Home>SMTP and Mail

Email Outbound Hardening

Configure ColdFusion mail services with proper authentication, encryption, rate limiting, and error handling to ensure reliable and secure email delivery.

Mail Server Configuration

You should configure mail servers in the ColdFusion Administrator following these security best practices:

Use a dedicated SMTP relay service instead of attempting direct delivery to recipient mail servers
Enable STARTTLS or SSL/TLS encryption to protect email content in transit
Require SMTP authentication to prevent unauthorized use of your mail server
Store SMTP credentials in an external secrets manager rather than in the Administrator
Set an appropriate connection timeout between 30-60 seconds to handle network issues gracefully

Example Configuration

// In ColdFusion Administrator > Mail
Mail Server: smtp.sendgrid.net
Port: 587 (STARTTLS) or 465 (SSL)
Username: apikey
Password: <from secrets manager>
Use TLS: Yes
Verify Connection: Yes
Timeout: 60 seconds

Secure Email Sending

<cfmail
    to="#recipientEmail#"
    from="noreply@example.com"
    subject="Order Confirmation"
    type="html"
    server="smtp.sendgrid.net"
    port="587"
    useSSL="false"
    useTLS="true"
    username="#application.smtpUser#"
    password="#application.smtpPass#">

    <cfmailpart type="text/plain">
        Plain text version for email clients that don't support HTML
    </cfmailpart>

    <cfmailpart type="text/html">
        <html>
            <body>
                <h1>Order Confirmation</h1>
                <p>Thank you for your order!</p>
            </body>
        </html>
    </cfmailpart>
</cfmail>

Authentication and Encryption

Always use authentication: Prevents open relay abuse
STARTTLS (port 587): Upgrades connection to encrypted
SSL/TLS (port 465): Encrypted from start
Avoid plain SMTP (port 25): Unencrypted and often blocked

Security: Never send mail without authentication and encryption in production environments.

Rate Limiting and Throttling

You should implement rate limiting to prevent abuse and avoid hitting SMTP provider sending limits:

Configure the maximum number of concurrent connections in the ColdFusion Administrator
Implement application-level throttling for bulk email sends to stay within provider limits
Use mail queues with spooling for handling large volumes of emails
Monitor your email send rates using the Performance Monitoring Toolset (PMT)

// Application.cfc - Rate limiting example
function sendThrottledEmail(to, subject, body) {
    // Check rate limit (e.g., max 100 emails per minute)
    var rateLimitKey = "email_rate_limit";
    var currentMinute = dateFormat(now(), "yyyymmdd_hhmm");
    var cacheKey = rateLimitKey & "_" & currentMinute;

    var count = cacheGet(cacheKey) ?: 0;

    if (count >= 100) {
        throw(type="RateLimitExceeded", message="Email rate limit exceeded");
    }

    // Send email
    cfmail(...);

    // Increment counter
    cachePut(cacheKey, count + 1, createTimeSpan(0, 0, 2, 0));
}

Error Handling and Dead Letter Queue

You should implement robust error handling to gracefully manage failed email delivery:

Enable mail spooling to automatically retry delivery when transient failures occur
Configure the maximum number of retry attempts before giving up
Log all failed email attempts for later analysis and debugging
Implement a dead letter queue to handle permanent delivery failures
Regularly monitor the undelivered mail directory for messages that couldn't be sent

// Enable spooling in Administrator
Spool Interval: 15 seconds
Max Delivery Threads: 5
Enable Spooling: Yes

// Monitor undelivered mail
<cfdirectory
    action="list"
    directory="#expandPath('{cf_root}/Mail/Undelivr')#"
    name="undeliveredMail">

<cfif undeliveredMail.recordCount GT 0>
    <!--- Alert operations team --->
    <cflog file="mail_errors" type="error"
        text="Undelivered mail count: #undeliveredMail.recordCount#">
</cfif>

Email Security Best Practices

Input Validation: Validate and sanitize all email addresses
SPF/DKIM/DMARC: Configure DNS records for deliverability
Content Filtering: Prevent injection attacks in email content
Attachment Limits: Restrict attachment size and types
Header Injection: Validate custom headers to prevent injection

// Email validation
function isValidEmail(email) {
    return reFindNoCase("^[A-Z0-9._%+-]+@[A-Z0-9.-]+.[A-Z]{2,}$", email);
}

// Prevent header injection
function sanitizeEmailHeader(value) {
    return reReplace(value, "[
]", "", "ALL");
}

Separate Mail Relay Architecture

For high-volume or mission-critical applications, consider implementing a more robust mail relay architecture:

Use separate mail relay servers that run independently from your application nodes
Implement a mail queue using a message broker like RabbitMQ or Amazon SQS
Scale mail processing workers independently from your application servers
Use dedicated IP addresses for sending email to maintain good sender reputation

Monitoring and Observability

Track email send rates and failures in PMT
Alert on spike in failures or undelivered mail
Monitor SMTP provider rate limits and quotas
Dashboard showing delivery success rate
Track bounce rates and categorize (hard vs soft)

Email Security Checklist

SMTP authentication enabled
STARTTLS or SSL/TLS encryption configured
Credentials stored in secrets manager
Rate limiting implemented
Mail spooling enabled with retry logic
Email addresses validated before sending
SPF, DKIM, DMARC records configured
Undelivered mail monitored
Send success/failure rates tracked

Gotchas

Port 25 often blocked by cloud providers - use 587 or 465
Missing SPF/DKIM records causes delivery to spam folders
Bulk sends without throttling trigger provider rate limits
Unmonitored undelivered mail directory fills disk
Hard-coded SMTP credentials in code create security vulnerabilities
Header injection in custom headers allows email spoofing

References

Need Help?

Convective can help configure secure, reliable email delivery for ColdFusion applications. Find out more.