Questions tagged [email]

Related to email protocols, clients, servers, content, and message format.

Filter by
Sorted by
Tagged with
0 votes
0 answers
29 views

Can I email a lot of random people I don't know for no reason [closed]

I'm not going to do it, but is it legal to email a lot random people? Again, I'm just asking, not going to do it.
0 votes
2 answers
82 views

Why is it ok to send my lender an email, but not ok for them to send an email back?

My loan lender accepts emails from their customers. They share their contact details including their customer service email address on their website with the public. So, they apparently regard ...
0 votes
0 answers
48 views

Why does the majority of email spam even exist? [duplicate]

This is a serious question and I have thought about it a lot. Not a newbie question. I am unsatisfied with the common answers they try to sell things they try to scam you they try to do phishing they ...
0 votes
3 answers
98 views

Is my Hotmail compromised as many emails have been sent automatically?

There were hundreds of emails sent from my Hotmail account between 30 Aug to 1 Sept to many Hotmail and Outlook addresses with sECURED.shtml attachment of 764KB. Some emails were not delivered and ...
48 votes
4 answers
4k views

Is URL rewriting in e-mail a sound security practice?

Our work e-mail server has started rewriting links in incoming mail through a redirecting gateway, for "security reasons": if I receive an e-mail containing a link to https://security....
0 votes
0 answers
22 views

How could I get a spam/phishing email from microsoft.com [duplicate]

I got this email from no-reply@microsoft.com. This spam email Report The User points to mailto:Unusuaal.Signin980@googlemail.com?subject=unusual sign-in activity&body=Report The User How can ...
0 votes
1 answer
76 views

How can I filter out phishing e-mails containing malware using Gmail?

I use gmail, and about 3 weeks ago I started getting a couple e-mails a day from random sources. All of the e-mails contain gibberish text like this: 6 5 4 8 2586 8016 70170 2 1 08 05 60 172 01 ...
  • 183
2 votes
2 answers
71 views

Flattening an SPF record - drawbacks and downsides?

I have an SPF record that has too many DNS lookups. Consequence is some mail servers will silently drop emails; RFC7028 says that over 10 lookups: SPF implementations MUST limit the total number of ...
  • 508
6 votes
1 answer
714 views

Can DMARC's SPF alignment be spoofed?

IP addresses can be spoofed. The Envelope-From and Header-From addresses can be spoofed as well. But is it possible to spoof all three at the same time to send a forged email that passes both SPF and ...
0 votes
1 answer
45 views

Forward messages without tracking pixels using thunderbird

Thunderbird does not load remote content by default, preventing pixel-tracking. However, if I forward an email, the links to remote content is still included in the forwarded email. Is there an option ...
  • 103
0 votes
1 answer
126 views

How to detect phishing emails in the future?

My main tactic (amongst others, see related questions) of how I detect phishing emails are through the use of the obviously wrong sender domain. I see a trend that big companies start to use dedicated ...
0 votes
2 answers
49 views

Is this a valid use case for email 2FA?

We have a private website for our clients which needs a username and password for login to see protected information. The users are created by ourselves by petition of our clients for some of their ...
0 votes
0 answers
37 views

How to encrypt an e-mail to many recipients in an effective way? [duplicate]

Let's say we have an e-mail of 10MB, and we want to distribute this to 1000 users. Before sending the e-mail, I encrypt it. And all users have my public key to decrypt it. What encryption method can I ...
0 votes
1 answer
97 views

Abnormal Receiving of Google Verification Codes

Recently I have been receiving "Google Verification Codes" that I never requested and for password recovery of the google accounts that are not mine however are similar to mine. It might be ...
  • 1
1 vote
1 answer
123 views

Why is email 2FA not common?

SMS is a quite common, albeit insecure, 2FA method. Why is email not more common? If someone is using a computer, they almost certainly have an email address, while it is less certain that they have a ...
  • 115
0 votes
1 answer
60 views

Does S/MIME encryption encrypt with each recipient's key?

If I send an email through S/MIME protocol to a group of recipients, does the email client require to encrypt the same email content with each recipient's public key before sending to each recipient? ...
0 votes
0 answers
47 views

Can code be executed from copying the From field of an Outlook Email?

I received a suspicious email in Outlook and wanted to check the from email field to see if it was still a Microsoft address. I right clicked and selected "copy address" on the From field ...
  • 1
1 vote
0 answers
70 views

What's the purpose of this spam that only sends a link to a Google search query? [duplicate]

I received the following email today which got caught by my spam filters. <My username> https://www.google.com/search?q= <my email address> Rock_jim Clearly this is spam, but I have no ...
  • 1,317
3 votes
1 answer
352 views

Can a plain text email contain XSS injection?

I need to send a plain text email with user-specified input. For example, if a user is an attacker a plain text email can contain <script>alert(1)</script> It looks like mail clients ...
  • 33
0 votes
0 answers
52 views

Best practices for GPG user ids and mail extensions / catch-all addresses

Assuming I want to use different mail addresses for different purposes and using either a catch-all configuration (*@example.com) or mail extensions (e.g. me+*@example.com) (where * can be replaced ...
0 votes
1 answer
59 views

Is an HMAC of an email address with a permanent secret key a good way to generate security tokens for unsubscribing from an email list?

I'm writing a mailing list manager program. For subscribing and unsubscribing, I'm considering using HMACs of email addresses with secret keys to generate unsubscribe links. This key would be ...
  • 115
32 votes
5 answers
5k views

Is there any security benefit from emailing a "secure link"?

Sometimes I receive email messages from organisations I'm involved with saying something like: Alice at AnyCo has sent you a secure message Along with a link to access said message. Sometimes I'm ...
0 votes
1 answer
68 views

How would you counter an email/honeypot mischief scenario?

I'm thinking through a mischief denial-of-service scenario that seems too easy to employ. Your web-site validates email addresses for new users on sign-up. A rogue party (a competitor) performs sign-...
  • 103
34 votes
5 answers
11k views

Can I prove that I did not receive an email?

A company are saying they sent an email to me. I have gone through all of my inbox, junk, and deleted files and the email still doesn’t exist. They have asked me to prove the email never got to me by ...
  • 341
0 votes
2 answers
87 views

Does my receiver have a public key for email encryption?

I'm using an email service with encryption option and I need to send an encrypted email. So if I need my letter to be sent encrypted, I need to take my receiver's public encryption key and apply it to ...
  • 11
0 votes
2 answers
66 views

How can I receive a (spam) email from an unknown email address?

When you receive an email, most email programs will display the sender as a name (chosen by the sender) and hide the actual email address behind it. Spam emails often abuse this by sending mails from ...
  • 123
0 votes
1 answer
57 views

Email TLS coverage for forwarded recipient email address

When an email recipient server (say server-A) is configured to forward to another email addresses (on say server-B), is TLS applied all the way up to server-B, or does it end at server-A, or something ...
  • 103
0 votes
0 answers
32 views

Do I have to check the fingerprint of new received OpenPGP public key, if it has been sent in a signed and encrypted email from a verified source?

I asked this question before at https://askubuntu.com/questions/1404973/do-i-have-to-check-the-fingerprint-of-new-received-openpgp-public-key-if-it-has and the answer to my question was "This ...
0 votes
0 answers
34 views

Spam investigation and email reputation check

We are investigating emails which were marked as spam by Cloudmark's service Cloudmark Authority Engine (CMAE). We want to find out if they are false positives. When an user ask to investigate why a ...
  • 3
0 votes
2 answers
91 views

Is the text of an email subject line a softer target for surveillance than the text in the body?

After using PGP for a long time I have trained myself to write bland email subject lines that disclose little or nothing about the contents. Some people I correspond with unencrypted have an annoying ...
  • 359
0 votes
1 answer
774 views

Is it safe to use AnonAddy or SimpleLogin for email address security?

I was intrigued with AnonAddy and SimpleLogin. They provide an email address forwarding service to prevent leakage of your real email address. I just want to ask if they really hide my real email ...
-1 votes
2 answers
85 views

How to check the authenticity of an outlook email attachment (.msg)?

let's say that someone sends me a business email on Microsoft outlook 365. I save the email as an attachment (email.msg) How a third person can make sure that the email attachment is not edited (...
  • 99
2 votes
2 answers
596 views

Cipher suite choice on macOS on Apple Silicon

I have a postfix mail server that accepts these cipher suites: tls_high_cipherlist=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384: ...
  • 647
0 votes
0 answers
8 views

Click on a link in a malicious email - how can i be hacked? [duplicate]

I accidentally clicked a link in a malicious email. The link has opened in my browser. I have not entered any username and password to login in. Could I have been hacked? I'd like to know what could ...
3 votes
3 answers
697 views

Securing Email: use GPG for all emails?

I am thinking of using GPG to sign commits and particularly to secure emails, and have some questions regarding the usefulness. Basic threat model (I use LESP as abbreviation for large email service ...
  • 39
-1 votes
1 answer
76 views

What might happen if you post a local URL?

To show something in a forum you capture a page of an email service after logging in; but using MS Paint you erase the titles of the inbox as well as your name. Only the following information is shown ...
  • 1
0 votes
1 answer
90 views

Virus from Embedded Image in Mac Mail?

I'm using macOS High Sierra, and mac Mail version 11.3. I have a script that uses the Twitter API to continually fetch tweets in real-time and send the contents of each of these tweets, including any ...
  • 3
0 votes
1 answer
59 views

Suspicious ip address of our mail domain found on talosintelligence.com (spoofing attempt)

We have a fair amount of email traffic. Recently, we had some suspicious email spoofing attacks and a lot of users reported that outgoing emails were marked as spam and landed in junk folder (reported ...
  • 3
0 votes
1 answer
38 views

Authorizing 3rd Party Envelope Sender to Impersonate Header Sender

Rewriting for clarity: This is regarding emails send from a 3rd party marketer spoofing one of our email addresses in the message header from field. In these emails the envelope sender would come ...
1 vote
0 answers
25 views

Email supposedly from the future mentioning fairly recent password [duplicate]

Just got an email that mentioned, in very broken english, having hacked my email etc. and actually managed to list my current password of that email account. The mail was, apparently, send by that ...
  • 11
1 vote
2 answers
69 views

Using Google Domains' Email Forwarding Service for throwaway accounts and other things

I registered my current web domain (masonbitbyte.dev) with Google Domains and one of the offered features is an email alias / forwarding service. I can create over 100 email addresses on my domain (...
1 vote
1 answer
86 views

Is authentication through mail clients safe when encryption is off?

When adding an account on a mail client, the SSL/TLS is usually turned off and the encryption method is 'none' (see Outlook example below). Is the password safely sent through the internet when ...
1 vote
1 answer
97 views

Possible rogue admin monitoring my online activities

I teleworked for a medium-sized software company. We had a network architect who offered me a firewall to install so I could securely access on-premises resources and play around with some ...
1 vote
0 answers
91 views

iOS (iPhone) S/MIME certificate with multiple addresses

On an iPhone I have a mail account in the native Mail app with two distinct e-mail addresses, and a certificate that lists both of those e-mail addresses in the SAN field. When I try to send mail with ...
1 vote
0 answers
60 views

Is there a standard for fencing email domains to specific use cases?

To my knowledge, there's no common standard for sysadmins to publish trusted domains for specific use cases. If it exists, I would presume that this might limit phishing attacks. Think of my question ...
0 votes
0 answers
45 views

How am I receiving emails addressed to an address not associated with my account?

I currently have a g-mail address (example@gmail.com). I recently received a message addressed to example@aol.com. Looking at the header I see my correct address in the Delivered-To: field but in the ...
0 votes
0 answers
67 views

Is it inappropriate at all for someone in my client organization to email their PEM file to me?

I have a SAML offering for my clients to access my cloud based application. Should I have a portal for them to upload their certificates or should I go the easy route and just have them e-mail them to ...
0 votes
1 answer
204 views

Making a phishing link look innocent

Situation I am learning about phishing attacks using OSINT, social engineering and some Kali tools to send a mail to a dedicated target, which contains an 'appealing' message and an ngrok link leading ...
-1 votes
1 answer
88 views

Automated malicious links delivered with e-mail (Reddit, LinkedIn, Package) [closed]

Recently my organisation has been flooded with phishing e-mails with different approaches: pretending to be Reddit or LinkedIn information about a new follower or package delivery status/problems, etc....
  • 353
1 vote
1 answer
129 views

Suspicious hyperlinks (all hex URLs) in e-mail

I'm communicating with a job headhunter over LinkedIn and he sent me an e-mail containing information about a position. However, I noticed that all of the hyperlinks in the e-mail (even the one on ...

1
2 3 4 5
35