Re: Email Server and DNS

2013-11-08 Thread Rich Kulawiec
I suggest moving this to mailop, where it arguably belongs. But I'm going to follow up on a few points, anyway. First, I forgot to mention two other highly effective mail system defense methods: geoblocking and passive OS fingerprinting. Geoblocking: A mail server for a local construction

Re: Email Server and DNS

2013-11-08 Thread rwebb
Thanks to everyone for all the tips and info. I think I have compiled plenty of info to get this done. I will probably start with some of the basics and see how things go. THen as needed start putting in some additional features as I see how things progress. Robert On Fri, 8 Nov 2013

Re: Email Server and DNS

2013-11-08 Thread William Herrin
On Sun, Nov 3, 2013 at 11:39 AM, rw...@ropeguru.com wrote: I am looking for some info on current practice for an email server and SMTP delivery. It has been a while since I have had to setup an email server and I have been tasked with setting up a small one for a friend. My question centers

Re: Email Server and DNS

2013-11-08 Thread bmanning
On Fri, Nov 08, 2013 at 08:37:32AM -0500, William Herrin wrote: On Sun, Nov 3, 2013 at 11:39 AM, rw...@ropeguru.com wrote: I am looking for some info on current practice for an email server and SMTP delivery. It has been a while since I have had to setup an email server and I have been

Re: Email Server and DNS

2013-11-04 Thread Dave Crocker
On 11/3/2013 8:11 PM, John Levine wrote: I would recommend you go a step further and use DKIM, ADSP, and DMARC. Using DKIM is a good idea. Do *not* use ADSP. It is a failed experiment which will provide no benefit and considerable pain. +1 If you believe that your domain is heavily

Re: Email Server and DNS

2013-11-04 Thread Franck Martin
www.maawg.org has published a sender BCP, please read it signature.asc Description: Message signed with OpenPGP using GPGMail

Re: Email Server and DNS

2013-11-04 Thread David Conrad
On Nov 4, 2013, at 8:41 AM, Franck Martin fmar...@linkedin.com wrote: www.maawg.org has published a sender BCP, please read it You mean http://www.maawg.org/sites/maawg/files/news/MAAWG_Senders_BCP_Ver2a-updated.pdf? Regards, -drc signature.asc Description: Message signed with OpenPGP using

Email Server and DNS

2013-11-03 Thread rwebb
So I figured a little break from the NSA was in order. I am looking for some info on current practice for an email server and SMTP delivery. It has been a while since I have had to setup an email server and I have been tasked with setting up a small one for a friend. My question centers

Re: Email Server and DNS

2013-11-03 Thread Rich Kulawiec
On Sun, Nov 03, 2013 at 12:39:25PM -0400, rw...@ropeguru.com wrote: I am looking for some info on current practice for an email server and SMTP delivery. It has been a while since I have had to setup an email server and I have been tasked with setting up a small one for a friend. My question

Re: Email Server and DNS

2013-11-03 Thread Private Sender
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 11/3/2013 8:39 AM, rw...@ropeguru.com wrote: So I figured a little break from the NSA was in order. I am looking for some info on current practice for an email server and SMTP delivery. It has been a while since I have had to setup an email

Re: Email Server and DNS

2013-11-03 Thread Jimmy Hess
On Sun, Nov 3, 2013 at 11:08 AM, Rich Kulawiec r...@gsp.org wrote: non-generic DNS/rDNS. (non-generic meaning something that looks like a host that should sending and receiving email. In other words, mailgw.example.net looks real. ip-137-12-16-164.example.com looks like a random host

Re: Email Server and DNS

2013-11-03 Thread TR Shaw
In addition to all the other reco's below, 1) only allow sending by your users from the submit port and only with authentication. There should be no client sending through the SMTP port. 2) Implement SSL on POP IMAP if at all possible Otherwise enforce CRAM-MD5 3) Review logs esp pop and

Re: Email Server and DNS

2013-11-03 Thread Jim Popovitch
On Sun, Nov 3, 2013 at 11:49 AM, Private Sender nob...@snovc.com wrote: I would recommend you go a step further and use DKIM, ADSP, and DMARC. Don't do DMARC if you expect to have end-users forward emails, or subscribe to mailinglists. Despite the removal from the current DMARC spec, the

Re: Email Server and DNS

2013-11-03 Thread John Levine
MX, PTR, and SPF are really all you need. So far so good, noting that a host name that doesn't look generic is better than one that does. I would recommend you go a step further and use DKIM, ADSP, and DMARC. Using DKIM is a good idea. Do *not* use ADSP. It is a failed experiment which will

Re: Email Server and DNS

2013-11-03 Thread bmanning
On Sun, Nov 03, 2013 at 08:49:32AM -0800, Private Sender wrote: On 11/3/2013 8:39 AM, rw...@ropeguru.com wrote: I am looking for some info on current practice for an email server and SMTP delivery. It has been a while since I have had to setup an email server and I have been tasked with

Re: Email Server and DNS

2013-11-03 Thread Stefan Foerster
* Private Sender nob...@snovc.com: On 11/3/2013 8:39 AM, rw...@ropeguru.com wrote: I am looking for some info on current practice for an email server and SMTP delivery. It has been a while since I have had to setup an email server and I have been tasked with setting up a small one for a