7

Despite the fact that Email standards such as MIME don't specify any file size limits, but in practice email users will find that they can't send very large files(more than 20 or 25 MB).

Some experts say that "you can safely send files upto 10MB between any email providers without the fear of message not being delivered"

Also I hear that over the Internet a message will often pass through several mail transfer agents to reach the recipient. Each of these has to store the message before forwarding it on, and may therefore need to impose size limits.

According to above, I have three questions that have one direction:

  1. Why mail transfer agents need to impose size limits?
  2. is there any security reason for this limitation?
  3. Why the limitation has not been exceeded 25 MB until now?

Comment:"With MIME, a message and all its attachments are encapsulated in a single multipart message, with base64 encoding to convert binary into 7-bit ASCII - or on modern mail servers running Extended SMTP, optionally full 8-bit support via the 8BITMIME extension. the MIME encoding, which typically uses Base64 adds ~33% overhead"

Update: I think that the reason is not only because of mitigating DoS attack,because:

An attacker can not perform attack with one file! So he needs enough email transfers, if he have a mechanism for performing his attack with many email, and he is faced with file limitation,instead of sending 10000 email with 50MB, he performs attack with 20000 email and 25MB size.(as an example)

Improve this question
2
  • It's mostly for protecting against denial of service which could be considered a security thing.
    – user42178
    May 16, 2015 at 12:22
  • 1
    The experts are wrong because I still know providers with 5MB or 3MB limits.
    – Hagen von Eitzen
    May 16, 2015 at 19:41

3 Answers 3

Reset to default
6

MTAs often virus scan, DLP scan, or perform other scans that take CPU time. Sometimes a MTA is on a bandwidth constrained network link.

Base64 encoding bloats a message from its binary size by 33%, which increases pressure on disk and on the network.

Exceeding these limits will cause a denial of service attack against the MTAs, or even against the host itself in the event of a NDR return message.

Improve this answer
4
  • But if it is because of DoS attack, why the limitation is 25MB,why it is not 26MB or 30MB or something else?
    – Ali
    May 16, 2015 at 12:40
  • And also an attacker can not perform attack with one file! So he needs enough email transfers, if he have a mechanism for performing his attack with many email, and he is faced with file limitation, for example instead of sending 10000 email with 50mb, he performs attack with 20000 email and 25mb size.
    – Ali
    May 16, 2015 at 12:57
  • @ali one file can be bifurcated into many if the SMTP envelope RFC2821 / includes many different SMTP domains. If those domains allow both a two hop NDR AND a full text inclusion of the large attachment, one 1MB file sent to 1,000 people can be expanded into 1 GB outbound, then back inbound with the two hop NDR.. turning 1 MB into 2 GB
    – makerofthings7
    May 16, 2015 at 13:03
  • @ali netcat email_server_ip < email_headers.txt < /dev/random Syntax may be a little off, but this would upload arbitrarially large messages to the server. If there is no upper limit (other than MAX_INT) then this command can eat up a significant amount of server memory without usimg much client resources.
    – atk
    May 16, 2015 at 16:01
2

I can think of the following reasons for the limitation :

  • Traffic, A mail server is busy a lot of the time (eating bandwidth). and most of that mail is SPAM... a size limit also limits the SPAM sizes to that limit.

  • Disk Size, every mail server in the chain has to e able to store the messages, the bigger the mail size the larger the 'cache' has to be on all the nodes. with 10k users having a avarage of 100 mails that allready amounts to 10 000 x 100 x 25 Mb = 25 000 000 Mb or 25 TB of storage just for the mail messages if they were not BASE64 encoded (that adds about 1/3 to the total) the header information (adds 10% overhead & logging) and you end up with 25TB *1 1/3 * 1.1 = 36.67 TB Most people these days store more than 100 mails per user and 10k users is for the mail companies not a huge amount anymore.

  • Denial of use, A mail server often has only 3 Delivery ports (2 for users 1 for servers) that means that of to many people connect for a to long time (big email messages and many users / sources) you run out of ports. performing a DoS. limiting mail size offers 1 form of mitigation against this by limiting the amount of bits being "normally' transmitted pert connection.

  • Need, there has not been a 'global' need for bigger mail messages than 25 MB (the limit is arbitrary chosen)

  • Entropy Depletion (not that common anymore) Secure connections can deplete the Kernels Entropy pool. Most kernels these days have methods to prevent this from becoming a real problem, or a Random chip could be added to the server.

Improve this answer
1
  • Actually, many MTAs want to have the complete mail in memory for some time, so the pressure is even larger than with disk size. Even if virtual memory is available, it may be good idea to have it completely in physical RAM due to many random access checks made during spam/virus checks and such.
    – Hagen von Eitzen
    May 16, 2015 at 19:40
1

Message size limits are an important mechanism to control mailbox sizes, guarantee service availability, and also protect from potential DoS attacks.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .