I own a domain - for the purpose of this question, let's call it example.com.
I have verified example.com with Amazon SES. I have set up the DKIM stuff as well. Everything is working; I have no problems sending outgoing emails, and I have already been granted production access.
The question: I am sending emails from no-reply#example.com, but this email address does not actually exist. Should I be worried about this? Is it bad to send emails from an email address that does not actually exist? Since I verified the domain, it seems that I can send emails from any email address I choose to invent.
(My emails are 'email validation' emails. We do not wish to capture any form of reply from our users, and bounces would only occur due to users registering fake email addresses - despite our warning that it is pointless to do so.)
I searched everywhere for an answer to this question, and I'm very surprised that I haven't found an explicitly clear answer to it...
What you are doing is very common, with SES and/or any other batch mailing type service where you don't want any replies to the sending address - I don't see any problem.
Related
My main goal is to setup an email address for my server to use for sending emails only.
I did some research, and it looked like Amazon Simple Email Server and/or Amazon Workmail could provide me with what I needed. I've gotten as far as setting up SES and Workmail so that I can set my server to be able to send emails. However, I saw that once the Workmail inbox is full (50GB), the account would be unable to send emails. Given that this is going to be used by the server and not a human, I didn't want the inbox to get filled with auto replies, spam, or failed to send messages, and then be unable to send emails. So, I went looking for a way to either:
A) prevent emails from being received and stored in the inbox
B) a rule I could setup to delete anything that didn't match the company domain
C) be able to read the inbox and delete email messages using the AWS CLI, and I'd setup my own script to manage how and what was deleted when
So far I haven't had any luck.
Again, I'm not particular how I achieve the goal, but I do preferably need to find a way to have an email address for a server to use exclusively for sending messages. I worry that if I leave it to employees to remember to login and clear the inbox, someone will forget, and then the server will stop sending emails.
Any direction or advice would be greatly appreciated.
I'm not well versed in email protocols; could I setup the address to return a bounce back always, and that would prevent it from receiving emails into it's inbox?
How are you generating these emails? If you are generating them programmatically (via an app/script), you may not need to set up a server. If you just route the outgoing mail through your app to SNS, the emails will be valid, however, there will be no "inbox" for incoming mail and they will just be dumped. This way you don't have to actually worry about an inbox getting full as it will just drop anything coming in.
https://docs.aws.amazon.com/ses/latest/DeveloperGuide/receiving-email.html
In order to receive emails though SNS, you have to go through the setup linked above, but if you do not set this up, then emails will just bounce. At least, that is how I have been doing it.
Trying to understand something thats not clear from AWS SES emails.
I have a simple emailer on my website that I have setup using nodemailer.
It has 3 fields
Name: name of user filling out form
email: email address of user filling out email.
Description: description filled out by user.
I'm seeing in AWS docs that I need to verify on their console the users email.
You can only send mail from verified email addresses and domains.
Note: This restriction applies even when your account isn't in the
sandbox.
This could be any number of different user email address how would I be able to verify them all I wouldn't know them.
What am I not getting here. I have verified the To: email which will always be the same as its coming to my domain email.
You'll want to send from an email address under your control (SES enforces this on a technical level, but spam filters tend to de facto enforce this everywhere due to things like SPF records) with a Reply-To header of the email address submitting the form.
I am sending emails from my website with postfix my domain name. But suddenly my email credentials was compromised and someone used my credentials to send thousands of emails to peoples. So Because of that, peoples mark that email as SPAM.
Because of that, Now emails are coming to spam in GMAIL now.
Please tell me, How can i fix that issue.
Note: I am using aws ses email service.
Good practice is to have proper SPF + DKIM + DMARC set in your domain, other than that, you can do everything good, but there is 0 guarantee that your email will never be marked as spam, sadly, it's half in your control, the other half is what others have reported from your domain, your server, your content, your actual username, links included, etc. Keep in mind that your reputaion varies per server, so if emails land in spam in Gmail, it doesn't necesarily mean that it'll land in spam in hotmail. Sometimes using a completely different domain/server/service helps, but if the reputation is already tainted, only marking emails as 'not spam' would eventually help the delivery (I know, it sucks when that happens).
I'd like to send email to third parties on behalf of users. The key is for the user's email to show up as the "from:" email.
I've tried using send_mail with the user's email as the from_email, but to no avail. When I used gmail's servers to send the message, the third party sees the EMAIL_HOST_USER as the "from:" email. And when I tried using namecheap's mail server, I got SMTPRecipientsRefused: {u'<to email>': (553, '5.7.1 <from email>: Sender address rejected: not owned by user <EMAIL_HOST_USER>')}.
If possible, I'd like to avoid asking for their password as well.
Short answer: You can't do that.
Back in the old days, mail servers used to be quite relaxed about posting mail whenever anyone asked them to, but then SPAM happened and people realised that it was actually quite important to check that the person sending an email is actually the person whose address appears in the From: header.
There are now several mechanisms in place that make it very difficult to spoof a sender email address. These include:
Sender Policy Framework (SPF): An email validation system that works by placing restrictions on the IP addresses authorised to send email from a particular email address. If you try sending email from an IP address not associated with the legitimate owner of an email address, your mail will be rejected.
DomainKeys Identified Mail (DKIM): A method for confirming that emails claiming to have originated from a particular mail server really did originate from that server.
Mail transfer agent restrictions: These days, most MTAs are configured to only accept emails from people who it already knows. (This is why you're seeing a Sender address rejected: not owned by user error message).
Instead, your best option — essentially your only option — is to put your own email address in the From: header, and send the email from your own mail server. If you want the reply to go to someone else, add a Reply-To: header containing their email address.
If you are using Exchange, you might be able to use a library such as Exchangelib, in which the author seems to have been inspired by some of Django's design decisions. Unfortunately, it does look like you will still need to ask for the user's password. I'm going to be looking into this further later on, and since I use LDAP authentication to the Django project, perhaps there is some way to use that to authenticate to the email server, but I have my skepticism.
See this question:
https://serverfault.com/questions/546255/sending-email-with-python-django-through-microsoft-exchange-imap
Something odd is happening and I am wondering what is the explanation.
I have a web application which is using amazon SES to send email when users lose passwords, on new registrations, etc...
While testing I realized SES is returning a "500 BAD REQUEST" for specific email address, I typed pippo#gmail.com just to test the UI of my application perfectly knowing the email address does not exist, and I got "500 BAD REQUEST", initially I could not understand what was wrong so I kept debugging and not understanding why error 500; later I realized I was getting it for not existent or generic email address.
For example if I try sending email to "bar#gmail.com" I get the 500, but if I try "foo#gmail.com" I do not.
(By the way for an italian pippo#gmail.com is equivalent to foo#gmail.com)
If I try with pippo#hotmail.com, foo#hotmail.com, bar#hotmail.com, I don't have any issue.
Actually this could be a feature, maybe it is and I just didn't know.
Is SES behaving like that for anyone else?
SES blacklists email addresses that bounce. When you try to send an email, it makes sure that the address is not blacklisted (that is, it did not bounce recently).
My guess is that those addresses are so commonly used by people testing SES that they almost always bounce and so they get blacklisted.