Rafael Pfister

Blog

Notes from the field: SEPPmail, totemomail, HIN Mail Gateway, Microsoft 365, and Exchange.

Topics

Admin Hub

Active Directory / Entra Active Directory, Microsoft Entra, LDAP integration, and directory services. 5 articles → Archiving and journaling Compliant email archiving: Exchange journaling, journal mailboxes, Enterprise Vault, and proving that nothing is missing. 1 article → Cisco ESA / SMA Cisco Secure Email Gateway (ESA) and Secure Email and Web Manager (SMA): administration, certificates, and operating the AsyncOS-based mail security appliances. 1 article → Email Encryption S/MIME, OpenPGP, GINA, and TLS in practice. 6 articles → Exchange OnPrem / Hybrid On-premises Exchange Server, security updates, hybrid connectivity to Exchange Online, and the migration to Exchange SE. 12 articles → Exchange updates (SU & CU) Security updates (SU) and cumulative updates (CU) for Exchange Server in chronological order: closed vulnerabilities, installation pitfalls, and the follow-up work that comes after patch day. 3 articles → FortiMail Fortinet FortiMail as a mail gateway: vulnerabilities, mail routing, encryption (IBE), administration, and operations. 1 article → HIN Gateway The HIN Mail Gateway based on SEPPmail: clusters, backup, Stargate. 4 articles → Kiteworks / Totemomail Totemomail / Kiteworks Email Protection Gateway: operations, routing, licensing. 8 articles → Load Balancers F5 BIG-IP and other load balancers in the mail environment: virtual servers, SNAT, persistence, timeouts, and health monitoring for SMTP traffic. 1 article → Microsoft 365 / Exchange Exchange Online, connectors, mail routing, and hybrid scenarios. 13 articles → Microsoft Entra Entra ID, Entra Connect Sync, and hybrid identity between Active Directory and the cloud. 1 article → Microsoft Teams Microsoft Teams from an operations perspective: media traffic and network requirements, call quality, client specifics, and how Teams interacts with VPNs, firewalls, and proxies. 1 article → Outlook Outlook as a client from an admin perspective: new and classic Outlook, Outlook on the web, account types, shared mailboxes, S/MIME, and the limits of each variant. 1 article → SEPPmail SEPPmail Secure E-Mail Gateway: firmware releases, encryption, cluster operations, and appliance administration. 2 articles → SMTP and Mail Flow Delivery paths, relays, and smarthosts: diagnosing SMTP connections, transport encryption, and sender checks in the mail flow. 19 articles → SMTP Load Testing Measuring throughput and stability of mail systems: load generators such as smtp-source, test setup, traceable test runs, and evaluating the results. 2 articles → Tailscale The WireGuard-based mesh VPN in practice: subnet routers and exit nodes, route approval and ACLs, secure remote access to internal services, and the limits of each operating mode. 1 article → Testing and Load Tests Test plans, load generators, and measurement methodology: probing infrastructure under controlled conditions, from a single SMTP transaction to a 10,000-mail burst, and evaluating the results properly. 5 articles → Windows client Windows on the desktop from an admin's perspective: Remote Desktop, printing, Group Policy, and the registry tweaks that make the difference in day-to-day support. 4 articles →

AI & Automation Hub

Claude Working with Claude and Claude Code: setting up your own servers securely as a working environment, everyday automation, and running AI tooling on your own infrastructure. 3 articles → Cloudflare Workers Serverless applications on Cloudflare: Workers, D1, Pages, and automation without running your own server infrastructure. 1 article → OpenAI API Running the OpenAI API in production: cost control, quotas, and language-model automation outside ChatGPT. 1 article →

Off Topic

Home Assistant and IoT Running connected devices on your own network: local control instead of vendor clouds, Home Assistant and community integrations, network segmentation, firewall rules, and handling long-lived device credentials. 3 articles → Paperless-ngx Running your own document archive with Paperless-ngx: container installation, version upgrades and migrations, storage requirements, backup and restore, and the limits of offloading the document store. 1 article → PC & Hardware BIOS/UEFI maintenance, firmware updates, stability diagnostics and hardware topics around the personal machine. 3 articles → Proton Drive Proton Drive beyond the official apps: the state on Linux, connecting via Rclone and the SDK, unattended authentication, and using it as a store for self-hosted services. 2 articles → Rclone Connecting cloud storage with Rclone: FUSE mounts, the VFS cache, running inside Docker containers, unattended authentication and the pitfalls of individual backends. 3 articles → Remote support Remote access and support with open-source tools: RustDesk as a TeamViewer alternative, direct connections over your own network, unattended access and the limits of free usage. 1 article → VPN and remote access Private networks over the internet: mesh VPN with Tailscale and WireGuard compared with classic IPsec and SSL VPN gateways, least-privilege access rules and connecting existing networks. 1 article →

All articles

NewCVE-2026-104286: FortiMail Zero-Day Is Being Exploited - Workaround and Compromise Assessment

Fortinet reports a critical, actively exploited path traversal vulnerability in FortiMail 7.2 through 8.0 (CVE-2026-104286, CVSS 9.8). A patch is not yet available. The workaround disables IBE or blocks Internet access to the management interface; indicators for assessing compromise are also available.

October 2, 2026 FortiMail 8 min read

NewProton Drive CLI: Using Proton Drive from Scripts and Servers

Since June 2026, Proton has offered an official command-line tool for Proton Drive. This article covers commands, signing in on servers without a desktop, conflict strategies for scripts, and its limitations compared with Rclone.

October 1, 2026 Proton Drive 9 min read

NewProton Drive on Linux: The State of Play in October 2026

The official Linux client has been announced but is not yet available. The official Proton Drive CLI has been available for scripts and servers since June 2026; Proton Drive can still only be mounted with Rclone. What is missing is machine access limited to individual folders or tasks.

October 1, 2026 Proton Drive 8 min read

NewWhat exactly is Tailscale, and what advantages does it offer over traditional VPN connections?

Tailscale uses WireGuard to create a mesh VPN in which devices connect directly rather than through a central VPN concentrator. Learn how coordination servers, NAT traversal, and DERP relays work together, the advantages over IPsec and SSL VPNs, and the dependencies and limitations you should know before deploying it.

October 1, 2026 VPN and remote access 11 min read

NewMoving Windows to a Smaller SSD with Rescuezilla: From 1 TB to 512 GB

Rescuezilla restores an image only to a disk that extends at least to the end of the final partition. Using a 1 TB NVMe as an example, this guide shows how to shrink C: with GParted, move the recovery partition, remove the dirty flag, and restore the new image to a 512 GB SSD.

September 29, 2026 PC & Hardware 9 min to read

NewRescuezilla: Migrate Windows to a New SSD, with an Introduction to the Tool

Rescuezilla is a free, Clonezilla-compatible imaging solution with a graphical interface. This article introduces the tool and shows the complete migration of a Windows installation to a new SSD: preparation in Windows, bootable USB drive, backup, verification, restore, and follow-up steps.

September 29, 2026 PC & Hardware 10 min to read

Brave Web Discovery Project: Why Long Word Segments in URLs Exclude Pages

In the Web Discovery Project, Brave discards any URL whose path contains a word segment longer than 18 characters. German compounds such as Verschlüsselungsgateway are affected. Because Claude's web search is based on the Brave index, this also affects visibility in Claude. The source-code rule, further heuristics, the role of the canonical URL, a script for checking your own sitemap, a measurement using 825 terms in 24 languages, and an assessment of why the rule disadvantages compound-word languages.

September 25, 2026 Claude 13 min read

Kiteworks: Vendor Recommends Shutdown on September 26—What Is Known So Far

Kiteworks asked its customers by email to shut down all systems on Saturday, September 26, 2026, from 4:00 a.m. to 10:00 a.m. The reason is a warning from law enforcement agencies about a possible attack. Since September 27, the recommendation has been lifted; there is no CVE or new patch. TotemoMail is not affected.

September 25, 2026 Kiteworks / Totemomail 9 min read

MailHeaderAnalyzer: Analyze Email Headers in PowerShell Without Network Access

Reference for the MailHeaderAnalyzer PowerShell module: parameter overview, syntax, description, examples, and parameter properties for Get-MailHeaderAnalysis and ConvertTo-MailHeaderReport, plus the output object with delivery chain, authentication results, Exchange Online classification, and all finding codes.

September 24, 2026 SMTP and Mail Flow 16 min read

Mail loop with encryption gateway behind EXO - Prevent spoofing issues

If the encryption gateway (HIN in this example) is behind Exchange Online, every incoming message reaches EOP a second time: with a foreign sender domain, an invalid DKIM signature, and the gateway IP as the source. The result is a spoof verdict and junk. Four settings prevent this without disabling filtering using SCL -1: a PTR record, Enhanced Filtering disabled, a spoof exception for the gateway infrastructure, and CloudServicesMailEnabled on both connectors.

September 23, 2026 SMTP and Mail Flow 9 min read

Closing a journaling gap: Exporting from Microsoft Purview and importing into Enterprise Vault

If journal reports from Exchange Online fail for several days, they cannot be generated retroactively. However, the content still exists in the mailboxes. Learn how to export it as PST through the new Purview eDiscovery, why Enterprise Vault's PST Migrator is usually not an option, and how to reimport it through the journal mailbox without displacing the active journal stream, using two generic scripts for importing, moving, and logging.

September 22, 2026 Archiving and journaling 18 min read

Exchange Online throttles and blocks outdated Exchange 2016 and 2019 servers starting in September 2026: How transport enforcement works

Starting in the second week of September 2026, Exchange Online requires hybrid servers to have at least the October 2025 SU; otherwise, mail flow is throttled and later blocked. Background on transport enforcement since 2023, escalation stages with SMTP codes, the report in the Admin Center, the 90-day pause via PowerShell, and why the next increase will only allow ESU customers and Exchange SE.

September 7, 2026 Exchange OnPrem / Hybrid 9 min read