Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [smtp]

Simple Mail Transfer Protocol. A protocol for delivering e-mail from an end user to a server for storage and later retrieval by the intended recipient.

0
votes
3answers
4k views

Can I spoof email?

I mean, if I would have my own SMTP (also, is it just about money or are there some limitations to running my own SMTP server?) and would just completely made up the mail (headers, spoofed IPs and ...
1
vote
1answer
41 views

Postfix SMTP - Can I use SSH public keys instead of sasl password

I am relatively new to managing mail server, although i am familiar with webhosting servers not running dedicated email services. Postfix is configured to use sasl-password authentication I have ...
1
vote
2answers
154 views

How to test if TLS is enforced for emails sent through SMTP? [closed]

We are planning to create a rule in Proofpoint to enforce TLS on all outgoing email. I need to test that the rule is working and emails are bouncing if the recipient SMTP server does not support TLS. ...
1
vote
2answers
1k views

Is it possible to fake the mail server address?

Suppose that I send an E-mail to someone. Is it possible to fake mail server address - for example, while I used my own local mail server, I send it as if it was sent from Microsoft mail server. (I ...
1
vote
2answers
176 views

How to extract intresting data from malicious e-mail header

Premise: I know pretty well how SMTP works, and how to read an e-mail header. I know what all the main fieds mean, but I couldn't know what to look for if I want to know if the mail is kind of ...
0
votes
2answers
76 views

What are recommendations for unblocking outbound SMTP traffic in an organization?

Our organization has blocked all outbound SMTP traffic under the assumption that we are preventing potential botnet spamming issues which lead to blacklisted IPs. However, I've seen other ...
1
vote
1answer
176 views

Is there a list of open mail relays I can use for a pentest? [closed]

I'm currently pentesing a client (with permission of course) and we are testing their email filtering capabilities. We want to check whether they reject mail coming from open mail relays, but I seem ...
49
votes
5answers
8k views

Why is end-to-end encryption still not default in mails?

I am not a cryptographer. Maybe that is why I don't see the issues with integrating PGP into SMTP. In my head: Lea requests the server of Luke's domain jedi.com to tell her the public key of luke@...
28
votes
4answers
65k views

Test STARTTLS configuration of SMTP server

Is there an easy way to test an SMTP server to check for configuration issues associated with STARTTLS encryption, and report on whether it has been configured properly so that email will be encrypted ...
0
votes
0answers
67 views

Database in DMZ and SMTP relay

I have an application that talks with a database in the DMZ. There is a firewall between the apps and the db but our developer thought that they require a mail notification that is triggered from the ...
1
vote
2answers
168 views

Why would an attacker try SMTP login many times even though it is disabled?

I recently set up an SMTP server for myself to use, and I am getting some traffic from two IP addresses and none else (though for obvious reasons I will not state the addresses here). An example ...
1
vote
2answers
7k views

Email Spoofing by SMTP Message-ID?

Many of my users today got email from docs#@mydomain.com (where docs# was between docs0 and docs8 or so, and mydomain.com is obviously changed from my real domain name), with the sender name of "...
1
vote
2answers
1k views

It's still possible to email spoofing to Google

I would like to know if it's still possible to spoof an address from, for example, no-reply@company.com when sending to Gmail. I've tried sending a spoofed e-mail to other mail service and it performs ...
0
votes
1answer
66 views

Simple Mail Delivery Protocol (SMDP), where is it today? what do you think of it?

So I'm doing a research study on Simple Mail Delivery Protocol (SMDP) for those of you who don't know what it is, it's a new protocol for Email delivery that promises complete anti-spam filtering. ...
0
votes
2answers
62 views

Running open relay smtp in company network

We are producing IoT gateways which send out emails via SMTP protocol for user notifications. These IoT gateways are mainly used by corporate customers in intranets without access to or from the ...
0
votes
3answers
6k views

How a spoofing email site such as emkei works

I'm trying to understand how email spoofing works. After studying the technical process, I have finally understood that : 1)The spoofer will try to scan every ports of a smtp server to catch the mx ...
2
votes
2answers
70 views

Domain offline - are unmaintained email clients a security risk?

I have just unregistered a domain. Now my mail client (Thunderbird) popped up a message saying that it cannot connect to the mail server. That's fine - for the moment. However, I wonder what would ...
1
vote
1answer
665 views

How to spoof a MIME-level email address

As a sysadmin, I need to send spoofed emails to ensure that the spoofing protection (DMARC, etc) is working. I think Emkei's Fake Mailer can be used to send emails spoofed at the SMTP / 5321.MailFrom ...
1
vote
2answers
160 views

How to detect SMTP proxy on public wifi?

For a small research project I want to collect characteristics of public wifi hotspots. One topic that came up was SMTP proxy - is there a way to detect a proxy or could I just check whether the ...
1
vote
1answer
329 views

SMTP Service STARTTLS Plaintext Command Injection

We are getting this vulnerability on SUSE Linux Enterprise Server 11. This vulnerability is getting triggered on port 587 for postfix. I have checked several links but I am unable to get any relevant ...
7
votes
2answers
530 views

Why are common services using implicit SSL not considered obsolete in the way that SMTPS is?

SMTPS (implicit SSL) has been deprecated/obsolete since SMTP+STARTTLS (explicit SSL) was defined in RFC2487. I'm not entirely clear on the reasoning behind that, but it was clearly considered a good ...
2
votes
0answers
280 views

Why is hotmail mail server providing an invalid certificate?

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com is using a TLS certificate issued to mail.protection.outlook.com. Both the mail server hostname and TLS ...
0
votes
2answers
125 views

Can password be stolen when doing SSL/TLS-protected IMAP/SMTP in public network

My email password has been stolen most probably while I was on vacation in another country and was using hotel's (and maybe others, cannot remember) WiFi networks to read and optionally send emails ...
2
votes
2answers
1k views

Rationale behind hiding originating IP address in emails?

Gmail has been hiding originating IP addresses for quite some time now. Hotmail and Yahoo have started doing this too. Apart from obvious privacy implications of revealing the sender's IP address, is ...
15
votes
3answers
2k views

Can I expect my e-mail to be routed securely?

If I connect to my e-mail server via SSL (SMTP/SSL) and the recipient also only checks his e-mail via SSL (web/https or IMAP/SSL), does this - generally speaking - increase the security for the ...
3
votes
1answer
74 views

Why doesn't SMTP check that users are authenticated to send from an address?

I think it's a bit different from this question since it's about SMTP, but similar idea. Wikipedia says on email spoofing: MAIL FROM: - generally presented to the recipient as the Return-path: ...
1
vote
2answers
505 views

Close Port 587 - Ramifications?

Our recent PCI scan failed because "Plaintext authentication is allowed over unencrypted channel on SMTP." As such, our tech support suggested to close port 587. What are the effects of closing port ...
4
votes
2answers
364 views

How to securely store user-specific mail server credentials at the server side of a web application

I have an asp.net web app that generates emails when users perfrorm actions...these emails are generally notifications to other users that they should see/do something. The users can be internal to ...
4
votes
1answer
163 views

How secure is e-mail landscape right now?

In light of recent news about some flaws in PGP standard, I (a non-PGP user) started to think how secure are regular e-mails these days. I have found the STARTTLS Everywhere project, and they have a ...
2
votes
2answers
195 views

Can SPF be bypassed by using a shared email server?

As I understand it, SPF works by listing permitted SMTP server domains in the TXT DNS record of the domain you own. So if I own example.com and wish to permit a 3rd-party SMTP server at smtpexample....
0
votes
1answer
310 views

Is it possible to disable SSL over SMTP/POP to the mail server that enables SSL/TLS?

I'm using thunderbird where I can check the option whether I will use SSL/TLS or not. However in my company's server, SSL/TLS is enabled both on POP3 and SMTP. Is it possible to disable SSL/TLS on ...
0
votes
1answer
48 views

SMTU AUTH and compromised user

Recently I've set up two SMTP auth-enabled sendmails, and within a week and month both of them were used to send unsolicited mail using SMTP AUTH. Attackers were acting from different IP and using ...
1
vote
1answer
678 views

How to get the IP Adress of an email receiver

I am communicating through email with a scammer who is trying to by me mw own parcel of land. I already contacted the police but it could take 2 to 3 months before they start investigating. I want to ...
2
votes
2answers
4k views

What type of attacks will a SMTP server face if it does not have ratelimiting while sending mails?

Assume a web site with some kind of mailer option, that doesn't implement any rate limiting: This enables users to send an unlimited amount of email per second. Will SMTP face possible DoS attacks ...
3
votes
2answers
309 views

SSL/TLS compression attacks on mail servers (smtp)

Currently, we know few compression attacks on the SSL/TLS protocol (such as Crime or Breach). I wonder for few days if these attacks are practicable on a mail server (smtp). Is CRIME attack ...
7
votes
4answers
3k views

Is STARTTLS a security-vulnerability?

After reading about STARTTLS and SSL and performing a scan/pentest at our server I have the next question regarding security: Is this STARTTLS warning below a security-vulnerability? And if so why? ...
1
vote
1answer
449 views

Why did PHP 5.6 change how it handles SSL certificates?

I was using PHPMailer to send an email with SMTP. This time I used PHP 5.6. I received the following error. Warning: stream_socket_enable_crypto(): Peer certificate CN=`*.example1.com' did not match ...
4
votes
2answers
942 views

What happens if STARTTLS dropped in SMTP?

SMTP uses STARTTLS extension to upgrade SMTP to SMTP Secure (STMPS). According the the RFC, the client and server starts TLS as follows: S: <waits for connection on TCP port 25> C: <opens ...
6
votes
1answer
686 views

Why is still so easy to send phishing emails?

When I first started playing around with how SMTP worked over 20 years ago, I remember being somewhat surprised how easy it was to make an email appear in someone else's mailbox that looked like it ...
1
vote
2answers
733 views

Email Security Gateway vs Firewall [closed]

An email security gateway is an edge device such a router that serves for relaying the external network with the private network. It helps with detecting and blocking spams and phishing emails. That ...
0
votes
3answers
1k views

Is Open Port 25 on Web Server dangerous?

Port 25 of a web server is open. We dont have any email server, since we use google mail server, but still port 25 is open. Is it dangerous to keep it open? If it can be attacked then how it can be ...
62
votes
1answer
13k views

Why does Gmail (add accounts) using SMTP server recommend SSL instead of TLS?

I stumbled something interesting today when I was adding an account to my gmail one. Why is SSL boldly stated as recommended when TLS supersedes SSL? The links for SSL and TLS is the same: https://...
1
vote
0answers
157 views

I want to know if exist a vulnerability in using sp_send_dbmail of SQL Server?

I'm using the next stored procedure sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection? In the configuration of the Database ...
0
votes
1answer
383 views

What security settings is Yahoo Mail looking for to consider IMAP client secure?

When setting up an IMAP client for Yahoo Mail, Yahoo requires the "Allow apps that use less secure signin" option to be enabled. The client is configured to use SSL for IMAP (and SMTP). What ...
1
vote
1answer
41 views

When is it appropriate to check the from part of a mail address and to not only validate the domain?

SMTP authentication Mailing in same domain This question is based on the answers provided above. The question is not how and why to authenticate server mails from same domain which makes it ...
2
votes
3answers
1k views

How does lack of SMTP authentication impact users?

My school supplies an email address for its students. To connect to their email server, no authentication is needed for the outgoing mail server. So no user name, or password is needed and no SSL/TLS ...
4
votes
3answers
5k views

SMTP Email Spoofing

While testing my SMTP server using a telnet session from home, I was able to generate an email using the following commands: telnet MyEmailServer 25 HELO MyEmailServer MAIL FROM: ...
0
votes
0answers
139 views

simple question about smtp server ( msa to mta ) security design?

Not sure if this is due to security; hence the reason i am asking here. I have 2 SMTP server and a couple of unix servers the actual mailserver running on window. client connect to it and download ...
2
votes
2answers
102 views

Using port port 25 on the same WiFi

Me and my brother live in the same apartment and use the same internet connection. (A WiFi router with WPA2 password). He uses Microsoft Outlook as his primary email tool and I noticed that his POP ...
34
votes
4answers
20k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...