57 karma · joined November 2, 2010
# dig -x 172.217.5.14 +short
lga15s49-in-f14.1e100.net.
ord38s19-in-f14.1e100.net.
# dig lga15s49-in-f14.1e100.net. +short
172.217.5.14
# dig lga15s49-in-f14.1e100.net. +short
172.217.5.14
The first command (dig -x) checks the PTR record for the IP address 172.217.5.14. It returns two PTR records: lga15s49-in-f14.1e100.net. and ord38s19-in-f14.1e100.net.[0]. Those are subdomains of 1e100.net, which we know Google owns. However, you can set a PTR to pretty much whatever you want, so we now take an additional step as well. We run the dig command again to check the A records for the domains. This returns the same IP address we started with, which is good. Since Google controls the DNS for 1e100.net we can be reasonably sure that it is in fact a Google server. This is called Forward-confirmed reverse DNS (FCrDNS) and is one tool you can use to determine the ownership of an IP address. For example, it is frequently used as a weight in email spam filters. Although, because of the intricacies of email, in that case it is usually not used for identification and instead used as a general purpose check to determine whether a mail server is rogue or not, since spam servers very often do not have proper FCrDNS.
There are other tools to determine who owns an IP address, like whois, but in some instances one will garner useful information and the other will not. So it's nice to have both at your disposal.
[0] As a side note: the trailing . in those PTR records returned by dig is not a typo. All domains actually end in a dot, it's just usually implied.
[0] https://en.bitcoin.it/wiki/Non-specialized_hardware_comparis...
[1] https://blockchain.info/charts/hash-rate
[2] https://en.wikipedia.org/wiki/WannaCry_ransomware_attack
That said, there are some things you should be aware of when running a mail server:
1. You need to make sure that the IP address and domain name that SMTP is bound to is not on a blacklist[2]. You also need to consider the trustworthiness of your host because you could very well get caught in the cross-fire if one of their other customers gets them range banned. Certain cloud providers that make it very easy to change IP will more than likely have all of their addresses on some blacklist or another.
2. You also need to make sure you have matching forward (A record) and reverse (PTR record) DNS records for that IP address. This is called Forward-confirmed reverse DNS, aka FCrDNS. Many mail servers will reject email from servers that do not have or have mismatching records for FCrDNS.
3. You must set up SPF and DKIM. Many mail servers will either reject mail from servers without these, or at least weight heavily against it.
4. You probably want to make sure TLS is set up properly, otherwise your mail is going to travel the internet in plaintext.
5. The IP address you're sending from is going to start off with no reputation. The volume, type of mail, and how many people mark your mail as spam is going to decide whether other mail servers start filtering you or not. You may have no problems here. If you're unlucky, you will need to try to reach out to whichever major mail provider is filtering your mail. Many of them have a ticketing system for this, but you'll be at the mercy of whomever is working that ticket. There are also various whitelists that might be worth trying your server on. They're usually very selective and will probably reject your request.
6. You really, really need to make sure you've got your policies set up correctly because you do not want to accidentally set up an open relay[3] that will be used to spam other people.
7. Greylisting is a very, very effective means of spam filtering. The downside is that mail from new servers wont be delivered instantaneously and will instead be delivered whenever their mail server tries to deliver it again. Other than that, most spam is malformed in some way so some basic DNS checks will filter a ton of it. There are also free RBL and DNSBL lists that will pick up the slack.
[0] http://www.iredmail.org/ [1] https://mailinabox.email/ [2] https://mxtoolbox.com/blacklists.aspx [3] https://en.wikipedia.org/wiki/Open_mail_relay
It might be better to ask what you had expected the outcome in this scenario to be?
* Something you know
* Something you have
* Something you are
A conventional password-based login implements "something you know" (i.e. your password). A password-less login implements "something you have" (e.g. email access). That doesn't make it more secure, it's just substituting one authentication factor for another. One could argue that it's more convenient but that's subjective since people that use password lockers might actually find it less convenient.
An argument against password-less logins might be that they should be implementing multi-factor authentication in the first place. Password-less login is by nature not at least two-factor authentication. Even if you have two-factor authentication enabled for your email, it will still just be "something you have" because someone that gains access to your PC or phone will probably have access to your email as well. The easiest second factor to add into the mix is "something you know" (e.g. a password) and now you're back to conventional two-factor authentication practices.
More supporting evidence that any title that ends in a question mark can be safely summed up as 'No'.
[1] https://support.microsoft.com/en-us/help/13853/windows-lifec...
Sounds like a good way to get fired depending on how strict their policies are.
To play devil's advocate, some APs support rogue triangulation. Ours plot any rogues on a building map so we know exactly where they are. When combined with a proper wireless survey, you could ensure that they don't deauth anything beyond the building perimeter. Not that I recommend that, since at the very least someone should be able to tether their phone if they want. But also because it puts additional overhead on your APs, which are usually already taxed in high-usage areas.