XF 2.0 Server IP address is getting leaked when using SMTP + Mailgun

[orthopug]

I just bought Xenforo and was hoping to use Mailgun to send out emails. In the email address setting, I set up my SMTP username and password with Mailgun (TLS encryption). The email successfully sends out, but when I view the full email, it displays the server IP address.

Received: from domain.com (XX-XX-XX-XX.static.hosting-provider.com [XX.XX.XX.XX])
by mxa.mailgun.org with ESMTP id 5ea88d94.7fea854e20c0-smtp-out-n01

I've tried a few different ports but the result is the same. Is there any way to fix this? I don't want to open my site to DDOS attacks.

 

[Kirby]

I'd say that's how SMTP does work. Unless Mailgun does provide options to hide this header (it's generated by their MTA) there is no way to hide your IP except using some kind of tunnel (Socks, VPN, etc.)

 

[Brent W]

Use Amazon SES as it strips the IP Address.

 

[orthopug]

Use Amazon SES as it strips the IP Address.

Is Amazon SES the only one that does this? Are there others?

 

[Brent W]

Is Amazon SES the only one that does this? Are there others?

Only one I am aware of but haven't really shopped around.

 

[sbj]

According to @eva2000 there are 2 smtp providers who hide IPs, one is Amazon the other one I don't know.

 

[m1ne]

Postmark removes the IP as well.

https://postmarkapp.com/

 

[orthopug]

I got it to work with Amazon SES and it does remove the IP address. Thanks.

 

[Monkeytime]

I don't want to open my site to DDOS attacks.

I don't understand this and want to double check what you are thinking. I get you want to avoid a ddos attack, but everybody already knows your website ip address just by knowing the URL. How does the smtp + mailgun leak increase your vulnerability? What am I missing?

 

[orthopug]

I don't understand this and want to double check what you are thinking. I get you want to avoid a ddos attack, but everybody already knows your website ip address just by knowing the URL. How does the smtp + mailgun leak increase your vulnerability? What am I missing?

But they don't know the server IP address. That is the address they need to launch a DDOS attack. The website IP address is from Cloudflare, which cannot be attacked.

 

[Monkeytime]

Oh, the DNS pointer doesn't actually point to your server, but a reverse proxy or load balancer or something. Got it!