Skip to content

Latest commit

 

History

History
376 lines (251 loc) · 10.2 KB

README.md

File metadata and controls

376 lines (251 loc) · 10.2 KB

Mail servers

E-mail server factors

  • Transport encryption (TLS on SMTP in&out and IMAP)
  • Forwarding with SRS (Sender Rewriting Scheme)
  • Fetch instead of forwarding
  • Attack mitigation (SMTP vulnerability, authentication)
  • Spam filtering
  • Custom blackhole lists (RBL)
  • Custom whitelisting of hosts (broken mail servers)
  • Monitor IP reputation
  • Apply to whitelists
  • Register to feedback loops
  • Monitor delivery and delivery errors

Transactional email providers

Marketing tools

Webmails

http://www.rainloop.net/changelog/

Disposable email address

http://nincsmail.hu/ (inbox and sending)

Problems

Outlook 2013 fixes

  • Root: "Inbox"
  • To recognize standard folder names delete .pst/.ost file after account setup
  • Fix folder subscription, see: ${D}/mail/courier-outlook-subscribe-bug.sh (Outlook 2007)

MacOS Mail.app fixes

Advanced/IMAP Path Prefix: "INBOX"

Open winmail.dat

https://github.com/Yeraze/ytnef

See: ${D}/repo/debian/pool/main/y/ytnef/

MIME type: application/ms-tnef

Set up Google Apps mailing

https://toolbox.googleapps.com/apps/checkmx/

Online IMAP migration

Email filters

Decode emails

  • Encoded (base64 or QP) headers: conv2047.pl -d
  • Body and attachments: munpack -t
  • Syntax highlight: headers.vim for vim, /input/mc/email.syntax for mcedit
  • Enveloped-data (application/pkcs7-mime): cat smime.p7m | base64 -d | openssl smime -verify -inform DER

Settings

Malware (virus) scanning

  • ClamAV (CCTTS, Safe Browsing)
  • clamav-unofficial-sigs (paid: SecuriteInfo, MalwarePatrol, Sanesecurity)
  • clamav pythonfilter through pyClamd for Courier MTA

clamav-unofficial-sigs needs 1 GB of memory.

"Best clamd.conf" in SecuriteInfo FAQ.

Send all messages in an mbox file to an email address

See: mbox_send2.py

Email forwarding (srs)

Build Courier SRS

See: /package/couriersrs-jessie.sh

Courier catchall address

http://www.courier-mta.org/makehosteddomains.html

http://www.courier-mta.org/dot-courier.html

Add alias: @target.tld: foo

Delivery instructions:

echo "|/pipe/command" > /var/mail/localhost/user/.courier-foo-default

Spamtrap

spamtrap@domain.net:  |/usr/local/bin/multi-stdout.sh "/usr/bin/spamc -4 --learntype=spam --max-size=1048576" "/usr/bin/spamc -4 --reporttype=report --max-size=1048576"
problematic@address.es:  spamtrap@domain.net

NAIH nyilvántartási szám - "Hungarian National Authority for Data Protection and Freedom of Information" registry

NAIH kereső http://www.naih.hu/kereses-az-adatvedelmi-nyilvantartasban.html

Courier kitchen sink (drop incoming messages)

See the description of /etc/courier/aliasdir in man dot-courier DELIVERY INSTRUCTIONS

echo "" > /etc/courier/aliasdir/.courier-kitchensink

Add alias: ANY.ADDRESS@ANY.DOMAIN.TLD: kitchensink@localhost

Courier MTA message processing order on reception

  1. SMTP communication
  2. NOADD*, opt MIME=none
  3. filters
  4. DEFAULTDELIVERY

Courier MTA log analyzer

Courier-analog

Courier as smarthost client

esmtproutes "both MX and A records get looked up"

Test

IMAP PLAIN authentication

D0 CAPABILITY
D1 AUTHENTICATE PLAIN
$(echo -en "\0USERNAME\0PASSWORD" | base64)
D2 LOGOUT

Spamassassin test and email authentication

sudo -u daemon -- spamassassin --test-mode --prefspath=/var/mail/.spamassassin/user_prefs -D < msg.eml

# For specific tests see: man spamassassin-run
sudo -u daemon -- spamassassin --test-mode --prefspath=/var/mail/.spamassassin/user_prefs -D dkim < msg-signed.eml

opendkim -vvv -t msg-signed.eml

Mailserver SSL test

https://ssl-tools.net/

Authentication

SPF (HELO, MAIL FROM:)

Sender ID from Microsoft (From:)

DKIM

DKIM tests

Domain Keys

Deprecated.

ADSP

An optional extension to the DKIM E-mail authentication scheme.

https://unlocktheinbox.com/resources/adsp/

DMARC

Specs: https://datatracker.ietf.org/doc/draft-kucherawy-dmarc-base/?include_text=1

http://www.returnpath.com/solution-content/dmarc-support/what-is-dmarc/

Bulk mail

Body parts

  • ☀️ ☀️ ☀️ Descriptive From name "Firstname from Company"
  • ☀️ ☀️ Descriptive subject line
  • ☀️ Short preview line at top of the message
  • Link to online version (newsletter archive)
  • Short main header
  • 💡 Sections: image + title + description + call2action, see: https://litmus.com/subscribe
  • External resources should be able to load through HTTPS (opening in a HTTPS webmail)
  • 📱 Mobile compatible

Footer

  • Sender's contact details (postal address, phone number)
  • Who (recipient name, email address, why) is subscribed
  • Unsubscribe link
  • Forward to a friend

Email headers

  • List-Unsubscribe: URL (invisible)
  • Precedence: bulk (invisible)
  • Return-Path: bounce@addre.ss (invisible)
  • Reply-to: reply@addre.ss (invisible) How to video
  • From: sender@domain.net
  • To: recipients@addre.ss
  • bounce X-Autoreply: yes
  • bounce Auto-Submitted: auto-replied

Others

Email templates

Email tests

HTML content

RBL-s (DNSBL)

Blacklists

Check RBL-s

rblcheck

Trendmicro ERS check

wget -qO- --post-data="_method=POST&data[Reputation][ip]=${IP}" https://ers.trendmicro.com/reputations \
    | sed -ne 's;.*<dd>\(.\+\)</dd>.*;\1;p' | tr '\n' ' '

OK response: "IP Unlisted in the spam sender list None"

IP reputation

IP reputation monitoring

Whitelists

Feedback loops, postmaster tools, sender support

Free e-mail backup server

http://www.junkemailfilter.com/spam/free_mx_backup_service.html