Cloudflare Proxy - How to hide the IP of the mail subdomain and make it work

[robi]

@brutalbirdie This is good stuff, I just didn't see where Cloudflare says they will use SRV records to enable traffic to non-supported ports.

This is also a good feature request for Cloudron to make it the default configuration for Cloudflare managed DNS.

This way there is some DDoS protection and some site speed enhancements by having CF proxy & cache supported traffic w/o disrupting other Cloudron services.

[girish]

The MX entry will still expose the mail server, no?

[BrutalBirdie]

@girish

this is what my Cloudflare DNS Dashboard now looks like.

Yes the MX still reveals the real IP.
This is more like a small inconvenience for DNS scanners / script kiddies.

[BrutalBirdie]

@robi I may need to revert my post, because as of today I can no longer get / send my mails.

Damn.

SOGo and Thunderbird did not work anymore.
I will have to dig a little deeper.

[BrutalBirdie]

After reading this forum post I assumed this would work as well
https://community.cloudflare.com/t/teamspeak-setup/58035

hmmm

[robi]

@brutalbirdie It may be good to ping someone at CF or find some docs that SRV records are supposed to do that and is a supported config.

It may have worked for a while due to DNS propagation.

[BrutalBirdie]

@robi maybe my _mail Service entry is wrong?

https://tools.ietf.org/id/draft-daboo-srv-email-05.html#rfc.section.3.2

also for sieve?

https://datatracker.ietf.org/doc/html/rfc5804#section-1.8

[robi]

@brutalbirdie hmm, perhaps the names of the SRV records are important. If you add those, see if it starts flowing again.

[BrutalBirdie]

@robi I want to try it.

[robi]

@brutalbirdie
_imap._tcp
_smtp._tcp
_sieve._tcp

Not sure about sieve..

[BrutalBirdie]

@robi Yea I just updated that and will report back.

also _imaps and not _imap

time to do some reading...

https://datatracker.ietf.org/doc/html/rfc6186

[BrutalBirdie]

@brutalbirdie does not look like its working hmmm

[robi]

Sent out an SOS here: https://twitter.com/vRobM/status/1442197044303577089?s=20

[BrutalBirdie]

@robi Very Nice!

[robi]

I didn't know Argo tunnels were free. So one can hide the mail service and put it thru an Argo tunnel on a subdomain to the world.

https://docs.ibracorp.io/all-guides-in-order/documentation/cloudflare-tunnel

Similarly one can have another domain and IP handle the incoming, which is tunneled to you via Tailscale.

https://docs.ibracorp.io/all-guides-in-order/documentation/tailscale