2

I use the same server for sending my emails and web hosting.I send user registration and support forum mails from my server and occasional marketing mails or newsletters.

I read on a cloudflare blog that if I use the same server for email and web hosting the headers of the mails sent will contain my IP which will make me exposes to DDos attacks but my hosting providers says that there is no such threat with IP's in mail headers.

I am confused if it's okay to use the same server for both web and mail and does having my server's IP in the mail header really does increase the risk of DDos.

Here is the cloudflare link

Improve this question
1
  • 2
    CloudFlare's point is that when you use their service, all your DNS records that are proxied point to their IP addresses instead of the IP address of your server, making it more difficult to figure out your IP address and launch a DDoS attack. If you host an email server on the same server, that is not going to be proxied, so by sending an email to your domain for an unknown user, they would be able to view the IP address of your server in the email headers of the returned (bounced) email. If you want to take advantage of the security they're offering, I'd suggest following what they advise.
    – dan ♦
    Mar 11, 2016 at 6:18

3 Answers 3

Reset to default
1

Does using the same mail and web server increases risk of DDos due to IP exposure?

Probably. The Cloudflare blogpost explains this pretty well. Cloudlares DDoS protection can be bypassed if you expose the IP address of your server, as attackers can now directly attack your server. They couldn't do that before, because all they had was an IP address that pointed to Cloudflare (which - unlike your server - does have DDoS protection).

We can't really say if you specifically are affected by this, but to be safe, the easiest way would be to just follow Cloudflares advice. Otherwise, check if emails from your server indeed do disclose the servers IP address.

Of course, an attacker might gain your IP addresses via many different means. Cloudflare mentions some others: Server allows outbound connections, general information disclosure, old DNS records, etc.

So if you do want Cloudflares DDoS protection, you will have to make sure that your IP address is not disclosed via any of these channels.

Improve this answer
1

Cloudflare suggest the right thing. Here is good article worth to read.

Hope you already setup MX record for your site let's say [email protected], and you already protecting it with their server. So whenever any guys sent you email to that address, and your server reply back automatically or manually, then attacker check Show original message and find receive from line to check IP address of mail server. So here Cloudflare protecting you, because you are hiding that Mail server with cloudflare.

But, if attacker sent gmail mail to bogus email address like [email protected], then Gmail gives error about, mail sent to that server is failed and here attackers get your real IP address, because your origin mail server sent information to Google SMTP and Google SMTP sent information to recipient/attacker.

Improve this answer
1
  • 1
    An easy workaround for this is to send from a sub domain with separate IP address & MX records (e.g. [email protected])
    – Tom Brossman
    Mar 12, 2016 at 23:48
0

I do not know what CloudFlare is thinking. IP addresses are always exposed. Afterall, that is how the Internet works!

As well, DoS/DDoS is always a targeted and intentional act. It does not just happen because one day a hacker woke up and decided to ping the snot out of your site. They may hate Target and ping the snot out of their site, but not you who they do not even know. Besides, DoS/DDoS is not as much fun as it used to be. That is so beyond yesterday, it makes hacking into Paris Hilton's phone seem like the stone age. Hackers are into espionage these days. Think Snowden. Everyone wants the notoriety without the hassle of going to the Kremlin.

Do not worry about it. It is done every day far more times than not.

Improve this answer
9
  • @John Anytime!! My systems are set-up with e-mail and web and I used to be a web-host as well as a consult to all the major telecoms including global telecoms specializing in core networks and Internet services. It will be fine. Really. I hope I did not scare you with my attempt at humor. I am a bit sleep deprived. ;-)
    – closetnoc
    Mar 11, 2016 at 6:04
  • @closetnoc the whole point of Cloudflare is that your domain now points to their servers, meaning that your IP address is not linked to your domain anymore. So if you do not leak your IP address via other channels, an attacker wanting to attack you should not be able to attack your server directly, but must attack it via Cloudflare. I also doubt that DDoS attacks are declining (the articles and graphs I have seen are talking about an increase in number and power of attacks). Of course, if OP actually needs DDoS protection is a different question, which may depends on the nature of the site,etc
    – tim
    Mar 12, 2016 at 16:20
  • @tim I realize that. There are a lot of people labeling general hacks against a site as DDoS where it is not. DoS/DDoS just does not happen unless specifically targeted for such activities. Most of what is happening are brute force attacks of one kind or another. Be that as it may, I have been at this since before the very beginning. I have only seen one apparent DoS/DDoS attack which in reality was a proxy attack and not DoS/DDoS. I have been a web host, a major consultant to all the major telecoms including global, DoD, The World Bank, The IMF, etc. Some people are trading on fear.
    – closetnoc
    Mar 12, 2016 at 16:36
  • @closetnoc Of course DDoS attacks are targeted, nobody said anything else. But that doesn't mean that they are not happening, or that they are nothing to worry about. Of course OP should do their own risk assessment, but just flat out stating that DDoS attacks are never something to worry about is just wrong. I also highly doubt that any brute force attack will look like a DDoS attack. And what's a proxy attack?
    – tim
    Mar 12, 2016 at 17:06
  • @tim When I say targeted, there is a high degree of motivation to cause specific harm to a websites ability to perform it's duties. It is not a hacking activity in regard to taking advantage of a vulnerability to compromise the system. DoS attacks are generally intended to make a political or social point. In this, DoS attacks do not happen to just anyone. Target, for example, was a target (no pun intended but still appreciated). For Joe Schmo, people who would engage in a DoS attack would have not motivation to do so under normal circumstances.
    – closetnoc
    Mar 12, 2016 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.