Skip to content

Latest commit

 

History

History
351 lines (231 loc) · 8.56 KB

README.md

File metadata and controls

351 lines (231 loc) · 8.56 KB

Mail servers

E-mail server factors

  • Transport encryption (TLS on SMTP in&out and IMAP)
  • Forwarding with SRS (Sender Rewriting Scheme)
  • Fetch instead of forwarding
  • Attack mitigation (SMTP vulnerability, authentication)
  • Spam filtering
  • Custom blackhole lists (RBL)
  • Custom whitelisting of hosts (broken mail servers)
  • Monitor IP reputation
  • Apply to whitelists
  • Register to feedback loops
  • Monitor delivery and delivery errors

Transactional email providers

Marketing tools

Webmails

http://www.rainloop.net/changelog/

Disposable email address

http://nincsmail.hu/ (inbox and sending)

Problems

Outlook 2013 fixes

  • Root: "Inbox"
  • To recognize standard folder names delete .pst/.ost file after account setup
  • Fix folder subscription, see: ${D}/mail/courier-outlook-subscribe-bug.sh (Outlook 2007)

MacOS Mail.app fixes

Advanced/IMAP Path Prefix: "INBOX"

Open winmail.dat

https://github.com/Yeraze/ytnef

See: ${D}/repo/debian/pool/main/y/ytnef/

MIME type: application/ms-tnef

Set up Google Apps mailing

https://toolbox.googleapps.com/apps/checkmx/

Online IMAP migration

Settings

Send all messages in an mbox file to an email address

See: ${D}/mail/mbox_send2.py

Email forwarding (srs)

Build Courier SRS

apt-get install -y build-essential libsrs2-dev libpopt0
git clone https://github.com/szepeviktor/couriersrs
cd couriersrs
./configure --sysconfdir=/etc
make
make install

See couriersrs package: http://szepeviktor.github.io/

Set up SRS secret

./couriersrs -v
apg -a 1 -M LCNS -m 30 -n 1 > /etc/srs_secret
chown root:daemon /etc/srs_secret
chmod 640 /etc/srs_secret

Create system aliases SRS0 and SRS1.

echo "|/usr/bin/couriersrs --reverse" > /etc/courier/aliasdir/.courier-SRS0-default
echo "|/usr/bin/couriersrs --reverse" > /etc/courier/aliasdir/.courier-SRS1-default

Add forwarding alias

user: |/usr/bin/couriersrs --srsdomain=domain.srs username@external-domain.net

* Note: SRS domain cannot be a virtual domain (@virt.dom: an@account.net).

Courier catchall address

http://www.courier-mta.org/makehosteddomains.html

http://www.courier-mta.org/dot-courier.html

Add alias: @target.tld: foo

Delivery instructions:

echo "|/pipe/command" > /var/mail/localhost/user/.courier-foo-default

Spamtrap

spamtrap@domain.net:  |/usr/local/bin/multi-stdout.sh "/usr/bin/spamc -4 --learntype=spam --max-size=1048576" "/usr/bin/spamc -4 --reporttype=report --max-size=1048576"
problematic@address.es:  spamtrap@domain.net

Courier kitchen sink (drop incoming messages)

See the description of /etc/courier/aliasdir in man dot-courier DELIVERY INSTRUCTIONS

echo "" > /etc/courier/aliasdir/.courier-kitchensink

Add alias: ANY.ADDRESS@ANY.DOMAIN.TLD: kitchensink@localhost

Courier MTA message processing order on reception

  1. SMTP communication
  2. NOADD*, opt MIME=none
  3. filters
  4. DEFAULTDELIVERY

Courier MTA log analyzer

Courier-analog

Test

IMAP PLAIN authentication

D0 CAPABILITY
D1 AUTHENTICATE PLAIN
$(echo -en "\0USERNAME\0PASSWORD" | base64)
D2 LOGOUT

Spamassassin test and email authentication

sudo -u daemon -- spamassassin --test-mode --prefspath=/var/mail/.spamassassin/user_prefs -D < msg.eml

# For specific tests see: man spamassassin-run
sudo -u daemon -- spamassassin --test-mode --prefspath=/var/mail/.spamassassin/user_prefs -D dkim < msg-signed.eml

opendkim -vvv -t msg-signed.eml

Mailserver SSL test

https://ssl-tools.net/

Authentication

https://www.unlocktheinbox.com/resources/identifieralignments/

Sender ID (From:)

SPF (HELO, MAIL FROM:)

DKIM

DKIM tests

ADSP

An optional extension to the DKIM E-mail authentication scheme.

https://unlocktheinbox.com/resources/adsp/

Domain Keys

Deprecated.

DMARC

Specs: https://datatracker.ietf.org/doc/draft-kucherawy-dmarc-base/?include_text=1

http://www.returnpath.com/solution-content/dmarc-support/what-is-dmarc/

Bulk mail

Body parts

  • ☀️ ☀️ ☀️ Descriptive From name "Firstname from Company"
  • ☀️ ☀️ Descriptive subject line
  • ☀️ Short preview line at top of the message
  • Link to online version (newsletter archive)
  • Short main header
  • 💡 Sections: image + title + description + call2action, see: https://litmus.com/subscribe
  • External resources should be able to load through HTTPS (opening in a HTTPS webmail)
  • 📱 Mobile compatible

Footer

  • Sender's contact details (postal address, phone number)
  • Who (recipient name, email address, why) is subscribed
  • Unsubscribe link
  • Forward to a friend

Email headers

  • List-Unsubscribe: URL (invisible)
  • Precedence: bulk (invisible)
  • Return-Path: bounce@addre.ss (invisible)
  • Reply-to: reply@addre.ss (invisible) How to video
  • From: sender@domain.net
  • To: recipients@addre.ss
  • bounce X-Autoreply: yes
  • bounce Auto-Submitted: auto-replied

Others

Email templates

Email tests

HTML content

Feedback loops

https://wordtothewise.com/isp-information/

RBL-s (DNSBL)

List of blacklists

http://psky.me/

Check RBL-s

cat anti-abuse.org.rbl | xargs -I %% host -t A "$(revip "$IP").%%" 2>&1 \
    | grep -v "not found: 3(NXDOMAIN)"
#rblcheck

Trendmicro ERS check

wget -qO- --post-data="_method=POST&data[Reputation][ip]=${IP}" https://ers.trendmicro.com/reputations \
    | sed -ne 's;.*<dd>\(.\+\)</dd>.*;\1;p' | tr '\n' ' '

Response: "IP Unlisted in the spam sender list None"

Monitoring IP reputation

Whitelists

Free e-mail backup server

http://www.junkemailfilter.com/spam/free_mx_backup_service.html