Rafael Pfister

Blog

Notes from the field: SEPPmail, totemomail, HIN Mail Gateway, Microsoft 365, and Exchange.

Topics

Admin Hub

Active Directory / Entra Active Directory, Microsoft Entra, LDAP integration, and directory services. 5 articles → Cisco ESA / SMA Cisco Secure Email Gateway (ESA) and Secure Email and Web Manager (SMA): administration, certificates, and operating the AsyncOS-based mail security appliances. 1 article → Email Encryption S/MIME, OpenPGP, GINA, and TLS in practice. 4 articles → Exchange OnPrem / Hybrid On-premises Exchange Server, security updates, hybrid connectivity to Exchange Online, and the migration to Exchange SE. 11 articles → Exchange updates (SU & CU) Security updates (SU) and cumulative updates (CU) for Exchange Server in chronological order: closed vulnerabilities, installation pitfalls, and the follow-up work that comes after patch day. 3 articles → HIN Gateway The HIN Mail Gateway based on SEPPmail: clusters, backup, Stargate. 3 articles → Load Balancers F5 BIG-IP and other load balancers in the mail environment: virtual servers, SNAT, persistence, timeouts, and health monitoring for SMTP traffic. 1 article → Microsoft 365 / Exchange Exchange Online, connectors, mail routing, and hybrid scenarios. 10 articles → Microsoft Entra Entra ID, Entra Connect Sync, and hybrid identity between Active Directory and the cloud. 1 article → Microsoft Teams Microsoft Teams from an operations perspective: media traffic and network requirements, call quality, client specifics, and how Teams interacts with VPNs, firewalls, and proxies. 1 article → Outlook Outlook as a client from an admin perspective: new and classic Outlook, Outlook on the web, account types, shared mailboxes, S/MIME, and the limits of each variant. 1 article → SEPPmail SEPPmail Secure E-Mail Gateway: firmware releases, encryption, cluster operations, and appliance administration. 2 articles → SMTP and Mail Flow Delivery paths, relays, and smarthosts: diagnosing SMTP connections, transport encryption, and sender checks in the mail flow. 17 articles → SMTP Load Testing Measuring throughput and stability of mail systems: load generators such as smtp-source, test setup, traceable test runs, and evaluating the results. 2 articles → Tailscale The WireGuard-based mesh VPN in practice: subnet routers and exit nodes, route approval and ACLs, secure remote access to internal services, and the limits of each operating mode. 1 article → Testing and Load Tests Test plans, load generators, and measurement methodology: probing infrastructure under controlled conditions, from a single SMTP transaction to a 10,000-mail burst, and evaluating the results properly. 5 articles → Totemomail Totemomail / Kiteworks Email Protection Gateway: operations, routing, licensing. 7 articles → Windows client Windows on the desktop from an admin's perspective: Remote Desktop, printing, Group Policy, and the registry tweaks that make the difference in day-to-day support. 4 articles →

AI & Automation Hub

Claude Working with Claude and Claude Code: setting up your own servers securely as a working environment, everyday automation, and running AI tooling on your own infrastructure. 2 articles → Cloudflare Workers Serverless applications on Cloudflare: Workers, D1, Pages, and automation without running your own server infrastructure. 1 article → OpenAI API Running the OpenAI API in production: cost control, quotas, and language-model automation outside ChatGPT. 1 article →

Off Topic

Home Assistant and IoT Running connected devices on your own network: local control instead of vendor clouds, Home Assistant and community integrations, network segmentation, firewall rules, and handling long-lived device credentials. 3 articles → Paperless-ngx Running your own document archive with Paperless-ngx: container installation, version upgrades and migrations, storage requirements, backup and restore, and the limits of offloading the document store. 1 article → PC & Hardware BIOS/UEFI maintenance, firmware updates, stability diagnostics and hardware topics around the personal machine. 1 article → Proton Drive Proton Drive beyond the official apps: the state on Linux, connecting via Rclone and the SDK, unattended authentication, and using it as a store for self-hosted services. 1 article → Rclone Connecting cloud storage with Rclone: FUSE mounts, the VFS cache, running inside Docker containers, unattended authentication and the pitfalls of individual backends. 3 articles → Remote support Remote access and support with open-source tools: RustDesk as a TeamViewer alternative, direct connections over your own network, unattended access and the limits of free usage. 1 article →

All articles

NewExchange Online throttles and blocks outdated Exchange 2016 and 2019 servers starting in September 2026: How transport enforcement works

Starting in the second week of September 2026, Exchange Online requires hybrid servers to have at least the October 2025 SU; otherwise, mail flow is throttled and later blocked. Background on transport enforcement since 2023, escalation stages with SMTP codes, the report in the Admin Center, the 90-day pause via PowerShell, and why the next increase will only allow ESU customers and Exchange SE.

September 7, 2026 Exchange OnPrem / Hybrid 9 min read

NewWhen the log fills the disk: properly limiting log4j2 RollingFile, using totemomail as an example

A log volume filling up can bring down the entire gateway in the worst case. Why combining time- and size-based rotation without %i creates a single huge file, how strategy.max caps retention, the role of the log level, and where totemomail hides these values.

September 4, 2026 Totemomail 9 min read

NewHow Long Does an SMTP Session Stay Open? ConnectionTimeout 00:10:00 in Exchange and the Systems for Which That Is Too Short

Exchange terminates every incoming SMTP session after ten minutes, even if it is currently transferring data. Which senders stay on a connection that long, how to determine the actual session duration from the protocol log, and when ConnectionTimeout and ConnectionInactivityTimeout should be adjusted on a relay connector.

September 3, 2026 SMTP and Mail Flow 10 min read

NewNew Outlook: S/MIME signature cannot be verified in secondary account, attachments missing

The new Outlook reports that the S/MIME signature cannot be verified in a secondary account for a shared mailbox and does not display attachments. This article explains the difference between Clear Signing and Opaque Signing, why attachments disappear from opaque-signed messages, why the new Outlook processes S/MIME only in the primary account, and what workarounds are available, including unpacking smime.p7m with PowerShell or OpenSSL.

September 3, 2026 Outlook 8 min read

NewPort Forwarding with netsh portproxy: Access Internal Services Through a Jump Host

Windows includes built-in TCP port forwarding with netsh interface portproxy. Combined with a VPN such as Tailscale, it lets you access an internal service, such as a NAS interface, from outside without exposing it publicly. Learn how to set up, secure, and remove forwarding, and where its limitations lie: no UDP, no additional encryption, and certificate and redirect pitfalls.

September 2, 2026 Windows client 9 min read

NewTailscale: Exit Nodes and Subnet Routes Compared, and How They Work Technically

In Tailscale, exit nodes and subnet routers are two related but distinct operating modes. A subnet router selectively opens specific IP ranges, while an exit node routes all internet traffic through itself. What the difference means in practice, how Tailscale implements it through WireGuard, route approval, and SNAT, and where the limits of each option lie.

September 2, 2026 Tailscale 11 min read

Prerequisites for Remote PowerShell to Work

PowerShell remoting rarely fails because of the command itself, but rather because of prerequisites: the WinRM service, listener, firewall, authentication, and the specifics of local accounts. What needs to be configured on the target and client sides, how to check it with Test-WSMan, and why Access denied usually has nothing to do with the password.

September 1, 2026 Windows client 10 min read

RustDesk: Setting Up the Open-Source TeamViewer Alternative

RustDesk is open-source remote support software licensed under the AGPL, free of charge and self-hostable. Learn how to install the client on Windows (including unattended deployment via MSI), how connections work through the public rendezvous server, your own server, or a direct connection, which features are needed for day-to-day support, and where the limits of free use lie.

September 1, 2026 Remote support 9 min read

CVE-2026-62911: Why 85 Percent of On-Premises Exchange Servers Are Vulnerable and What Is Technically Behind It

The BSI reports that around 85 percent of on-premises Exchange servers in Germany are vulnerable to CVE-2026-62911. This article explains the vulnerability technically: MRSProxy, missing Channel Binding, NTLM relay, and Orange Tsai’s Pwn2Own chain, along with context for the figures and the specific recommended actions.

August 31, 2026 Exchange OnPrem / Hybrid 9 min read

Essential Controls for TotemoMail Admins: Stop the Server, Check Queues, and Clean Up in a Controlled Manner

The key controls for operating a totemomail gateway: stop the service via systemd and the Tanuki control script, count queue contents per repository, inspect individual messages, clean up in a controlled manner, and restart the service.

August 28, 2026 Totemomail 9 min read

NDR, DSN, Bounce: How to correctly distinguish non-delivery notifications

NDR, DSN, bounce, reject, backscatter: The terms surrounding failed delivery are often used interchangeably, but they refer to different things. What the RFCs define, who generates which notification, how a DSN is structured, and why the distinction between reject and bounce determines backscatter.

August 28, 2026 SMTP and Mail Flow 10 min read

Passwordless Linux Server Access: Set Up SSH Key Login with PuTTY, Pageant, and More

Admins who access Linux servers daily have to enter a username and password every time when using password login. An SSH key pair reduces this to a double-click: generate a key with PuTTYgen, store the public key on the server, and load Pageant. The same key works in WinSCP, MobaXterm, and OpenSSH, and if desired, takes you straight to a service account shell.

August 28, 2026 Totemomail 9 min read