Skip to content

Latest commit

 

History

History
626 lines (443 loc) · 20.2 KB

README.md

File metadata and controls

626 lines (443 loc) · 20.2 KB
Raw

Mail servers

E-mail server factors

  • Transport encryption (TLS on SMTP in&out and IMAP)
  • Forwarding with SRS (Sender Rewriting Scheme)
  • Fetch instead of forwarding
  • Attack mitigation (SMTP vulnerability, authentication)
  • Spam filtering
  • Custom blackhole lists (RBL)
  • Custom whitelisting of hosts (broken mail servers)
  • Monitor IP reputation
  • Apply to whitelists
  • Register to feedback loops
  • Monitor delivery and delivery errors

Transactional email providers

Email delivery features

  • Shared IP / IP pool / Dedicated IP
  • On whitelists (mailspike, dnswl.org, Return Path)
  • Open tracking (custom domain, HTTPS)
  • Click tracking (custom domain, HTTPS)
  • Bounce handling (SMTP bounce classification)

Campaign automation providers

  • dotdigital Email+SMS+Social+Ads+Mobile+Web+Offline €200
  • MailerLite $30
  • Klaviyo $0
  • https://convertkit.com/ $29
  • ONTRAPORT $79
  • https://www.drip.com/features $0
  • HubSpot $46
  • Act-On Software $900
  • Campaign Monitor $29
  • Delivra by Campaign Monitor $100
  • Marketo $895
  • Salesforce / Pardot $1250
  • Adobe Campaign $$$
  • Cheetah Digital $$$
  • Constant Contact $20
  • Oracle Eloqua $2000
  • Emma by Campaign Monitor $89
  • IBM Watson Campaign Automation $$$
  • MailChimp $0 🦍
  • Oracle Responsys $1200
  • Salesforce / ExactTarget $400
  • SendGrid by Twilio $10
  • https://tinyletter.com/ by Mailchimp 🐌

Webmail

Email client problems

Outlook 2013 IMAP fixes

  • Root: Inbox
  • To recognize standard folder names delete .pst/.ost file after account setup
  • Fix folder subscription, see /mail/courier-outlook-subscribe-bug.sh (Outlook 2007)

Outlook 2007 cipher suite

TLS1.0 ECDHE_RSA_AES_256_CBC_SHA1

MacOS Mail.app IMAP fixes

Advanced/IMAP Path Prefix: INBOX

Open winmail.dat

https://github.com/Yeraze/ytnef

See /repo/debian/pool/main/y/ytnef/

MIME type: application/ms-tnef

Set up Google Workspace mailing

See G-Suite.md

Test tool: https://toolbox.googleapps.com/apps/checkmx/

Online IMAP migration

Decode emails

  • Encoded (base64 or QP) headers: conv2047.pl -d
  • Body and attachments: munpack -t
  • Syntax highlight: headers.vim for vim, /input/mc/email.syntax for mcedit
  • Enveloped-data (application/pkcs7-mime): cat smime.p7m | base64 -d | openssl smime -verify -inform DER

Configuration

Standards

Malware, spam, phishing scanning

  • ClamAV (CCTTS, Safe Browsing)
  • clamav-unofficial-sigs (paid: SecuriteInfo, MalwarePatrol, free: Sanesecurity)
  • clamav.py pythonfilter through pyClamd for Courier MTA

clamav-unofficial-sigs needs 1 GB of memory.

See "Best clamd.conf" in SecuriteInfo FAQ.

Block executables

courier-pythonfilter attachments module

[attachments.py]
blockedPattern = r'^.*\.(ade|adp|bat|chm|cmd|com|cpl|dll|exe|hta|inf|ins|isp|jar|js|jse|lib|lnk|mde|msc|msp|mst|pif|reg|scf|scr|sct|shb|shs|sys|url|xxe|vb|vbe|vbs|vxd|wsc|wsf|wsh)$'

Gmail's blocked file types

https://support.google.com/mail/answer/6590

Spamassassin rule

20_gmail-blocked-filetypes.cf

# Gmail's blocked file types
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

mimeheader GMAIL_BLOCKED_ATTACH Content-Type =~ /\.(ADE|ADP|BAT|CHM|CMD|COM|CPL|EXE|HTA|INS|ISP|JAR|JSE|LIB|LNK|MDE|MSC|MSP|MST|PIF|SCR|SCT|SHB|SYS|VB|VBE|VBS|VXD|WSC|WSF|WSH)/i
mimeheader GMAIL_BLOCKED_ATTACH_CD Content-Disposition =~ /\.(ADE|ADP|BAT|CHM|CMD|COM|CPL|EXE|HTA|INS|ISP|JAR|JSE|LIB|LNK|MDE|MSC|MSP|MST|PIF|SCR|SCT|SHB|SYS|VB|VBE|VBS|VXD|WSC|WSF|WSH)/i
score GMAIL_BLOCKED_ATTACH 20
score GMAIL_BLOCKED_ATTACH_CD 20

endif

Send all messages in an mbox file to an email address

See mbox_send2.py

Email forwarding (srs)

Build Courier SRS

See /package/couriersrs-jessie.sh

Courier catchall address (virtual domain)

http://www.courier-mta.org/makehosteddomains.html

http://www.courier-mta.org/dot-courier.html

Add alias:

@target.tld:    foo

Delivery instructions:

echo "|/pathto/pipe/command" >/var/mail/domain/user/.courier-foo-default

Spamtrap

# Reporting includes learning
spamtrap@domain.net:                    |/usr/bin/spamc --reporttype=report --max-size=1048576
problematic@address.es:                 spamtrap@domain.net

Deliver e-mail through SSH

Create an alias:

|/usr/bin/ssh -p 22 -i /home/user/.ssh/id_ecdsa user@example.com -- /usr/sbin/sendmail -f envelope-from@example.com

Courier MTA message processing order on reception

  1. SMTP communication
  2. NOADD*, opt MIME=none
  3. filters
  4. DEFAULTDELIVERY

Courier kitchen sink (drop incoming messages)

See the description of /etc/courier/aliasdir in man dot-courier DELIVERY INSTRUCTIONS section.

echo >/etc/courier/aliasdir/.courier-kitchensink
echo "kitchensink" >/etc/courier/aliasdir/.courier-kitchensink-default

Add alias:

ANY.ADDRESS@ANY.DOMAIN.TLD:             kitchensink@localhost
@example.com:                           kitchensink@localhost

Courier MTA log analyzer

Courier-analog

Courier as smarthost client

esmtproutes "both MX and A records get looked up"

Non-email domains

Tarbaby

Test

IMAP PLAIN authentication

D0 CAPABILITY
D1 AUTHENTICATE PLAIN
$(printf '\0%s\0%s' USERNAME PASSWORD | base64)
D2 LOGOUT

Spamassassin test and email authentication

sudo -u courier -- spamassassin --test-mode --prefspath=/var/lib/courier/.spamassassin/user_prefs -D <msg.eml

# For specific tests issue
#     man spamassassin-run
sudo -u courier -- spamassassin --test-mode --prefspath=/var/lib/courier/.spamassassin/user_prefs -D dkim <msg-signed.eml

# Needs opendkim package
opendkim -vvv -t msg-signed.eml
# With opendkim-tools
opendkim-testmsg <msg-signed.eml && echo "OK."

# Display the contents of the Bayes database
sa-learn --dbpath /var/lib/courier/.spamassassin/ --dump magic

Mailserver SSL test

Forwarding a temporary server's tcp/443 to Courier's tcp/465.

read -p "Courier IP? " COURIER_IP
read -p "This host's IP? " TEMPORARY_VPS_IP
sysctl --write net.ipv4.conf.all.route_localnet=1
#iptables -I FORWARD -i eth0 -p tcp -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination ${COURIER_IP}:465
iptables -t nat -A POSTROUTING -p tcp --dst ${COURIER_IP} --dport 465 -j SNAT --to-source ${TEMPORARY_VPS_IP}

Then browse to https://www.ssllabs.com/ssltest/

Local alternative:

addcr | TLS_PRIORITY="$TLS_PRIORITY_STRING" TLS_VERIFYPEER=PEER TLS_TRUSTCERTS=/etc/ssl/certs \
  couriertls -host=example.com -port=25 -protocol=smtp -verify=example.com

See also

E-mail authentication

SPF (SMTP HELO, MAIL FROM:)

DKIM (any header field and message body)

DKIM tests

DMARC (RFC5322.From)

Specs: https://datatracker.ietf.org/doc/rfc7489/

https://blog.returnpath.com/how-to-explain-dmarc-in-plain-english/

External destination verification: https://space.dmarcian.com/what-is-external-destination-verification/

ADSP

Declared "Historic".

An optional extension to the DKIM E-mail authentication scheme.

http://web.archive.org/web/20161202063549/https://www.unlocktheinbox.com/resources/adsp/

Sender ID from Microsoft (From:)

Domain Keys

Deprecated.

Bulk mail

  1. Tonality: personal or impersonal
  2. What is the most important message?

Headers and Body parts

  • ❗ Dedicated landing page
  • ☀️ ☀️ ☀️ Descriptive From name "Firstname from Company"
  • ☀️ ☀️ Descriptive subject line
  • ☀️ Short preview text at top of the message
  • Gmail actions
  • Link to online version (newsletter archive)
  • Company logo
  • Short main header
  • Personalization (e.g. statistics)
  • 💡 Sections: image + title + description + call2action + background color, see https://litmus.com/subscribe
  • "Updates from #RandomChannel"
  • Bind words together with &nbsp;
  • External resources should be able to load through HTTPS (opening in a HTTPS webmail)
  • 📱 Mobile compatible

Footer

  • Sender's contact details (postal address, phone number)
  • Who (recipient name, email address, why) is subscribed
  • Unsubscribe link
  • Forward to a friend
  • GDPR

Email headers

  • From: sender@example.com
  • Reply-to: reply@example.com (invisible) How to video
  • To: recipients@addre.ss
  • Precedence: bulk (invisible)
  • List-Unsubscribe: URL (invisible)
  • Return-Path: bounce@example.com (invisible)
  • List-Unsubscribe-Post: List-Unsubscribe=One-Click RFC8058 (invisible)
  • X-Auto-Response-Suppress: OOF, AutoReply (invisible)

Others

Email templates

Email design

Email tests

HTML content and CSS inlining

Prevent automatic replies

  1. RFC3464: delivery status notifications (bounce message)
  2. RFC3834: out of office reply (vacation responder) and delivery confirmation (automatic response)
  3. RFC3798: disposition notification (read receipt)

Detect automatic responses

About spam

85% of emails are spam https://www.talosintelligence.com/reputation_center/email_rep

Deliverability

RBL-s (DNSBL)

Check RBL-s

rblcheck

Built-in blacklist check in Courier MTA

BLACKLISTS="-block=bl.blocklist.de"

Trendmicro ERS check

wget -qO- --post-data="_method=POST&data[Reputation][ip]=${IP}" https://ers.trendmicro.com/reputations \
    | sed -ne 's;.*<dd>\(.\+\)</dd>.*;\1;p' | tr '\n' ' '

OK response: IP Unlisted in the spam sender list None

MIPSpace Reputation lists - "No More Email Marketing"

wget -qO- --post-data="search=1.2.3.4" "http://www.mipspace.com/lookup.php" \
    | sed -n -e 's#<[^>]\+>##g;s#^.*\(The IP address .\+\)$#\1#p'

Sample response: The IP address 1.2.3.4 is on the the following MIPSpace Reputation lists: MIPSpace-Poor

Mail server reputation

R - Register your mail server here

ESP Postmaster Site/Feedback loop (FBL)

ESP Sender Support/Delivery Issues

ESP Abuse Reporting

Whitelists

Blacklists (RBL, DNSBL)

Certification Services/IP Reputation

Threat Centers

Email filtering services

Lookup Tools/Monitoring Tools

Free e-mail backup server

http://www.junkemailfilter.com/spam/free_mx_backup_service.html