Reference projects: Exchange migration, mail gateways, Microsoft 365

16 Oct 2026 · Exchange On-Prem / Hybrid Exchange outages after the October 2026 Windows Server updates: MapiExceptionMdbOffline (ec=1142) After the October 13, 2026 Windows Server updates, Exchange servers report MapiExceptionMdbOffline (ec=1142) after around 24 hours: OWA fails, queues grow, and DAG copies stop replicating. The cause is a new limit in the RPC Endpoint Mapper; since October 17, 2026, Microsoft has recommended the EpmapSavedContextCap registry value, but a fix is still unavailable. Symptoms, affected KBs, verification commands, and procedure.

3 Sep 2026 · Outlook New Outlook: S/MIME signature cannot be verified in secondary account, attachments missing The new Outlook reports that the S/MIME signature cannot be verified in a secondary account for a shared mailbox and does not display attachments. This article explains the difference between Clear Signing and Opaque Signing, why attachments disappear from opaque-signed messages, why the new Outlook processes S/MIME only in the primary account, and what workarounds are available, including unpacking smime.p7m with PowerShell or OpenSSL.

24 Sep 2026 · SMTP & Mail Flow MailHeaderAnalyzer: Analyze Email Headers in PowerShell Without Network Access Reference for the MailHeaderAnalyzer PowerShell module: parameter overview, syntax, description, examples, and parameter properties for Get-MailHeaderAnalysis and ConvertTo-MailHeaderReport, plus the output object with delivery chain, authentication results, Exchange Online classification, and all finding codes.

27 Aug 2026 · OpenAI API Up to 10 Million Free Tokens per Day: Using OpenAI’s Data-Sharing Program with Cost Guardrails OpenAI gives organizations that share their API traffic for training a daily free allowance: depending on the tier, up to 10 million tokens. With prepaid credit, project limits, and a token budget in the code, usage remains free indefinitely.

7 Sep 2026 · Exchange On-Premises / Hybrid Exchange Online throttles and blocks outdated Exchange 2016 and 2019 servers starting in September 2026: How transport enforcement works Starting in the second week of September 2026, Exchange Online requires hybrid servers to have at least the October 2025 SU; otherwise, mail flow is throttled and later blocked. Background on transport enforcement since 2023, escalation stages with SMTP codes, the report in the Admin Center, the 90-day pause via PowerShell, and why the next increase will only allow ESU customers and Exchange SE.

14 Jul 2026 · Exchange On-Premises / Hybrid Properly follow up on the July 2026 Exchange security updates Two cleanup tasks are needed after installation: safely remove the old CVE-2026-42897 mitigation and review overprivileged legacy groups in Active Directory.

22 Jul 2026 · Cloudflare Workers Run your own newsletter with Cloudflare Workers and D1 The open template provides signup, unsubscribe, queue, and database in your own Cloudflare account. A deploy button sets up Worker, D1, and CI without a local server.

26 Aug 2026 · Microsoft Teams VPN Split Tunneling for Microsoft Teams: Routing Media Traffic Around the Tunnel Teams calls over a VPN suffer from latency, jitter, and the detour through the VPN gateway. This article explains which Microsoft networks and ports handle media traffic, why IP-based split tunneling is superior to app exclusions, and how to implement it in consumer VPNs, WireGuard, OpenVPN, and enterprise clients.

11 Aug 2026 · Exchange On-Premises / Hybrid Analyzing Exchange Mail Flow: Message Tracking, SMTP Logs, and Receive Connectors How to systematically determine where a message ended up in Exchange On-Premises, Hybrid, and Exchange Online: queries with sample output, how to read the SMTP log correctly, and the issues that regularly lead to incorrect conclusions.

23 Sep 2026 · Mail flow and SMTP Mail loop with encryption gateway behind EXO - Prevent spoofing issues If the encryption gateway (HIN in this example) is behind Exchange Online, every incoming message reaches EOP a second time: with a foreign sender domain, an invalid DKIM signature, and the gateway IP as the source. The result is a spoof verdict and junk. Four settings prevent this without disabling filtering using SCL -1: a PTR record, Enhanced Filtering disabled, a spoof exception for the gateway infrastructure, and CloudServicesMailEnabled on both connectors.

7 Aug 2026 · Exchange On-Premises / Hybrid EXO Migration Without a Remote Move How to provision on-premises Exchange mailboxes in a controlled manner as new, empty Exchange Online mailboxes: PST backup, CSV approval, RemoteMailbox, synchronization, validation, and rollback.

11 Jul 2026 · TotemoMail Access Exchange Online with PowerShell: Replace EWS with Microsoft Graph EWS ends in Exchange Online on October 1, 2026. Learn how to register an app, authenticate a PowerShell script using a certificate, restrict access to individual mailboxes, and process messages and attachments through Microsoft Graph.

26 Aug 2026 · Exchange OnPrem / Hybrid AuthMechanism 10 and AuthAs Internal: How Exchange Classifies Message Submission in the Header The X-MS-Exchange-Organization-AuthMechanism header documents how a submitting server authenticated. Value 10 indicates a Receive Connector with Externally Secured and classifies external emails as internal, with consequences for spam filters, mail flow rules, and spoofing protection.

31 Aug 2026 · Exchange On-Premises / Hybrid CVE-2026-62911: Why 85 Percent of On-Premises Exchange Servers Are Vulnerable and What Is Technically Behind It The BSI reports that around 85 percent of on-premises Exchange servers in Germany are vulnerable to CVE-2026-62911. This article explains the vulnerability technically: MRSProxy, missing Channel Binding, NTLM relay, and Orange Tsai’s Pwn2Own chain, along with context for the figures and the specific recommended actions.

3 Sep 2026 · SMTP and Mail Flow How Long Does an SMTP Session Stay Open? ConnectionTimeout 00:10:00 in Exchange and the Systems for Which That Is Too Short Exchange terminates every incoming SMTP session after ten minutes, even if it is currently transferring data. Which senders stay on a connection that long, how to determine the actual session duration from the protocol log, and when ConnectionTimeout and ConnectionInactivityTimeout should be adjusted on a relay connector.

25 Sep 2026 · Kiteworks / Totemomail Kiteworks: Vendor Recommends Shutdown on September 26 – What Is Known So Far Kiteworks asked its customers to shut down all systems on Saturday, September 26, 2026, from 4:00 a.m. to 10:00 a.m. Final report: During the shutdown, the vendor found and closed a critical flaw without a CVE; on September 30, 125 advisories followed, including CVE-2026-54154 (CVSS 10.0) in the Email Protection Gateway. Totemomail is not affected.

31 Jul 2026 · SMTP and Mail Flow Testing SMTP on Linux: From the TCP Connection to Delivered Email When an appliance stops delivering email, a manual SMTP test is more useful than any log. Learn how to check each layer using built-in tools, what different error patterns mean, and why a load balancer can distort diagnosis.

17 Jul 2026 · Microsoft Entra Entra Connect Sync 2.6.84.0: What’s Changing and Who Should Update Now The security release brings Passkey support and changes to app authentication, PowerShell, and Password Hash Sync. The previous version was withdrawn, so the update requires a phased decision.

25 Aug 2026 · Claude Claude Desktop keeps crashing: “GPU process gone” with exit code 101457950, cause and solution The Claude Desktop app on Windows exits completely with “GPU process gone: exitCode 101457950” (0x060C201E), often followed by the Store app repair dialog. The complete causal chain: Code Integrity blocks vk_swiftshader.dll, Chromium’s fallback chain runs out, and the built-in self-termination exits the app. With a permanent solution (switching to the classic installation without MSIX), self-diagnosis via the event log, and analysis down to the minidump.

17 Jun 2026 · TotemoMail Understanding Mail Routing Between TotemoMail and Exchange Online How TotemoMail stores and processes messages, how the underlying Apache James switches between processors, and what matters for a secure mail loop with Exchange Online.

30 Jul 2026 · Active Directory / Entra Microsoft Entra Domain Services: LDAP and Kerberos for Cloud-Only Environments Entra ID does not speak LDAP or Kerberos. Microsoft Entra Domain Services provides a managed Active Directory domain that synchronizes users from Entra ID and offers traditional protocols. How it works, limitations, costs, and a real-world email gateway use case.

11 Aug 2026 · SMTP / Mail Flow What We Can Learn from Science for IT Troubleshooting Falsifiability, control groups, confounding variables, and sampling bias: the method natural sciences have used for centuries solves exactly the problems where IT troubleshooting regularly fails, illustrated with examples from mail flow.

8 Jul 2026 · HIN Gateway Backing up and restoring the HIN Mail Gateway after a failure A cluster protects the HIN Mail Gateway against node failures, but it does not replace a backup. Configuration, key material, restore sequence and the changes introduced by Stargate are crucial.

29 Jul 2026 · SEPPmail Connect the SEPPmail Admin GUI to Active Directory: Configure LDAP Authentication Starting with 15.0.6 Starting with firmware 15.0.6, administrators of the SEPPmail appliance can authenticate against an external LDAP server such as Active Directory, including group mapping to the local admin group. Configuration under User > Advanced Settings, step by step.

21 Jul 2026 · Claude Running Claude Code Securely on Your Own VPS A hardened Debian VPS keeps Claude Code sessions persistently available. This guide covers everything from user accounts and SSH keys to firewalls, data hygiene, tmux, and secure access from an iPhone.

4 Aug 2026 · Cisco ESA / SMA Renewing a Certificate on the Cisco SMA Certificates can only be installed on the Cisco SMA through the CLI, and current AsyncOS versions validate the entire chain during import: without a stored root CA, the import fails. This article shows the paths to a new key pair, the OpenSSL approach in detail, how to handle OpenSSL 3's RC2-40-CBC error, and how to import the internal root CA into the appliance's trust store.

4 Sep 2026 · Totemomail When the log fills the disk: properly limiting log4j2 RollingFile, using totemomail as an example A log volume filling up can bring down the entire gateway in the worst case. Why combining time- and size-based rotation without %i creates a single huge file, how strategy.max caps retention, the role of the log level, and where totemomail hides these values.

26 Aug 2026 · Load Balancer F5 BIG-IP as an Outbound Proxy for Bulk Email Delivery: Persistence, SNAT, Timeouts, and DNS Resolution A bulk delivery of 1,000 emails per minute runs through a BIG-IP as an outbound proxy to the provider relay. This article explains why sticky sessions provide no benefit here, how to properly resolve the provider hostname using an FQDN node, and which SNAT, timeout, and connection-limit settings actually determine throughput.

25 Sep 2026 · Claude Brave Web Discovery Project: Why Long Word Segments in URLs Exclude Pages In the Web Discovery Project, Brave discards any URL whose path contains a word segment longer than 18 characters. German compounds such as Verschlüsselungsgateway are affected. Because Claude's web search is based on the Brave index, this also affects visibility in Claude. The source-code rule, further heuristics, the role of the canonical URL, a script for checking your own sitemap, a measurement using 825 terms in 24 languages, and an assessment of why the rule disadvantages compound-word languages.

24 Aug 2026 · SMTP and Mail Flow SMTP Load Testing with Apache JMeter in Practice: 10,000 Emails, Five Rule Paths, One HTML Report A complete load test from A to Z: a test plan with a message mix along the ruleset paths of an encryption gateway, a portable setup without installation, 10,000 emails in a burst, and analysis using the JMeter HTML report—including the issues that actually occurred.

11 Aug 2026 · Totemomail Rebuilding Apache James Rule Sets in a Structured Way: Tools and Method Mailet rule sets that have grown over the years contain dead paths that no one recognizes anymore. Learn how to analyze the rule set as a graph, reliably find unreachable code, and design the migration so that a single Mailet keeps the rollback path open.

27 Aug 2026 · SMTP and Mail Flow SMTP Load Testing with Numbered Recipients: Send Every Email Traceably A load test is only as good as its evaluation. With the -N option, smtp-source numbers every email via the recipient address without sacrificing throughput. Learn how to structure the run, how many sessions make sense, and how to automatically find missing numbers.

26 Aug 2026 · SMTP & Mail Flow Analyze Email Headers Without Uploading the Email: Locally in the Browser Instead of in a Web Tool Email headers contain internal hostnames, IP addresses, and personal data. Anyone who pastes them into an online tool sends this information to a third-party server. Why analysis does not need a server and what a tool running locally in the browser can do.

28 Aug 2026 · TotemoMail Essential Controls for TotemoMail Admins: Stop the Server, Check Queues, and Clean Up in a Controlled Manner The key controls for operating a totemomail gateway: stop the service via systemd and the Tanuki control script, count queue contents per repository, inspect individual messages, clean up in a controlled manner, and restart the service.

2 Oct 2026 · FortiMail CVE-2026-104286: FortiMail Zero-Day Is Being Exploited - Workaround and Compromise Assessment Fortinet reports a critical, actively exploited path traversal vulnerability in FortiMail 7.2 through 8.0 (CVE-2026-104286, CVSS 9.8). A patch is not yet available. The workaround disables IBE or blocks Internet access to the management interface; indicators for assessing compromise are also available.

1 Aug 2026 · HIN Gateway HIN Platform Renewal 2026: Access Gateway, Client, and Deadlines Through September 14 Firewall approval by August 14, Access Gateway version 4 from August 17, SAML endpoints, hardware tokens, and HIN Client by September 14. The mail gateway is not affected and will be replaced separately.

6 Oct 2026 · Cisco Secure Email CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Is Being Exploited—Update and Check for Compromise A specially crafted email is all it takes: via an SQL injection in AsyncOS, attackers can execute commands with root privileges on Cisco Secure Email Gateway (CVE-2026-76461, CVSS 9.8). The vulnerability is being exploited, and no workaround is available. Updating to a fixed version and checking for compromise are required.

2 Oct 2026 · Claude Which data center processes Claude? Trace the connection and restrict processing to Switzerland or the EU Which stops a request to Claude passes through, why the trace ends at the Cloudflare edge, and what Anthropic discloses about its data centers. Plus a comparison of paths with a fixed processing location (Anthropic API, AWS Bedrock, Google Vertex AI, Microsoft Foundry), the limits of Switzerland-only operation, and the cost of regional binding.

6 Oct 2026 · Zimbra CVE-2026-73570: Zimbra Command Injection via SNMP Is Being Exploited—Update to 10.1.20 and Check for Compromise A crafted email is all it takes: On Zimbra servers with the zimbra-snmp package and SNMP notifications enabled, attackers can execute commands as the zimbra user without authentication (CVE-2026-73570, CVSS 8.9). The vulnerability is being exploited and was fixed in 10.1.20. Update, apply the workaround until then, and check for web shells and persistence.

14 Oct 2026 · Windows CVE-2026-96951: Windows Shell Mark of the Web Bypass Is Being Exploited—Install the October Update On October 13, 2026, Microsoft fixed an already exploited Windows Shell vulnerability (CVE-2026-96951, CVSS 8.8). Crafted files delivered by email or chat can bypass Mark of the Web protection. CISA lists the vulnerability in its KEV catalog; only the cumulative October update resolves it.

15 Oct 2026 · Cisco Secure Email CVE-2026-76519: Cisco Secure Email Gateway Path Traversal Is Being Exploited - Update and Check for Compromise A crafted email attachment is all it takes: Through a path traversal vulnerability in the AMP File Reputation feature, attackers can write arbitrary files to Cisco Secure Email Gateway and execute commands with root privileges (CVE-2026-76519, CVSS 9.8). The vulnerability is being exploited. Updating the Content Scanner Tools or AsyncOS and checking for compromise are required.

References: migrations, mail gateways and Microsoft 365 Reference projects from regulated industries

Simplified mail routing: four Edge Transport servers replaced

Exchange on-premises migrated to a hybrid environment

Secure messaging platform: in-place upgrade of totemomail

Mail hub and bulk mail infrastructure for SAP invoice delivery

Exchange Online tenant-to-tenant migration

IT consolidation after a cross-border merger

Highly available messaging platform for the public sector

Messaging service portfolio of an IT service provider

The most-read technical articles