Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [smtp]

Simple Mail Transfer Protocol. A protocol for delivering e-mail from an end user to a server for storage and later retrieval by the intended recipient.

Filter by
Sorted by
Tagged with
34
votes
4answers
20k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
36
votes
4answers
67k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
188
votes
3answers
35k views

Don't understand how my mum's Gmail account was hacked

My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...
1
vote
2answers
1k views

Issues with using a mail server that doesn't support authentication to send mail?

I have noticed the mail server we use at work (provided by our web-host) doesn't require any authentication to send mail through. I understand you easily spoof sender address' in emails, but I'm ...
30
votes
5answers
68k views

Test STARTTLS configuration of SMTP server

Is there an easy way to test an SMTP server to check for configuration issues associated with STARTTLS encryption, and report on whether it has been configured properly so that email will be encrypted ...
9
votes
2answers
4k views

If I send an email over SSL, will it always be transmitted over SSL?

This is largely a question of how MTAs and different components communicate. I'm curious that if I send an email using SMTP over SSL to my MTA, can it's next jump to the next MTA or MDA be insecure? ...
7
votes
2answers
619 views

Why are common services using implicit SSL not considered obsolete in the way that SMTPS is?

SMTPS (implicit SSL) has been deprecated/obsolete since SMTP+STARTTLS (explicit SSL) was defined in RFC2487. I'm not entirely clear on the reasoning behind that, but it was clearly considered a good ...
1
vote
1answer
1k views

Mail server security: Mails to internal receivers with faked sender address

I noticed that I am able to send emails from my company's mail server to internal receivers from faked inhouse sender addresses without problem and I'm wondering if this should be supposed a security ...
0
votes
1answer
2k views

What are the ports used by Online Email Accounts such as Yahoo Mail, Gmail, etc.?

Let us say that I send an email using Yahoo Mail or GMail. Can this email be intercepted using a packet sniffer? On which port does the email travel? HTTP, SMTP, POP3?
15
votes
3answers
2k views

Can I expect my e-mail to be routed securely?

If I connect to my e-mail server via SSL (SMTP/SSL) and the recipient also only checks his e-mail via SSL (web/https or IMAP/SSL), does this - generally speaking - increase the security for the ...
0
votes
3answers
5k views

Can I spoof email?

I mean, if I would have my own SMTP (also, is it just about money or are there some limitations to running my own SMTP server?) and would just completely made up the mail (headers, spoofed IPs and ...
3
votes
4answers
491 views

How webmail's authorisation should work?

I'm building a webmail client (like gmail). It allows the user to browse emails and send them. Under the hood, php uses IMAP and SMTP to talk with email server. user->webserver->mailserver When user ...
2
votes
3answers
2k views

How does lack of SMTP authentication impact users?

My school supplies an email address for its students. To connect to their email server, no authentication is needed for the outgoing mail server. So no user name, or password is needed and no SSL/TLS ...
-1
votes
3answers
1k views

SMTP injection: where am I wrong?

On another thread a user was trying to use SMTP injections and, as a test, trying to inject a supplementary recipient for this email. My understanding of the issue preventing him from succeeding were ...
5
votes
1answer
4k views

How secure is Integrated Windows Authentication for IIS SMTP?

I have a Windows SMTP server that is currently allowing the "AUTH LOGIN" method of authenticating. As I now know, this is simply a base-64 encoding of the username and password, which is basically as ...
5
votes
4answers
821 views

A Secure Email Host Architecture

How would one go about creating a secure email architecture? I'm thinking specifically about protecting email from routine surveillance from oppressive regimes and corporations. I had a think about ...
4
votes
1answer
170 views

How secure is e-mail landscape right now?

In light of recent news about some flaws in PGP standard, I (a non-PGP user) started to think how secure are regular e-mails these days. I have found the STARTTLS Everywhere project, and they have a ...
3
votes
1answer
1k views

Phishing email from Avast - Headers look totally legit?

Below is the email with headers. I never registered on the site, so it's clearly phishing, but the links in the email point to the real Avast site. The delivery path also looks legit since both IP ...
2
votes
2answers
296 views

Can SPF be bypassed by using a shared email server?

As I understand it, SPF works by listing permitted SMTP server domains in the TXT DNS record of the domain you own. So if I own example.com and wish to permit a 3rd-party SMTP server at smtpexample....
2
votes
1answer
1k views

Why doesn't outlook 2013 meet modern security standards?

It is required to turn on the allow less secure apps setting in order to be able to use a gmail account with outlook 2013, despite it is using the IMAP and SMTP services with SSL protocol enabled. ...
1
vote
1answer
775 views

How to spoof a MIME-level email address

As a sysadmin, I need to send spoofed emails to ensure that the spoofing protection (DMARC, etc) is working. I think Emkei's Fake Mailer can be used to send emails spoofed at the SMTP / 5321.MailFrom ...