0

Can origin IP be disclosed if an email message is sent over SMTP (exim4) from the server to a user email IF Received header is cut off? Are there any other SMTP headers (or something) that may expose origin IP?

Improve this question
2
  • Why not simply send a test email and look for your IP in the headers?
    – ceejayoz
    May 30, 2017 at 13:41
  • I did and haven't found it. But it doesn't mean it's not disclosed.
    – Schneefall
    May 30, 2017 at 13:55

2 Answers 2

Reset to default
2

Any number of headers can disclose origin information. These include buy by no means are limited to:

  • Received headers
  • Message-ID
  • Authentication-Results
  • DKIM-Signature.
  • From, Reply-to, Sender and other addresses.
  • X- headers.

Be careful about obfuscating origin. Overly obfuscated messages may trigger spam avoidance measures. If you are stripping headers in the Exim server, you should log them. Being able to trace the path of a message makes resolving issues much simpler.

EDIT: It is highly unlikely that Received headers will be used to target a DDoS attack. It is far simpler to look up the MX record and use that for an attack. Unless you abusively sending email, it is unlikely that the sending MTA would be DDoS'd. Even in that case, you are more likely to be be blacklisted than DDoS'd.

It is not important that your email server be up 7x24. The mail system is quite resilient to mail server outages of up to a day or two. I've had occasional outage of a day or so after which the delayed email is delivered. Some mail blasts don't send missed emails, but otherwise all expected emails are delivered.

It is acceptable to have a second MTA that is used to send outgoing email. You need to configure your published policy in your SPF record accordingly. It might be appropriate to used this MTA as a back up (lower priority) MX.

The main concern with leaving Received headers on outgoing emails is security. The information in the headers can leak information about internal addresses on your network.

Improve this answer
3
  • Thanks, very helpful answer. What do you say about setting up an SMTP relay and sending emails from main server through the relay? Would it be a better solution for hiding origin IP? The relay getting DDoS'd is not critical but the main server must always be online.
    – Schneefall
    May 31, 2017 at 13:04
  • @Schneefall Headers are unlikely to be used to target a DDoS. Other than the outgoing MTA, usually the MX, the hosts in the header should be unreachable, It the host is unreachable, it is pretty hare to DDoS it. You won't be able to hide the outgoing MTA in Received headers, as the host you send the email to will add that header.
    – BillThor
    Jun 3, 2017 at 0:32
  • When I send an email from my server over SMTP Exim adds a Received header that contains the origin IP (e.g. Received: from example.com ([ORIGIN_IP])) which makes possible a DDoS attack (e.g UPD flood) targeted on to that IP. The problem I needed to solve was keeping the origin IP a secret so I decided to use a transactional email service API that does the trick. What about MX records - I'm using an email forwarding service so there's no way to get origin IP looking up MX records (cloudflare doesn't proxy traffic on the port 25).
    – Schneefall
    Jun 3, 2017 at 16:07
0

I ended up using a transactional email service.

Improve this answer
1
  • Indeed using a 3rd party SMTP service is the way to go to properly obscure the origin IP. Amazon SES and now SendGrid will strip Received headers; SES will also set their own Message-Id so you don't have to worry about that, but with SendGrid you may need to get your mail server (in my case, Postfix with smtp_header_checks) to rewrite the Message-Id to obscure the hostname. The resulting headers show no hint of the origin, and because SPF and DKIM are handled by the provider, DNS entries won't give away your origin.
    – dlo
    May 7, 2021 at 0:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .