3

I am using a cloud server to host my site with WHM/CPanel. Everything else is going great and I am proud of how well my site is working. Except nobody can sign up themselves because the email isn't working.

Strangely, emails from things I signed up to ages ago are coming through today but I can't recieve or send emails myself. Which is also stopping people being able to sign up as they have to click the confirmation email etc.

WHM is set up on an IP address I am going to call IP A and the site is on a connected IP I am going to call IP B. The domain is registered through Godaddy and I am using Cloudflare as a middleman to stop attacks I was getting before. The site itself wasnt resolving properly a couple of days ago so I greyed out all the clouds for the hosting in Cloudflare. This fixed the issue and the site works fine otherwise. I left the clouds for everything else including the email as orange, to use Cloudflare DNS AND HTTP.

I have now greyed them all out, just to use Cloudflare DNS and not HTTP. The thing is I dont think that will help and I cant keep trying such small things and having to wait a couple of days for the DNS to work or not.

I am using Roudcube. Which opens on IP A. The WHM IP.

My question is, should IP B be used for all of the fields in Cloudflare (like it is now), including the email fields like MAIL or should IP B be used for all the site related fields and IP A be used for the email fields?

And/Or have you seen something else wrong from what I have written?

Thank you for your time.

  • 1
    I always found that using cloudflare for your mail server is basically useless since your mailserver will send it's IP address within the email headers. This means that if your mail is on the same server as your web service then your mail server can be used as a method to get your true IP address. – Analog May 9 '16 at 21:23
  • I have heard that about SEO but for security it helps the site hosted on the server. – Gary Carlyle Cook May 9 '16 at 21:25
  • 1
    @GaryCarlyleCook I think what Analog and Scottie are trying to convey is that if your email and site are hosted on the same IP/server, anyone can bounce an email to a non-existent address and get back a reply with the IP address of your server in the email's header. CloudFlare therefore recommends using an external mail server so that all IP addresses will correspond to theirs or the external email server's. See this for more about that. – dan May 10 '16 at 1:23
2

Ok so for inbound mail you need to have your MX record set properly in your domain. This record tells anybody who wants to send you email where to send it. As you use WHM to handle your email you need to ultimately get it to point to your cloud server's IP address (IP A) but MX records can only point to domains and not IP addresses so you want to have a separate A type record in the DNS (these map names to IP addresses) configuration to let everybody know what IP the domain name points to. So for example you could have:

MX record: mail.example.com
A record: mail = 1.2.3.4 (IP A)

That way you have a chain which says send the email for example.com to the server at mail.example.com which is located at IP A. You need to turn all the clouds off for those records as Cloudflare doesn't process emails.

See here: https://support.cloudflare.com/hc/en-us/articles/200168876-My-email-or-mail-stopped-working-What-should-I-do-

Outbound mail doesn't touch Cloudflare at all your WHM and Cpanel configuration needs to be setup to send it correctly. Check your firewalls are allowing outbound/inbound connections to common mail server ports such as (25, 465, etc) if you have installed something like CSF. Having a valid MX record such as the above will definitely help with delivery though as sometimes the receiving server checks this.

You will be able to get it working but depending on the size of the project you might even want to move to a transactional email service for outbound mail and a hosted service such as Google Apps for inbound mail.

Also as Analog has already suggested this could allow a malicious attacker to bypass the CF protection and directly attack your server so this is one reason why people choose to outsource email too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.