Sending mail - problem with authentication

[squidge]

"bad people" can use your login and password to send thousands of emails to people. This can happen until your account is banned.

If you create your own SMTP server, it will be free of charge if you host it yourself on your own connection, else you need to shop around. It can be expensive.

[kremuwa]

If I host my own SMTP server, can't they use it knowing my login data (fetched from my program)? And how can I accept mails only from one specified e-mail adress? Is this a kind of property of an SMTP server?

[squidge]

If you hosted your own SMTP server, it would be impractical for other people to use it, as it would only ever accept mail to local addresses to itself (where there might only be one), so other people just wouldn't bother.

Spammers are only interested in "open" mail servers - those which will accept mail destined for anywhere. As soon as your mail server rejects all non-local mail, people lose interest very quickly and go find some other mail server. This is the typical mail server configuration.

[wysota]

I think bringing up your own mail server is an overkill here. A solution with the end-user providing authentication data to the application is much better. A not so bad alternative is to embed some of the capabilities of an smtp server directly into your application. Actually what is required besides what the client side of smtp offers is an ability to query dns for an MX record for a particular destination address. When you connect to the appropriate server, it won't require you to authenticate yourself (i.e. you don't need to authorize to poczta.onet.pl if you are sending mails destined for poczta.onet.pl domain). Unfortunately QHostInfo doesn't provide means for querying for MX records so this needs to be done manually.

[kremuwa]

toutarrive, wysota - I'm not sure if I got you well but let me explain what do I need it for. I've got pretty small application, which I want to have one additional feature - it should send mails to my mail account, containing information about bugs and opinions from users. They click "send mail" in menu, they write a message content, they specify their e-mail (so I can answer them) and they click "Send". I only want this mail to be delivered to my e-mail account - nothing else. So asking user for login and password is not a good solution here. Now, with such a knowledge, could you say what would be the best thing to do here?

[toutarrive]

See answers #9 and #16.

[squidge]

toutarrive, wysota - I'm not sure if I got you well but let me explain what do I need it for. I've got pretty small application, which I want to have one additional feature - it should send mails to my mail account, containing information about bugs and opinions from users. They click "send mail" in menu, they write a message content, they specify their e-mail (so I can answer them) and they click "Send". I only want this mail to be delivered to my e-mail account - nothing else. So asking user for login and password is not a good solution here. Now, with such a knowledge, could you say what would be the best thing to do here?

The best thing to do would be to fire up the users email client, let them write the message content there, and then click send. No need to request there email address, as the email client will have that already. It'll also go through the appropriate mail server so you don't need to worry about that.

Why make it more complicated than it needs to be?

[wysota]

toutarrive, wysota - I'm not sure if I got you well but let me explain what do I need it for. I've got pretty small application, which I want to have one additional feature - it should send mails to my mail account, containing information about bugs and opinions from users. They click "send mail" in menu, they write a message content, they specify their e-mail (so I can answer them) and they click "Send". I only want this mail to be delivered to my e-mail account - nothing else. So asking user for login and password is not a good solution here. Now, with such a knowledge, could you say what would be the best thing to do here?

If you are going to send mail to only one specific address (yours) then you can hardcode your application to connect directly to the server handling mail for your account and transmit the message directly to it withouth authenticating. Just be aware that should the mx record for the domain be changed, your application will not be able to transmit emails anymore.

A much cleaner approach would be to have a php script somewhere in the web that would receive feedback from your application instead of using smtp protocol and emails for this. Getting free hosting with php capabilities shouldn't pose any problem.

[toutarrive]

currently I'm connecting to smtp server (which belongs to poczta.onet.pl - popular mail service in poland) using my login and password which are specified in the code. Are you saying that "bad people" will fetch this data? What can they do then?

Harcoding your login and password make yourself recognize by the server (so validate the connection). And then, people using your app will be seen by the server as if you were the one sending a mail.

Instead your app should asked for a valid login and password on the relevant SMTP server. So, never harcode one in your app.