Questions tagged [smtp]

Simple Mail Transfer Protocol. A protocol for delivering e-mail from an end user to a server for storage and later retrieval by the intended recipient.

Filter by
Sorted by
Tagged with
2
votes
2answers
124 views

Using port port 25 on the same WiFi

Me and my brother live in the same apartment and use the same internet connection. (A WiFi router with WPA2 password). He uses Microsoft Outlook as his primary email tool and I noticed that his POP ...
0
votes
1answer
1k views

smtp port 25 connect failed

If I take any host from https://www.arclab.com/en/kb/email/list-of-smtp-and-pop3-servers-mailserver-list.html why I'm not able to telnet to any of the specified ports ? I'm getting: "Connecting To ...
2
votes
1answer
114 views

What are the security issues of having all services (web, smtp, dns) on a single machine?

I'm wondering what are the drawbacks, from a security point of view, of having more than one service (let's say the web server, the mail server and the DNS server) on the same machine, rather than ...
2
votes
3answers
2k views

How does lack of SMTP authentication impact users?

My school supplies an email address for its students. To connect to their email server, no authentication is needed for the outgoing mail server. So no user name, or password is needed and no SSL/TLS ...
0
votes
4answers
3k views

System nmap shows port closed but online nmap tool shows port open

When I run a nmap scan against a remote target, it shows port 25 closed but an online nmap tool like (https://hackertarget.com/nmap-online-port-scanner/) shows that port 25 is open. sudo nmap -sS -v ...
17
votes
3answers
10k views

What is the most secured SMTP authentication type?

Say you have to choose only one among the following authentication types for your own SMTP server: LOGIN, PLAIN CRAM-MD5 DIGEST-MD5 NTLM/SPA/MSN Which one would you recommend for optimal security? ...
0
votes
2answers
985 views

Tracing the email sent from SMTP

How can someone be traced over email/SMTP, if they connect via telnet to SMTP and send and email. I know that email can be spoofed with this method, but how secure it really is? Can I see who was ...
21
votes
7answers
10k views

Is there a risk connecting to POP3 or SMTP email server without secure connection?

My ISP gives instructions how to connect to its POP3 and SMTP email servers: These settings will help you to set up your email program. email server: POP3 POP server (incoming): pop....
0
votes
1answer
1k views

Whitelist mail domains and users to smtp on mail server

Lately our mail server (postfix 2.9.6, ubuntu 12.04, courier) got compromised by spammers that are send plenty of dummy mails to many recipients, The spammers used two different ways: 1- using real ...
3
votes
1answer
160 views

Why does my password appear in clear text with my smartphone mail IMAP application?

I am using the default Galaxy 5 mail application to fetch my mail with IMAP. Packet capture shows my user and password in clear text (see below). Why does my username and password appear in clear ...
2
votes
0answers
38 views

Where to find mails or mail addresses on a web server? [closed]

In a training lab I'm using for a computing security certification I just got root access to a SMTP server, and there are so much files to look for. I want to retrieve mails or mail addresses using or ...
0
votes
1answer
2k views

How to use testssl.sh on an SMTP server? [closed]

I need your help with testing SMTP with testssl.sh. This is the command that I run: ./testssl.sh -t smtp [IP] Where the IP is the SMTP server IP where I know there is an SSL/TLS certificate. With ...
1
vote
2answers
173 views

SMTP Strict Transport Security vs Zix

I've read that Google, Microsoft, and Yahoo have banded together to introduce a new protocol for email encryption - SMTP Strict Transport Security. From my understanding of it, it seems that it's ...
5
votes
2answers
2k views

Does sending email with TLS help to not being flaged as spam?

Does sending email with TLS help to not being blocked or not being flagged as spam by recipient?
1
vote
3answers
5k views

Can I spoof email?

I mean, if I would have my own SMTP (also, is it just about money or are there some limitations to running my own SMTP server?) and would just completely made up the mail (headers, spoofed IPs and ...
0
votes
3answers
3k views

Is the IP (from) address of the email header 100% correct? [duplicate]

Imagine I send one email with my e-mail client to a person B. Person B gets the email, and in the email header he/she can read the IP address from where it was sent. Which IP address is written? The ...
1
vote
2answers
2k views

It's still possible to email spoofing to Google

I would like to know if it's still possible to spoof an address from, for example, no-reply@company.com when sending to Gmail. I've tried sending a spoofed e-mail to other mail service and it performs ...
6
votes
2answers
1k views

Who can read my email?

I just sent an email to my colleague. Besides his eyes and mine, who can read the body of the message? Assumptions: I have a name@mycorp.com address, hosted by Google Apps. Recipient has a name@...
0
votes
0answers
528 views

“SMTP AUTH extension not supported by server” with setoolkit

In order to test pishing attacks with setoolkit (Social Engineering Toolkit), I installed iRedMail in my local network. I created two account: attacker@hackme.clubhacking.org hackme@hackme....
0
votes
1answer
4k views

Google's Mail Delivery Subsystem sending DSN (Failure) caused by spams sent on my behalf

I have been receiving Delivery Status Notification (Failure) e-mails from Google's Mail Delivery Subsystem (mailer-daemon@googlemail.com) containing errors like this: Delivery to the following ...
0
votes
2answers
435 views

Mail server security: Authentication in SMTP servers for mails from same domain

SPF and DKIM helps to determine whether a sender is allowed to send a mail from a specific domain or not. Now, if X employee of Company with email X@Company.com tampers the message headers and sends ...
0
votes
1answer
65 views

Questions to help decide which SSL cert to get for three websites on Windows server

First of all, my first Stack Exchange question! I hope I'm at the right place. Secondary, I know TLS is the successor of SSL, but since everywhere I go, they just called it SSL, I'm using it for this ...
50
votes
5answers
8k views

Why is end-to-end encryption still not default in mails?

I am not a cryptographer. Maybe that is why I don't see the issues with integrating PGP into SMTP. In my head: Lea requests the server of Luke's domain jedi.com to tell her the public key of luke@...
3
votes
3answers
690 views

How to know an SMTP server is securely configured [closed]

I have set up an SMTP server for personal use, and I used Postfix for that. However, Postfix has a lot of different options for how to configure it, and I'm guessing by configuring it incorrectly you ...
-1
votes
1answer
726 views

How do Bots Spam Where Outgoing SMTP is blocked

I have read,that bots in an internal network talk directly to External Mail servers instead of going through the Internal Mailserver to deliver spam. Query If it's true, than how do Bots spam do so ...
1
vote
1answer
139 views

How can I contract an email tracking service and be silent about it?

I use a customized e-mail and my web-master, who is also the domain owner, doesn't allow me to see the settings that the DNS provides. Some DNS services provide, beside domain name registration, ...
4
votes
2answers
2k views

Is it secure to send sensitive data through gmail smtp with nodemailer?

I have an application that would send sensitive data through email to specific users. I have setup a google business account which provides email addresses on my business domain. I will be sending ...
2
votes
1answer
2k views

Mail : non existent domain FROM field

I'm wondering if during the process of sending a message, the domain indicated in "from" field is checked? I know there is no integrity control of the from field, but I tried to send a message to an ...
6
votes
4answers
6k views

Is it possible to fake incoming IP?

I would like to whitelist an IP address on my smtp server so that non-authenticated emails on connections originating from that IP could be routed. I control that other IP, so I can make sure that ...
0
votes
2answers
69 views

Secure way for bulk mailbox verification to avoid IP Blacklisting

We have built an API that verifies a address existence in the respective MX using RCTP command. Their are many services available out there but we like to do it again since we have few clients who ...
2
votes
2answers
3k views

Why do email that didn't pass SPF checks go to my mailbox?

I tried a website that supposedly sends spoofed email. I sent myself an email impersonating another email address and the message showed up in my yahoo mailbox even though according to the headers it ...
-3
votes
1answer
94 views

How does SMTP facilitate sending spam? [closed]

My friend tells me that there are exist weakness of the Simple Mail Transfer Protocol (SMTP) that make make it easy to send spam. Is this true?
2
votes
1answer
1k views

Why doesn't outlook 2013 meet modern security standards?

It is required to turn on the allow less secure apps setting in order to be able to use a gmail account with outlook 2013, despite it is using the IMAP and SMTP services with SSL protocol enabled. ...
0
votes
1answer
750 views

OpenSSL gmail - receiving Please log in via your web browser and then try again

Using openssl as below when I do EHLO auth login and then enter my username and password I get the following error: Please log in via your web browser and then try again. Learn more at https://...
1
vote
1answer
2k views

Mail server security: Mails to internal receivers with faked sender address

I noticed that I am able to send emails from my company's mail server to internal receivers from faked inhouse sender addresses without problem and I'm wondering if this should be supposed a security ...
0
votes
1answer
850 views

smtp-auth attack ?

it looks someone or something is trying to hack our Exchange. Exchange Server Transport Protocol Logs: it appears the internet facing IP on the firewall has not been locked down correctly, so is ...
5
votes
2answers
111 views

Should I email contents of a https form submission

I am building an online registration form for a voluntary organisation in the UK and am considering data security measures. The form will be served up over https and there may be an optional payment ...
0
votes
0answers
337 views

script for analysis of tcpdump log file

I'm trying to get the following metrics from my tcpdump log file: (1) one-way delay, (2) request/response delay, (3) packet loss, (4) overall transaction duration and (5) delay variation (jitter). ...
6
votes
3answers
26k views

I'm getting spam e-mail…from myself?

I noticed yesterday that I had received spam e-mail, but my own e-mail address was listed as the sender. Naturally, I changed my password. This is probably a spoof, but I don't know enough about ...
6
votes
2answers
3k views

Can (and should) TLS be strict about the ciphers it supports?

When trying to establish a TLS channel to outlook.com in order to relay SMTP traffic I get connection failures and have to continue without encryption. An example of such a connection: openssl ...
1
vote
3answers
6k views

Is VRFY command enabled on SMTP server usually considered a vulnerability? [closed]

Messing around I found a critical SMTP server with VRFY command enabled.
2
votes
2answers
465 views

TLS capable SMTP store-and-forward server — does it have to store private keys?

I know that email is inherently insecure anyway, but considering that pretty much everyone that I send email to is using a large, somewhat-trusted cloud provider, (hint, starts with G) I would expect ...
6
votes
1answer
4k views

How to reject e-mails spoofing your own domain targeting your employees at Office365?

One problem Office365 users deal with is that an external SMTP server can spoof the domain of an organization and send e-mails to the domain users; where the e-mails appear to be from employees of the ...
6
votes
2answers
8k views

How to prevent abuse of SMTP by sending spam emails?

I'm not an admin, I just created a website, and there's also a mail server on the server I payed for from my hosting provider. Most for what I learnt about mail servers is from an internet tutorials. ...
1
vote
0answers
95 views

How to inform other sysadmins their email encryption is broken [closed]

Does anyone have a good template email to use to send to remote system/mail/security administrators to alert them to the fact that emails to them would not be getting through either at all or securely ...
-2
votes
1answer
291 views

Recommendations for SMTP DoS [closed]

I have an opened SMTP server that allows me to send emails. The problem is that I can send a massive amount of emails (80,000+) to a specific mailbox and block all the other legitimate emails (that ...
0
votes
2answers
133 views

Is there a way to attack STARTTLS + certificate pinning probed from multiple places?

I just had this discussion on IRC and I have to admit I did not understand why other users were not convinced this would be enough... Let's say I would like to protect e-mails sent out from my ...
2
votes
2answers
2k views

Rationale behind hiding originating IP address in emails?

Gmail has been hiding originating IP addresses for quite some time now. Hotmail and Yahoo have started doing this too. Apart from obvious privacy implications of revealing the sender's IP address, is ...
2
votes
4answers
2k views

How can I stop an IP from trying to use my mail server?

I have recently set up my first email server, and I look at the logs in /var/logs/mail.log to see what is happening, I notice this one IP does this multiple times every day for the last so many weeks :...
-1
votes
3answers
2k views

SMTP injection: where am I wrong?

On another thread a user was trying to use SMTP injections and, as a test, trying to inject a supplementary recipient for this email. My understanding of the issue preventing him from succeeding were ...