Over 3 Million Mail Servers without Encryption exposed to Sniffing Attacks.

As scans from the IT-security threat monitoring platform Shadowserver show, 3.3 million hosts are running POP3/IMAP services without TLS encryption enabled and expose usernames & passwords in plain text when transmitted over the Internet.

https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-pop3-report/

#pop3 #imap #mailservers #exposed #sniffing #tls #it #security #privacy #engineer #media #tech #news

Hrm. When you have #dmarc setup for your #mailservers, getting reports is nice.

Then you get the idea that you could also have your tools send out #reports. Ok, sure, easy to setup, just a cronjob.

But then, umm, it seems I am missing something.
Sending dmarc reports for mails that clearly had been spam (#rspamd sorted them out correctly), seems like an idiotic idea to me?! "Heyho, I got your mail all fine, here is a report, come on, send more" seems to not be the wisest move available.

But there also doesn't appear to be an option to skip on such things. Except for setting either exclude_domains or only_domains.
For the first I would need to know which domains spammers send from. So nope, out.
For the second I limit myself to just a few domains to send to. Which would be the known big ones usually, and that's not much interesting.

Meh, so for now, no report sending.

@freakazoid @dansup well, #ActivityPub - just like #XMPP & #SMTP + #IMAP - #eMail is an #open, #MultiVendor / #MultiProvider standard and thus jist like with #Webservers, #Browsers, #Mailservers & -Clients, #Mastodon not only can but will be superseded by better alternatives over time...

Just like #Linux overtook #Minix and why #FreeBSD is sometimes being used instead of #Linux and why we'll see #Windows dying a slow and painful death...

https://mstdn.social/@kkarhan/110330778109678586

I have had a couple of incidents recently of important customer communications not getting through in part because said customers' SPF records were not correctly set up.

In both cases, the blocked emails were from a mail solution/service that was not listed in the customer's SPF networks/includes – and the SPF record ended with a dash-all (ie: hard fail for others). It boggles my mind that admins aren't setting up these records correctly in 2022.

If you administrate a mailsystem, I urge you to read up on SPF. It is an essential part of your mail domain's validation and reputation and is relatively easy to set up. #SPF #mailservers

https://support.google.com/a/answer/10683907