31–40 of 63 posts
Say I want a personal domain and have the MX not be Google or Fastmail, how complete is the implementation of these standards on major email providers' SMTP setups? Would I need to do thorough research or is it reasonable to expect it to just work in a, say, European SMTP hoster's configuration?
Earlier quoted context omitted.
>There's a pretty direct inverse correlation between the cost of a hosting service ($5/mo VPS vs. minimum $200/mo colocation of a 1U server) and how much outgoing abuse traffic has been sent from the particular netblock assigned to the enduser customers. Cheap hosting company = poor IP space reputation. Eh...this is pretty much bullshit. Unless you're running your own, good-reputation AS (or happen to know someone ru…
Not really bullshit if you find the right hosting company. There's shitty $200/mo single server colo options, and less shitty ones. In my experience it comes down to personally knowing the people who run the ISP and how serious they are about network abuse issues (and general network engineering best practices). If you find a colo/cabinet space hosting company in a major city that's one of the founding members of a m…
The number of colo providers who refuse to allow customers like VPS hosting companies (who buy rooms not just rent a piddly little 2U from a shared cabinet), is pretty small.
All in, your advice isn't tenable for the majority of technophiles, let alone your slightly-more-technical-than-average user who wants to setup a mailserver. The barrier to entry, your way, is insurmountable.
Maybe it's time for a startup in the "DIY mailserver" space, that offers clean IPs for personal use mailservers and hand-holds through the process?
Earlier quoted context omitted.
A huge part of the problem is that while your personal smtpd might be set up impeccably, you're in the same /24 as a bunch of other low cost bulk hosting customers that have in the past several years set up VPS with much less clue than you. As a result the entire ARIN netblock that your server resides in has a "poor" IP space reputation as seen by the opaque incoming anti-spam measures put in place by Microsoft and G…
And this is how the decentralized internet dies...
Earlier quoted context omitted.
Not really bullshit if you find the right hosting company. There's shitty $200/mo single server colo options, and less shitty ones. In my experience it comes down to personally knowing the people who run the ISP and how serious they are about network abuse issues (and general network engineering best practices). If you find a colo/cabinet space hosting company in a major city that's one of the founding members of a m…
Most people aren't in your or my position, where we might know (sometimes personally) the management at an ISP. Most people aren't in a position to build their own server. Heck, the vast majority of people who want to host any thing aren't in that position. And who wants to spend $200+/m to on their personal email? The number of colo providers who refuse to allow customers like VPS hosting companies (who buy rooms no…
The venn diagram of people who are capable of operating a secure Linux or *BSD based email server implementing, for example, SPF, DKIM and DMARC with postfix+opendkim+spamassassin+dovecot overlaps a great deal with the sort of people who want to colocate a $100-200/month server. A lot even have "free" colocation through their work at an ISP or with friends that have extra rack space and power for a small 1U box.
It certainly doesn't make sense to spend $200/mo on colocating a server just for email - but if you're colocating a whole physical server in this era, it's not hard to make it a box with 64GB or more of RAM and two good quality 512GB SSDs in RAID-1: Make it a hypervisor platform and put twenty of your own VPS on it doing many different things. Balanced with the need to not centralized too much stuff on one piece of hardware as a single point of failure. Public IP space availability depending, of course.
In my experience the best colo is with ISPs that are not actually colo companies, but will only do it as a side thing for people they know and trust. The absolute best colo I've ever had is with a company that has a core business doing X.509/SSL stuff for healthcare enterprise customers. Gear in racks two hops network-topology away from their core routers at a major IX point.
The vast majority of people who do not want to maintain and secure a world-facing Linux/BSD based smtpd are probably better off going with a google apps or hosted email solution where all of the smtp and imap/TLS1.2 infrastructure is handled for them.
I wrote this a while ago. I have SPF, DMARC and DKIM all implemented on my mail domain and I still get put in the spam folder: http://penguindreams.org/blog/how-google-and-microsoft-made-... I think part of it might be that I use Linode, and there are other spammers in their data centre, so I could just be on a subnet bad list. But I think a lot of it has to do with Google/Microsoft's spam filters just being crazy ov…
What is your score on here?: https://www.mail-tester.com/
I wrote this a while ago. I have SPF, DMARC and DKIM all implemented on my mail domain and I still get put in the spam folder: http://penguindreams.org/blog/how-google-and-microsoft-made-... I think part of it might be that I use Linode, and there are other spammers in their data centre, so I could just be on a subnet bad list. But I think a lot of it has to do with Google/Microsoft's spam filters just being crazy ov…
Have you also set up reverse DNS and done it all for IPv6 too? The second part was what I was missing a while back. I do agree that Google and Microsoft are extremely strict with what they accept and it's not always easy to tell why you get thrown to the spam pile.
If I remember correctly, the problem isn't that IPv6 needs to be set up, but that if your host listens on IPv6, Google will default to that and then your SPF/DMARC/DKIM setup needs to work with IPv6. If you don't have an external IPv6 address, then you don't need to configure SPF etc... for IPv6 and you should be fine.
SPF is used more frequently.
A few tips from setting up SPF/DMARC/DKIM for a SAAS service: * SPF: limit your record and all includes to 10 DNS lookups (e.g., "A MX include:_spf.google.com" is 3 DNS lookups plus all of the lookups inside the include. * DMARC: to see a strict reject policy, check out Yahoo: $ dig +short -t txt _dmarc.yahoo.com "v=DMARC1\; p=reject\; pct=100\; rua=mailto:dmarc_y_rua@yahoo.com\;" * Mail forwarding: if your app sends…
A few tips from setting up SPF/DMARC/DKIM for a SAAS service: * SPF: limit your record and all includes to 10 DNS lookups (e.g., "A MX include:_spf.google.com" is 3 DNS lookups plus all of the lookups inside the include. * DMARC: to see a strict reject policy, check out Yahoo: $ dig +short -t txt _dmarc.yahoo.com "v=DMARC1\; p=reject\; pct=100\; rua=mailto:dmarc_y_rua@yahoo.com\;" * Mail forwarding: if your app sends…
I run a small Saas company that does mail forwarding as you mentioned above ("send mail as the logged-in user"). If not putting the user's email as FROM, how do you recommend handling it?
Most e-mail providers accept my email.
More accurately: in the last two years only gmx.de rejecte one email.