Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [email]

Related to email protocols, clients, servers, content, and message format.

Filter by
Sorted by
Tagged with
0 votes
1 answer
51 views

Mails in my iCloud mailbox with a foreign mail address as recipient

How is it possible that my iCloud address is not the recipient but has been spoofed in some way? I don't have any forwarding active and I don't know the sender or recipient addresses.
Yannic's user avatar
  • 3
0 votes
0 answers
46 views

Locating Spambot

My mail server (IP, not domains) was recently flagged as a spam source by Spamhaus and I'm looking for help at tracking down the source. First, I verified the forward and reverse DNS records, SPF ...
user1801810's user avatar
32 votes
6 answers
7k views

Is .txt the only email attachment type that can always be opened without risk?

Is .txt the only email attachment type that can always be opened without risk? Source of the claim: Training program on phishing at my company
I. Haage's user avatar
  • 453
1 vote
3 answers
191 views

Can my phone got infected if visit my mail inbox without opening any mail attachments?

I've found some articles saying some viruses/malware can attack your device by just opening an email without downloading or opening any attachments. Is this true? If yes, how risky for ordinary mail ...
Sasi Bulan's user avatar
0 votes
1 answer
135 views

What are forms of "hidden tracking links" in email messages that collect data; activated by simply opening email?

The US Dept of Justice on Monday, March 25, 2024 announced Seven Hackers Associated with Chinese Government Charged with Computer Intrusions Targeting Perceived Critics of China and U.S. Businesses ...
uhoh's user avatar
  • 1,409
0 votes
1 answer
65 views

Can I use multiple email providers with my website's DKIM, DMARC and SPF?

I'm a software developer, with limited Mail server setup experience, running a little side SAAS on the side where I send emails to my customers. My domain has SPF, DMARC and DKIM setup and I use ...
LePrinceDeDhump's user avatar
2 votes
1 answer
121 views

Does the school have access to email content of my personal email if logged into Chrome with my school account?

I sent an email to somebody with my personal email account (not my school email account). However, when using my personal email, I am doing it with a Chrome browser that I am logged in to using my ...
Amanra 's user avatar
0 votes
0 answers
106 views

How can email-tracking services track emails in Google

Some email-tracking services use tracking pixels to detect whether an email was opened. The idea is to add an HTML img tag with an src attribute that links to a 1x1 or 0x0 pixel image to the email ...
Starnec's user avatar
  • 101
0 votes
0 answers
69 views

What is the correct way to implement a change-of-email request flow?

I am currently implementing a change-of-email request flow for a web service without MFA. My initial approach is to consult the current OWASP Guide for such a flow. In reading the document, I've ...
peteredm's user avatar
0 votes
0 answers
131 views

Is this a safe setup to prevent email account hack?

I would like to protect a Gmail account from being hacked. Suppose I use the following approach for login/authentication: Username, Password 2FA via security stick the stick is in a place that is not ...
fkarger's user avatar
  • 21
0 votes
1 answer
206 views

How to check e-mail message authenticity? Suspected EML file forging

In a small company, we have an issue suspecting a former employee has forged an e-mail to our company from his Hotmail account by changing its date and recipients in the EML file, claiming that the ...
Asdf's user avatar
  • 101
1 vote
2 answers
86 views

Is it possible for an attacker to change an email-attachment of a received email client-side and synchronize it via IMAP with Webmailer?

an attacker manipulated the IBAN of an invoice.pdf attached to a received email. The question remains, can said attacker manipulate/change such a pdf client-side and cause an IMAP synchronization with ...
frank's user avatar
  • 11
1 vote
0 answers
106 views

Can an email trace be maliciously removed by an admin on a default Outlook setup?

I'm doing some research into email servers and how they work. There is a function in Outlook 365 where an admin can perform several traces on emails for the past 90 days. For example, an 'enhanced ...
Elizabeth Vogue's user avatar
0 votes
2 answers
135 views

Why spamassasin is doing dns lookup?

I have a server which have configured Amavis and Spamassasin (in default state only). I recently noticed log lines that probably indicate DNS query failure, below is an excerpt: Nov 21 11:15:40 ...
SUNITA GUPTA's user avatar
0 votes
0 answers
218 views

Guidance: S/MIME Signed Certificate invalid for many clients even though it worked previously and still works

I have a very strange problem and i would like to get some guidance on this. Problem description: My application is sending S/MIME signed Email messages to clients. It worked perfectly no problems ...
Lorem ipsum's user avatar
0 votes
0 answers
160 views

If only 'two' insecure MFA options are available (email and sms) which is 'most secure'? [duplicate]

Although I disagree with the term MFA entirely if it refers to 'login code send to email', it's a one-time password at best, and likely badly implemented with its associated risks. I do see quite some ...
Bob Ortiz's user avatar
  • 6,665
-1 votes
1 answer
164 views

Tracing the email's MAC address

Can someone trace the MAC address of an email to the point of origin if the email address has been deleted? I received an email from an unknown sender regarding an issue at my work, and when I tried ...
nida ejaz's user avatar
0 votes
0 answers
21 views

How to determine if email is from from gaia.bounces.google.com or just forwarded from there? [duplicate]

Shown below are the "from and to" portions of the message. It looks like it is just forwarded by "gaia.bounces.google.com". The message itself (and I have quite a few of them) ...
Alexander C. Landsburg's user avatar
0 votes
2 answers
142 views

What does the IMAP banner alone show regarding security (STARTTLS, hashing, information disclosure)?

I encountered an open TCP/143 IMAP port which responded with this banner: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=...
Bob Ortiz's user avatar
  • 6,665
6 votes
1 answer
1k views

Spoofed email sent to me from my email address with SPF/DKIM/DMARC passing

I received an email earlier today on my work email address. The email came from the same address—mine—but I didn't send it. It was an email claiming that he was a professional hacker who had hacked my ...
PaulMcF87's user avatar
  • 161
0 votes
1 answer
134 views

Text that is turned into links by email clients

When sending emails in the context of an application that will send transactional or marketing emails, sometimes you want to include user-provided information in the body, like for example you ask the ...
gimix's user avatar
  • 283
2 votes
0 answers
217 views

Is email between "large email providers" now secure against interception?

Now that almost all users use only a few email providers, is email content secure from interception? This related question was closed referencing a question about the security of SMTP IMAP, and POP: ...
Croad Langshan's user avatar
0 votes
1 answer
119 views

How can an email forwarding service send email with a "From" from a domain they don't control, and still pass SPF?

Let's say: [email protected] sends an email to [email protected]. Bob owns the domain bob.com but doesn't manage an emailing server. Instead he uses an email forwarding service (provided by his registrar /...
Basj's user avatar
  • 953
0 votes
0 answers
110 views

Proper HIPAA security

I am a sysadmin, though not security-specific. I was recently stunned to receive an automated email from my physician's office (in USA) containing an HTTP link to their website for the completion of ...
Charles Nix's user avatar
0 votes
3 answers
359 views

Gmail encryption

Is sending emails between Gmail accounts encrypted, can ISP read gmail content in transit??
Naqibullah Vakili's user avatar
1 vote
1 answer
150 views

Measures to safeguard against ZeroFont phishing attack

What measures can be taken to safeguard against ZeroFont phishing attacks (setting font size to zero), and how can email security settings assist in the detection of ZeroFont elements and the ...
Maideen Asbak's user avatar
0 votes
0 answers
134 views

I am trying to identify suspicious content within a PDF file

I have a PDF file that has been sent to me as part of a suspicious email. I viewed the email as message source from within outlook. This gave me all raw text within the email. I copied this to ...
JHM's user avatar
  • 1
1 vote
1 answer
104 views

With selfhosting email server, selfsigned certificate, does it make a difference with PGP mail, What can be leaked?

If we are self hosting our own email server with mydomain.com with a self sign CA for S/MIME. What are some possible ways that our email content can get leaked? Then if we use PGP email, does it make ...
user294265's user avatar
2 votes
2 answers
324 views

Is a + on an email address a security vulnerability for a registration process?

Is + in email addresses a security vulnerability for authentication algorithms? How can it be used in a malicious way? Should we forbid emails with + signs during registration? For example we have 2 ...
user228062's user avatar
0 votes
0 answers
21 views

How do I find out what country did an email originate from? [duplicate]

Out of curiosity I came across some emails in my inbox that I really wanted to know where they where sent from. Not just Google's or Yahoo's service's address, but the actual country the sender was in ...
Hugo Almeida's user avatar
1 vote
2 answers
197 views

Is OK to accept multibyte unicode codepoints as recipient address for Sendmail and Postfix?

I am working on a server software that receives an utf-8 encoded email address to send an email to. I permit multibyte unicode characters (emoji etc.). Then I pass that email address to Sendmail to ...
Greenlight's user avatar
0 votes
1 answer
1k views

Still able to spoof emails with strict DMARC, SPF and DKIM enabled

Despite setting up strict DMARC, SPF, and having DKIM enabled, I am still easily able to spoof the "From" address. I can easily do this with PHPMailer on my Mac and even with some free 3rd ...
Ian W's user avatar
  • 101
1 vote
1 answer
173 views

User Access to Quarantined Emails

Are there any industry recommendations with regards to allowing users access to quarantined emails in Office 365? Should users be notified of quarantined emails. Should they be allowed to request the ...
CJamesEd's user avatar
0 votes
2 answers
256 views

What is this bot/person trying to do with my contact form:

I have a small Wordpress website using contact form 7. I received messages that look like an attempt to hack my website: From: <div style="background-color:#4169E1; margin:auto; max-width:...
Plouff's user avatar
  • 103
0 votes
1 answer
273 views

What is the most secure way to send email now? PGP or S/MIME, Given both parties willing to learn the technical parts

What is the most secure way and privacy-focused to send email now (current tech)? PGP or S/MIME, Given both parties willing to learn the technical parts? Use case, both of parties use third party ...
user294265's user avatar
0 votes
1 answer
102 views

How can we ensure the best practice with mail pgp when the recipient is not using it?

How can we ensure the best practice with mail pgp when the recipient is not using it?, so when Bob send the vary first email to Alex, Bob signing and encrypted it? Q1. In that case, Is Alex able to ...
user294265's user avatar
1 vote
0 answers
246 views

How secure is SMTP email today? [duplicate]

Can SMTP be relied on to send confidential information and attachments in 2023? With the concentration of email accounts in big cloud platforms belonging to Microsoft, Google and others, is email more ...
aire's user avatar
  • 11
1 vote
1 answer
2k views

Does Apple’s Hide my Email feature really work?

I was wondering if when you use something like Apple's 'Hide my Email' functionality if there's some way for the organization to still recover the user's original email if the user is then asked to ...
Justin T's user avatar
  • 113
0 votes
1 answer
3k views

Is this google security alert legit?

I got this security alert from Google lately, but I'm not sure if it is legit. Someone might have tried to scam me, because it says my E-Mail was linked to another as the recovery email. Either ...
Alpha-Craft's user avatar
0 votes
1 answer
261 views

Spoofed forwarded email? Help with analyzing of DMARC report

Why did this email get forwarded successfully? An XML report is below: I simply cannot understand the delivery status, a transcript follows: This email has been automatically forwarded. Despite the ...
Vlastimil Burián's user avatar
-1 votes
1 answer
197 views

Can Outlook stay connected to an email account through a password change?

Corporate setting, multiple people have access to the same email account (it is a functional not a personal account). Order of events: User A opens Outlook, connects to the shared email account, ...
quarague's user avatar
  • 183
1 vote
1 answer
130 views

Would asking for user input email again in password reset increase security?

I have a workflow like this right now: User inputs the account email and clicks the "forget password" button User receives an email containing a link with token for password reset User ...
John Winston's user avatar
2 votes
0 answers
137 views

What does a Microsoft Safelink contain?

Regarding the URL query arguments of a Safelink: Why do they contain my e-mail address (the recipient)? What are these two longish strings? Look like IDs of a database. Does Microsoft store Safelinks ...
rexkogitans's user avatar
3 votes
1 answer
811 views

What are the risks of an MTA-STS policy with a long max_age?

In setting up SMTP MTA Strict Transport Security (RFC 8461) for my domain, I've noticed some contradictory advice and practice: although the maximum value for the max_age policy value is around one ...
Emily's user avatar
  • 33
0 votes
0 answers
125 views

If I have my own email server and domain, but use Outlook at the client, does this give Microsoft access to my emails?

I have a custom domain, and I'm going to set up an email server on a VPS. Then I'm going to create an Outlook account and connect it to the email server via POPS/IMAP. How much does this compromise my ...
David Kagan's user avatar
1 vote
0 answers
167 views

I have found my email online in a .txt file. What should be my next steps? [closed]

A few days ago someone tried to log into my bank account, the attempt was unsuccessful but it was quite concerning. I’ve spent the past weekend moving my most important accounts to alternate emails ...
Ahania's user avatar
  • 11
1 vote
0 answers
144 views

Malicious Mass Email Attack Occurred, Do I Still Have Problem?

I'm using Apache Airflow and I was troubleshooting built-in smtp setup. A mass email occurred on "[email protected]". It was used as a "From:" email in a mass email attack. ...
python_mainly's user avatar
0 votes
0 answers
470 views

SPF passes but in Gmail, 'Show Original', top section doesn't show SPF: PASS with IP

When I send an email from my HostGator account to my Gmail account, I see in the header spf=pass... When I paste the header in this tool -> https://toolbox.googleapps.com/apps/messageheader/ It ...
Bob Aune's user avatar
1 vote
1 answer
6k views

Can an email be traced if the account is deleted?

Can the government trace an email that has been sent from an account that is now deleted?
nessa's user avatar
  • 11
2 votes
0 answers
112 views

Is there a safe way to follow a suspicious link? [duplicate]

When I get suspicious emails, I pretty much always just report it as spam, delete forever, and then be done with them. Low quality spam is pretty easy to identify, but sometimes they are on the ...
David K's user avatar
  • 1,337

1
2 3 4 5
36