Show Public IP address when sending via Postfix via Postmarkapp

Question

We have a security system set up where the first time a sold computer is booted up we get an e-mail from it's destination to show its been received. The police recommend we do this after a number of unfortunate scam attempts - all is working fine with Postfix on macOS, the caveat though is they want the originating IP address of the computer in the header to prove it's not an e-mail we've just sent ourselves.

I tested it with Google's SMTP and that worked just fine with the same settings, however as the delivered computers would appear in different parts of the world, Google's security would kick in and think our password had been stolen, so only 20% of emails were sent.

Postmark gets 100% delivery so far it seems, the problem is, like other SMTP servers we've tested, it doesn't show the originating IP in the header the X-Sf-Originating-Ip is their server.

Is there anyway with Postfix headers we can force the public IP of the sender to be included in the header, or any settings in using Postmark's SMTP server we might have missed?

It seems most Postfix options are to exclude the public IP, not force it to be included.

Answer 1

This is some of the cases where an own SMTP server would be ideal as you

• get to decide which information you would like to store.
• avoid any region detection simply by not deploying such (the default).
• won't reveal your Gmail (or other) password in configuration files.

Since most ISPs block port 25 due to spam, using submission on port 587, as I believe you are already doing with Gmail, would be necessary to get the mail through. However, even submission might be blocked. Certainly, if the abusers get to know how you are tracking them, they could easily block port 587 in their firewall.

Instead of SMTP I'd prefer using HTTPS on port 443 for this, as that's the port that's almost always available and due to wide use of HTTPS seldom gets tampered. A script or a program could try to load some web page after startup / by cron, e.g. https://example.com/imhere.php?serial=<S/N>.

On the other hand, if you want stick to email, with an own dedicated server you could make SMTPS without STARTTLS to use port 443 instead of default 465. The SMTPS without STARTTLS, like any TLS encrypted traffic, looks just like HTTPS.

Whatever you do, these are purely technical recommendations. Be sure this kind of tracking is not violating any of your local privacy or data protection regulations as well as of the countries of your customers. Don't try to be like Batman. :)

Answer 2

I work on Postmark. While your solution can work technically, I would recommend against this approach:

When you ship your computers, and have this setup, I think you'd need to include a postmark server token on the machine, and this can be eventually discovered by your customers, and they could end up using it to send email through your account on Postmark.

The server token should be treated just like a password, and shouldn't be shared with unknown parties like this.

An Alternative:

A much simpler approach to this problem would be to configure a webhook that can accept JSON payloads over https. This eliminates the need for postfix, and will generally not end up being blocked by ISPs, since 443 is a standard port that is essentially ubiquitous on the web.

Your webhook could include useful information including

• The public IP (which you can gather from a service like the following): curl https://api.ipify.org

• The MAC addresses on the machine: ifconfig | grep 'ether'

• The machine serial number or other information (https://apple.stackexchange.com/a/40244/15813)

There are a number apps that can accept "JSON dumps" in a webhook that are publicly available, like https://requestb.in/ - I would recommend hosting this on your own server, as this is your record of requests, this would eventually look like the following:

curl -H "Content-Type: application/json" https://your-server-tracking.com/booted -d '{ "IP": "'"$(curl https://api.ipify.org)"'", "SERIAL" : "'"$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}')"'", "Date", "'"$(date)"'" }'

Other Notes:

• You should make sure you're complying with the laws of what you're allowed to include in these machines, this seems like it could conflict with your customers' privacy.
• You should confirm that this method provides adequate information for the police to investigate these cases. That being said, given that email headers can be added by anyone along the way, the method of adding an IP as outlined above is likely at least as reliable as what you would get with email headers. By the way, headers like X-Sf-Originating-Ip are non-standard, and any sender can put whatever they want to, in there.

Good luck!