# Mailgun leaking server's real IP behind Cloudflare

**URL:** <https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128>\
**Category:** Product Support\
**Created:** [March 15, 2017, 3:01am UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128 "2017-03-15T03:01:37Z")\
**Posts on this page:** 1\
**Showing post:** 14

<div class="post-metadata">

**Author:** ![DNSTARS](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dnstars/32/100957_2.png) [@DNSTARS](https://meta.discourse.org/u/DNSTARS)\
**Post date:** [May 16, 2019, 12:22pm UTC](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128/14 "2019-05-16T12:22:36Z")

</div>

For those who are looking at this today, someone who wants to DDOS you can drop anything that discourse tries to fetch, point the url of the file to a server they control and get your IP address. Relay for the mail server isn’t enough, you need a rule to send new outbound connections from discourse to go through a proxy or similar.

We had several false starts with trying to get this working against all bad actors out there and ended up with Flokinet in Romania, they have a proprietary DDOS shield to the tune of 1.4 Tb/ps IIRC.

---

_[View the full topic](https://meta.discourse.org/t/mailgun-leaking-servers-real-ip-behind-cloudflare/59128)._