Questions tagged [smtp]

Simple Mail Transfer Protocol. A protocol for delivering e-mail from an end user to a server for storage and later retrieval by the intended recipient.

188
votes
3answers
34k views

Don't understand how my mum's Gmail account was hacked

My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...
62
votes
1answer
13k views

Why does Gmail (add accounts) using SMTP server recommend SSL instead of TLS?

I stumbled something interesting today when I was adding an account to my gmail one. Why is SSL boldly stated as recommended when TLS supersedes SSL? The links for SSL and TLS is the same: https://...
50
votes
5answers
8k views

Why is end-to-end encryption still not default in mails?

I am not a cryptographer. Maybe that is why I don't see the issues with integrating PGP into SMTP. In my head: Lea requests the server of Luke's domain jedi.com to tell her the public key of luke@...
36
votes
4answers
62k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
34
votes
4answers
20k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
28
votes
4answers
66k views

Test STARTTLS configuration of SMTP server

Is there an easy way to test an SMTP server to check for configuration issues associated with STARTTLS encryption, and report on whether it has been configured properly so that email will be encrypted ...
25
votes
3answers
3k views

What does the email header-line “message opened by mailclient” mean?

Today a Belgian MP claimed (backed up by a security expert) that her email headers show that her email was read during routing (text in Dutch). The published screenshot of the headers highlights the ...
21
votes
7answers
8k views

Is there a risk connecting to POP3 or SMTP email server without secure connection?

My ISP gives instructions how to connect to its POP3 and SMTP email servers: These settings will help you to set up your email program. email server: POP3 POP server (incoming): pop....
16
votes
2answers
24k views

Perfectly secure Postfix MTA (SMTP) configuration

I want to secure my root server (further) service by service, starting with the SMTP service (Postfix MTA) as the most busy one. I the course of setting everything up, I read a lot about security and ...
15
votes
3answers
7k views

What is the most secured SMTP authentication type?

Say you have to choose only one among the following authentication types for your own SMTP server: LOGIN, PLAIN CRAM-MD5 DIGEST-MD5 NTLM/SPA/MSN Which one would you recommend for optimal security? ...
15
votes
3answers
2k views

Can I expect my e-mail to be routed securely?

If I connect to my e-mail server via SSL (SMTP/SSL) and the recipient also only checks his e-mail via SSL (web/https or IMAP/SSL), does this - generally speaking - increase the security for the ...
14
votes
2answers
2k views

What threats come from CRLF in email generation?

I have an application where a code scanner has identified CRLF injection possibilities in some classes related to email generation. I understand how CRLF injection could be used against me on URL-...
12
votes
1answer
3k views

How to study the packets sent by a keylogger

One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it. I have a strong doubt that it is a key-logger. ...
10
votes
3answers
2k views

Why enable SMTP STARTTLS if OpenSSL is dangerous?

There are a bunch of people in the anti-surveillance movement who are virtually demanding that I enable SMTP STARTTLS support in my environment, in order to enable opportunistic MTA-to-MTA encryption. ...
9
votes
1answer
3k views

Email SSL security?

I use IMAP and I only access my email through SSL. However, the settings for encrypted email access seem a bit more complicated that https. Can someone explain the security implications of the ...
9
votes
2answers
4k views

If I send an email over SSL, will it always be transmitted over SSL?

This is largely a question of how MTAs and different components communicate. I'm curious that if I send an email using SMTP over SSL to my MTA, can it's next jump to the next MTA or MDA be insecure? ...
9
votes
1answer
241 views

Long running SMTP session

I recently noticed an SMTP session on my server which started when a remote host connected but never seemed to result in any emails being delivered. I could see that it was probably a SPAM site and so ...
7
votes
4answers
3k views

Is STARTTLS a security-vulnerability?

After reading about STARTTLS and SSL and performing a scan/pentest at our server I have the next question regarding security: Is this STARTTLS warning below a security-vulnerability? And if so why? ...
7
votes
2answers
534 views

Why are common services using implicit SSL not considered obsolete in the way that SMTPS is?

SMTPS (implicit SSL) has been deprecated/obsolete since SMTP+STARTTLS (explicit SSL) was defined in RFC2487. I'm not entirely clear on the reasoning behind that, but it was clearly considered a good ...
6
votes
2answers
3k views

Can (and should) TLS be strict about the ciphers it supports?

When trying to establish a TLS channel to outlook.com in order to relay SMTP traffic I get connection failures and have to continue without encryption. An example of such a connection: openssl ...
6
votes
3answers
26k views

I'm getting spam e-mail…from myself?

I noticed yesterday that I had received spam e-mail, but my own e-mail address was listed as the sender. Naturally, I changed my password. This is probably a spoof, but I don't know enough about ...
6
votes
2answers
908 views

Who can read my email?

I just sent an email to my colleague. Besides his eyes and mine, who can read the body of the message? Assumptions: I have a name@mycorp.com address, hosted by Google Apps. Recipient has a name@...
6
votes
2answers
126 views

What information should I provide to a website or organization when notifying them that their domain may be sending out spam?

Over the past few days, I've received several spam emails coming from the addresses of a school district. I don't know much about email message headers, but since they contain numerous references like ...
6
votes
1answer
689 views

Why is still so easy to send phishing emails?

When I first started playing around with how SMTP worked over 20 years ago, I remember being somewhat surprised how easy it was to make an email appear in someone else's mailbox that looked like it ...
6
votes
2answers
7k views

How to prevent abuse of SMTP by sending spam emails?

I'm not an admin, I just created a website, and there's also a mail server on the server I payed for from my hosting provider. Most for what I learnt about mail servers is from an internet tutorials. ...
6
votes
1answer
4k views

How to reject e-mails spoofing your own domain targeting your employees at Office365?

One problem Office365 users deal with is that an external SMTP server can spoof the domain of an organization and send e-mails to the domain users; where the e-mails appear to be from employees of the ...
5
votes
4answers
812 views

A Secure Email Host Architecture

How would one go about creating a secure email architecture? I'm thinking specifically about protecting email from routine surveillance from oppressive regimes and corporations. I had a think about ...
5
votes
3answers
2k views

How do you verify a certificate belongs to a domain?

I'm using PHP and trying to verify a SSL certificate belongs to the SMTP domain/IP I'm connecting to. Currently I can verify the certificate is valid using the following code $resource = fsockopen( "...
5
votes
4answers
4k views

Is it possible to fake incoming IP?

I would like to whitelist an IP address on my smtp server so that non-authenticated emails on connections originating from that IP could be routed. I control that other IP, so I can make sure that ...
5
votes
2answers
110 views

Should I email contents of a https form submission

I am building an online registration form for a voluntary organisation in the UK and am considering data security measures. The form will be served up over https and there may be an optional payment ...
5
votes
2answers
2k views

Does sending email with TLS help to not being flaged as spam?

Does sending email with TLS help to not being blocked or not being flagged as spam by recipient?
5
votes
1answer
5k views

SMTP injection, how it is done and what can it cause?

There are a few things that I dont understand about the injection. The injection is something along this line > . MAIL FROM: mail1@gmail.com RCPT TO: mail@gmail.com DATA EMAIL data . Here are ...
5
votes
1answer
4k views

How secure is Integrated Windows Authentication for IIS SMTP?

I have a Windows SMTP server that is currently allowing the "AUTH LOGIN" method of authenticating. As I now know, this is simply a base-64 encoding of the username and password, which is basically as ...
4
votes
2answers
2k views

Can unencrypted email be read or altered while it is in transit?

If email is not secure while in transit, exactly how can it be read by unintended parties? Can an attacker read SMTP traffic while it is between the sender and recipient?
4
votes
3answers
5k views

SMTP Email Spoofing

While testing my SMTP server using a telnet session from home, I was able to generate an email using the following commands: telnet MyEmailServer 25 HELO MyEmailServer MAIL FROM: ...
4
votes
2answers
954 views

What happens if STARTTLS dropped in SMTP?

SMTP uses STARTTLS extension to upgrade SMTP to SMTP Secure (STMPS). According the the RFC, the client and server starts TLS as follows: S: <waits for connection on TCP port 25> C: <opens ...
4
votes
2answers
367 views

How to securely store user-specific mail server credentials at the server side of a web application

I have an asp.net web app that generates emails when users perfrorm actions...these emails are generally notifications to other users that they should see/do something. The users can be internal to ...
4
votes
1answer
163 views

How secure is e-mail landscape right now?

In light of recent news about some flaws in PGP standard, I (a non-PGP user) started to think how secure are regular e-mails these days. I have found the STARTTLS Everywhere project, and they have a ...
4
votes
2answers
3k views

SMTP and SSL/TLS

If I understand correctly, communication between SMTP servers may be encrypted but is not required. Because it is optional, does it really have benefits? When server A connects to server B, both of ...
4
votes
2answers
1k views

Is it secure to send sensitive data through gmail smtp with nodemailer?

I have an application that would send sensitive data through email to specific users. I have setup a google business account which provides email addresses on my business domain. I will be sending ...
4
votes
1answer
520 views

Checklist for securing smtp

What are some things, one should know when setting up an SMTP server, which supports ESMTP protocol. I have disabled relaying, and only enabled TLS authenticated transfers. when I telnet to my server, ...
3
votes
3answers
677 views

How to know an SMTP server is securely configured [closed]

I have set up an SMTP server for personal use, and I used Postfix for that. However, Postfix has a lot of different options for how to configure it, and I'm guessing by configuring it incorrectly you ...
3
votes
3answers
899 views

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?
3
votes
4answers
478 views

How webmail's authorisation should work?

I'm building a webmail client (like gmail). It allows the user to browse emails and send them. Under the hood, php uses IMAP and SMTP to talk with email server. user->webserver->mailserver When user ...
3
votes
2answers
120 views

SPF and Articles from News Sites

Suppose I activate SPF in my environment. I am now strictly enforcing SPF records from sending domains. There are many execs in the company who like to forward news stories from CNN and such to ...
3
votes
2answers
3k views

Send credit card info by email from HTTPS and SMTP on SSL

A client asked me to receive credit card info of his costumers by email. I know that is a very very not secure way ... But if the page with the input form is on HTTPS, and then i use a smtp (like ...
3
votes
2answers
309 views

SSL/TLS compression attacks on mail servers (smtp)

Currently, we know few compression attacks on the SSL/TLS protocol (such as Crime or Breach). I wonder for few days if these attacks are practicable on a mail server (smtp). Is CRIME attack ...
3
votes
1answer
1k views

Phishing email from Avast - Headers look totally legit?

Below is the email with headers. I never registered on the site, so it's clearly phishing, but the links in the email point to the real Avast site. The delivery path also looks legit since both IP ...
3
votes
1answer
75 views

Why doesn't SMTP check that users are authenticated to send from an address?

I think it's a bit different from this question since it's about SMTP, but similar idea. Wikipedia says on email spoofing: MAIL FROM: - generally presented to the recipient as the Return-path: ...
3
votes
1answer
98 views

Why does my password appear in clear text with my smartphone mail IMAP application?

I am using the default Galaxy 5 mail application to fetch my mail with IMAP. Packet capture shows my user and password in clear text (see below). Why does my username and password appear in clear ...