How to receive e-mail alerts from internal devices
-
-
Setting up a Postfix relay. I need to rewrite this as I took the blog down.
Note: this works for O365 also if you setup your public IP as a connectoer in Office 365.
-
@jaredbusch said in How to receive e-mail alerts from internal devices:
@zachary715 said in How to receive e-mail alerts from internal devices:
Well this is part of my initial question is DO I NEED IT TO RELAY TO OFFICE365 AT ALL if it'll all be internal devices? You could make the argument I guess that eventually there may be an external device I wanted to use this for so set it up this way, but this is what I'm trying to uncover. Complete noob here.
How is the email "internal"? Do you have a local email server hosting email?
I do not think you even understand what you are asking here.Yeah good point. It has to go external since I'm using Office 365. My point though was simply do I need to relay to Office 365 to get what I need, or is a simple postfix server sufficient? I have my first device setup and working fine the way I intended. Not sure if other devices will cooperate as easy or not.
Is there a security or other reason to not set it up this way? Are there any benefits to running the relay through Office 365? All questions I have to better wrap my head around this.
-
@jaredbusch said in How to receive e-mail alerts from internal devices:
Setting up a Postfix relay. I need to rewrite this as I took the blog down.
Note: this works for O365 also if you setup your public IP as a connectoer in Office 365.
Yeah I actually saw that thread but as you stated, the blog was down so I just started a new thread to discuss it. I wanted to know more than "How to setup with Office365" though to understand why that was needed at all. Obviously will be very helpful though if I get to needing it so thanks for sharing.
-
@zachary715 said in How to receive e-mail alerts from internal devices:
@jaredbusch said in How to receive e-mail alerts from internal devices:
@zachary715 said in How to receive e-mail alerts from internal devices:
Well this is part of my initial question is DO I NEED IT TO RELAY TO OFFICE365 AT ALL if it'll all be internal devices? You could make the argument I guess that eventually there may be an external device I wanted to use this for so set it up this way, but this is what I'm trying to uncover. Complete noob here.
How is the email "internal"? Do you have a local email server hosting email?
I do not think you even understand what you are asking here.Yeah good point. It has to go external since I'm using Office 365. My point though was simply do I need to relay to Office 365 to get what I need, or is a simple postfix server sufficient?
You have to SEND to O365 always. You have no local mail server to send to. It is not necessarily a "relay". It can just send to anyone, your own MX included.
-
@jaredbusch said in How to receive e-mail alerts from internal devices:
@zachary715 said in How to receive e-mail alerts from internal devices:
@jaredbusch said in How to receive e-mail alerts from internal devices:
@zachary715 said in How to receive e-mail alerts from internal devices:
Well this is part of my initial question is DO I NEED IT TO RELAY TO OFFICE365 AT ALL if it'll all be internal devices? You could make the argument I guess that eventually there may be an external device I wanted to use this for so set it up this way, but this is what I'm trying to uncover. Complete noob here.
How is the email "internal"? Do you have a local email server hosting email?
I do not think you even understand what you are asking here.Yeah good point. It has to go external since I'm using Office 365. My point though was simply do I need to relay to Office 365 to get what I need, or is a simple postfix server sufficient?
You have to SEND to O365 always. You have no local mail server to send to. It is not necessarily a "relay". It can just send to anyone, your own MX included.
I understand what you're saying. Step Q of your guide is what I've skipped thus far and I'm trying to determine if/when it's needed. I haven't connected this postfix server to any SMTP connectors with Office365. As far as Office 365 is concerned, this postfix server doesn't exist and isn't interacting, other than when it sends email to one of its recipients.
In what scenario would I need/want to connect the postfix server to an SMTP connector with Office 365? What functionality, security, or otherwise do I gain?
-
@tim_g said in How to receive e-mail alerts from internal devices:
@zachary715 said in How to receive e-mail alerts from internal devices:
@black3dynamite said in How to receive e-mail alerts from internal devices:
To have postfix relay to Office 365, you would need to setup postfix to use TLS.
If you are using Fedora make sure you have these packages installed:
sudo dnf -y install postfix cyrus-sasl cyrus-sasl-plain mailxInstalling
cyrus-saslandcyrus-sasl-plainis needed if you want to configure postfix to use TLS.Start at the section where it talks about configuring postfix to use TLS.
https://gordan.jandreoski.me/how-to-configure-postfix-relay-to-office365-on-ubuntu-14-04/Well this is part of my initial question is DO I NEED IT TO RELAY TO OFFICE365 AT ALL if it'll all be internal devices? You could make the argument I guess that eventually there may be an external device I wanted to use this for so set it up this way, but this is what I'm trying to uncover. Complete noob here.
You don't need a relay if whatever is sending alerts/emails does full authentication by itself. The problem is that many things do not, and many do not even do authentication at all and just have a spot for server and port only.
Ahh so I skipped over this. The device I'm sending from now doesn't require authentication, although it is available. I have skipped it. Should I desire authentication for security reasons? Are there other devices I'll likely run into which will require authentication, therefore requiring me to connect to Office365?
-
@zachary715 said in How to receive e-mail alerts from internal devices:
@tim_g said in How to receive e-mail alerts from internal devices:
@zachary715 said in How to receive e-mail alerts from internal devices:
@black3dynamite said in How to receive e-mail alerts from internal devices:
To have postfix relay to Office 365, you would need to setup postfix to use TLS.
If you are using Fedora make sure you have these packages installed:
sudo dnf -y install postfix cyrus-sasl cyrus-sasl-plain mailxInstalling
cyrus-saslandcyrus-sasl-plainis needed if you want to configure postfix to use TLS.Start at the section where it talks about configuring postfix to use TLS.
https://gordan.jandreoski.me/how-to-configure-postfix-relay-to-office365-on-ubuntu-14-04/Well this is part of my initial question is DO I NEED IT TO RELAY TO OFFICE365 AT ALL if it'll all be internal devices? You could make the argument I guess that eventually there may be an external device I wanted to use this for so set it up this way, but this is what I'm trying to uncover. Complete noob here.
You don't need a relay if whatever is sending alerts/emails does full authentication by itself. The problem is that many things do not, and many do not even do authentication at all and just have a spot for server and port only.
Ahh so I skipped over this. The device I'm sending from now doesn't require authentication, although it is available. I have skipped it. Should I desire authentication for security reasons? Are there other devices I'll likely run into which will require authentication, therefore requiring me to connect to Office365?
Well you can send an email to whoever you want without authentication.
The issue is "sending as".
For example, you cannot send an email to someone using my O365 email address (spoofing) because most mail services check for that. Also, in order to send as a legit O365 email address, you would of course need to authenticate through O365. (smtp authentication)
That's why you can send an email to yourself from "[email protected]"..., but you can't send it legitimately as an O365 email.
It really depends on your email settings. Microsoft or Google may not accept an email like that unless you allow that sender first.
I use an O365 relay because we have a lot of notifications that go out from different softwares and systems that need to use legitimate emails to send as, and to be received by a lot of different people over different email services. So everything needs to be officially sent via O365.
-
@tim_g said in How to receive e-mail alerts from internal devices:
For example, you cannot send an email to someone using my O365 email address (spoofing) because most mail services check for that.
This is totally not true. I can 100% send as you and it will go through almost everywhere. Very few places spam things on SPF rules.
@tim_g said in How to receive e-mail alerts from internal devices:
Also, in order to send as a legit O365 email address, you would of course need to authenticate through O365. (smtp authentication)
Also not true.
-
@tim_g said in How to receive e-mail alerts from internal devices:
It really depends on your email settings. Microsoft or Google may not accept an email like that unless you allow that sender first.
We tested this back a few months ago, and I was perfectly able to send mail to my Gmail account from a different gmail account from postfix system with zero authentication and no spam marking.
-
@jaredbusch said in How to receive e-mail alerts from internal devices:
@tim_g said in How to receive e-mail alerts from internal devices:
For example, you cannot send an email to someone using my O365 email address (spoofing) because most mail services check for that.
This is totally not true. I can 100% send as you and it will go through almost everywhere. Very few places spam things on SPF rules.
@tim_g said in How to receive e-mail alerts from internal devices:
Also, in order to send as a legit O365 email address, you would of course need to authenticate through O365. (smtp authentication)
Also not true.
Send an email to my outlook.com email from my google.com email.
I'll PM you the addresses.
Will you?
-
@tim_g said in How to receive e-mail alerts from internal devices:
@jaredbusch said in How to receive e-mail alerts from internal devices:
@tim_g said in How to receive e-mail alerts from internal devices:
For example, you cannot send an email to someone using my O365 email address (spoofing) because most mail services check for that.
This is totally not true. I can 100% send as you and it will go through almost everywhere. Very few places spam things on SPF rules.
@tim_g said in How to receive e-mail alerts from internal devices:
Also, in order to send as a legit O365 email address, you would of course need to authenticate through O365. (smtp authentication)
Also not true.
Send an email to my outlook.com email from my google.com email.
I'll PM you the addresses.
Will you?
I no longer have that system set up.
This was discussed in a thread about dnf-automatic and how it sends mail.
-
@jaredbusch said in How to receive e-mail alerts from internal devices:
@tim_g said in How to receive e-mail alerts from internal devices:
@jaredbusch said in How to receive e-mail alerts from internal devices:
@tim_g said in How to receive e-mail alerts from internal devices:
For example, you cannot send an email to someone using my O365 email address (spoofing) because most mail services check for that.
This is totally not true. I can 100% send as you and it will go through almost everywhere. Very few places spam things on SPF rules.
@tim_g said in How to receive e-mail alerts from internal devices:
Also, in order to send as a legit O365 email address, you would of course need to authenticate through O365. (smtp authentication)
Also not true.
Send an email to my outlook.com email from my google.com email.
I'll PM you the addresses.
Will you?
I no longer have that system set up.
This was discussed in a thread about dnf-automatic and how it sends mail.
Yes I kinda remember it, but I must still not understand it.
At my company, we've tackled, in the past, email spoofing. So I do know it's possible to make it look like an email is coming from an email address that it's not actually coming from.
This no longer happens through O365. So, as a made up example, a CFO is no longer getting money transfer company email requests (via O365 email) from the CEO.
-
So what I"m thinking, is that unless the outgoing email server is a trusted server, O365 won't allow it into it's system to be delivered to my email.
I can send an email from [email protected], to [email protected], because the email is coming from a trusted gmail server.
But if i set up some outgoing email server myself, and try to send an email from [email protected] to [email protected], I believe O365 will not let it through.
This is the point I was trying to make.
-
@tim_g said in How to receive e-mail alerts from internal devices:
At my company, we've tackled, in the past, email spoofing. So I do know it's possible to make it look like an email is coming from an email address that it's not actually coming from.
Ah, I think that I see your confusion. You can easily generate an email that is not one email pretending to be from another address. It is simply "from" your address. The only technical thing that can be keyed on is the sending server not being your server. But this is not a restriction that email is designed to handle except with SPF.
@tim_g said in How to receive e-mail alerts from internal devices:
This no longer happens through O365. So, as a made up example, a CFO is no longer getting money transfer company email requests (via O365 email) from the CEO.
Correct, you can implement stricter controls, but they are not default, and most places to not have them. Generally SPF records are set to soft fail which increases the recipient systems chance to add it to SPAM, but only increases the chance.
Even if you set SPF to hard fail, many system never check it. So it would have no affect on the recipient.
In your case, with inbound email, you have restricted it beyond SPF by telling that system that, unless an email from one of your domains to one of your domains was authenticated, it will be killed.
-
@tim_g said in How to receive e-mail alerts from internal devices:
So what I"m thinking, is that unless the outgoing email server is a trusted server, O365 won't allow it into it's system to be delivered to my email.
This is impossible, well not technically impossible, but would never be implemented. How are you defining trusted? SPF? See my above reply. Because what if I have no SPF record and I have internal Exchange at my Jared's Fucking Consulting Services? Are you saying that you will not receive my email?
But if i set up some outgoing email server myself, and try to send an email from [email protected] to [email protected], I believe O365 will not let it through.
I do not recall what services were tested other than Gmail, but yes, it will.
Your work domain will not because you have specifically told it to use SPF I assume.
This is a different issue than someone trying to send form a company email to a company email.
-
@jaredbusch said in How to receive e-mail alerts from internal devices:
@tim_g said in How to receive e-mail alerts from internal devices:
So what I"m thinking, is that unless the outgoing email server is a trusted server, O365 won't allow it into it's system to be delivered to my email.
This is impossible, well not technically impossible, but would never be implemented. How are you defining trusted? SPF? See my above reply. Because what if I have no SPF record and I have internal Exchange at my Jared's Fucking Consulting Services? Are you saying that you will not receive my email?
But if i set up some outgoing email server myself, and try to send an email from [email protected] to [email protected], I believe O365 will not let it through.
I do not recall what services were tested other than Gmail, but yes, it will.
Your work domain will not because you have specifically told it to use SPF I assume.
This is a different issue than someone trying to send form a company email to a company email.
Okay I think I understand now.
It's different for me because I am specifically taking steps to block emails whose "from address" is not from a verified server... meaning if someone sends an email from [email protected], it will be blocked unless it actually came from a gmail.com email server?
-
@tim_g said in How to receive e-mail alerts from internal devices:
@jaredbusch said in How to receive e-mail alerts from internal devices:
@tim_g said in How to receive e-mail alerts from internal devices:
So what I"m thinking, is that unless the outgoing email server is a trusted server, O365 won't allow it into it's system to be delivered to my email.
This is impossible, well not technically impossible, but would never be implemented. How are you defining trusted? SPF? See my above reply. Because what if I have no SPF record and I have internal Exchange at my Jared's Fucking Consulting Services? Are you saying that you will not receive my email?
But if i set up some outgoing email server myself, and try to send an email from [email protected] to [email protected], I believe O365 will not let it through.
I do not recall what services were tested other than Gmail, but yes, it will.
Your work domain will not because you have specifically told it to use SPF I assume.
This is a different issue than someone trying to send form a company email to a company email.
Okay I think I understand now.
It's different for me because I am specifically taking steps to block emails whose "from address" is not from a verified server... meaning if someone sends an email from [email protected], it will be blocked unless it actually came from a gmail.com email server?
Assuming that gmail.com is actually companydomain.com, yes you are correct.
-
Yes we have our SPF record setup that if I try to send these alerts via [email protected], it will get blocked. I don't require it to be from my domain though at this time. I'm perfectly satisfied with it being from internaldomain.local just as long as I get the reports I need.
-
@zachary715 said in How to receive e-mail alerts from internal devices:
Yes we have our SPF record setup that if I try to send these alerts via [email protected], it will get blocked. I don't require it to be from my domain though at this time. I'm perfectly satisfied with it being from internaldomain.local just as long as I get the reports I need.
Yeah then you won't need any authentication.
