I run a Linux based mail server and use Dovecot to provide IMAP over TLS access. This server has been up and running for a bit more than 8 years now and it serves my email address along with those of my clients.
As this is one of my business activities, and one that is very important to all my clients that want a reliable and secure email service, I am very attentive and concerned with security and privacy issues.
I have no issues with my configuration whatsoever, it has been running very smoothly for so long and I am very happy with it. The only incidents I had where small, occasional and usually related to connectivity issues or a config update done too hastily.
Packages and distro versions are not the latest but they are stable and updated with the latest security fixes.
So, my point finally, I have been noticing for a while now that if I use a client like Outlook for mobile, I see connections from unknown IP addresses. Those IP addresses are not even in the country I am phisically and have nothing to do with the network (or networks) I am connected with my devices.
doveadm who gives me this information and the logs tell me also that those connections stay up basically always:
Jan 16 21:13:46 imap-login: Info: Login: user=<REDACTED EMAIL>, method=LOGIN, rip=52.125.138.151, lip=X.X.X.X, mpid=8175, TLS, session=
This is related to my email account on my server, the lip is of course my server's IP. I am also seeing another ip address connected to my account and that corresponds to my internet connection (or whatever network I am connected to).
So the question is: is it safe? is it just a proxy (but I use TLS..) or when I setup my account with outlook my password got stored on Microsoft servers?
I had exactly the same issue with another application (I think it was Spark for MAC and IOS) and I had to go through a lengthy process to delete my information from their service, I had to contact their support and finally changed my password. Why? because I was seeing their IP addresses connected to my server and my IMAP account months after I deleted their app from all my devices.
I am wondering if anybody else noticed this behavior and if I am too concerned about it. I understand those application want to add features to "email" that would be impossible to have otherwise, but I see it as a security issue.
52.112.0.0/14
but that IP address range is52.112.0.1
to52.115.255.254
. Although, I've personally observed the SPF records not being up-to-date with the real-life IP addresses used for sending email in Outlook.com (the service, I can't remember which domain names) so I wouldn't be surprised if it's that.