" smtp Archives - LuxSci

Posts Tagged ‘smtp’

Are Cloud Servers Bad for Sending Email?

Tuesday, July 27th, 2021

Public cloud servers are great for many things; however, sending email is not one of them.

cloud servers bad sending email

Why Cloud Servers are Bad for Sending Email?

The main issue with public cloud based services is that you are sharing resources with their other customers. This includes IP addresses. Most organizations try to filter out bad IPs, but when joining a new service there is a chance you could be assigned an IP with a poor reputation.

The IP address spaces used by the major public cloud vendors (i.e. Amazon, Rackspace, etc.) for their cloud servers are well known and are generally black- or gray-listed by anti-spam systems. This can slow or altogether stop emails sent from those IPs to getting to inboxes. Additionally, many of the IP addresses in use by these systems are flagged from previous abusive use by spammers. When setting up a new cloud server, you could be easily assigned one of these flagged IP addresses. Even if you do not inherit a bad IP reputation from the previous user(s), your server will be listed as a public cloud IP address. As a result, it may suffer from the “bad neighborhood effect” and thus considered a possible spam source.

We have investigated several services that claim to offer “Cloud-Based Outbound Email” and have found that many use cloud servers for things like scanning email messages for spam and viruses, but use non-public cloud servers for the actual sending of email. This is obviously not true for all companies, but if everyone might be affected, the solution is to NOT send email directly from your public cloud. There are, however, straight-forward solutions to getting email originating from such servers delivered.

How Did Cloud Servers get a Bad Email Reputation?

The “utility computing” model of the cloud is to blame. In the interest of making these services as cheap as possible, there are generally very few services included. In particular, you get 1) minimal customer support, 2) little pre-sales work, and 3) minimal, if any, validation of new customers. All that time would increase prices. As a result, it is easy for a spammer to signup with a name and credit card. To start sending spam, all they need to do is agree to “terms and conditions” by checking a box. (How much do spammers care about that?)

Spammers and fraudsters take advantage of this simple workflow to setup servers for sending spam or performing other abusive actions. They do not care if they get shutdown fairly quickly because:

  • They are using stolen credentials and payment information,
  • It is so easy to setup a basic cloud server, that there is not much time lost, and
  • Even if they get shut down “fairly quickly,” they have still sent some of their spam, etc.

Once they get shut down, spammers choose another public cloud provider and use another stolen identity to do it again. They can even automate this signup process by using the available APIs for these services.

The above scenario contributes to the pollution of the reputation of IP addresses and the public cloud servers in general.

Why Private Cloud Servers Are Better for Sending Email

With physical dedicated and managed servers and private clouds, you typically interact with a sales representative, sign a contract, and undergo some level of validation (even if that happens behind the scenes). The time it takes to sign up blocks most spammers who use these services and  keeps these IP address spaces much cleaner. The more validation and attention that is offered by a sales staff before signing up their customers, the cleaner the IPs are.

If you are sending large quantities of important email from a cloud server, consider using LuxSci Secure High Volume Email Sending to avoid the risk of your emails getting blocked by spam filtering services. Using a trusted private provider will mitigate the bad neighborhood effect and significantly increase the deliverability of your email. Unlike in a public cloud, you can add additional dedicated resources to ramp up throughput for business critical emails.

Are Replies to my HIPAA-Compliant Secure Emails also Secure?

Friday, June 18th, 2021

Sending HIPAA-compliant secure emails is easy- LuxSci’s services allow you to send secure emails to anyone with an active email address. One common question is whether the replies back to these messages will also be HIPAA compliant. This is especially a concern when customers choose to use TLS only a a secure means of email delivery.

In this article we will break down the various ways that messages are sent securely from LuxSci to recipients across the Internet, and how replies behave — and whether they are secure and compliant. At the end, we provide some recommendations for best practices for maximizing data security.

Read the rest of this post »

How do I fix the reputation of my IP address?

Tuesday, May 11th, 2021

It happens — you’re sending email messages without issue, and then suddenly emails are not being delivered, or they’re being flagged as spam. A little digging reveals that the problem is that your “IP reputation” is poor, and you need to fix it somehow.

improve reputation ip address

Read the rest of this post »

Opportunistic TLS for SMTP

Tuesday, December 15th, 2020

If you want to make sure your emails are secure and private, opportunistic TLS for SMTP won’t quite cut it. To explain why, first we have to step back a bit.

Most people don’t put a lot of thought into how their emails are sent and received, so it’s not unusual for them to think it works akin to teleportation or magic–that messages somehow just appear right in their inboxes.

While the rapid delivery speeds may seem to justify such presumptions, there are actually a bunch of steps under the hood. When you send an email, it uses a protocol called the Simple Mail Transfer Protocol (SMTP) to make its way through to your recipient’s server. From there, your recipient uses another protocol such as ActiveSync, POP3, MAPI, or IMAP, or a Web-based interface, to pick it up and read it.

Opportunistic TLS

Unfortunately, these aren’t always secure by default. Under its original design, emails are sent as plaintext. This means that anyone along the email’s journey can see (and even change) their contents. This can include those in charge of the servers, the government, and even hackers that intercept the data.

Thankfully, engineers weren’t completely oblivious to this glaring security hole, and they have introduced a number of mechanisms that can be leveraged to protect email.

Read the rest of this post »

HIPAA-compliant Email Host or SMTP Connector?

Tuesday, July 28th, 2020

choosing hipaa compliant email

You may have heard that you need to use HIPAA-compliant email to protect your organization’s ePHI, but many people aren’t sure where to go from there. Don’t worry if you fall into this camp, because this article will explain your options in depth.

The most straightforward solution is to simply sign up for a HIPAA-compliant email host. These are providers who specifically design their email services to be compliant with HIPAA regulations. A good example is LuxSci’s Secure Email.

If you currently use tools like Google Workspace or Microsoft Office 365 for your email, you might be looking for ways that you can adapt them for HIPAA compliance. The good news is that this is possible with an outbound encryption tool like our HIPAA-compliant SMTP connector.

Some organizations may pursue this option because they need certain features that these programs offer, while others may be hesitant to introduce new software and have to train their employees to use it.

Why Do You Need a HIPAA-compliant SMTP Connector for Google Workspace, Microsoft Office & Other Services?

These services aren’t designed to be HIPAA-compliant. Tools like Google Workspace, Microsoft Office 365, and Microsoft Exchange are designed for the mass market, so HIPAA compliance and security were not significant factors during their development.

This means that they are unsuitable for protecting ePHI straight out of the box. In the case of Google Workspace, it lacks a HIPAA-compliant email encryption solution. Microsoft does have one, but it is difficult to configure. A solution like LuxSci’s Secure SMTP Connector hooks up to your existing email service, bridging the gap to make your outbound email secure and HIPAA-compliant.

LuxSci Secure Connector

LuxSci Secure Connector

 

HIPAA-compliant SMTP connectors can also help you send emails if your internet service provider prevents or limits your outbound mail server from sending messages. On top of this, they can also add SMTP authentication to your outbound email system, as well as offer encryption and archival mechanisms. SMTP servers can also assist you in adapting your existing mail service in a variety of other ways.

Should You Use a HIPAA-compliant Email Host or an SMTP Connector?

Every organization will come to its own conclusion, based on the factors that matter most in its unique situation. If your main concern is making your company’s HIPAA compliance as easy as possible, then a HIPAA-compliant email host is probably your best option.

These are developed with the regulations in mind, and are designed to make compliance simple, with configuration options that suit a range of scenarios. With a HIPAA-compliant email host, you are less likely to misconfigure it and accidentally expose ePHI. 

LuxSci’s HIPAA-compliant email is designed to offer you a high level of performance and functionality, without having to constantly worry about regulatory headaches.

In contrast, some organizations aren’t in a position where they are ready to switch to a new email host. If they rely on certain software features in Google Workspace or Microsoft Office 365, it’s best for them to deploy LuxSci’s secure connector so that they can protect their outbound email sending.

Setting up and maintaining HIPAA compliance may be more complicated if they pursue this option, but it’s still a better choice than completely disregarding their regulatory obligations.

LUXSCI