I am trying to send email through OpenSSL as below :  Client &gt; openssl s_client -crlf -connect smtp.mail.yahoo.com:465 SERVER &gt; 220 smtp.mail.yahoo.com ESMTP ready Client &gt; HELO localhost SERVER &gt; 250 smtp.mail.yahoo.com Client &gt; auth login SERVER &gt; 334 VXNlcm5hbWU6 Client &gt; aC5rYW1yYXZh SERVER &gt; 334 UGFzc3dvcmQ6 Client &gt; bXlQYXNz // It's not my real password :) SERVER &gt; 235 2.0.0 OK Client &gt; MAIL FROM: &lt;h.kamix@yahoo.com&gt; SERVER &gt; 250 OK , completed Client &gt; rcpt to: &lt;h.kamix1@gmail.com&gt; SERVER &gt; 250 OK , completed Client &gt; data SERVER &gt; 354 Start Mail. End with CRLF.CRLF Client &gt; subject: Test title Client &gt; Hello this is a test email. Client &gt; . Client &gt;  SERVER &gt; 250 OK , completed Client &gt; quit SERVER &gt; 221 Service Closing transmission SERVER &gt; closed   Everything looks fine, but it doesn't send any email and gets me Service Closing transmission error at the last step!   I think it's clear enough.  Please tell me what am I missing here?
1429
This is a  about how to handle email sent from your server being misclassified as spam.  For additional information you may find these similar questions helpful:                    Sometimes I want to send newsletters to my customers. The problem is, that some of the emails get caught as spam messages. Mostly by Outlook at the client (even in my own Outlook 2007).  Now I want to know what should be done to create "good" emails. I know about reverse lookup etc., but (for example), what about a unsubscribe link with an unique ID?  Does that increase a spam rating?
2204
This is a  about understanding and remediating the Heartbleed security issue.   What exactly is CVE-2014-0160 AKA "Heartbleed"? What is the cause, what OSs and versions of OpenSSL are vulnerable, what are the symptoms, are there any methods to detect a successful exploit?   How can I check to see if my system is affected? How can this vulnerability be mitigated? Should I be concerned that my keys or other private data have been compromised? What other side effects should I be concerned about?
63310
This is a follow up to another question I had, but its quite different so I thought I'd start a new post.    I'm trying to work out why I still get this error message when adding an email account (in this case, in Thunderbird - but I also get the problem on phones as well);    The weird thing is that if I check it on SSL-Tools.net, it looks fine:    I really don't get it - as Thunderbird shows me my certificate is expired here:    Am I missing something? Please let me know if you need any more information to help me debug. I'm not sure what would be helpful.
60544
On webmail every user gets error "ERROR: Message not sent. Server replied: 354" while sending mails.   But mails are sent properly and reaches properly.  Can you tell me where is problem, and why it is occurred?  UPDATE: I found in some resources that this is not an error but standard information message. On the other side, it's annoying. Can you tell me if it is a true, and if it is how can I avoid it?
34796
I have 4 servers. prod1.example.com, prod2.example.com, dev1.example.com, and dev2.example.com. They all send their mails to smtp.example.com. This server does the relay. Now I want that dev1 and dev2 send all their e-mails to devbox@example.com except for the e-mails that are sent to admin@example.com. The e-mails from prod1 and prod2 are relayed without any restriction.  I read that in the access file you can define that a server must be handled by a filter instead of a simple RELAY (with FILTER foo:bar). I cannot find how and where I need to define this foo (transport) and bar (destination). Al these different parameters confuse me. Also in what order are the different files handled?  Can anybody help me out?
95342
I'm trying to check if I running the latest OpenSSL version, my main concern is the heartbleed bug.  I tried 2 commands:   openssl version yum info openssl    openssl version output     OpenSSL 1.0.1e-fips 11 Feb 2013     yum info openssl output     Installed Packages      Name        : openssl      Arch        : x86_64      Version     : 1.0.1e      Release     : 16.el6_5.14      ...      I have a couple of questions:   Why do I get different versions from these 2 commands? How do I check the heartbleed vulnerability without having the 443 port open?
18425
I've set up proftpd to use ssl/tls. Trying to connect I get an 'Illegal PORT command'  Finding Host xxx.nl ... Connecting to xxx.xxx.xxx.xxx:21 Connected to xxx.xxx.xxx.xxx:21 in 0.018001 seconds, Waiting for Server  Response Initializing SSL Session ... 220 FTP Server ready. AUTH TLS 234 AUTH TLS successful SSL session NOT set for reuse SSL Session Started. Host type (1): AUTO USER xxx 331 Password required for xxx PASS (hidden) 230 User xxx logged in SYST 215 UNIX Type: L8 Host type (2): Unix (Standard) PBSZ 0 200 PBSZ 0 successful PROT P 200 Protection set to Private PWD 257 "/" is the current directory CWD /var/www/html/ 250 CWD command successful PWD257 "/var/www/html/" is the current directory TYPE A 200 Type set to A PORT 192,168,192,14,211,181 500 Illegal PORT command Port failed 500 Illegal PORT command PASV 227 Entering Passive Mode (xxx,xxx,xxx,xxx,160,151). connecting data channel to xxx.xxx.xxx.xxx:160,151(41111) Failed to connect data channel to xxx.xxx.xxx.xxx:160,151(41111)   iptables:  Chain INPUT (policy ACCEPT) target     prot opt source               destination ACCEPT     icmp --  anywhere             anywhere            /* 000 accept all icmp */ ACCEPT     all  --  anywhere             anywhere            /* 001 accept all to lo interface */ REJECT     all  --  anywhere             loopback/8          /* 002 reject local traffic not on loopback interface */ reject-with icmp-port-unreachable ACCEPT     all  --  anywhere             anywhere            /* 003 accept all to eth1 interface */ ACCEPT     all  --  anywhere             anywhere            /* 004 accept related established rules */ state RELATED,ESTABLISHED ACCEPT     tcp  --  anywhere             anywhere            multiport ports ftp /* 021 allow ftp. */ ACCEPT     tcp  --  anywhere             anywhere            multiport ports ssh /* 022 allow ssh. */ ACCEPT     tcp  --  anywhere             anywhere            multiport ports smtp /* 025 allow smtp. */ ACCEPT     tcp  --  anywhere             anywhere            multiport ports pharos /* 051 allow rundeck. */ ACCEPT     tcp  --  anywhere             anywhere            multiport ports 8140 /* 814 allow puppetserver. */ ACCEPT     tcp  --  anywhere             anywhere            multiport ports http /* 080 allow http. */ ACCEPT     tcp  --  anywhere             anywhere            multiport ports https /* 443 allow https. */ DROP       all  --  anywhere             anywhere            /* 999 drop all */  Chain FORWARD (policy ACCEPT) target     prot opt source               destination  Chain OUTPUT (policy ACCEPT) target     prot opt source               destination   Connecting via normal ftp works just fine...  I'm using WS_FTP with ftp-authssl//xxx.nl/.... I tried several other connection options, ports, etc. But all give the same error. Althoiugh it seems that sometimes a first directory listing is shown (but that might be caching of WS_FTP)
96398
Im an intermediate Linux user and got assigned the task to make Apache run https connections. Currently running centOS 6 and my problem is following:  installed mod_ssl and tried to set up  paths correctly but not sure if i used the right files. I have class2-root.crt and root-2-int.cer also i was given a wildcard.ssl.pfx. i have realized that there is a variable that has to point to ".key" file which i don't have. So generated that using:  openssl req -new -keyout server.key -out server.csr  there are plenty of sources showing how to do this online and tried many times but no luck. I just need someone who would help according to my case to tell me what files i only need to touch and configure. Also if the key has to be from the same source as the certs i have? and what certs i need from what i was given?  what i did exactly is this in httpd.conf:  &lt;VirtualHost *:443&gt; DocumentRoot /var/www/html ServerName MyServer_Ip_Adress SSLEngine on SSLCertificateFile /etc/ssl/crt/class-root.crt SSLCertificateKeyFile /etc/ssl/crt/server.key SSLCertificateChainFile /etc/ssl/crt/root-2int.cer &lt;/VirtualHost&gt;   after this couldn't stop Apache nor restart it. Stopping will always fail.
100493
When I try to Curl a SSL page on my ubuntu 12.04 TLS server, it won't work:  not ssl page:  $ curl https://evernote.com/ -vv [the entire webpage]   ssl page:  $ curl https://evernote.com/ -vv * About to connect() to evernote.com port 443 (#0) *   Trying 204.154.94.73... connected * successfully set certificate verify locations: *   CAfile: none   CApath: /etc/ssl/certs * SSLv3, TLS handshake, Client hello (1): * Unknown SSL protocol error in connection to evernote.com:443  * Closing connection #0 curl: (35) Unknown SSL protocol error in connection to evernote.com:443    This does work on my own machine (OS X).  When I try it via openSSL:  $ openssl s_client -connect evernote.com:433 connect: Connection timed out connect:errno=110   openSSL version:  $ openssl version OpenSSL 1.0.1c 10 May 2012
56632
I've got a Postfix mail server setup for hosting multiple virtual domains (say xxx.com and yyy.com).  Users configure their outgoing mail server as mail.xxx.com and mail.yyy.com. All mail servers refer to the same physical Postfix server (same IP, single instance of Postfix running on this Linux server).  Which SSL certificate do I need for Postfix smtpd_tls_cert_file configuration option?  Or do I have to use a single certificate for mail.xxx.com and tell users of yyy.com to use mail.xxx.com as their outgoing server? This would break the illusion of separate virtual servers.  [Note: the domains are completely separate. These are not multiple subdomains sharing a common root].
32527
We run an e-mail server for a few customers, and we've recently run into a bit of a conundrum.  We had a user who sent an e-mail to an incorrect e-mail address. The incorrectly specified domain unfortunately existed. It did not have MX records, and the A record of the domain went to a server which did not speak SMTP. Therefore, the e-mail server attempted delivery and did not succeed because no e-mail server was running.  For that reason, our e-mail server, entirely in accordance with the SMTP RFC, attempted re-delivery over the course of five days and finally gave up and sent a notice to the sender after 5 days of unsuccessful delivery.   says:     Retries continue until the message is transmitted or the sender gives up; the give-up time generally needs to be at least 4-5 days.   Therefore, the mail server in its default configuration, in this case has operated in accordance with the RFC, meaning that a user specifying the wrong e-mail address in this case would not receive notice of that except five days later.  At this point, my boss has asked whether it would be possible to reduce the give-up time to something shorter, say 1 day. His reasoning is that it is better that the user be notified earlier of non-delivery, and that the user may attempt re-delivery at a later date, or delivery through an alternate channel. It sounds like a reasonable thing to do, but in general I'm wary of performing any kind of configuration changes which contradict what's in the RFC.  Is there any non-obvious reason why it would be a bad idea to reduce the give-up time to 24 hours, beyond just saying "the RFC says otherwise"?  Also, what do the bigger e-mail providers out there (the Googles, Microsofts, AOLs and Yahoos) do in this scenario?
93823
Say you own a abcd.com and you only want to use it to send and receive email via bob@abcd.com. You don't want to provide any kind of website.  Can you set up the DNS records to include an "MX" record and no "A" record?   Is this enough for sending and receiving email to work? Is this valid in terms of whatever standard defines these things?     Edit: To clarify, the mail server (terminology?) would not be hosted on abcd.com or *.abcd.com
104008
Here is the problem: From any IP address not belonging to your mail server:  telnet me.myemailserver.com 25    helo me.someserver.com mail from: &lt;yourusername@mydomain.com&gt; rcpt to: &lt;yourusername@mydomain.com&gt; data This is spam.  Buy my stuff. .   I'm using Postfix.  I'm having a problem finding a solution to requiring SMTP-AUTH for email claiming to be from mydomain.com.  Googling around, this guy has identified the same problem (where I cut-n-paste with some modifications) the above example from:   This link   gets close to a solution but it has a side effect of requiring SMTP-AUTH for mail not from mydomain.com.  For mail not claiming to be from mydomain.com, I would do the usual RBL and Spam filtering.  In short, I want to reject mail to local domains (mydomain.com) from outside/unauthenticated clients claiming to be from local domains (mydomain.com).  This is what I tried: I've tried both permit and reject as the default.  Here is exact excerpt from my main.cf:  smtpd_recipient_restrictions = reject_unauth_pipelining,                            permit_sasl_authenticated,                            check_recipient_access pgsql:/etc/postfix/pgsql-recipient.cf,                            reject_unauthenticated_sender_login_mismatch,                            reject_unauth_destination,                            reject_unlisted_recipient,                            check_sender_access pgsql:/etc/postfix/pgsql-sender.cf,                            reject_unlisted_sender,                            reject_invalid_hostname,                            reject_non_fqdn_hostname,                            reject_non_fqdn_sender,                            reject_non_fqdn_recipient,                            reject_unknown_sender_domain,                            reject_unknown_recipient_domain,                            reject_rbl_client cbl.abuseat.org,                            reject_rbl_client sbl.spamhaus.org,                            reject_rbl_client sbl-xbl.spamhaus.org,                            reject_rbl_client bl.spamcop.net,                            reject_rbl_client dnsbl.njabl.org,                            reject_rbl_client blackholes.wirehub.net,                            reject_rbl_client relays.mail-abuse.org,                            reject_rbl_client dialups.mail-abuse.org,                            reject_rbl_client blackholes.mail-abuse.org,                            reject_rhsbl_sender dsn.rfc-ignorant.org,                            (reject and permit both tried here)
52698
I know that I can sign up to a service using user+foo@example.com, the question I have is how can I send an email from this same address?
72480
We have an AWS server running OpenVPN which was built using Ubuntu 13.10. After the announcement of the Heartbleed vulnerability, we updated the server. This morning, we upgraded the server to 14.04. The current output of "openssl version -a" is:  OpenSSL 1.0.1f 6 Jan 2014  built on: Mon Apr  7 21:22:23 UTC 2014  platform: debian-amd64  options:  bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx)   compiler: cc -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM OPENSSLDIR: "/usr/lib/ssl"   I verified the fact that the server is still vulnerable using the following:  :~$ openssl s_client -connect openvpn.example.com:443 -tlsextdebug 2&gt;&amp;1| grep 'server extension "heartbeat" (id=15)' || echo safe TLS server extension "heartbeat" (id=15), len=1   Attempts to run "sudo apt-get install openssl" return that the current version is already installed. What are the best options to resolve this issue? Does it appear there was a problem during distribution upgrade; i.e. is the 14.04 OpenSSL package actually outside the danger range? Or is there a possible issue with the repository itself?
35011
I got DKIM setup on my mail server (postfix and ubuntu) so it signs outgoing emails.  I used these instructions:   However, I need it to sign emails from any domain (in the From address) and not just my own.  I'm building an email newsletter service and clients will be sending their own email through the server.  First I set "Domain *" in /etc/dkim-filter.conf.  This got it to include the DKIM headers in all outgoing emails, no matter what the domain.  However, the verification check fails on gmail because it is checking the domain in the from address, and not my domain (and dns record).  Does anyone know how to do this?
53179
What in all actually is this PDF attachment doing with the newsletter?    I'm fairly confident that this also came from Stack Exchange, so would someone care to enlighten me as to what's going on?  I admit I'm rusty at reading mail headers, but the sources seem to line up just fine.  Delivered-To: --REDACTED-- Received: by 10.229.68.6 with SMTP id t6csp224071qci;         Fri, 20 Mar 2015 12:28:47 -0700 (PDT) X-Received: by 10.55.31.97 with SMTP id f94mr119580342qkf.10.1426879727323;         Fri, 20 Mar 2015 12:28:47 -0700 (PDT) Return-Path: &lt;do-not-reply@stackexchange.com&gt; Received: from mx-out.stackexchange.com (mx-out.stackexchange.com. [198.252.206.125])         by mx.google.com with ESMTPS id i90si5136899qge.83.2015.03.20.12.28.46         for &lt;--REDACTED--&gt;         (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);         Fri, 20 Mar 2015 12:28:47 -0700 (PDT) Received-SPF: pass (google.com: domain of do-not-reply@stackexchange.com designates 198.252.206.125 as permitted sender) client-ip=198.252.206.125; Authentication-Results: mx.google.com;        spf=pass (google.com: domain of do-not-reply@stackexchange.com designates 198.252.206.125 as permitted sender) smtp.mail=do-not-reply@stackexchange.com;        dkim=pass header.i=@stackexchange.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=stackexchange.com; s=dk;     h=Content-Type:Message-ID:Date:Subject:Reply-To:To:From:MIME-Version; bh=1OWPTURI/S9xuD+By0vS6qm84rNbZTEnVTBe0n3jV2Q=;     b=VEwIjIH/yuaj1DiAJMIuXOs8vPo1fhJOHhM7v9IWtvRozVyDnMzZBeFVsaAiUDSmsMrXb8sH3X0TU2a94KkuzByGyong8s4pRn6CridgSwOJuQ1OLhN/zSNiSu00rPENBxFhmiABN0PNx8m6S8OZHwMMPob6SzQUm5IK1JsjFxY=; Received: from [10.7.2.15] (helo=[10.7.2.101])     by mx-out.stackexchange.com with esmtp (Exim 4.72)     (envelope-from &lt;do-not-reply@stackexchange.com&gt;)     id 1YZ0VC-0006l0-SY     for --REDACTED--; Fri, 20 Mar 2015 17:14:30 +0000 MIME-Version: 1.0 X-Mailer: MailBee.NET 7.0.4.334 From: "Stack Exchange" &lt;do-not-reply@stackexchange.com&gt; To: --REDACTED-- Reply-To: do-not-reply@stackexchange.com Subject: Super User Weekly Newsletter - Friday, March 20, 2015 Date: Fri, 20 Mar 2015 17:14:30 +0000 Message-ID: &lt;2.9e47a33dae2ecd6e7599@NY-WEB01&gt; Content-Type: multipart/alternative;