Questions tagged [email]
Related to email protocols, clients, servers, content, and message format.
1,668
questions
2
votes
0answers
27 views
Disturbing/suspicious Google notifications about account recovery and password change
This is similar to Is this Google mail from gaia.bounces.google.com legit?, except a) I have nothing in my life related to the language used (Indonesian), b) these are different notifications (and ...
4
votes
2answers
510 views
How to fix DMARC alignment failure
I'm sending emails via the Ionos mail servers.
I've got spf set up, but dmarc still fails.
This seems related to: Why is DMARC failing when SPF and DKIM are passing?
But I can't figure out how to fix ...
0
votes
0answers
21 views
checking if my email is in blacklist or whitelist of an organization [closed]
Is there any way to check if my email is on a blacklist or whitelist of some organization? Is there an option to check it without sending an email to that organization?
Because of I don't want to send ...
0
votes
1answer
34 views
How are validation links getting triggered by a third party?
Question: It appears that somebody can intercept and read emails that I send from my server, although
I have set up 2-Factor authentification for sudo-access
I log all logins on my server (Did not ...
0
votes
0answers
82 views
MacOS Mail app suddenly Opened trying to send message to a suspicious email
I'm on MacOS Monterey 12.0.1 and suddenly my Mail App opened to a "Compose" window which was addressed to a sender with address m.iPCMtmJsFmCms-Kma@pcm-m.l" m.iPCMtmJsFmCms-Kma@PCM-m.L. ...
0
votes
1answer
18 views
Cpanel Phising Link
Today I received a cpanel phishing link and I clicked on it. It redirected to another cpanel. I decide to look at the url, and here it is
redirect url
https://example.net/esg9/cpanel.php?token=...
0
votes
2answers
83 views
Can an HTML attachment in an email contain a virus?
I received an email from an old colleague asking me to take a look at an attachment. The email didn’t seem suspicious at all, it contained all the right logos, etc. When I opened the attachment it ...
0
votes
1answer
96 views
Guidance on Storing Email Addresses as Hashes
I am building an application where one user (User A) can store a "query" of another user (User B) that may or may not exist in the system. This query can be done by email address.
The ...
1
vote
2answers
101 views
report bribery: snail mail vs email vs SMS
Say I live in a western country and suspect a foriegn businessperson is trying to bribe local officials. I am provided with 3 options to report: snail mail, email and SMS. For my threat model, I am ...
1
vote
1answer
43 views
SPF records and spoofing
Lets say we have this SPF record
v=spf1 include:spf.protection.outlook.com include:spf.onprem.com -all`
And this record
v=spf1 include:spf.protection.outlook.com include:spf.onprem.com ?all
What ...
0
votes
1answer
93 views
Email and purchase order history
I have a common email (gmail, outlook, mail, etc) provider that I use to purchase from different merchants (amazon, target, etc).
Since some of these providers have had breaches before, do there exist ...
0
votes
0answers
32 views
Sending emails as other persons from internal network in Outlook Online
So today in work I tried making an SMTP email to our local mailserver. Using colleagues email name I sent an email to another colleague. The email didn't fall in spam and it actually showed the ...
0
votes
3answers
187 views
If email is an insecure medium, why are usernames and passwords sent via email (albeit in separate ones)?
At work we are using a secure file transfer utility that, after setting it up, sends you and the participants you want to share those files with, two emails. One email contains the randomised username,...
0
votes
0answers
48 views
Unknown Cause of SPF Fail
I have the following SPF record:
v=spf1 include:_spf.mailspamprotection.com include:_spf.google.com ip4:209.85.220.0/24 ~all
Although I have included _spf.mailspamprotection.com in my SPF record, ...
0
votes
0answers
39 views
Dealing with particular clients wrt TLS support in postfix?
External (other) Mail clients have started to deny/de-list anonymous ciphersuites. But the TLS support is often spotty. Worse, some clients (mainly Windows, which does not care one whit about your RFC ...
0
votes
1answer
75 views
Vulnerability : Missing SPF - is this a scam?
I got an email with the following:
I am just looking at your SPF records then found following. SPF Records missing safe check which can allow me to send mail and phish easily any victim.
PoC:
<?...
0
votes
1answer
67 views
Contact form encryption
Currently we have an email address and in certain cases we receive sensitive data via email. The goal is protecting this sensitive data. We have a website with SSL too so we thought that the website ...
16
votes
3answers
5k views
Can an email be doctored to appear from a different sender on an earlier date?
Could someone doctor an email to make it appear that it was sent from a different sender at an earlier date? For example, could someone who knows my email address make it appear that I had emailed ...
1
vote
0answers
83 views
Potential Western Union Scam - Account Registration
In recent weeks I have seen a handful of senior employees in my organization receive a confirmation email from Wester Union for a new account creation. The issue is that none of these users have ...
0
votes
2answers
102 views
Are e-mails that have a name slightly different from the web page legitimate e-mails?
I usually receive e-mails from an organization called Change.org, that is a site for create on-line petitions (it's site is https://www.change.org/).
The thing is, they send me e-mails with ...
0
votes
1answer
69 views
Should email password be encrypted in a django app when using TLS?
I have seen multiple videos/tutorials regarding how to setup the email system in Django.
It seems that they all assume as long as the password is stored in an environmental variable, no encryption is ...
0
votes
1answer
119 views
Is it a myth that signing up for social media puts your email open for phishing attacks?
So far I have owned a Google profile since 2016, and I had no problems until now when I began detecting unusual/bizarre messages in my 'Spam' folder.
This suspects me that operating a social ...
0
votes
1answer
71 views
Does having secondary email for 2FA increase security
Bank account have portals that one can access online.
After entering my uname/password, OTP is sent via SMS to mobile phone.
After entering OTP and password again, one is allowed access to online ...
0
votes
4answers
148 views
Is exposing email delivery failure to a user a security risk?
Case 1: When user creates an account, a confirmation email is sent.
Case 2: When user invites a coworker to his/her account, an invitation email is sent.
Problem: If a user makes a typo in the email, ...
2
votes
2answers
177 views
Why isn't there a protocol to exchange PGP keys?
Why isn't there a defined protocol to retrieve PGP keys from a destination mail server? Or am I just not searching with the right parameters?
I imagine a quite simple process like other established ...
-1
votes
1answer
69 views
Does gmail use SPF or DMARC when sending messages outside of gmail?
I can't seem to find any record of SPF or DMARC in the original messages coming from gmail to my mail server.
Does gmail use SPF or DMARC when sending messages outside of gmail?
0
votes
3answers
124 views
Sending Mail from Different Server SPF Record
Firstly, i'm not a mail expert! My workplace owns the domain example.com, until recently we had an application hosted on the LAN that worked fine and sent emails from info@example.com to various ...
0
votes
3answers
145 views
Is it safe to open email links in a private window?
Sometimes there are links on the email you have to click because they are agrements, but they are coming from a different URL. As of now what I'm doing is opening a private window and pasting the link ...
0
votes
1answer
140 views
Is there any security risk in sending a dangerous file via email to oneself?
Most common email services don't allow to attach file like exe files, or similar files that may contain security threats to a computer.
This can be bugging for users, but I can understand that, in ...
0
votes
1answer
97 views
Is there a way to know when someone tries to guess your gmail password?
Is there a way to check if someone is trying to login to my Gmail account without knowing the password (so they keep trying to guess the password and failing repeatedly or trying to guess the answers ...
0
votes
1answer
91 views
Company sent me a registration email with a clear text password [duplicate]
I recently signed up for a company's product, and promptly received an email confirming my registration, showing both my email address and my password. I'm not a security expert, but that was a huge ...
1
vote
2answers
86 views
What is the point of having SPF and DKIM set up, but having DMARC with policy=none?
Under this FAQ it says that using policy=none is a way for domain owners to monitor forged emails, without having to set up SPF/DKIM. But what im wondering, because i dont fully understand what SPF/...
0
votes
0answers
73 views
How many emails and accounts an organization's administrator and developer should have?
Let's say there is a small organization called "Example" with the registered domain "example.com".
There is a person, Bob, who has full control over the organization's GitHub ...
0
votes
0answers
67 views
How to detect and prevent phishing attacks on Gmail via Logging and DLP?
We did a phishing engagement on a client both payload and credential phishing. The first was using shortened file sharing links (including Google Drive) of our payloads and the second was a duplicate ...
0
votes
0answers
64 views
Confirm User Account Without Exposing IP of Server?
Right now, when a user signs up for a new account on my site, the server sends the user a email verification link.
When the user clicks the verification link, the link redirects to my server to ...
0
votes
0answers
60 views
Account enumeration on verification-less signup
Is there a way to prevent account enumeration on signup page if access to the site is not requiring you to verify your email?
The scenario is as following:
Sign up for a site with email+password, but ...
0
votes
2answers
208 views
Why are there so many special characters in this phishing link?
I recently looked at a spam mail I received. Generally, I'd say it was a fairly standard phishing attempt, but one thing struck me as odd:
The link that victims are supposed to click looks very weird ...
1
vote
2answers
128 views
Do fowarded emails retain DMARC protection?
Assume I ask someone to create a filter in their Gmail account that automatically forwards certain emails to my inbox. If the original email was protected with DMARC, would the forwarded email also be ...
1
vote
2answers
99 views
Inbox filling up with "confirm your registration" emails - what kind of attack is this? [duplicate]
My google inbox is filling up with hundreds and hundreds of "please confirm your new account on our website" messages. A coworker reports he had the same thing happen to him a couple of ...
-1
votes
2answers
153 views
Is it Safe to Rely on Gmail API to Reward Users for Placing Orders on Merchant Sites?
I have an application that rewards users for placing orders with certain merchants. In order to verify that the order was actually placed and delivered, a user is required to grant us read access to a ...
3
votes
1answer
242 views
Is using email (protonmail with Tor Browser / obfs4 bridges) to contact embassy in potentially hostile foreign countries safe?
Suppose one wants to use email (say using protonmail with Tor Browser / obfs4 bridges) to discuss sensitive matters (such as asylum seeking / embassy protection) with embassy in potentially hostile ...
0
votes
2answers
136 views
Can you trust a VPS service not to log data?
Like the title says, can you trust a VPS service not to log any data?
Is creating your own email server with a VPS service really a private solution?
0
votes
0answers
56 views
How can you tell if an email is really from the address it claims it's from? [duplicate]
I am creating a basic website contact form. It requires entering a 'from' email address. I entered a dummy email address, which I do not control, yet the email is still sent, and, to the recipient, it ...
0
votes
2answers
93 views
Sending password in separate email [duplicate]
I've noticed some services will send a username in one email with a note saying the password will come in a different email. Is there any point to this? It seems that if someone can get that email ...
0
votes
1answer
132 views
Is an owned domain + self hosted email the closest to owning one's online identity? Are there better alternatives?
Most online accounts identify users using email/phone & password; but since most all email/phone is handled by another service (e.g. Gmail), one's online identity only exists so long as these ...
0
votes
1answer
140 views
My IP Address is on 3 blacklists
I noticed my email address (my email address is through a web host where I also host my website) was being bounced from one or more professional email subscriber lists.
Through MX Tools I see that my ...
0
votes
1answer
161 views
Emails being sent to strange addresses
I use Yahoo Mail from Android devices. In my Sent box over the last few weeks I see a handful of completely blank e-mails (no subject and no contents) being sent to very strange addresses such as: ...
1
vote
2answers
264 views
How to check if a mail server is Enforced-STARTLS rather than Opportunistic-STARTTLS?
This article tells us that there are two types of STARTTLS: Opportunistic (i.e. optional STARTTLS) STARTTLS and Enforced STARTTLS, which works by the doctrine of "Encrypted connection or drop ...
0
votes
1answer
67 views
How to merge two email boxes securely with an email box fetcher?
I have two email boxes: The first one is my main email box in Gmail and the second one is in my website hosting company by Thunderbird which I access from my website hosting manager (WHM) which is ...
0
votes
2answers
108 views
Would Thunderbird's cache be affected by ransomware?
My university was hit by ransomware.
I wanted to know if it was possible that Thunderbird emails were also affected. (Mails saved in the cache, encrypted or not, etc.)
