Email Changes at IONOS

[Stompa]

I've just received an email from IONOS which refers to 'Important Change for Sending Emails with Different Sender Addresses', and links to the following article:

https://www.ionos.co.uk/help/index.php?id=5380

I'm not sure whether I've understood this correctly, but does it effectively mean that you will no longer be able to use aliases in Thunderbird (or any other email client for that matter)?

Thanks

[mc2fool]

I've just received an email from IONOS which refers to 'Important Change for Sending Emails with Different Sender Addresses', and links to the following article:

https://www.ionos.co.uk/help/index.php?id=5380

I'm not sure whether I've understood this correctly, but does it effectively mean that you will no longer be able to use aliases in Thunderbird (or any other email client for that matter)?

Maybe. Does IONOS currently let you send out messages from non-existent addresses? I'd actually be a bit surprised if they do 'cos most email service providers don't, but then the article kind of implies that maybe they currently do but are going to stop it...

However, a valid existing address doesn't necessarily mean a mailbox; it can be a forwarder. With my provider (Hostpresto) I only have one mailbox, me@mydomain, but I have a whole bunch of forwarders, xxx@mydomain, yyy@mydomain, zzz@mydomain, all of which forward to me@mydomain, and I can, with Thunderbird, send out from any of those addresses. But they won't let me send out from anything@mydomain that isn't a valid address to receive to.

Now, the IONOS link you give doesn't explicitly cover that, but it does say "If you set up the previously used sender address as a forwarding address and it contains a different domain, this forwarding address can no longer be used as the sender address.", with the implication that if it's a forwarder to the same domain, as with my example above, then you can use it as a sender address. Clear as mud though....

[Infrasonic]

There's an ongoing conflict in the email world between privacy (anonymity) and security (authentication), and aliases unfortunately are massively abused by spammers so the authentication side is slowly winning. Some of the privacy focused email services like Proton mail, Start mail, Tutanota already have issues with blanket blocks on their IP address ranges by certain email services because of spammer abuse of aliases.

The majors are tightening the email authentication noose again in 2024 and this IONOS move is probably to stay aligned with the likes of Gmail, Yahoo, Outlook.com rules and avoid domain email inbox delivery problems going forward.

There's not much you can do - the vast majority of email traffic is controlled by the above so they effectively set the agenda for the acceptable sending environment. Spam is still a major issue so it does need addressing, expect minimum authentication requirements to tighten more each year for sending domain email.

As IPv6 becomes more prevalent that will also help with weeding out spammers quickly as they can't hide behind IPv4 double/CGNAT as much - so the ripple affect on innocent parties should (hopefully) lessen...

[Stompa]

However, a valid existing address doesn't necessarily mean a mailbox; it can be a forwarder. With my provider (Hostpresto) I only have one mailbox, me@mydomain, but I have a whole bunch of forwarders, xxx@mydomain, yyy@mydomain, zzz@mydomain, all of which forward to me@mydomain, and I can, with Thunderbird, send out from any of those addresses. But they won't let me send out from anything@mydomain that isn't a valid address to receive to.

Now, the IONOS link you give doesn't explicitly cover that, but it does say "If you set up the previously used sender address as a forwarding address and it contains a different domain, this forwarding address can no longer be used as the sender address.", with the implication that if it's a forwarder to the same domain, as with my example above, then you can use it as a sender address. Clear as mud though....

Thanks, I use a similar technique, but rather than using forwarders for xxx@mydomain, yyy@mydomain, zzz@mydomain, etc.... I just use *@mydomain. So anything@mydomain will be forwarded to my mailbox. Currently I can then use 'Customize From Address...' in Thunderbird to send out from anything@mydomain. Quite whether that will continue to be the case is as you suggest as 'clear as mud'!

[Stompa]

There's an ongoing conflict in the email world between privacy (anonymity) and security (authentication), and aliases unfortunately are massively abused by spammers so the authentication side is slowly winning. Some of the privacy focused email services like Proton mail, Start mail, Tutanota already have issues with blanket blocks on their IP address ranges by certain email services because of spammer abuse of aliases.

The majors are tightening the email authentication noose again in 2024 and this IONOS move is probably to stay aligned with the likes of Gmail, Yahoo, Outlook.com rules and avoid domain email inbox delivery problems going forward.

There's not much you can do - the vast majority of email traffic is controlled by the above so they effectively set the agenda for the acceptable sending environment. Spam is still a major issue so it does need addressing, expect minimum authentication requirements to tighten more each year for sending domain email.

As IPv6 becomes more prevalent that will also help with weeding out spammers quickly as they can't hide behind IPv4 double/CGNAT as much - so the ripple affect on innocent parties should (hopefully) lessen...

Groan, I had a horrible suspicion it might be something along those lines. Thanks!

[Tubaman]

I'm also with IONOS and got the same notification. I spent an hour on the phone to their support team who really struggled to understand my use case and couldn't help, and told me to email their complaints address. The complaints department responded promptly, but said they cannot help and the change will go ahead as it's necessary to prevent people sending spam from fake addresses.

For me (and anyone else using catch-all email addresses like accounts@my-domain.com, sales@my-domain.com etc. to redirect to a individual mailbox), it will no longer be possible to reply to emails using these aliased addresses, it will only be possible to reply from a real user's mailbox address, which seems to defeat the whole point of using aliased addresses to mask the real address of an individual user.

Why IONOS can't fix this in a less disruptive way I fail to see - surely they could just restrict the maximum volume of sent emails from aliased addresses to something reasonable for the package. And surely it won't fix the issue as they describe it anyway - if some of their customers are sending spam, they can just create a temporary mailbox with their chosen address and then delete it afterwards and continue using a catch-all for the replies.

I've spent a few hours today trying to find a solution but to no avail sadly. I thought I'd found the answer with simplelogin.io, but upon trying it out I discovered that while you can have catch all addresses at a custom domain with them and be able to reply to these using any email client, the domain cannot be the same one which hosts the real underlying mailbox - they don't provide hosting themselves. So for my use case where I already have email hosting elsewhere for my custom domain, and wish to maintain the ability to send mails directly from real mailbox addresses to trusted contacts, I cannot transfer the email DNS records for that domain to work with simplelogin without breaking the real mailboxes.

If anyone does know of an email hosting provider which allows sending of emails using any address at a given domain, I'd be most interested to hear.

[mc2fool]

However, a valid existing address doesn't necessarily mean a mailbox; it can be a forwarder. With my provider (Hostpresto) I only have one mailbox, me@mydomain, but I have a whole bunch of forwarders, xxx@mydomain, yyy@mydomain, zzz@mydomain, all of which forward to me@mydomain, and I can, with Thunderbird, send out from any of those addresses. But they won't let me send out from anything@mydomain that isn't a valid address to receive to.

Now, the IONOS link you give doesn't explicitly cover that, but it does say "If you set up the previously used sender address as a forwarding address and it contains a different domain, this forwarding address can no longer be used as the sender address.", with the implication that if it's a forwarder to the same domain, as with my example above, then you can use it as a sender address. Clear as mud though....

Thanks, I use a similar technique, but rather than using forwarders for xxx@mydomain, yyy@mydomain, zzz@mydomain, etc.... I just use *@mydomain. So anything@mydomain will be forwarded to my mailbox. Currently I can then use 'Customize From Address...' in Thunderbird to send out from anything@mydomain. Quite whether that will continue to be the case is as you suggest as 'clear as mud'!

I don't use the catch-all 'cos there are far too many try-a-random-username@mydomain fishing attempts, however I just tried temporarily turning it on and then my provider allows me to send out messages from anything@mydomain even if there's no forwarder for anything.

I'm not familiar with the IONOS setup, is it a cPanel with Exim system?

[mc2fool]

I'm also with IONOS and got the same notification. I spent an hour on the phone to their support team who really struggled to understand my use case and couldn't help, and told me to email their complaints address. The complaints department responded promptly, but said they cannot help and the change will go ahead as it's necessary to prevent people sending spam from fake addresses.

But did you question them on the point in the final paragraph of my first post above, viewtopic.php?p=630905#p630905, in which I note that their info seems to imply that you'll be able to use any address for sending out as long as you have a same-domain forwarder set up for it.

If anyone does know of an email hosting provider which allows sending of emails using any address at a given domain, I'd be most interested to hear.

Yes, as per my post immediately above, my provider, https://hostpresto.com/ does -- at least for my cPanel websites+email hosting package, https://hostpresto.com/cpanel-hosting/. I don't know if their just-email hosting packages do but you can always ask them.

[Stompa]

Thanks, I use a similar technique, but rather than using forwarders for xxx@mydomain, yyy@mydomain, zzz@mydomain, etc.... I just use *@mydomain. So anything@mydomain will be forwarded to my mailbox. Currently I can then use 'Customize From Address...' in Thunderbird to send out from anything@mydomain. Quite whether that will continue to be the case is as you suggest as 'clear as mud'!

I don't use the catch-all 'cos there are far too many try-a-random-username@mydomain fishing attempts, however I just tried temporarily turning it on and then my provider allows me to send out messages from anything@mydomain even if there's no forwarder for anything.

I've not found that a problem, though in reality I'm actually using a subdomain anything@mail.mydomain rather than anything@mydomain.

I'm not familiar with the IONOS setup, is it a cPanel with Exim system?

I'm afraid I know little about cPanel, but Google seems to suggest that IONOS uses it's own proprietary control panel.

[genou]

For me (and anyone else using catch-all email addresses like accounts@my-domain.com, sales@my-domain.com etc. to redirect to a individual mailbox), it will no longer be possible to reply to emails using these aliased addresses, it will only be possible to reply from a real user's mailbox address, which seems to defeat the whole point of using aliased addresses to mask the real address of an individual user.

Since you have spoken to them, can you clarify what a "real user's mailbox" is ? I have a handful of domains on a single IONOS account, so what is the real user attached to each of those domains?

Did they say anything about their mail offerings? Most of my addresses are incoming only; I have a handful that are also outgoing. I see they will sell me Mail Basic licences to create additional mailboxes, but does that make them "real"? I'm pretty sure I'm going to have to talk to them, but any forewarning would be gratefully received.

In passing ( given where we are ) , I note that AJBell are one broker who will only accept comms from a registered email address, so that could get interesting.

If anyone does know of an email hosting provider which allows sending of emails using any address at a given domain, I'd be most interested to hear.

As would I.

Edit> bunch of replies while I was writing, apologies if there is duplication.

[Stompa]

I'm also with IONOS and got the same notification. I spent an hour on the phone to their support team who really struggled to understand my use case and couldn't help, and told me to email their complaints address. The complaints department responded promptly, but said they cannot help and the change will go ahead as it's necessary to prevent people sending spam from fake addresses.

For me (and anyone else using catch-all email addresses like accounts@my-domain.com, sales@my-domain.com etc. to redirect to a individual mailbox), it will no longer be possible to reply to emails using these aliased addresses, it will only be possible to reply from a real user's mailbox address, which seems to defeat the whole point of using aliased addresses to mask the real address of an individual user.

Well that wasn't what I wanted to hear, but thanks for the info.

[Tubaman]

But did you question them on the point in the final paragraph of my first post above, in which I note that their info seems to imply that you'll be able to use any address for sending out as long as you have a same-domain forwarder set up for it.

I did explain to them my scenario which is all about a single domain to them (catch all to receive from any address e.g. 'sales@mydomain' and then send using SMTP with the from header set to 'sales@mydomain' and they said this would cease to work. But they support chap did seem very confused, 4 times he had to put me on hold to chat to his 2nd-line support colleague, so a fair chance he misunderstood. So, as you say, 'clear as mud'. Sadly I don't wish to wait until January to find it all suddenly stops working and be left with no time to change provider.

Yes, as per my post immediately above, my provider, hostpresto.com does -- at least for my cPanel websites+email hosting package. I don't know if their just-email hosting packages do but you can always ask them.

I'll take a look at their offering, many thanks for the info.

PS Sorry I had to remove links in your quotes above as the board doesn't allow me to use links yet.

[Tubaman]

Since you have spoken to them, can you clarify what a "real user's mailbox" is ? I have a handful of domains on a single IONOS account, so what is the real user attached to each of those domains?

Did they say anything about their mail offerings? Most of my addresses are incoming only; I have a handful that are also outgoing. I see they will sell me Mail Basic licences to create additional mailboxes, but does that make them "real"? I'm pretty sure I'm going to have to talk to them, but any forewarning would be gratefully received.

I currently have their 'Mail Basic' email hosting, which provides 3 'real' mailboxes - by real I mean an address providing actual email storage and SMTP/POP/IMAP access, which I connect to from my email client to send and receive email, as opposed to a 'forwarded' address e.g. 'sales@mydomain' which is forwarded to one of my real mailboxes so I can mask my actual personal email address from some companies.

[Stompa]

The actual email I received from IONOS said:

We have noticed that you are sending emails with alternate or blank sender addresses through our email servers. This can pose a security risk and cause other email providers to reject these emails or classify them as spam.

To increase security for all email customers, as of 15.01.2024, it will only be possible to send emails through our servers if the sender address matches the corresponding mailbox. You can find more information about this in our Help Centre.

What does this mean for you?

For these mailboxes, it will be necessary to make adjustments in the settings of your email programs or the software that sends the emails no later than 14.01.2024:

mailbox1@mydomain.com

mailbox2@mydomain.com

No later than 14.01.2024, please ensure that identical email addresses are set for the sender and authentication at the outgoing mail server (SMTP) in the settings of the software you use. If these addresses do not match, affected emails from 15.01.2024 will be rejected by our SMTP servers with the error message "Sender address is not allowed." and will not be sent.

We have summarised how to make these changes for you in our Help Centre.

It only lists 2 mailboxes which is a bit odd since I actually have 5. I don't understand why the other 3 weren't listed, since I regularly use at least one of those with aliases.

[genou]

I currently have their 'Mail Basic' email hosting, which provides 3 'real' mailboxes....

This looks like it could be fun. I have only one Mail Basic address, which is the account I use to log in to their SMTP servers to send email from underlying Gmail accounts linked to 5 domains registered with them ( various family members ).

So perhaps the only "real" address I have is an SMTP client. Thanks for your help. I'm clearly going to have to talk to them.

Again, traffic while writing.....

[genou]

The actual email I received from IONOS said:



No later than 14.01.2024, please ensure that identical email addresses are set for the sender and authentication at the outgoing mail server (SMTP) in the settings of the software you use. If these addresses do not match, affected emails from 15.01.2024 will be rejected by our SMTP servers with the error message "Sender address is not allowed." and will not be sent.

We have summarised how to make these changes for you in our Help Centre.

That at least makes some sense. If I want to have outgoing aliased email, I have to buy an IONOS Mail account for each alias, so that the account has SMTP credentials to use. Off now to review what gets outgoing. A fair amount is going to get ditched.

Edit: Not that I have had an email yet.

[Stompa]

There's some further discussion which may have some relevance on these German websites:

https://www-borncity-com.translate.goog ... c#comments

https://www.frankysweb.de/ionos-stellt- ... -2024-ein/

[genou]

There's some further discussion which may have some relevance on these German websites:

https://www-borncity-com.translate.goog ... c#comments

https://www.frankysweb.de/ionos-stellt- ... -2024-ein/

Thank you for that. They are in the same loop we are:

it seems sure that
outgoing sender [fred@genou.co.uk] , smtp login [fred@genou.co.uk] is going to work, but it's the trivial case

whereas
outgoing sender [fred@genou.co.uk] , smtp login [router@genou.co.uk] is in question, and it is the one that you'd want to work.

It's mindboggling that IONOS hadn't grasped what they needed to clarify. I assume they will be clarifying ASAP. I'll sit on my hands for a while.

[Midsmartin]

You should be able to use any arbitrary email address if you use cpanel hosting. But there's a snag. These services usually run on servers shared by lots of people, some of whom may send out spam. So it's not uncommon for outgoing email from cpanel email to be blacklisted from time to time by Gmail or Microsoft.

[mc2fool]

You should be able to use any arbitrary email address if you use cpanel hosting.

That depends on how the host is configured. The cPanel/Exim default (Exim is the mail transport agent most commonly used by cPanel hosts) for sender verification is "on", meaning that you can only use outgoing email addresses that you can receive to at your domain.

But there's a snag. These services usually run on servers shared by lots of people, some of whom may send out spam. So it's not uncommon for outgoing email from cpanel email to be blacklisted from time to time by Gmail or Microsoft.

That's potentially the case with any shared host, not just cPanel ones.