4

I have an asp.net web app that generates emails when users perfrorm actions...these emails are generally notifications to other users that they should see/do something. The users can be internal to the company, or external (subcontractors).

These emails are stored in the database, and picked up by an email service. The database and email service are often, but not always, on a different server to the web app.

The email service up till now has been sending the emails from a generic account, or setting the sender as the user's email so it looks like it's come directly from them.

The problem I have is that some of our newer customer setup's don't allow emails that are claimed to be sent from somewhere, and actually sent from somewhere else. The solution I am looking at is to have the user enter their smtp settings and then the service will use these settings to actually send the email from that user. ...however, I need to be able to store the smtp settings securely, including password, so the service can retrieve them.

Can anybody please suggest how I can securely store the settings, or if it's not possible then how else I may tackle this issue?

thanks in advance.

  • 2
    Sending from a single "service" address (e.g. webservice@example.com) with the reply-to attribute set to the initiating user is a fairly common pattern for this type of situation, which avoids the need to pretend to be another user. – Matthew Jun 5 '18 at 14:19
  • Thanks Matthew. I hadn't noticed the ReplyTo, or ReplyToList (as ReplyTo is obsolete in this case apparently). I understand that our customers want the email to come "from" them though. Any ideas on how I might acheive that please? – RazorUK84 Jun 5 '18 at 14:35
  • There are some suggestions at stackoverflow.com/questions/4728393/… - note that the second answer has more upvotes than the accepted one, and I'm not sure how much has changed in acceptance terms in the last 5 years... I wouldn't be entirely surprised if even more options were blocked now. – Matthew Jun 5 '18 at 14:42
5

Don’t. Don’t take the risk.

Jira, for example, sets the From: <user name> noreply@jira.com and reply to: user@realaddress.com

Then the user sees the right person’s name in the from, replies to the correct email, and the message comes from your domain (replace Jira with your domain). Then on your domain, ensure you use DKIM, DMARC, and proper SPF (Amazon SES and Sendgrid are great options to outsource properly configured SMTP delivery).

Now the receiving mail server can decide to trust email from your domain because your domain has a good reputation. And the users get email that looks like it comes from their friends.

  • Thank you guys, that's very helpful. Would you mind adding a link or 2 to some recommended reading on DKIM, DMARC and SPF please. This really isn't my area, so I don't know if what I find will be accurate and up to date. Regards. – RazorUK84 Jun 6 '18 at 8:01
0

If you must store credentials (which I think you shouldn’t in this case), you need to:

  1. Encrypt them,
  2. Protect the keys
  3. Monitor decryption

Using a microservice like Hashicorp Vault or an HSM (hardware encryption module) allows you to keep the keys and the data separate except in the encryption service.

  • did you mean to post 2 answers? – schroeder Jun 5 '18 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.