Email Encryption
S/MIME, OpenPGP, GINA, and TLS in practice.
Renewing a Totemomail Certificate: 4096-Bit Key, PKCS#12 Import, and Restarting Each Node
Totemomail’s request dialog generates only 2048-bit keys without alternative names. However, many internal CAs now sign only 4096-bit keys. The key and request are therefore created with openssl, followed by ordering from the PKI team, PKCS#12 import, connector binding, and restarting each node.
CVE-2026-104286: FortiMail Zero-Day Is Being Exploited - Workaround and Compromise Assessment
Fortinet reports a critical, actively exploited path traversal vulnerability in FortiMail 7.2 through 8.0 (CVE-2026-104286, CVSS 9.8). A patch is not yet available. The workaround disables IBE or blocks Internet access to the management interface; indicators for assessing compromise are also available.
Mail loop with encryption gateway behind EXO - Prevent spoofing issues
If the encryption gateway (HIN in this example) is behind Exchange Online, every incoming message reaches EOP a second time: with a foreign sender domain, an invalid DKIM signature, and the gateway IP as the source. The result is a spoof verdict and junk. Four settings prevent this without disabling filtering using SCL -1: a PTR record, Enhanced Filtering disabled, a spoof exception for the gateway infrastructure, and CloudServicesMailEnabled on both connectors.
New Outlook: S/MIME signature cannot be verified in secondary account, attachments missing
The new Outlook reports that the S/MIME signature cannot be verified in a secondary account for a shared mailbox and does not display attachments. This article explains the difference between Clear Signing and Opaque Signing, why attachments disappear from opaque-signed messages, why the new Outlook processes S/MIME only in the primary account, and what workarounds are available, including unpacking smime.p7m with PowerShell or OpenSSL.
Rebuilding Apache James Rule Sets in a Structured Way: Tools and Method
Mailet rule sets that have grown over the years contain dead paths that no one recognizes anymore. Learn how to analyze the rule set as a graph, reliably find unreachable code, and design the migration so that a single Mailet keeps the rollback path open.
Guide for DNS Administrators: MX, SPF, DKIM, DMARC, and Common Pitfalls
Anyone managing a zone will usually receive ready-made mail records and only needs to publish them. What regularly goes wrong: the 255-byte limit for DKIM, duplicate SPF records, the lookup limit, MX pointing to a CNAME, automatically appended zone suffixes, and policies nobody enforces anymore.
Testing SMTP on Linux: From the TCP Connection to Delivered Email
When an appliance stops delivering email, a manual SMTP test is more useful than any log. Learn how to check each layer using built-in tools, what different error patterns mean, and why a load balancer can distort diagnosis.
