Mail Store & Forward Support

What is ETRN?

ETRN is an Internet mail (or SMTP) protocol command which stands for 'Extended Turn'. It is an implementation of an extension to the SMTP mail delivery protocol TURN to request a remote machine to process mail. ETRN enhances the security of the TURN implementation. This is the method in which E-Biz Mail Store & Forward is based on.

How does ETRN work and how can it be used?

The general principle of a reason to use ETRN is in a scenario where there is one primary mail server that may have suspect reliability in terms of connectivity and availability. It is suggested that a domain name has at least 2 MX records, and the ‘secondary’ record can be a simple backup mail server. The advantage that this gives is that even if your primary mail server is offline, mail will be safely connected from any Internet hosts attempting delivery, and this deferred mail can be collected late on. The secondary ‘backup’ server in this scenario will be configured to collect all mail for the domain, but permanently queue it. E.g. it will not attempt instantaneous onward delivery. Meanwhile, the primary server is configured to ‘de-queue’ the backup server. The ETRN command is the command that is used to dequeue. When a de-queue command is authenticated and processed by the backup server, the backup server will then send the messages for that domain, to a specified host, i.e. the primary server. According to the primary server, it simply observes new messages coming from the Internet as it would do normally.

What about security?

a) TLS and SSL support

The server supports TLS v1.0 via the STARTTLS command (via the normal plain text SMTP protocol on port 25), and will also accept connections over SMTP over SSL via port 465. Using either of these methods will ensure the ETRN request and authentication is passed securely.

b) User authentication

The server requires a valid username and password to be sent to the server before accepting any requests, using either PLAIN or CRAMMD5 as the authentication protocol. It is suggested to use CRAMMD5 if the server being configured supports it. It is important to note that a secure connection must be established either via SSL, or STARTLS before authentication can proceed. Almost all modern mail server software has a TLS negotiation field that can be populated with a username and password.

c) DNS and destination host security

The server will be configured to send mail destined to a domain to only be sent to a specific host name (the host name or your primary mail server). This is hard configured on the server to prevent any possible attacks on the public DNS information from causing your mail to inadvertently route to a 3rd party host.

Authentication based on hostname

As this backup MX server is a shared platform, the server will be configured to only accept an ETRN request for a specific domain from a specific host, so for a request to succeed a valid username and password has to be seen to come from a specific authenticated host. This will prevent your domain from being de-queued by another client. It is important to note, even if it was possible for another client to try ‘de-queue’ a different domain through using the correct username and password, that domain’s email would ONLY be routed to the specified host for that domain specific in section c), there is no risk of mail being misrouted as a result of a bogus ETRN request.