# Mailgun leaking server's real IP behind Cloudflare
**URL:** https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128
**Category:** Support
**Created:** [15.Март.2017 03:01:37 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128 "2017-03-15T03:01:37Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@anon67292109](https://meta.discourse.org/u/anon67292109)
#### Post date: [15.Март.2017 03:01:37 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/1 "2017-03-15T03:01:37Z")
Mailgun is leaking my DigitalOcean server IPs via emails deployed for Discourse which is resulting in repeated DDoS attacks.
`Received: from localhost.localdomain (sposting.com [**REAL IP HERE**]) by mxa.mailgun.org with ESMTP id 78c1220.7fe02c20b530-smtp-out-n03; Wed, 15 Mar 2017 01:30:08 -0000 (UTC)`
No DDoSers have discovered this yet.
Additionally, a security researcher just pasted me the following information and told me it was pulled using “linux dig”
```
IP address **REAL IP HERE**
Reverse DNS (PTR record) sposting.com
DNS server (NS record) ns3.digitalocean.com (198.41.222.173)
ns1.digitalocean.com (173.245.58.51)
ns2.digitalocean.com (173.245.59.41)
ASN number 393406
ASN name (ISP) Digital Ocean, Inc.
IP-range/subnet 138.197.80.0/20
138.197.80.0 - 138.197.95.255
```
So it may be leaking in other ways as well but I can’t totally confirm that.
Any ideas?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [15.Март.2017 03:03:51 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/2 "2017-03-15T03:03:51Z")
Why are you reporting this to us? Shouldn’t you contact mailgun about it?
---
### Author:  [@anon67292109](https://meta.discourse.org/u/anon67292109)
#### Post date: [15.Март.2017 03:05:39 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/3 "2017-03-15T03:05:39Z")
I want the solution indexed here in the event someone else runs into the same issue in the future.
I did submit a support ticket there first and I’m waiting on the response. Sometimes it takes Mailgun a long time to respond or they don’t respond at all. Either way, I intend to discover and/or leave a solution to the problem ITT.
Mailgun is commonly used in conjunction with Discourse.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [15.Март.2017 04:49:17 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/4 "2017-03-15T04:49:17Z")
_cough_:
```
$ dig @ns1.digitalocean.com sposting.com +short
138.197.91.157
```
Looks like you setup DNS on DigitalOcean before moving to Cloudflare, then forgot to remove the zone from DO.
---
### Author:  [@anon67292109](https://meta.discourse.org/u/anon67292109)
#### Post date: [15.Март.2017 05:17:45 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/5 "2017-03-15T05:17:45Z")
Derp. Thanks.
That won’t prevent the IP from leaking via Mailgun though, will it? I think I might be limited to Mailgun API only. No idea how I’m going to integrate that if so.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [15.Март.2017 05:20:09 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/6 "2017-03-15T05:20:09Z")
Mailgun is a separate problem, but you’ve got to close off every avenue of leakage if you want to remain DDoS proof.
---
### Author:  [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [15.Март.2017 06:11:12 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/7 "2017-03-15T06:11:12Z")
> [@anon67292109](#):
>
> Mailgun is leaking my DigitalOcean server IPs via emails deployed for Discourse
I warned you for that:
> [@\[PAYING GIG\] migrating servers, tweaking rate limits and implementing signup captcha](https://meta.discourse.org/t/paying-gig-migrating-servers-tweaking-rate-limits-and-implementing-signup-captcha/58859/2):
>
> Make sure your outgoing emails don’t leak the original IP address
I don’t think Mailgun has any options or settings for this. It’s best to set up a separate relay server inbetween Discourse and Mailgun, that removes those headers. See this article: [https://major.io/p/remove-sensitive-information-from-email-headers-with-postfix/](https://major.io/2013/04/14/remove-sensitive-information-from-email-headers-with-postfix/)
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [15.Март.2017 15:33:11 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/8 "2017-03-15T15:33:11Z")
> [@anon67292109](#):
>
> I think I might be limited to Mailgun API only.
If you did a [standard install](https://meta.discourse.org/t/142537?silent=true), you’re delivering mail via SMTP, not the API.
---
### Author:  [@anon67292109](https://meta.discourse.org/u/anon67292109)
#### Post date: [16.Март.2017 00:30:09 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/9 "2017-03-16T00:30:09Z")
> [@michaeld](#):
>
> See this article: [https://major.io/p/remove-sensitive-information-from-email-headers-with-postfix/](https://major.io/2013/04/14/remove-sensitive-information-from-email-headers-with-postfix/)
Going to try to implement this. I’ll let you know how I make out ITT.
> [@pfaffman](#):
>
> If you did a [standard install](https://meta.discourse.org/t/142537?silent=true), you’re delivering mail via SMTP, not the API.
Yes naturally. I’m either going to set up a separate relay server or try to locate and alter the email send code in Discourse; which I understand vanishes upon updates and fresh installs. Uncharted territory. My first attempt will be the former method as it seems the simplest approach.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [16.Март.2017 00:34:59 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/10 "2017-03-16T00:34:59Z")
Yeah. The relay server is the cleaner of those solutions. You could offer a bounty for someone to write a send-with-mailgun-api plugin. I have no idea how hard it’d be, but there are hooks to use mailgun webhooks.
---
### Author:  [@anon67292109](https://meta.discourse.org/u/anon67292109)
#### Post date: [18.Март.2017 06:15:58 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/11 "2017-03-18T06:15:58Z")
Solved.
The quick and dirty solution was indeed a mail relay server. I set up a cheap $5/mo DigitalOcean droplet running Postfix as a Mailgun relay and a custom header\_checks file to prevent the original requesting IP, i.e. my Discourse droplet, from being displayed in the email headers. Discourse now talks to _that_ mailserver opposed to connecting directly to [smtp.mailgun.org](http://smtp.mailgun.org)
A non-SMTP Mailgun API solution be it a plugin, or as an official Discourse option would be incredibly useful for anyone using Cloudflare. An additional fix could be pushed internally at Mailgun as well if they added an option to hide the original requesting IP as is done automatically through their API.
In the meantime this works fine enough.
Thanks to @michaeld, @pfaffman and @mpalmer for the sound advice and I hope this thread serves as reference in the future for anyone experiencing similar issues.
---
### Author:  [@blau](https://meta.discourse.org/u/blau)
#### Post date: [18.Март.2017 15:46:21 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/12 "2017-03-18T15:46:21Z")
Just for curiosity I checked what Mandrill does, and yes it leaks my server IP address too. So if I were concerned hiding the original IP gainst DOS, I would setup a mailrelay .
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [16.Май.2019 08:08:18 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/13 "2019-05-16T08:08:18Z")
---
### Author:  [@DNSTARS](https://meta.discourse.org/u/DNSTARS)
#### Post date: [16.Май.2019 12:22:36 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/14 "2019-05-16T12:22:36Z")
For those who are looking at this today, someone who wants to DDOS you can drop anything that discourse tries to fetch, point the url of the file to a server they control and get your IP address. Relay for the mail server isn’t enough, you need a rule to send new outbound connections from discourse to go through a proxy or similar.
We had several false starts with trying to get this working against all bad actors out there and ended up with Flokinet in Romania, they have a proprietary DDOS shield to the tune of 1.4 Tb/ps IIRC.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [16.Май.2019 12:23:51 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/15 "2019-05-16T12:23:51Z")
You could also use firewall rules to disable all connections except from cloudflare.
---
### Author:  [@DNSTARS](https://meta.discourse.org/u/DNSTARS)
#### Post date: [16.Май.2019 12:30:43 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/16 "2019-05-16T12:30:43Z")
I don’t know how feasible it is but if during installation there was a means to specificy those kinds of requests to a different gateway or something that would be cool. Also, before discourse error handles this it can be used by bad actors to grab someone’s IP address in a PM, a setting to not list the link until it had been processed could prevent that maybe?
Last I looked the latter problem was “turn off embed content globally or live with it”.
> [@What are some of the hardest moments you had as a moderator?](https://meta.discourse.org/t/what-are-some-of-the-hardest-moments-you-had-as-a-moderator/117677/3):
>
> More on topic — I’ve been lightly doxxed (had my home address posted) in the past when someone didn’t like what I was saying online. Nothing came of it, but it’s not pleasant
It wouldn’t stop someone clicking on a random link though that wasn’t embedded so I dunno.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [16.Май.2019 14:17:46 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/18 "2019-05-16T14:17:46Z")
Not really, Cloudflare is only used by the client connection, any oneboxing or image embedding by URL is done directly. It’s very easy to bypass and precisely why we regularly have to stress that Cloudflare isn’t a substitute to a firewall.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [16.Май.2019 14:33:01 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/19 "2019-05-16T14:33:01Z")
I think my point was that you’d firewall all http requests except from cloudflare (and firewall everything else too). Then it wouldn’t matter if they had your ip. Security through obscurity is not security.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [16.Май.2019 14:39:15 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/20 "2019-05-16T14:39:15Z")
How would that protect you if the attacker fakes their origin? Spoofing that kind of thing is trivial.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [16.Май.2019 15:20:35 UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/21 "2019-05-16T15:20:35Z")
> [@Stephen](#):
>
> Spoofing that kind of thing is trivial.
Oh. Right. I totally forgot spoofing the source IP address for a DDOS attack.
[Следующая страница](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128.md?page=2)