Tag Info

Hot answers tagged

8

Many SMTP servers out there do support opportunistic TLS, but it's not going to really cover your needs well. It's often with self-signed certificates, you'll run into many domains you're unable to deliver mail to if you won't speak to relays without TLS, and you have no control over what a relay does with the message once you send it on its first hop - ...


3

postfix logs each connection as it comes in, and the log lines look like Jul 8 16:25:15 swiss postfix/smtpd[11127]: connect from some.host.or.other [192.0.2.1] so you can tail -F your logfile (on my system it's /var/log/mail.log), use grep to filter the lines you want, and watch the live traffic.


3

E-Mail security sucks. So in the end, you're probably going to be faced with a decision where all your options are terrible, and break different things for different reasons. As for SPF specifically, a mailing list will cause a failure if it forwards a message, without rewriting the headers. A list can configure itself to work however it pleases, so there ...


2

DNS may need 24h or more to be updated and propagated through all levels of caching. This might be perfectly normal. Try again in a day, or query authoritative DNS servers directly.


2

Yes, most modern Mail Submission/Transfer Agents (MSA, MTA) support encrypted connections via SSL/TLS and STARTTLS, including Exim, Postfix and Sendmail. Since you are concentrating on sending rather than receiving, it would be relatively easy to set up - you wouldn't have to obtain or generate a security certificate. However, there is no guarantee that the ...


2

I don't disagree with anything that's been said so far, but I thought I'd add my 2p-worth, and some data. SSL/TLS, like all security features, is designed to protect against a threat. Whether or not it's a good protection depends on the nature of the feature, and of the threat model. If your threat model includes attack by a server administrator, then no ...


2

Question What Linux tool can immediately (without queueing) relay e-mails to recipient SMTP server and provide valid bounce messages? Or, if there is better solution of this problem, what tools should I look at? The postfix itself has MULTIPLE INSTANCE feature. It will lets you define separate instance of postfix that have its own queue and ...


2

Short version: Use TLS_Rcpt access table entries. to specify per recipient's domain requirements. TLS_Rcpt:fooexample.com ENCR:112` Full version: 0) TLS_Clt is for incoming connections. Use TLS_Srv for outgoing connections 1) Sendmail looks for TLS_Srv access table entries based on $&{server_name} first and $&{server_addr} later. 2) ...


2

On Debian, MTAs including Exim4 are configured to get the canonical domain from /etc/mailname. Mail clients (like mutt) are also supposed to read this file. This means that you can have a sensible hostname and still get your mail sent out with your desired From: header field. Beware of having more than one host with the same value in their /etc/mailname ...


2

You do not need an MTA if you are directly connecting to Gmail SMTP, if you did this and the MTA dealt with Gmail you would need to change config. to point to the MTA.


2

$myhostname is by default the same as the systems FQDN. This should be like hostname.example.com. Take a look in the manpages of hostname and associates to configure it correctly for your system. The $myhostname variable is used in many other parameters, such as smtp_helo_name, which should be a valid and correct FQDN. Otherwise your mail may be rejected by ...


1

I have a similar set up relaying via mailgun. Firstly, you can get the public IP of an instance using: http://169.254.169.254/latest/meta-data/public-ipv4 From within the instance, in my case I use orchestration (ie. Chef + OpsWorks) to automatically create a DNS record in Route53 for the instance on boot. You could probably also use: ...


1

First, most third party SMTP gateway providers support using their service as a authenticated, encrypted relay host: sendgrid documentation Dyn documentation AWS SES documentation mailjet documentation mailgun documentation etc. etc. etc. The key is, you shouldn't have to do access control using IP addresses or hostname. You use encryption (TLS) and ...


1

sendgrid uses password based authentication (config details for that below). It won't care about your IP, or the hostnames you use (myhostname, myorigin, etc). The hostname your server presents to sendgrid in the HELO (or EHLO) greeting is likely to appear in mail headers. Some recipients' spam software may check it, so use something that does exist in ...


1

From the operations center point of view, here are couple of metrics that truly matter: Amount of email received/sent per some time period Amount of spam filtered per some period Amount of IP addresses connected to your SMTP server pool Mail queue size at your SMTP servers From those you can quickly gather an overview if you have some situation going on ...


1

The pull request you found has not (yet) been merged into mainline Ansible. It may be merged at some point in the future, but that is 100% up to the project maintainers. Until then, you'll need to send SMTP to another host locally that can accept the mail without the need for authentication.


1

Turns out there doesn't seem to be anything wrong with my configuration. What's happening is that my messages are being processed by mailman correctly, and being relayed out to the list. There are a couple of receivers however which (for whatever reason is unique to them) reject the message. Because I have actually correctly configured SPF, I'm seeing the ...


1

Just sort your smtpd_recipient_restrictions accordingly. This list is processed from front to back. Some filters can return a reject or nothing (blacklists, spf; either it's a malicious sender or we don't know) or a permit (SASL, Networks, if they don't match, continue) In your case it would be: smtpd_recipient_restrictions = permit_mynetworks ...


1

The above poster is close. tail allows you to see the last 10 lines in a file. The -f switch allows you to see new lines as they are appended to the maillog file. cd /var/log tail -f maillog Ctrl+c to escape. Seeing this is already written to a file called /var/log/maillog, not sure why you would want to create another file unless you are looking to ...


1

I've not looked at the DKIM part. Concerning the SPF record I see the following used in most example: v=spf1 mx -all This is documented here: http://www.openspf.org/SPF_Record_Syntax However "+mx" should also be correct according to RFC 7208 (Thanks Chris for pointing this out). Maybe it is stil worth a try... I really don't know what to suggest ...


1

I have a VPS hosting multiple domains on Ubuntu 14.04 and wanted to make sure the email headers being sent only included the IP or the FQDN of the virtual host. I first started with this guide on Linode. Afterwards I performed the following steps: Create a file - /etc/exim4/mailhelo and using the syntax of domain.com: helodomain.com produce something ...


1

Your understanding seems to be correct. Quoting from section 3 of RFC 3030: The BINARYMIME service extension can only be used with the "CHUNKING" service extension. and: BINARYMIME cannot be used with the DATA command. If a DATA command is issued after a MAIL command containing the body-value of "BINARYMIME", a 503 "Bad sequence ...



Only top voted, non community-wiki answers of a minimum length are eligible