends a questionable quantity of emails.

Make sure that your email server is properly configured with a correct rDNS entry set up by your ISP. Also you should keep proper SPF records up to date.

You should throttle your emails. Sending them 'as fast as possible' will surely get you banned. It is much safer to spread them out with a delay between emails.

It is likely that your email traffic will have to go up gradually, or perhaps you will have to fill out unblock requests from the big carriers (Microsoft, AT&T, etc) as they will not take kindly to the huge spike in traffic (assuming this IP sends only minimal traffic prior to this)

You can also list an official unsubscribe feature, so that the mail client (i.e. Gmail) can provide a simple Unsubscribe quick link.

If you send enough email from your domain, Gmail will provide you with reporting on how well your emails fair.

There must be some canonical answer to how to properly format emails to avoid spam marks, but I'm not sure where it is.

2

If you do not implement proper rate limiting, your mail server's IP Address could get blacklisted and all mail rejected.

Good Practices:

  • Only send a few emails per second (do not send 1000s emails in 3 seconds).
  • Use proper SPF records.
  • DKIM sign all messages.
  • Include an unsubscribe link as to comply with the "CAN-SPAM" act.

If you get blacklisted and you have a provider with bad policies they could choose to terminate your account for spamming, this would include accidentally getting the IP blacklisted. Good luck with your project and I hope these key points help :)

1

Yes, Google and other well known mailing system would blacklist your IP, and your your mail server IP would land up in the spammers list (https://www.spamhaus.org/sbl/) even if you are using it for legitimate purpose.

Another point to consider is to make sure you have the SPF record for your domain or google mail drop all your mails.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.