How do I assign send access rights to a remote private queue for a machine which is on another domain?
Cross-forest MSMQ? You need to be trusting
"How do I send MSMQ messages between domains?"
Related
Honestly, I think I have a fundamental gap in understanding how SMTP works. I can't seem to find a good explanation of what is happening behind the scenes and I think this is preventing me from being able to do what I am attempting to do.
To explain, I'm trying to setup an application which sends notifications to users by connecting to an SMTP server. Fair enough. I figure, since I'm using my own domain, I have SPF/DKIM/DMARC configured, I can add an MX record for the host I set the application up on (my SPF record has the mx keyword to authorize any hosts in my MX records to send/receive mails). Then, I can have that same host run a super lightweight SMTP server that can accept mails from the application, and send them on to recipients.
Almost crucially, I want this server to basically just run on localhost so that only this application can connect and send mails through it, but so that it can't really "receive" mails sent to my domain (I have set the MX priority very low (well, a high number) for this app server). I figure since I'm running my own SMTP server, that I don't really need to authenticate against it (it's running on localhost), just take in any mail and send it on to recipient domains.
When sending on to recipient domains... does the SMTP server need to authenticate to say, the gmail SMTP server as a user in order to send mails over there? That seems weird, since it's not a user logging into gmail to send mails, it's an SMTP server that is authorized within SPF sending mail from my domain (From address from my domain as well) to where ever the app server user's email is based (in this example, the user would be e.g., some_user#gmail.com).
I tried using python's aiosmtpd command-line and telnet to send a mail from test#MY_DOMAIN.TLD to test#MY_DOMAIN.TLD and it didn't seem to deliver the message; I figured aiosmtpd would connect to the preferred MX servers for my domain (my "real" MX's) to transfer the message, which would then put it in my inbox. That didn't seem to be the case, and I'm not sure why.
Exact repro steps, where example.com is my domain, and terminals are running on a box with a hostname listed in my MX records.
Terminal A:
$ aiosmtpd -n
Terminal B:
$ telnet localhost 8025
EHLO <example.com>
MAIL FROM: test#example.com
RCPT TO: test#example.com
DATA
FROM: Application Notifications <test#example.com>
TO: User Name <test#example.com>
SUBJECT: App Notify Test
This is a test!
.
QUIT
How do SMTP servers normally send mail between each other? Do they each get some login to each other's SMTP servers to authenticate with, and since I'm not doing that, this is a problem? Can I run a SMTP server on localhost and have it send mail out of the network without receiving mails (a no-reply service)? Is there something obvious that I'm just missing here that solves all my problems?
Thanks
It sounds like you want to run a mail transfer agent (MTA) that relays email to remote SMTP servers. An MTA will typically act as an SMTP server to receive messages, and then it will act as an SMTP client when it relays the messages to remote hosts.
MTAs generally operate in two different modes: (1) They will relay messages from authenticated users to remote hosts, and (2) they will receive messages from remote hosts to its users and store them somehow. The combination of those two modes - where the MTA will accept messages from remote hosts and relay them to different remote hosts - is called an open relay and is sure to attract spammers and place your server on spam blacklists.
aiosmtpd is not an MTA or an email relay out of the box - it is merely an SMTP server that will receive messages and do whatever with the messages you program it to do. By default it will do nothing - that is, it will receive the messages and throw them away. If you want to implement an email relay in aiosmtpd, then you need to implement the SMTP client portion of the MTA, e.g. by implementing an aiosmtpd handler that instantiates smtplib.SMTP to connect to remote hosts.
However, if all you want is an email relay, then you most likely don't need aiosmtpd at all - postfix is probably a better choice.
aiosmtpd can be a good choice if you need to implement mailing list software or perform some automation tasks based on incoming emails from e.g. cameras or scanners.
If you want to implement an email relay in aiosmtpd, then you need to ensure that both the software and your server are configured in a way that you don't relay unauthenticated messages from the outside internet.
See also: Python aiosmtpd - what is missing for an Mail-Transfer-Agent (MTA)?
So, I actually figured out what was missing here.
I need to run an SMTP server, yes, but I also needed to write code to parse the "to" domain (the recipient domain), perform a DNS request for the MX server(s) of the recipient domain, and then use the smtplib client to then send mail over to the recipient domain. Authentication is not needed to relay that message to the recipient server, authentication is only required for reading from a given inbox or authenticating a sender to send on behalf of a domain (I trust myself and myself only to send mail). I can do all this while also only listening for mail on localhost so that only my local server can use the local SMTP server for relaying messages/emails off to recipient domains.
Additionally, I don't need to have my external IP listed as an MX server since it's not accepting mail for the domain, only sending. I do need an SPF record for it though so that it is an authorized relay/sender for email from my domain.
I am implementing TURN protocol for ICE. If the remote party sends its HOST,SERVER-REFLEXIVE and RELAYED-REFLEXIVE addresses in SDP ,should we create permissions to ALL(host,SERVER and RELAYED ) the remote candidates in the TURN server OR just to RELAYED-REFLEXIVE address ?
Thanks and Regards
I believe you need to set permissions for all known IP addresses of the remote host. The usual connectivity with TURN will be with the SERVER-REFLEXIVE address of the remote host.
From here.
While electronic mail servers and other mail transfer agents use SMTP to send and receive mail messages, user-level client mail applications typically only use SMTP for sending messages to a mail server for relaying. For receiving messages, client applications usually use either the Post Office Protocol (POP) or the Internet Message Access Protocol (IMAP) or a proprietary system (such as Microsoft Exchange or Lotus Notes/Domino) to access their mail box accounts on a mail server.
Why is that?
On that same page it talks about it.
SMTP vs mail retrieval
SMTP is a
delivery protocol only. It cannot pull
messages from a remote server on
demand. Other protocols, such as the
Post Office Protocol (POP) and the
Internet Message Access Protocol
(IMAP) are specifically designed for
retrieving messages and managing mail
boxes. However, SMTP has a feature to
initiate mail queue processing on a
remote server so that the requesting
system may receive any messages
destined for it (cf. Remote Message
Queue Starting). POP and IMAP are
preferred protocols when a user's
personal computer is only
intermittently powered up, or Internet
connectivity is only transient and
hosts cannot receive message during
off-line periods.
SMTP was designed for use with "always on" servers; most people do not leave their mail client running 24x7 and able to receive email at all times. More recently it became possible to use ETRN to instruct a remote server to try to deliver anything queued up for a client, but this is still not widely supported and in general doesn't work as well as client-side "pull" (or IMAP's fake-push IDLE extension).
There's an additional issue in that most servers send warnings to the original sender when delivery to the next server fails; this is a good thing for intra-server transfers but a bad thing for intermittently connected clients.
When you send messages to remote queue, a temporary outgoing queue is created on your own machine. Does this mean that if MSMQ is not installed on your own machine, you can't use remote queues?
You are correct. if MSMQ is not installed on your own machine, you can't use remote queues.
Yes. MSMQ is a transport protocol. Imagine having two machines but only one has TCP/IP installed. Same scenario.
I want to create a mail server, but my ISP does not allow reverse-IP record, so I ordered a VPS with such function. But I want use VPS only as a relaying server and my own server as an actual mail server (so it should have things like web-mail, and some other). I did not find any guides, but looks like VPS will be called a "smart-host". So I installed Axigen on my server, but it requires login and password for connecting to a smart-host. I tried to use postfix for relaying but I did non figure out how to properly configure it. What are my options?
Thank you!
To securely enable postfix as a mail forwarding server, you'll have to enable and configure SASL authentication. The postfix SASL README has all the details. I suggest dovecot as the backend, as it's the simplest to setup. After that, just create a new system user (adduser mail-forwarding) and configure Axigen to use that user for forwarding.
If I understand correctly, your goal is to forward outgoing mail from your local server to the VPS while incoming mail should be stored on the local server. This is possible, but not necessarily simple. Mail needs to be handled differently depending on how it reaches your local server, otherwise you might end up with a mail loop, with your servers playing pingping using mail sent back and forth.