Questions tagged [smtp]

Simple Mail Transfer Protocol. A protocol for delivering e-mail from an end user to a server for storage and later retrieval by the intended recipient.

Filter by
Sorted by
Tagged with
3
votes
1answer
99 views

Why does my password appear in clear text with my smartphone mail IMAP application?

I am using the default Galaxy 5 mail application to fetch my mail with IMAP. Packet capture shows my user and password in clear text (see below). Why does my username and password appear in clear ...
2
votes
0answers
36 views

Where to find mails or mail addresses on a web server? [closed]

In a training lab I'm using for a computing security certification I just got root access to a SMTP server, and there are so much files to look for. I want to retrieve mails or mail addresses using or ...
0
votes
1answer
1k views

How to use testssl.sh on an SMTP server? [closed]

I need your help with testing SMTP with testssl.sh. This is the command that I run: ./testssl.sh -t smtp [IP] Where the IP is the SMTP server IP where I know there is an SSL/TLS certificate. With ...
1
vote
2answers
164 views

SMTP Strict Transport Security vs Zix

I've read that Google, Microsoft, and Yahoo have banded together to introduce a new protocol for email encryption - SMTP Strict Transport Security. From my understanding of it, it seems that it's ...
5
votes
2answers
2k views

Does sending email with TLS help to not being flaged as spam?

Does sending email with TLS help to not being blocked or not being flagged as spam by recipient?
0
votes
3answers
4k views

Can I spoof email?

I mean, if I would have my own SMTP (also, is it just about money or are there some limitations to running my own SMTP server?) and would just completely made up the mail (headers, spoofed IPs and ...
0
votes
3answers
2k views

Is the IP (from) address of the email header 100% correct? [duplicate]

Imagine I send one email with my e-mail client to a person B. Person B gets the email, and in the email header he/she can read the IP address from where it was sent. Which IP address is written? The ...
1
vote
2answers
1k views

It's still possible to email spoofing to Google

I would like to know if it's still possible to spoof an address from, for example, no-reply@company.com when sending to Gmail. I've tried sending a spoofed e-mail to other mail service and it performs ...
6
votes
2answers
923 views

Who can read my email?

I just sent an email to my colleague. Besides his eyes and mine, who can read the body of the message? Assumptions: I have a name@mycorp.com address, hosted by Google Apps. Recipient has a name@...
0
votes
0answers
446 views

“SMTP AUTH extension not supported by server” with setoolkit

In order to test pishing attacks with setoolkit (Social Engineering Toolkit), I installed iRedMail in my local network. I created two account: attacker@hackme.clubhacking.org hackme@hackme....
0
votes
1answer
3k views

Google's Mail Delivery Subsystem sending DSN (Failure) caused by spams sent on my behalf

I have been receiving Delivery Status Notification (Failure) e-mails from Google's Mail Delivery Subsystem (mailer-daemon@googlemail.com) containing errors like this: Delivery to the following ...
0
votes
2answers
380 views

Mail server security: Authentication in SMTP servers for mails from same domain

SPF and DKIM helps to determine whether a sender is allowed to send a mail from a specific domain or not. Now, if X employee of Company with email X@Company.com tampers the message headers and sends ...
0
votes
1answer
63 views

Questions to help decide which SSL cert to get for three websites on Windows server

First of all, my first Stack Exchange question! I hope I'm at the right place. Secondary, I know TLS is the successor of SSL, but since everywhere I go, they just called it SSL, I'm using it for this ...
50
votes
5answers
8k views

Why is end-to-end encryption still not default in mails?

I am not a cryptographer. Maybe that is why I don't see the issues with integrating PGP into SMTP. In my head: Lea requests the server of Luke's domain jedi.com to tell her the public key of luke@...
3
votes
3answers
677 views

How to know an SMTP server is securely configured [closed]

I have set up an SMTP server for personal use, and I used Postfix for that. However, Postfix has a lot of different options for how to configure it, and I'm guessing by configuring it incorrectly you ...
-1
votes
1answer
651 views

How do Bots Spam Where Outgoing SMTP is blocked

I have read,that bots in an internal network talk directly to External Mail servers instead of going through the Internal Mailserver to deliver spam. Query If it's true, than how do Bots spam do so ...
1
vote
1answer
136 views

How can I contract an email tracking service and be silent about it?

I use a customized e-mail and my web-master, who is also the domain owner, doesn't allow me to see the settings that the DNS provides. Some DNS services provide, beside domain name registration, ...
4
votes
2answers
1k views

Is it secure to send sensitive data through gmail smtp with nodemailer?

I have an application that would send sensitive data through email to specific users. I have setup a google business account which provides email addresses on my business domain. I will be sending ...
2
votes
1answer
1k views

Mail : non existent domain FROM field

I'm wondering if during the process of sending a message, the domain indicated in "from" field is checked? I know there is no integrity control of the from field, but I tried to send a message to an ...
5
votes
4answers
4k views

Is it possible to fake incoming IP?

I would like to whitelist an IP address on my smtp server so that non-authenticated emails on connections originating from that IP could be routed. I control that other IP, so I can make sure that ...
0
votes
2answers
67 views

Secure way for bulk mailbox verification to avoid IP Blacklisting

We have built an API that verifies a address existence in the respective MX using RCTP command. Their are many services available out there but we like to do it again since we have few clients who ...
2
votes
2answers
2k views

Why do email that didn't pass SPF checks go to my mailbox?

I tried a website that supposedly sends spoofed email. I sent myself an email impersonating another email address and the message showed up in my yahoo mailbox even though according to the headers it ...
-3
votes
1answer
76 views

How does SMTP facilitate sending spam? [closed]

My friend tells me that there are exist weakness of the Simple Mail Transfer Protocol (SMTP) that make make it easy to send spam. Is this true?
2
votes
1answer
1k views

Why doesn't outlook 2013 meet modern security standards?

It is required to turn on the allow less secure apps setting in order to be able to use a gmail account with outlook 2013, despite it is using the IMAP and SMTP services with SSL protocol enabled. ...
0
votes
1answer
651 views

OpenSSL gmail - receiving Please log in via your web browser and then try again

Using openssl as below when I do EHLO auth login and then enter my username and password I get the following error: Please log in via your web browser and then try again. Learn more ...
1
vote
1answer
1k views

Mail server security: Mails to internal receivers with faked sender address

I noticed that I am able to send emails from my company's mail server to internal receivers from faked inhouse sender addresses without problem and I'm wondering if this should be supposed a security ...
0
votes
1answer
751 views

smtp-auth attack ?

it looks someone or something is trying to hack our Exchange. Exchange Server Transport Protocol Logs: it appears the internet facing IP on the firewall has not been locked down correctly, so is ...
5
votes
2answers
110 views

Should I email contents of a https form submission

I am building an online registration form for a voluntary organisation in the UK and am considering data security measures. The form will be served up over https and there may be an optional payment ...
0
votes
0answers
313 views

script for analysis of tcpdump log file

I'm trying to get the following metrics from my tcpdump log file: (1) one-way delay, (2) request/response delay, (3) packet loss, (4) overall transaction duration and (5) delay variation (jitter). ...
6
votes
3answers
26k views

I'm getting spam e-mail…from myself?

I noticed yesterday that I had received spam e-mail, but my own e-mail address was listed as the sender. Naturally, I changed my password. This is probably a spoof, but I don't know enough about ...
6
votes
2answers
3k views

Can (and should) TLS be strict about the ciphers it supports?

When trying to establish a TLS channel to outlook.com in order to relay SMTP traffic I get connection failures and have to continue without encryption. An example of such a connection: openssl ...
0
votes
3answers
5k views

Is VRFY command enabled on SMTP server usually considered a vulnerability? [closed]

Messing around I found a critical SMTP server with VRFY command enabled.
2
votes
2answers
417 views

TLS capable SMTP store-and-forward server — does it have to store private keys?

I know that email is inherently insecure anyway, but considering that pretty much everyone that I send email to is using a large, somewhat-trusted cloud provider, (hint, starts with G) I would expect ...
6
votes
1answer
4k views

How to reject e-mails spoofing your own domain targeting your employees at Office365?

One problem Office365 users deal with is that an external SMTP server can spoof the domain of an organization and send e-mails to the domain users; where the e-mails appear to be from employees of the ...
6
votes
2answers
7k views

How to prevent abuse of SMTP by sending spam emails?

I'm not an admin, I just created a website, and there's also a mail server on the server I payed for from my hosting provider. Most for what I learnt about mail servers is from an internet tutorials. ...
1
vote
0answers
90 views

How to inform other sysadmins their email encryption is broken [closed]

Does anyone have a good template email to use to send to remote system/mail/security administrators to alert them to the fact that emails to them would not be getting through either at all or securely ...
-2
votes
1answer
232 views

Recommendations for SMTP DoS [closed]

I have an opened SMTP server that allows me to send emails. The problem is that I can send a massive amount of emails (80,000+) to a specific mailbox and block all the other legitimate emails (that ...
0
votes
2answers
120 views

Is there a way to attack STARTTLS + certificate pinning probed from multiple places?

I just had this discussion on IRC and I have to admit I did not understand why other users were not convinced this would be enough... Let's say I would like to protect e-mails sent out from my ...
2
votes
2answers
1k views

Rationale behind hiding originating IP address in emails?

Gmail has been hiding originating IP addresses for quite some time now. Hotmail and Yahoo have started doing this too. Apart from obvious privacy implications of revealing the sender's IP address, is ...
2
votes
4answers
1k views

How can I stop an IP from trying to use my mail server?

I have recently set up my first email server, and I look at the logs in /var/logs/mail.log to see what is happening, I notice this one IP does this multiple times every day for the last so many weeks :...
-1
votes
3answers
1k views

SMTP injection: where am I wrong?

On another thread a user was trying to use SMTP injections and, as a test, trying to inject a supplementary recipient for this email. My understanding of the issue preventing him from succeeding were ...
3
votes
1answer
1k views

Phishing email from Avast - Headers look totally legit?

Below is the email with headers. I never registered on the site, so it's clearly phishing, but the links in the email point to the real Avast site. The delivery path also looks legit since both IP ...
16
votes
2answers
24k views

Perfectly secure Postfix MTA (SMTP) configuration

I want to secure my root server (further) service by service, starting with the SMTP service (Postfix MTA) as the most busy one. I the course of setting everything up, I read a lot about security and ...
3
votes
4answers
482 views

How webmail's authorisation should work?

I'm building a webmail client (like gmail). It allows the user to browse emails and send them. Under the hood, php uses IMAP and SMTP to talk with email server. user->webserver->mailserver When user ...
1
vote
1answer
304 views

Email account password change via email-to-script

I host a mail server (postfix and dovecot) and I wish to set up a password change feature (especially useful when creating a new address provided with a temporary password). Does my scenario has ...
1
vote
1answer
2k views

Is my Postfix and Dovecot configuration secure?

Today I set up my first server with Dovecot and Postfix. These are excerpts from the configuration files: Dovecot: disable_plaintext_auth = yes ssl = required ssl_prefer_server_ciphers = yes ...
3
votes
1answer
836 views

is there a risk in increasing esmtp header line length against rfc5822 - asa/pix question

Have a question towards the 998 bytes limitation on the esmtp header line length. We have noticed the asa is dropping emails coming from various external mail servers with the header line length ...
0
votes
1answer
212 views

Receiving strange data over SMTP where body is one line of random characters

I have a website that has an smtp server open on port 25. There is no outbound functionality on the smtp server. We just parse attachments from our users, then 'queue' the email in a dummy queue. So ...
10
votes
3answers
2k views

Why enable SMTP STARTTLS if OpenSSL is dangerous?

There are a bunch of people in the anti-surveillance movement who are virtually demanding that I enable SMTP STARTTLS support in my environment, in order to enable opportunistic MTA-to-MTA encryption. ...
2
votes
2answers
4k views

What type of attacks will a SMTP server face if it does not have ratelimiting while sending mails?

Assume a web site with some kind of mailer option, that doesn't implement any rate limiting: This enables users to send an unlimited amount of email per second. Will SMTP face possible DoS attacks ...