If you can arrange it, having a red team work on your SMTP server before you launch it may be a good idea. But testing for incidents like DoS attacks will probably require the work of penetration testers. Test, test, test! Have some test emails sent through your SMTP application, and commence full operation only when that's successful.Those will need to be tweaked for a while during operation until you find what works. Some of the settings specific to SMTP include total number of connections, total number of simultaneous connections, and maximum connection rate. Change all passwords according to a set schedule, once every three months is usually good. Also make sure that you change administrative usernames, and use only complex passwords. It's always more secure to make sure you're running no default settings. Also make sure that your application will be well supported in the coming years with frequent patches as necessary. If you can use an application that has added security features, that's probably a better choice. Consider any requirements that compliance and company policy may have. Whether your MTA application is opensource or proprietary, installed via repository or removable media, choose carefully. For instance, if you want to use postfix, you may have to uninstall sendmail packages first. Generally, you can only have one application for using SMTP per email server. Install the application of your choice.Here are the usual steps for setting up a mail transfer agent: Basic steps for secure mail server configuration These best practices can be applied to the configuration of most commonly used email server applications, regardless of your OS platform. There are many popular mail transfer agents, and mail delivery agents that businesses use, such as sendmail, Postfix, Microsoft Exchange Server, Apache James, MDaemon, and Citadel.

Sometimes, even the most experienced IT professionals forget about the basics.įor the sake of this piece, I use the phrase “email server” to refer to backend programs that are mail transfer/transport agents (SMTP), or mail delivery agents (e.g. This isn't a comprehensive guide to secure email configuration, and your business may be subject to compliance standards that aren't covered here, depending on your industry. But if an email server that your business operates is subject to attack, not only can your business experience lost productivity, you can also be subject to litigation for leaking sensitive data.įortunately, there are some basic best practices for configuring your email server in a more secure way, which should significantly reduce your risk. Enterprises are often required to host their own email servers for the sake of compliance and practicality, instead of using one of many third party email services that are often offered by ISPs. A significant percentage of online cyberattacks are email related.

Att email server settings 2019