1
"Block authentication by country" makes MS Outlook Mobile unusable: its connections come from foreign countries (Microsoft's fault...)
Problem reported by Gabriele Maoret - SERSIS - 11/18/2023 at 3:14 AM
Submitted
Scenario:

I set my SmarterMail domain to accept connections ONLY from Italy.
At this point my users who use MS Outlook Mobile are no longer able to connect to the server, this is because Microsoft passes MS Outlook Mobile connections through its Azure datacenters, many of which are abroad... (see also here: https://portal.smartertools.com/community/a95673/new-outlook-version.aspx)

How should we behave to solve this problem?
Gabriele Maoret - Head of SysAdmins at SERSIS
Currently manages 6 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 5 on-premise for customers who prefer to have their mail server in-house)

9 Replies

Reply to Thread
0
Brian Bjerring-Jensen Replied
Use the native apps instead of the shitty outlook app.
0
Gabriele Maoret - SERSIS Replied

I understand your point of view and, in general, I agree with it.

But it's not always that easy...

We have hundreds of different domains on our SmarterMail servers, and almost every domain corresponds to a different customer.
Unfortunately some of these customers WANT to use MS Outlook Mobile and there is no way to change their minds...


Furthermore, we don't know what will happen in the future with Outlook for Windows and/or MAC: what will happen if in the near future Microsoft decides to use the same strategy here too?
Gabriele Maoret - Head of SysAdmins at SERSIS
Currently manages 6 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 5 on-premise for customers who prefer to have their mail server in-house)
0
Brian Bjerring-Jensen Replied
Ohh they will. Its a matter of sanitizing your email for info/value.

Private clouds  and not using outlook on laptops/phones is the way forward. Tell your clients that they will violate GDPR using the Outlook app.

Then they will understand and obey :)
0
Douglas Foster Replied
Nine and emclient are non-invasive client alternatives to Outlook mobile

Other options:   (1) Tune your country blocking to be less restrictive .   China is the biggest problem, and I would hope that they are not routing traffic into the Great Firewall.

(2) Get a firewall that can do country blocking.  The attacks I have seen have used port 25 SMTP, while Outlook should be able to connect on port 443 using mapi or ews or was.


0
Brian Bjerring-Jensen Replied
On our firewalls 56% of crap blocked is from the US.

China is less than 8%.

INdia, Romania, Bulgaria and Brazil is a lot worse.
0
Gabriele Maoret - SERSIS Replied

  1. option: that can be a better-than-nothing solution, but:
    1. how can I know all the countries to "unblock" for MS Outlook Mobile? do you have a list?
    2. this anyway expose the server for attacks that came from the contries listed at point a., and (as Brian Bjerring-Jensen said)  a lot of attacks come from USA and Europen countries too...

  2. option: that can't do, because if I block port 25 (or/and 465) from (example) China with a firewall, then I block even the legitimate emails that came from there (and we have a lot of customers that have business with China...)

Gabriele Maoret - Head of SysAdmins at SERSIS
Currently manages 6 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 5 on-premise for customers who prefer to have their mail server in-house)
0
Nouman Saeed Replied
It also keeps on loading forever and not taking me anywhere.
Nomi
1
Douglas Foster Replied
The block-by-country feature was added because of a specific problem:  password guessing attacks using SMTP AUTH on port 25 from servers in China.    Because my MX is an inbound gateway, no legitimate sender should be trying to log into it, so I was able to use it as a honeypot.    I stopped counting at 20,000 unique IP addresses that were involved in the attack, which persisted over an extended period.    This campaign was detected and reported by multiple users on this forum.    All of our other spam problems pale in comparison.

The block-by-country feature may be useful for other contexts, but you have to consider the risks of cloud-based data centers that are replicated all over the world for redundancy.   If I remember correctly, one of my vendors has data centers in the US, Ireland, and Singapore.  My traffic usually goes through the U.S. data center, but the others are backup if the U.S. center has problems.

My organization also blocks port 443 from foreign countries, for other reasons.  So I don't know if China is cranking up similar attacks on port 443 or other ports, but we should probably expect it. 

0
Mark Johnson Replied
Does it log that an IP is "auth blocked by country"? 
I'm still seeing login attempts (unsuccessful) from China despite it being blocked?
Or will it only block login if the attempt is successful?

[2024.01.17] 10:10:55.418 [59.46.193.187][47860066] Country code: CN
[2024.01.17] 10:10:58.093 [59.46.193.187][47860066] cmd: EHLO [59.46.193.187]
[2024.01.17] 10:10:59.425 [59.46.193.187][47860066] cmd: AUTH LOGIN
[2024.01.17] 10:11:00.780 [59.46.193.187][47860066] Authenticating as ..

Reply to Thread