0

Problem:

When I send an email from my server, the email headers contain the IP address of the server. Yeah, this is a problem, because the server is being the target of DDoS attacks. Using CloudFlare is not going to help if my server reveals its IP when emails are sent...

Question:

How can I send emails from the server without revealing the IP? If that's not possible, can I send the emails to a secondary server that will act as "shield"? How can I do that? I don't mind if the secondary server is attacked, emails are not that important, (I just have to send emails when users register on my forum, or when they receive private messages/notifications).

Thank you.

2
  • 2
    You can't send mails from the server without revealing its IP. That is why spammers are hijacking other people's windows boxes to send spam without being discovered. Try not sending mail to users that don't like it so much that they start DOSing you in retaliation. – Jenny D May 25 '13 at 12:22
  • @JennyD The server is hosting a forum. I just send emails on user registration, private messages and stuff like that. So, if I can't send emails hiding the IP, well, lets send emails from a secondary server, how can I do that? – Salvatorelab May 25 '13 at 12:47
2

You can configure most MTAs to strip off Received: headers. For instance, in postfix, you can put this line in your main.cf file:

header_checks = regexp:/etc/postfix/header_checks.cf

Then, in that file, put a line like this:

/^Received:/ IGNORE

In this way, the history of the message before the relay will be stripped off. Set up a relay like this, and configure it to only accept mails from your web server(s). Extra points if you implement SSL with client certificate authentication; be careful not to operate an open relay.

That said, there are a number of reasons this won't appreciably improve your security. Firstly, if your service (whatever it may be) is accessible from the internet, by definition arbitrary hosts can send traffic to some point of presence you have on the internet. This can then be subject to DDoS anyway, and you can't hide that vector away because it is how people connect to you. If the attack is able to saturate your link, you're done. Secondly, relying on hiding IP addresses to improve security is merely security by obscurity; it is not intrinsically impossible to find the IP.

7
  • thanks for the answer, sounds easy hehe. Regarding your comment about security, CloudFlare will take care of attacks and link saturation. – Salvatorelab May 25 '13 at 13:08
  • Oh, if you're using it as a caching CDN or something like that, with your much smaller web server backing it, this makes sense - it sets the bar higher for DoS, until someone manages to scan for your backing server's IP. Hopefully these attackers aren't that determined. – Falcon Momot May 25 '13 at 13:11
  • 1
    haha there is no such thing as "really cheap fiber connection" here in Spain :P And all DDoS protected servers are far above my budget. But you have given me enough info to continue this fight. Thank you very much, I will accept the answer as soon as I test it. – Salvatorelab May 25 '13 at 13:47
  • 1
    I would like to let you know that this solution worked perfectly (in combination with CloudFlare of course). No more downtime. Thank you! – Salvatorelab Aug 2 '13 at 9:53
  • 1
    Awesome; glad to hear it. CloudFlare is a good plan for that, certainly. – Falcon Momot Aug 2 '13 at 10:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.