1. Mailjet’s Gearing Up for TechCrunch Disrupt!

    by

    Mark your calendars! Mailjet is sponsoring TechCrunch Disrupt NY, one of our biggest conferences of the year. The event will kick off with a hackathon May 3 - 4, leading into the main conference May 5 - 7. Be sure to stop by the Mailjet booth and say hello! Some of our team members from the Paris HQ will be visiting and we’ve got a limited amount of swag to give away!

    Can’t make it out? Don’t worry, we’ll be live tweeting so you won’t miss any of the action. Fill up on energy drinks and follow along on Twitter.

    TC Disrupt Hackers: Use our all-in-one solution for your product hack for a chance to win some awesome prizes (in addition to the Disrupt Cup). Our APIs are easy to configure and tailor to your needs. Sign up for a Mailjet account now to get a head start.  

                   

    image

  2. Mailjet’s newest feature: 3D print your emails!

    by

    Mailjet’s team is hustling constantly to offer you a better product every day. As you may know, a new Mailjet is coming. But before any official announcement, I would like to share with you one of the many new features we will offer. Introducing: the email 3D printing.

    image

    But… why?

    At Mailjet, we like to think that we are in tune with the time. That is why we follow each and every new technological trend, from flat design to email home delivery service. Today, we are taking a further step with 3D printing. Why 3D printing? Because we feel that, with the incoming domestic 3D printers sales jump, people will want to keep some of their emails in a more material, concrete version, like some memorabilia.

    With the new Mailjet, it will be possible! Your favorite message will be displayed in a beautiful 3D version. Users of upgraded plan will even be able to 3D print their attached files, should they be images, video or even audio! Sounds crazy? Do not worry: we are not.

    How does it work?

    We followed our motto: “Facere Atque Kalare Emailos” (it is Latin for “Build and Shout Emails”). Our tech team adjusted our APIs. Now, via your dashboard, you will be able to select the new “3D print this!” service. Our tool will automatically detect your 3D printer. Then, choose your option (edible printing, life-size printing…), press PRINT and you are done!

    You can now decorate your room with your freshly 3D printed email.

    image

    How much does it cost?

    We created a new plan: the Polymer plan. Like the Silver, Gold and so on plans, the Polymer plan will allow you to use all the Mailjet’s features (optimized deliverability, dedicated IP address, real-time analytics…) AND, of course, the 3D printing option. Should you upgrade it to the Polymer Thermoplastics Plan, smaller versions of your 3D printed items will be sent to your best recipients. Engage them! Interact with them! It is what emails is all about, after all!


    Want to learn more about our new cool features? Come meet us during the next events we will attend: from March 8th to 10th at Salon E-Marketing (Paris, FR) and May 5th to 7th at TechCrunch Disrupt (New York City, NY).

  3. New capital increase for Mailjet and opening of a New York office

    by

    The French startup Mailjet is proud to announce that it has raised 2.2 million euros (3 million dollars). This new capital increase will accelerate the growth of the company for international expansion and product development.

    image

    This action follows the recent opening of an office in New York, led by Anthony Marnell, Vice President, North America at Mailjet. Anthony is a TechStars alumnus and has advised multiple startups in the US.

    “This new capital increase will allow us to strengthen our sales strategy, onboard larger accounts and continue our international growth”, says Alexis Renard, CEO of Mailjet. “20% of Mailjet’s revenue already comes from the United States. A physical presence was mandatory. We chose New York City for its dynamic and growing startup ecosystem.”

  4. Setting up DKIM step by step

    by

    Originally developed at Yahoo!, DomainKeys Identified Mail has become a global standard in email security and is, together with its sister SPF, absolutely necessary to implement by anyone serious about mailing.

    DKIM in a nutshell

    DKIM is in theory quite simple. It relies on asynchronous encryption and therefore works with any tool developed for such a use. First one has to generate a private / public key pair. Then the public part of the key has to be put as a TXT record to the domain which is used as the sender address. The private key is then used to create a signature for each email. The signature is basically a hash code and computed by taking the content of the email and combining it with the private key using a security algorithm. The signature is then saved as a header of the email.

    When a receiving SMTP server detects such a header, it looks up the public part of the key by asking the domain name system (DNS) for the TXT record. One of the beauty of asynchronous encryption is that the keys are like brothers: they share DNA. Using the public key anyone can tell whether the email was sent by the owner of the domain or not. If this check fails or if the header and therefore the signature does not exist, many email service providers raise an alarm and may, depending on the volume of email sent, decide to mark this email as spam or even to block the sender IP address.


    Setting up DKIM

    First step:  Setting up DKIM to generate the key pair

    The tool of choice depends on your operating system. For Microsoft Windows you can use PUTTYGen (here is a tutorial), for Linux and Mac, you can use ssh-keygen (Github has an excellent tutorial).

    Second step: Placing the public key as a TXT record in the DNS

    We have provided a list of DNS providers together with links to official and third-party documentation:

    With some DNS providers the setup can be quite tedious, but we would be glad to help you out. Just contact our support!


    Third step: Generating and saving the signature

    When using Sendmail or Postfix (the world’s two most popular SMTP server), or any other SMTP server that supports milter, you can use a special milter ( = email filter), the DKIM milter. This milter has been released by Sendmail as Open Source and allows to sign emails with a generated private key. Please have a look at the extensive documentation.

  5. How to handle SPF

    by

    Sender Policy Framework (SPF) is an e-mail validation system designed for preventing e-mail spam by detecting e-mail spoofing, a common vulnerability and threat by verifying the sender’s IP addresses. SPF allows the administrators to specify which the hosts allowed to send mail from a given domain by creating a particular SPF record in the Domain Name System. Mail exchangers use the DNS for checking that whether the mail from a given record domain is being sent by a host sanctioned by that particular domain’s administrators.

    When a domain publishes an SPF record, spammers are less likely to forge e-mails pretending to be from that domain and the reason for this being that the forged e-mails are more likely to be caught by the spam filters which continuously check the SPF record. Hence, an SPF protected domain is much less attractive to the spammers. Because of an SPF protected domain is less attractive as being a spoofed address, it is less likely to get blacklisted by the spam filters and so the e-mail being sent is more likely to get through.

    Compliance with SPF consists of three interrelated tasks. The first task is to Publish a policy. Domains and hosts identify the machines which are authorized to send e-mails on their behalf. This is done by them by adding additional records to their existing DNS information; every domain name or host that has a record must have an SPF record, specifying the policy whether it is used as HELO argument or an e-mail record. Validating the SPF record is recommended highly and can be done through testing tools provided on the SPF Project webpage.

    The next task is to Check and use SPF information. Receivers use ordinary DNS queries, which are cached to enhance the performance and then interpret the SPF information as per specified, hence acting on the result. The next task is to Revise mail forwarding. Plain mail forwarding is not allowed by Sender Policy Framework. The alternatives in this case are: Re-mailing, i.e. replacing the original sender with the one belonging to the local domain, Refusing, White listingso that it will not refuse a forwarded message and Sender Rewriting Scheme, a complicated mechanism that handles routing non-deliver notifications to the original sender.

    SPF has many potential advantages beyond helping to identify the unwanted mail. If a sender provides the SPF information, then the receivers can use SPF PASS results in combination with a white list to identify the known reliable sender.

  6. How to monitor the reputation of your IP address

    by

    When you send big amount of emails, you have to constantly watch your email reputation. Broadly speaking “email reputation” is the amount of trust your sender IP enjoys from email inbox providers. Since they don’t give you direct feedback you have to check the email reputation of your sender IPs yourself. Since there are thousands and thousands of email inbox providers, it’s impossible to check your email reputation at every single one of them.

    There are a number of sites online that provide information to the public about the reputation of an IP address.

    Existing tools

    Sender Score - They collect data from certain ISP’s and block lists. They calculate a sender score using a proprietary formula running from 1-100 for each IP address sending mails to their network. Higher the score means having a better reputation. It can be inaccurate for IP’s sending them very low values of e-mail. Some Internet Service Provider’s use this site to feed into their delivery decision engines.

    AOL reputation This site reports the reputation of IP’s as determined by it. Scales of Good, Poor or Neutral can be used.


    SenderBase
    Provided by Ironport/Cisco. This site publically collects available data from their userbase. Then the reputation is reported by them as ‘Good, Poor or Neutral’. They feed into some Internet Service Provider’s decision engines.


    RoadRunner blocks This site reports whether a particular IP address is currently being blocked from sending mail to RoadRunner or not.


    Spamhaus blocks This site reports whether an IP address is listed currently on the Spamhaus lists or not.


    SendmailReputation This site reports the reputation of an IP address as measured by Sendmail.


    Trusted Source This site is provided by McAfee.


    Commtouch This site is provided by Commtouch.


    Barracuada Central This site is provided by Barracuada and it shows what IP addresses are currently blocked.


    SNDSThis site is provided by Microsoftand is used by Hotmail and Live.com. It shows the IP addresses which are currently blocked by Microsoft.

    The IP reputation to track computer crimes

    An IP address must be genuine and the sites mentioned above can be used to check the reputation of the IP address. A bad IP address is one which is intentionally known to send spam or has been identified as a zombie. Either of these can cause the sender’s email being blocked. A zombie computer is one which is compromised by an attacker without the operator’s knowledge. A hacker uses a zombie computer for carrying out illegal activities such as attacking the other computers on the internet network and sending spam emails.

    SPAM emails are unsolicited emails used for spreading dangerous computer data. The owner of the zombie computer can be held for all the illegal activities taking place in the background and can also be held liable for the entire unknown activity.

    Hence checking the IP address reputation is a great tool for being alert from all the crimes. The huge number of sites can be used to check the reputation of the IP address and the user can be protected from various unhealthy threats.

  7. Dos and Don’ts on setting up a SMTP Server

    by

    While setting up an SMTP server certain Dos and Don’ts have to be kept in mind, otherwise the transfer may not take place properly. To configure email relaying, all the data must be modified carefully. Modern SMTP servers require authentication of clients by credentials before allowing any access. This more flexible system is friendly to the mobile users and allows them for having a fixed choice of a configured outbound SMTP server.

    image

    [ETRN] command

    Remote Message Queue Starting is a special feature of SMTP that permits a remote host to start processing of the mail queue on a particular server so that it receives the messages destined to it by sending the ‘Turn’ command. This feature when deemed to be insecure; was extended in RFC 1985 with the [ETRN] command, which is more secure as it uses an authentication method based on Domain Name System information.


    [MAIL], [RCPT] and [DATA] commands

    An SMTP transaction mainly consists of three command and reply sequences. [MAIL] command is used to establish the return address. This is the address to which bounce messages are sent. [RCPT] command is used to establish a recipient for the message. This command can be issued multiple times but once for each recipient. [DATA] consists of a message header and a message body separated by an empty line. It is a group of commands. The server replies once to the [DATA] command to acknowledge that whether it is ready to receive the text and secondly after the end of data sequence for accepting or rejecting the entire message. These things should be very carefully prepared while setting up an SMTP server.


    SMTP authentication

    SMTP authentication and sender match authentication spoofed emails can be a big problem. Also now some compliancy agencies require mail servers to ensure that emails can’t be spoofed. Hence mail admins should surely enforce SMTP authentication and then take the step of enabling sender match authentication. So that the mail server ensures the sending address matches with the SMTP authentication address. Doing this will drastically reduce if not completely eliminate, the sender’s spoofing mail accounts.


    Check the reports

    An eye on the reports must be kept necessarily. Smarter mail has a number of reports that the admins can use to keep an eye on their server, traffic and the spam that’s being caught and much more. Reports are a unique and great way to spot trends and identify the potential for trends, so that admins can head issues before they become big problems. Some reports important interest are-SMTP Out usage, SMTP Out Connections, Outgoing Spam Reports.

    Locking down the mailing lists is also important. Mailing lists can be a big problem, especially if they are set in an improper manner. Only moderators should be allowed to post a list unless the list being very small or very well managed. The mailing list email must be set to lower priority. Throttle the outgoing messages. These small Dos and Don’ts can be followed while setting up an SMTP server.

  8. How to choose an SMTP server

    by

    With Email being older than the World Wide Web itself, it comes to no surprise that there is a plethora of SMTP server implementations out there. They range from command line applications to full blown corporate servers, covering all operating systems with prices going from zero for open source servers to tens of thousands of dollars.

    But besides the huge variety of servers out there, the market is established enough to have some real leaders.

    Sendmail, Postfix, Exim, and Microsoft Exchange Server together cover about 85% of the total market, which gives us reason enough to concentrate on these famous four first.

    Of all four, only Microsoft Exchange runs on Windows, leaving users of this operating system no choice. There are however a couple of smaller SMTP servers for Windows out there, notably hMailServer, which comes at no cost. When you have a Linux-based system, you can choose between the other three.

    When it comes to features, they all cover more or less the same, namely almost everything. However, the more features a system offers, the more complex it becomes.


    Complexity

    When choosing a server you should ask yourself whether you really need all these features or whether there might be a smaller server covering only the subset of features that you really need. Unneeded features may slow the server down or not, they definitely blow up the documentation and steepen the learning curve. Going with a less feature-rich server may therefore save you quite some time.


    Support

    Emailing is a very complex topic and so are most of the SMTP server implementations out there. As your SMTP system complexity increases you will need the help of experts. This can be quite problematic when you chose a lesser-known system and is quite easy when you go with the mainstream. You should definitely do some research on which systems are supported by experts in your area, because local support is really important, whether you hire someone or whether you pay a consulting firm to do the job. When things are on fire, it’s good to be able to walk to the person in charge.


    Pricing

    Surprisingly most of the biggest SMTP server implementations are open source and don’t cost you a penny no matter you big you are. Same as with Linux vs Windows, free in software does equal to free in money terms. Most of the Linux servers, notably Sendmail, are really complex and hard to configure. Without the help of true experts you soon end with a broken system. Microsoft software on the other costs a lot yet sometimes is definitely easier to set up and configure. Most often, your operating system is already chosen, so you have to go with one or the other anyway. Just keep in mind that the real cost factors are configuration, support, and maintenance.

    We hope that keeping these three factors, Complexity, Support, and Pricing in mind, you make the right choice and keep the total cost of ownership down.

  9. From Tel Aviv to Paris: 2 Israeli guys in France

    by

    We met Matan Markovics and Almog Luz last May during a hackathon in Tel Aviv. Both of them are developers, very active in the local startup community. We were impressed by their creativity and loved the way they used the Mailjet API to conceive CyberQueue, an online queue management tool (lines in public services seem to be a major issue in Israel). That is why we invited them to discover the Parisian tech scene. Matan accepted to give us some feedbacks about this experience.

    image

    How would you compare the Paris startup community to the one existing in Tel Aviv?

    What impressed me the most was the fact that there is not one but multiple tech communities in Paris. There are clusters, accelerators, studios, co-working spaces… where you can find several different startups that work together. And those small groups of people full of ideas work together on an even larger scale. With this kind of process, everybody know what is going on and can establish new partnership with local companies. It is a different kind of emulation than what exists in Tel Aviv. And I like it!

    During your Parisian trip, you have met French developers during another hackathon, Hack – Make – The Bank. What were your impressions?

    The participants of this event were asked to develop and work on projects about banking security and other financial issues. I liked that idea a lot. Really cool projects were conceived that day. In fact, I think that is the essence of what hackathons should be: places to create new uses of existing programs, codes or APIs.

    It reminded me a lot of what we did in May. When you participate to a hackathon, you have very short time to find clever solutions to answer the problem that has been asked. In that kind of context, we, developers, like to use quick and easy APIs. That is why we choosed the Mailjet’s API when we created CyberQueue.

    What did you learn during your stay in Paris that could have improved the way you work today?

    I think that Paris is the perfect city for startups. Like I said, the tech community is already established and strong. Mailjet is a good example of this, as a matter of fact! It started from scratch and now the company is one of the leaders in marketing and transactional emailing. I like to think that its growth and rise to success are linked to this dynamic Parisian environment. So, yes, we can learn one thing or two from you guys! That is why I intend to come back in France soon!

  10. Safer Internet Day - How Mailjet helps

    by

    Safer Internet Day is today. We, at Mailjet, want to use this opportunity to demonstrate that Email as a Service platforms can actively fight against phishing, a threat to a safe Internet.

    image

    Let’s take a look at the latest study made by the Anti-Phishing Working Group:

    For the first half of 2013 alone, they identified 53,685 phishing domains. 12,173 of which were directly registered by phishers, twice the number found in the second half of 2012. The most popular phishing target was Paypal, with 13,498 attacks, representing 18.3% of the total.

    How does Mailjet and other Email as a Service leaders help to overcome this problem? At least three barriers are set up.

    Let’s take an example. XYZ Corporation uses Mailjet to send its emails. One Wednesday evening the phishing mafia sends emails claiming to come from the company’s domain, xyz.com. What they don’t know is that Mailjet urges all customers to use SPF…


    Barrier 1: Sender Policy Framework (SPF)

    image

    SPF allows the owner of a domain to restrict sending of valid emails by specifying a list of valid IPs. He does this by adding a TXT record to his domain, which is kind of a meta information everyone can see. The content of this TXT record is a list of IPs which can be used to send valid emails. Each time a mail server receives an email from this domain, it will look up this TXT record and check whether the IP from where the email comes from, is included in the list of valid IPs. If this is not the case, the email can be marked as a phishing or spam attempt.

    Since the emails sent by the phishing mafia claim to come from xyz.com but have an IP address not included in the SPF list, the email gets filtered out and no harm is done.

    One week later, the phishing mafia learned about SPF and told its developers to change the sender IP address so that it matches an address included in the SPF filter.

    Again, they missed something. Every Mailjet customer gets plug and play DKIM.


    Barrier 2: Domain Keys Identified Mail (DKIM)

    DKIM allows a domain owner to use the power of asymmetrical encryption to prevent misuse by phishers and spammers. Asymmetrical encryption means that one generates a pair of keys, one of which is public and the other is private. The private key has to be kept away from the public and is used to generate a specific electronic signature for each email.

    This signature is basically a string of characters in which information about the content of the email is encrypted.

    The public key is added as a TXT record to the domain. Now, each time a mail is sent, it gets a signature. When an email server receives one of these emails, it checks the domain records for the public key entry. The public key tells whether the signature was made by his brother, the secret key, or not. If it wasn’t the email can be considered a phishing or spam attempt.

    Barrier 3: Email Pattern Filters

    Having failed twice, the only hope for the phishing mafia is to get access to the XYZ web server. Hopefully our friends from the Server Security Industry made a good job, but for sake of a good example lets say the mafia succeeds and now has full access to the XYZ web site, at least for the crucial first 12 hours because this is where most of the money is made by the phishing mafia. The mafia now can send emails and neither SPF nor DKIM cause alarm because both the IP addresses and the signature are correct. But this also means that emails are now sent via Mailjet’s SMTP Relay.

    Even so, the phishing mafia’s emails are still passed through Big Data algorithms like Bayesian Inference. Their purpose is to recognize frequency and content patterns in real time. Most likely will the phishing mafia send a different amount of emails than XYZ Corporation used to do. The content of the emails will differ as well. If these patterns diverge by a certain amount, an alarm is caused and emails are put on queue until the issue is resolved. This gives XYZ Corporation enough time to detect the attack and take measures.


    Invisible actions for the end user are undertaken every day, so that he can enjoy an always safer Internet. Mailjet brings its own contribution to the task.