Overview
This guide outlines essential security configurations and monitoring procedures for mail servers utilizing Plesk and Warden. Implementing these practices helps prevent unauthorized email abuse, maintain server reputation, and provide clear visibility into authentication and delivery activity.
Mail Server Security Best Practices
- Enable Outgoing Mail Limits: Configure Plesk outgoing limits to mitigate damage from compromised accounts. Refer to the official documentation for configuration steps: Plesk Outgoing Limits Guide.
- Install ModSecurity: Ensure the Plesk ModSecurity packages are installed and configured with a robust ruleset to block form-based spam submissions. Refer to: Install ModSecurity WAF.
- Enable PHP Script Tracking: Activate the X-PHP-Originating-Script header to allow Warden to accurately track mail sent via PHP scripts. Refer to: Enable X-PHP-Originating-Script Header.
- Block Spam Forwarding: Configure Warden to reject outgoing mail forwards flagged as spam, preserving the server's sending reputation. Refer to: Configure Warden Spam Forwarding Rejection.
- Restrict SMTP Access by Region: Advanced users utilizing Juggernaut Firewall can restrict outgoing SMTP access to specific countries to mitigate brute-force authentication attacks. Refer to: Restrict SMTP Access by Country.
Monitoring Authentication and Mail Delivery
Administrators should regularly review Warden reports and logs to identify suspicious activity, track mail volume, and diagnose delivery issues.
Tracking SMTP Authentication Activity
To identify which accounts are authenticating and sending mail, navigate to the reporting dashboard and review the following metrics:
- SMTP auth - User - Success
- SMTP Auth - Success - User Client Addr
A sudden increase in successful login attempts typically indicates a compromised account. Consult the tracking documentation for detailed analysis procedures: Track Email Authentication & Brute Force Attacks.
Analyzing Outgoing Mail Statistics
Monitor mail volume by domain and mailbox using the following navigation paths:
- Warden > Statistics > Statistics Out: Displays a sortable list of domains and mailboxes ranked by outgoing mail volume.
- Warden > Reports > Domain > Statistics > Out or Mailbox > Statistics > Out: Provides detailed reporting on outbound traffic. Click column headers to sort results from highest to lowest.
Monitoring the Mail Queue
Navigate to Warden > Queue to monitor pending outgoing messages. The recipient column indicates rejection reasons if a remote server declines delivery. To investigate message origins or detailed routing information, click the plus icon adjacent to any queue entry.
Reviewing Message Logs
To audit outgoing mail traffic, navigate to Warden > Logs > Message log. Select Out from the direction filter to isolate outbound messages for detailed review.
Troubleshooting & Common Issues
- Elevated Authentication Attempts: A high volume of successful SMTP logins from a single account or IP address typically indicates credential compromise. Immediately reset passwords and review the SMTP auth - User - Success report.
- Queue Rejections: If messages remain in the queue, check the recipient column for remote server rejection codes. Use the message details view to trace the originating script or mailbox.
- Untracked PHP Mail: If Warden cannot identify the source of outbound mail, verify that the X-PHP-Originating-Script header is enabled in your PHP configuration and restart the web service if necessary.
- Spam Forwarding Impact: If legitimate forwards are being blocked, review Warden's spam classification thresholds and adjust forwarding rules to exclude trusted domains or mailboxes.
