Home>SMTP and Mail

Email Outbound Hardening

Configure ColdFusion mail services with proper authentication, encryption, rate limiting, and error handling to ensure reliable and secure email delivery.

Mail Server Configuration

You should configure mail servers in the ColdFusion Administrator following these security best practices:

  • Use a dedicated SMTP relay service instead of attempting direct delivery to recipient mail servers
  • Enable STARTTLS or SSL/TLS encryption to protect email content in transit
  • Require SMTP authentication to prevent unauthorized use of your mail server
  • Store SMTP credentials in an external secrets manager rather than in the Administrator
  • Set an appropriate connection timeout between 30-60 seconds to handle network issues gracefully

Example Configuration

// In ColdFusion Administrator > Mail
Mail Server: smtp.sendgrid.net
Port: 587 (STARTTLS) or 465 (SSL)
Username: apikey
Password: <from secrets manager>
Use TLS: Yes
Verify Connection: Yes
Timeout: 60 seconds

Secure Email Sending

<cfmail
    to="#recipientEmail#"
    from="noreply@example.com"
    subject="Order Confirmation"
    type="html"
    server="smtp.sendgrid.net"
    port="587"
    useSSL="false"
    useTLS="true"
    username="#application.smtpUser#"
    password="#application.smtpPass#">

    <cfmailpart type="text/plain">
        Plain text version for email clients that don't support HTML
    </cfmailpart>

    <cfmailpart type="text/html">
        <html>
            <body>
                <h1>Order Confirmation</h1>
                <p>Thank you for your order!</p>
            </body>
        </html>
    </cfmailpart>
</cfmail>

Authentication and Encryption

  • Always use authentication: Prevents open relay abuse
  • STARTTLS (port 587): Upgrades connection to encrypted
  • SSL/TLS (port 465): Encrypted from start
  • Avoid plain SMTP (port 25): Unencrypted and often blocked
Security: Never send mail without authentication and encryption in production environments.

Rate Limiting and Throttling

You should implement rate limiting to prevent abuse and avoid hitting SMTP provider sending limits:

  • Configure the maximum number of concurrent connections in the ColdFusion Administrator
  • Implement application-level throttling for bulk email sends to stay within provider limits
  • Use mail queues with spooling for handling large volumes of emails
  • Monitor your email send rates using the Performance Monitoring Toolset (PMT)
// Application.cfc - Rate limiting example
function sendThrottledEmail(to, subject, body) {
    // Check rate limit (e.g., max 100 emails per minute)
    var rateLimitKey = "email_rate_limit";
    var currentMinute = dateFormat(now(), "yyyymmdd_hhmm");
    var cacheKey = rateLimitKey & "_" & currentMinute;

    var count = cacheGet(cacheKey) ?: 0;

    if (count >= 100) {
        throw(type="RateLimitExceeded", message="Email rate limit exceeded");
    }

    // Send email
    cfmail(...);

    // Increment counter
    cachePut(cacheKey, count + 1, createTimeSpan(0, 0, 2, 0));
}

Error Handling and Dead Letter Queue

You should implement robust error handling to gracefully manage failed email delivery:

  • Enable mail spooling to automatically retry delivery when transient failures occur
  • Configure the maximum number of retry attempts before giving up
  • Log all failed email attempts for later analysis and debugging
  • Implement a dead letter queue to handle permanent delivery failures
  • Regularly monitor the undelivered mail directory for messages that couldn't be sent
// Enable spooling in Administrator
Spool Interval: 15 seconds
Max Delivery Threads: 5
Enable Spooling: Yes

// Monitor undelivered mail
<cfdirectory
    action="list"
    directory="#expandPath('{cf_root}/Mail/Undelivr')#"
    name="undeliveredMail">

<cfif undeliveredMail.recordCount GT 0>
    <!--- Alert operations team --->
    <cflog file="mail_errors" type="error"
        text="Undelivered mail count: #undeliveredMail.recordCount#">
</cfif>

Email Security Best Practices

  • Input Validation: Validate and sanitize all email addresses
  • SPF/DKIM/DMARC: Configure DNS records for deliverability
  • Content Filtering: Prevent injection attacks in email content
  • Attachment Limits: Restrict attachment size and types
  • Header Injection: Validate custom headers to prevent injection
// Email validation
function isValidEmail(email) {
    return reFindNoCase("^[A-Z0-9._%+-]+@[A-Z0-9.-]+.[A-Z]{2,}$", email);
}

// Prevent header injection
function sanitizeEmailHeader(value) {
    return reReplace(value, "[
]", "", "ALL");
}

Separate Mail Relay Architecture

For high-volume or mission-critical applications, consider implementing a more robust mail relay architecture:

  • Use separate mail relay servers that run independently from your application nodes
  • Implement a mail queue using a message broker like RabbitMQ or Amazon SQS
  • Scale mail processing workers independently from your application servers
  • Use dedicated IP addresses for sending email to maintain good sender reputation

Monitoring and Observability

  • Track email send rates and failures in PMT
  • Alert on spike in failures or undelivered mail
  • Monitor SMTP provider rate limits and quotas
  • Dashboard showing delivery success rate
  • Track bounce rates and categorize (hard vs soft)

Email Security Checklist

  • SMTP authentication enabled
  • STARTTLS or SSL/TLS encryption configured
  • Credentials stored in secrets manager
  • Rate limiting implemented
  • Mail spooling enabled with retry logic
  • Email addresses validated before sending
  • SPF, DKIM, DMARC records configured
  • Undelivered mail monitored
  • Send success/failure rates tracked

Gotchas

  • Port 25 often blocked by cloud providers - use 587 or 465
  • Missing SPF/DKIM records causes delivery to spam folders
  • Bulk sends without throttling trigger provider rate limits
  • Unmonitored undelivered mail directory fills disk
  • Hard-coded SMTP credentials in code create security vulnerabilities
  • Header injection in custom headers allows email spoofing

Need Help?

Convective can help configure secure, reliable email delivery for ColdFusion applications. Find out more.