99
« on: November 25, 2007, 07:08:30 pm »
I've recently had to put in place some new rules about automated email. A lot of you have forums or other scripts that use the xepher.net server to send out things like new topic notifcations or registration confirmations. The problem is that a lot of these aren't well checked for sanity. That is, bots drive by, attempting forum spam, and that results in a lot of undeliverable mail being sent out by your forums. This in turn gets the server blacklisted as a spam source. Currently, roadrunner is refusing all email from xepher.net because of this, and yahoo.co.uk has basically got us on notice. This is pretty much due to the actions of only one or two users here. As such, new rules are going into effect immidiately regarding this.
1. The sendmail binary is no longer accessable to users. That's the local program that sends mail. A lot of web scripts use it on the backend to generate mail. There's no way to easily secure it user-by-user.
2. Thus, all outgoing email MUST be sent via the SMTP server, just like the mail server wasn't local to the script. (Most forums have settings for this if you need it.)
3. Email will be allowed ONLY to local/xepher.net addresses (and any aliases you have on domains hosted here) unless SMTP authentication is done.
4. You can only authenticate with the email system if you actually use email here (that option is set up via user-services) and you have to use your username and password. The reason for this is that means rejected/failed email will be returned to YOU instead of bounced around to me. It also gives other system admins a notice of who sent the email if/when they complain to me about abuse.
5. Keep an eye on your scripts, and do NOT let them be abused. If you set your username/password in your forum config, it will let it send email to anyone, using your creditentials. Do not do this unless you're absolutely sure it's neccessary, and you're willing to take responsibility if the script gets out of hand. Make sure your config also includes a valid return email address so you notice rejected messages right away. Pay attention to those rejection notices, and don't let the system keep sending email to invalid addresses.
As stated in the main xepher.net rules, email abuse is not allowed. Whether that abuse is directly by you, or by a system you've installed doesn't really matter. The new configuration I've just implemented means that email can't be abused by any script (or person) without it having your password. Thus, if you want to be safe, configure your scripts to send to your xepher.net email address (or one of your aliases on a domain you've got here) and do NOT give it your password. This means you can't do things like have a forum send out registration emails or stuff to other emails though. Most forums have a registration option that let's the admin directly approve/register new members that you could use. If you choose to give your password to a script though, you must be vigililant about what it's doing. Most of you know I'm not too hard to deal with, and I know sometimes things happen that you didn't intend. That said though, I reserve the right to terminate your email access if I feel you're not being responsible enough with things. Usually, I try to give everyone at least one direct warning before I do anything harsh, so make sure you don't ignore it. (That means you'd better have a valid contact email for me to send a warning to!)
Alright, rant over... exiting mail-nazi mode. :-P
Show Posts
