Admin Hub
Email is the most important and most attacked communication channel in most companies, and without clean identities neither mail routing nor permission management works. This hub collects hands-on knowledge from more than 14 years of running large mail environments: SMTP and mail flow, encryption gateways such as SEPPmail and Totemomail, the HIN mail gateway in the Swiss healthcare sector, Exchange and Microsoft 365 in hybrid scenarios, plus Active Directory, LDAP, and Microsoft Entra ID as the foundation behind it all. It also includes free tools to check your own domain and mail configuration right in the browser.
Mail DNS Check
Check a domain's MX, SPF, DKIM, DMARC, and more in seconds.
Mail Header Analyzer
Trace an email's delivery path and authentication from its header, 100% locally in your browser.
Analyze a header →Command Builder
Assemble DNS, SMTP, TLS, LDAP and network commands for PowerShell or the shell, built-ins first.
Build a command →Topics in this hub
Latest articles
NewExchange Online throttles and blocks outdated Exchange 2016 and 2019 servers starting in September 2026: How transport enforcement works
Starting in the second week of September 2026, Exchange Online requires hybrid servers to have at least the October 2025 SU; otherwise, mail flow is throttled and later blocked. Background on transport enforcement since 2023, escalation stages with SMTP codes, the report in the Admin Center, the 90-day pause via PowerShell, and why the next increase will only allow ESU customers and Exchange SE.
NewWhen the log fills the disk: properly limiting log4j2 RollingFile, using totemomail as an example
A log volume filling up can bring down the entire gateway in the worst case. Why combining time- and size-based rotation without %i creates a single huge file, how strategy.max caps retention, the role of the log level, and where totemomail hides these values.
NewNew Outlook: S/MIME signature cannot be verified in secondary account, attachments missing
The new Outlook reports that the S/MIME signature cannot be verified in a secondary account for a shared mailbox and does not display attachments. This article explains the difference between Clear Signing and Opaque Signing, why attachments disappear from opaque-signed messages, why the new Outlook processes S/MIME only in the primary account, and what workarounds are available, including unpacking smime.p7m with PowerShell or OpenSSL.
NewHow Long Does an SMTP Session Stay Open? ConnectionTimeout 00:10:00 in Exchange and the Systems for Which That Is Too Short
Exchange terminates every incoming SMTP session after ten minutes, even if it is currently transferring data. Which senders stay on a connection that long, how to determine the actual session duration from the protocol log, and when ConnectionTimeout and ConnectionInactivityTimeout should be adjusted on a relay connector.
NewTailscale: Exit Nodes and Subnet Routes Compared, and How They Work Technically
In Tailscale, exit nodes and subnet routers are two related but distinct operating modes. A subnet router selectively opens specific IP ranges, while an exit node routes all internet traffic through itself. What the difference means in practice, how Tailscale implements it through WireGuard, route approval, and SNAT, and where the limits of each option lie.
NewPort Forwarding with netsh portproxy: Access Internal Services Through a Jump Host
Windows includes built-in TCP port forwarding with netsh interface portproxy. Combined with a VPN such as Tailscale, it lets you access an internal service, such as a NAS interface, from outside without exposing it publicly. Learn how to set up, secure, and remove forwarding, and where its limitations lie: no UDP, no additional encryption, and certificate and redirect pitfalls.
