ideal mail server settings?

[jthorpe]

What's the best way to keep my order fulfillment setup secure? Since Miva domain settings only ask me for the mail server address, and Order Fulfillment only asks me for the email address...basically anyone who knows that email address and mail server could easily spoof the address and use it for phishing purposes. Right?

I'd be a little more comfortable if I could use Miva with an SSL server, or at least with password-authentication. Is there a way to do that with Miva?

[ILoveHostasaurus]

Re: ideal mail server settings?

Typically Merchant would be set up to use a mail server that only allows relaying from software running local to the server; localhost being the most common mail server setting. That eliminates the need for any authentication since the server won't accept email from anyone else, or if it does, they would have to authenticate since they'd be coming from remote.

If your store uses a mail server other than itself, then hopefully the admin of that mail server has set it up to only allow the server your store is on to relay through.

In either case, there's nothing yet available that can prevent an email address from being forged; there are proposed standards that can reduce the number of servers that will accept those forged messages but nothing can prevent their creation.

[jthorpe]

Re: ideal mail server settings?

The mail server in question is indeed off-site, and the administrator has set it up so that only the IP address of my Miva server (at hostasaurus) is allowed to use port 25. So, I guess that answers the question.

The problem, though, is that my Miva account is seemingly unable to send any order fulfillment messages with these settings. Each time I attempt to make a test purchase, Miva throws up the error message that it timed out while attempting to communicate with the mail server. Any idea how to troubleshoot that?

Thanks for replying so promptly, David!

[ILoveHostasaurus]

Re: ideal mail server settings?

Open a ticket with us and we'll help you troubleshoot; I'm guessing the remote server is allowing your site through but not allowing the primary IP of the server in question through, which is where the connection would appear to come from.