Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [smtp]

Simple Mail Transfer Protocol. A protocol for delivering e-mail from an end user to a server for storage and later retrieval by the intended recipient.

0
votes
1answer
57 views

What are recommendations for unblocking outbound SMTP traffic in an organization?

Our organization has blocked all outbound SMTP traffic under the assumption that we are preventing potential botnet spamming issues which lead to blacklisted IPs. However, I've seen other ...
1
vote
1answer
62 views

Is there a list of open mail relays I can use for a pentest? [closed]

I'm currently pentesing a client (with permission of course) and we are testing their email filtering capabilities. We want to check whether they reject mail coming from open mail relays, but I seem ...
0
votes
0answers
43 views

Database in DMZ and SMTP relay

I have an application that talks with a database in the DMZ. There is a firewall between the apps and the db but our developer thought that they require a mail notification that is triggered from the ...
1
vote
2answers
162 views

Why would an attacker try SMTP login many times even though it is disabled?

I recently set up an SMTP server for myself to use, and I am getting some traffic from two IP addresses and none else (though for obvious reasons I will not state the addresses here). An example ...
0
votes
1answer
60 views

Simple Mail Delivery Protocol (SMDP), where is it today? what do you think of it?

So I'm doing a research study on Simple Mail Delivery Protocol (SMDP) for those of you who don't know what it is, it's a new protocol for Email delivery that promises complete anti-spam filtering. ...
0
votes
2answers
57 views

Running open relay smtp in company network

We are producing IoT gateways which send out emails via SMTP protocol for user notifications. These IoT gateways are mainly used by corporate customers in intranets without access to or from the ...
2
votes
2answers
69 views

Domain offline - are unmaintained email clients a security risk?

I have just unregistered a domain. Now my mail client (Thunderbird) popped up a message saying that it cannot connect to the mail server. That's fine - for the moment. However, I wonder what would ...
1
vote
1answer
201 views

SMTP Service STARTTLS Plaintext Command Injection

We are getting this vulnerability on SUSE Linux Enterprise Server 11. This vulnerability is getting triggered on port 587 for postfix. I have checked several links but I am unable to get any relevant ...
2
votes
0answers
212 views

Why is hotmail mail server providing an invalid certificate?

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com is using a TLS certificate issued to mail.protection.outlook.com. Both the mail server hostname and TLS ...
0
votes
2answers
111 views

Can password be stolen when doing SSL/TLS-protected IMAP/SMTP in public network

My email password has been stolen most probably while I was on vacation in another country and was using hotel's (and maybe others, cannot remember) WiFi networks to read and optionally send emails ...
3
votes
1answer
72 views

Why doesn't SMTP check that users are authenticated to send from an address?

I think it's a bit different from this question since it's about SMTP, but similar idea. Wikipedia says on email spoofing: MAIL FROM: - generally presented to the recipient as the Return-path: ...
1
vote
2answers
383 views

Close Port 587 - Ramifications?

Our recent PCI scan failed because "Plaintext authentication is allowed over unencrypted channel on SMTP." As such, our tech support suggested to close port 587. What are the effects of closing port ...
0
votes
0answers
18 views

Understanding transit flow through email header [duplicate]

I am trying to analyse the flow of email by email header. I have added snippet of one my email header I am trying to understand. I have concluded some points using that. Are the below conlcluded ...
4
votes
2answers
309 views

How to securely store user-specific mail server credentials at the server side of a web application

I have an asp.net web app that generates emails when users perfrorm actions...these emails are generally notifications to other users that they should see/do something. The users can be internal to ...
4
votes
1answer
151 views

How secure is e-mail landscape right now?

In light of recent news about some flaws in PGP standard, I (a non-PGP user) started to think how secure are regular e-mails these days. I have found the STARTTLS Everywhere project, and they have a ...
2
votes
2answers
127 views

Can SPF be bypassed by using a shared email server?

As I understand it, SPF works by listing permitted SMTP server domains in the TXT DNS record of the domain you own. So if I own example.com and wish to permit a 3rd-party SMTP server at smtpexample....
0
votes
1answer
248 views

Is it possible to disable SSL over SMTP/POP to the mail server that enables SSL/TLS?

I'm using thunderbird where I can check the option whether I will use SSL/TLS or not. However in my company's server, SSL/TLS is enabled both on POP3 and SMTP. Is it possible to disable SSL/TLS on ...
0
votes
1answer
47 views

SMTU AUTH and compromised user

Recently I've set up two SMTP auth-enabled sendmails, and within a week and month both of them were used to send unsolicited mail using SMTP AUTH. Attackers were acting from different IP and using ...
1
vote
1answer
400 views

How to get the IP Adress of an email receiver

I am communicating through email with a scammer who is trying to by me mw own parcel of land. I already contacted the police but it could take 2 to 3 months before they start investigating. I want to ...
3
votes
2answers
264 views

SSL/TLS compression attacks on mail servers (smtp)

Currently, we know few compression attacks on the SSL/TLS protocol (such as Crime or Breach). I wonder for few days if these attacks are practicable on a mail server (smtp). Is CRIME attack ...
1
vote
1answer
375 views

Why did PHP 5.6 change how it handles SSL certificates?

I was using PHPMailer to send an email with SMTP. This time I used PHP 5.6. I received the following error. Warning: stream_socket_enable_crypto(): Peer certificate CN=`*.example1.com' did not match ...
7
votes
2answers
454 views

Why are common services using implicit SSL not considered obsolete in the way that SMTPS is?

SMTPS (implicit SSL) has been deprecated/obsolete since SMTP+STARTTLS (explicit SSL) was defined in RFC2487. I'm not entirely clear on the reasoning behind that, but it was clearly considered a good ...
4
votes
2answers
773 views

What happens if STARTTLS dropped in SMTP?

SMTP uses STARTTLS extension to upgrade SMTP to SMTP Secure (STMPS). According the the RFC, the client and server starts TLS as follows: S: <waits for connection on TCP port 25> C: <opens ...
0
votes
3answers
5k views

How a spoofing email site such as emkei works

I'm trying to understand how email spoofing works. After studying the technical process, I have finally understood that : 1)The spoofer will try to scan every ports of a smtp server to catch the mx ...
1
vote
2answers
646 views

Email Security Gateway vs Firewall [closed]

An email security gateway is an edge device such a router that serves for relaying the external network with the private network. It helps with detecting and blocking spams and phishing emails. That ...
0
votes
3answers
931 views

Is Open Port 25 on Web Server dangerous?

Port 25 of a web server is open. We dont have any email server, since we use google mail server, but still port 25 is open. Is it dangerous to keep it open? If it can be attacked then how it can be ...
1
vote
0answers
154 views

I want to know if exist a vulnerability in using sp_send_dbmail of SQL Server?

I'm using the next stored procedure sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection? In the configuration of the Database ...
61
votes
1answer
12k views

Why does Gmail (add accounts) using SMTP server recommend SSL instead of TLS?

I stumbled something interesting today when I was adding an account to my gmail one. Why is SSL boldly stated as recommended when TLS supersedes SSL? The links for SSL and TLS is the same: https://...
0
votes
1answer
356 views

What security settings is Yahoo Mail looking for to consider IMAP client secure?

When setting up an IMAP client for Yahoo Mail, Yahoo requires the "Allow apps that use less secure signin" option to be enabled. The client is configured to use SSL for IMAP (and SMTP). What ...
1
vote
2answers
157 views

How to detect SMTP proxy on public wifi?

For a small research project I want to collect characteristics of public wifi hotspots. One topic that came up was SMTP proxy - is there a way to detect a proxy or could I just check whether the ...
1
vote
1answer
40 views

When is it appropriate to check the from part of a mail address and to not only validate the domain?

SMTP authentication Mailing in same domain This question is based on the answers provided above. The question is not how and why to authenticate server mails from same domain which makes it ...
6
votes
1answer
643 views

Why is still so easy to send phishing emails?

When I first started playing around with how SMTP worked over 20 years ago, I remember being somewhat surprised how easy it was to make an email appear in someone else's mailbox that looked like it ...
4
votes
3answers
4k views

SMTP Email Spoofing

While testing my SMTP server using a telnet session from home, I was able to generate an email using the following commands: telnet MyEmailServer 25 HELO MyEmailServer MAIL FROM: ...
0
votes
0answers
115 views

simple question about smtp server ( msa to mta ) security design?

Not sure if this is due to security; hence the reason i am asking here. I have 2 SMTP server and a couple of unix servers the actual mailserver running on window. client connect to it and download ...
1
vote
1answer
570 views

How to spoof a MIME-level email address

As a sysadmin, I need to send spoofed emails to ensure that the spoofing protection (DMARC, etc) is working. I think Emkei's Fake Mailer can be used to send emails spoofed at the SMTP / 5321.MailFrom ...
0
votes
2answers
112 views

VPS outbound emails security

I have an instance of VPS running with logrotate that emails me logs every day. It is a send-only SMTP server with Postfix, set up using this guide. I just need to receive the logs from this server. ...
2
votes
2answers
95 views

Using port port 25 on the same WiFi

Me and my brother live in the same apartment and use the same internet connection. (A WiFi router with WPA2 password). He uses Microsoft Outlook as his primary email tool and I noticed that his POP ...
0
votes
1answer
1k views

smtp port 25 connect failed

If I take any host from https://www.arclab.com/en/kb/email/list-of-smtp-and-pop3-servers-mailserver-list.html why I'm not able to telnet to any of the specified ports ? I'm getting: "Connecting To ...
3
votes
1answer
109 views

What are the security issues of having all services (web, smtp, dns) on a single machine?

I'm wondering what are the drawbacks, from a security point of view, of having more than one service (let's say the web server, the mail server and the DNS server) on the same machine, rather than ...
3
votes
3answers
1k views

How does lack of SMTP authentication impact users?

My school supplies an email address for its students. To connect to their email server, no authentication is needed for the outgoing mail server. So no user name, or password is needed and no SSL/TLS ...
0
votes
3answers
2k views

System nmap shows port closed but online nmap tool shows port open

When I run a nmap scan against a remote target, it shows port 25 closed but an online nmap tool like (https://hackertarget.com/nmap-online-port-scanner/) shows that port 25 is open. sudo nmap -sS -v ...
15
votes
3answers
7k views

What is the most secured SMTP authentication type?

Say you have to choose only one among the following authentication types for your own SMTP server: LOGIN, PLAIN CRAM-MD5 DIGEST-MD5 NTLM/SPA/MSN Which one would you recommend for optimal security? ...
0
votes
2answers
642 views

Tracing the email sent from SMTP

How can someone be traced over email/SMTP, if they connect via telnet to SMTP and send and email. I know that email can be spoofed with this method, but how secure it really is? Can I see who was ...
21
votes
7answers
7k views

Is there a risk connecting to POP3 or SMTP email server without secure connection?

My ISP gives instructions how to connect to its POP3 and SMTP email servers: These settings will help you to set up your email program. email server: POP3 POP server (incoming): pop....
0
votes
1answer
876 views

Whitelist mail domains and users to smtp on mail server

Lately our mail server (postfix 2.9.6, ubuntu 12.04, courier) got compromised by spammers that are send plenty of dummy mails to many recipients, The spammers used two different ways: 1- using real ...
4
votes
1answer
93 views

Why does my password appear in clear text with my smartphone mail IMAP application?

I am using the default Galaxy 5 mail application to fetch my mail with IMAP. Packet capture shows my user and password in clear text (see below). Why does my username and password appear in clear ...
2
votes
0answers
36 views

Where to find mails or mail addresses on a web server? [closed]

In a training lab I'm using for a computing security certification I just got root access to a SMTP server, and there are so much files to look for. I want to retrieve mails or mail addresses using or ...
0
votes
1answer
1k views

How to use testssl.sh on an SMTP server? [closed]

I need your help with testing SMTP with testssl.sh. This is the command that I run: ./testssl.sh -t smtp [IP] Where the IP is the SMTP server IP where I know there is an SSL/TLS certificate. With ...
1
vote
2answers
155 views

SMTP Strict Transport Security vs Zix

I've read that Google, Microsoft, and Yahoo have banded together to introduce a new protocol for email encryption - SMTP Strict Transport Security. From my understanding of it, it seems that it's ...
5
votes
2answers
1k views

Does sending email with TLS help to not being flaged as spam?

Does sending email with TLS help to not being blocked or not being flagged as spam by recipient?