Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mail-in-a-Box – one-click, easy-to-deploy email server

github.com

Post reply on HN
Print view View original

61–70 of 92 posts

Re: Mail-in-a-Box – one-click, easy-to-deploy email server

#61

Post by cm2187 »

viraptor wrote: post #10
voltagex_ wrote: post #6

Earlier quoted context omitted.

Why?

Gmail and other really big providers are in a unique position for spam filtering. They have so many users that they get a continuously trained filter pretty much for free. They can instantly classify never-seen-before kind of spam in minutes because someone gets push notification on their phone and clicks "this is spam". Nobody with purely-technical solution to this problem can be better in practice. (although we're…

I receive tons of spam (on a very old email address).

I am progressively transitioning to giving a unique email alias for each service.

1. If the address gets leaked or sold I can identify the culprit and stop the spam by deleting the alias

2. It is a useful security measure too, if a website gets hacked, it becomes harder to correlate my account across websites since it is a unique, non predictable address.

Re: Mail-in-a-Box – one-click, easy-to-deploy email server

#62

Post by TheGrumpyBrit »

bigiain wrote: post #15
eikenberry wrote: post #12

Earlier quoted context omitted.

Once you have SPF/DKIM in place and make sure your IP isn't already on a blacklist for some past (previous users) infractions you should be good to go. I've run my own mail server for years and have only had to remove it from a blacklist once. So once you get past some initial blacklist monitoring work, you are good to go. That does bring up the point of how to do blacklist monitoring. There are various commercial se…

Question: where's your IP address come from? I'd have guessed that common cloud VM IP pools are likely all trashed permanently already? I somehow doubt AWS or DO or Linode or Rackspace et al are worthwhile places to host an outbound mail server? I'd also guess ISP pools of home IP addresses are probably just as poisoned. Is proper SPF/DKIM setup "enough" to overcome that? (Or are my suspicions about pools of IP addre…

I use DO without any problems. You need to make sure your IP isn't blacklisted before you start (and if it is, trash the instance and try again), and keep an eye on blacklists in case your range gets caught, but you should really be doing that anyway.

Re: Mail-in-a-Box – one-click, easy-to-deploy email server

#63

Post by benevol »

mr_blobs wrote: post #2

I setup my own mail server last year and shortly gave up on the idea. Setting the server up isn't the problem. The problem is keeping your IP off of all the major blacklists. I wasn't even sending out mass emails and 30%+ of my email would never be delivered. I had to constantly check to see if my IP addresses were on the various spam lists (and fight to get my IPs off) and I just got tired of it. Companies like Goog…

> The problem is keeping your IP off of all the major blacklists.

I run several email servers, and this is NOT the problem. You just need to configure things correctly. It's not 1996 anymore, you need to set up things like DKIM, SPF, etc. Also make sure your hosting provider has not sold you an IP that was previously used by a spammer. [0]

That's all there is to your "problem".

Besides that: Your solution to Google's insane domination is to put even more of your life on their servers? When we know thanks to Snowden that Google is part of the NSA's PRISM mass surveillance program? Surrendering is not what winners do.

[0] Simply run a Blacklist Check here: http://mxtoolbox.com/supertool.aspx

Re: Mail-in-a-Box – one-click, easy-to-deploy email server

#64

Post by abverma »

ProxCoques wrote: post #49
mr_blobs wrote: post #2

I setup my own mail server last year and shortly gave up on the idea. Setting the server up isn't the problem. The problem is keeping your IP off of all the major blacklists. I wasn't even sending out mass emails and 30%+ of my email would never be delivered. I had to constantly check to see if my IP addresses were on the various spam lists (and fight to get my IPs off) and I just got tired of it. Companies like Goog…

While I hear you on Gmail's overbearing influence, I'm not a sysadmin (I'm a designer and I spend most of my time talking to people about "user journeys" and fonts), but I run my own (and my family's) email using Ubuntu on a VM. There are lots of easy HOWTOS on setting up Postfix with DKIM and bind with SPF. I've got an alert on one of those blacklist monitors and not been in any blocking lists at all in several year…

You might want to switch to Lets Encrypt or a paid SSL certificate provider.

https://en.wikipedia.org/wiki/StartCom#Criticism

https://blog.mozilla.org/security/2016/10/24/distrusting-new...

https://wiki.mozilla.org/CA:WoSign_Issues

Re: Mail-in-a-Box – one-click, easy-to-deploy email server

#65

Post by TheGrumpyBrit »

awinter-py wrote: post #19
mr_blobs wrote: post #2

I setup my own mail server last year and shortly gave up on the idea. Setting the server up isn't the problem. The problem is keeping your IP off of all the major blacklists. I wasn't even sending out mass emails and 30%+ of my email would never be delivered. I had to constantly check to see if my IP addresses were on the various spam lists (and fight to get my IPs off) and I just got tired of it. Companies like Goog…

I think you're mischaracterizing the promotions tab. When users interact with a web merchant, they're exchanging money for goods/services -- they're not signing up for spam. Hiding marketing email is a feature, not an evil plot. It's not just G that differentiates between transactional email (a receipt) and bulk/marketing mail. Trans/bulk are so different that email companies consider these separate products (e.g. ma…

I found the Promotions tab to be a really handy "middle ground" between spam and actual mail. It usually contains mail from companies I've done business with, who I might be interested in receiving offers from, but I don't want those offers mixed in with my day-to-day stuff. Having them separately allows me to read them on my own time, and also lets me see at a glance if anyone is sending me too much. They're also usually the kind of companies who will honour an unsubscribe request.

Re: Mail-in-a-Box – one-click, easy-to-deploy email server

#66

Post by eps »

insertnickname wrote: post #60
viraptor wrote: post #10

Earlier quoted context omitted.

Gmail and other really big providers are in a unique position for spam filtering. They have so many users that they get a continuously trained filter pretty much for free. They can instantly classify never-seen-before kind of spam in minutes because someone gets push notification on their phone and clicks "this is spam". Nobody with purely-technical solution to this problem can be better in practice. (although we're…

I run my own mail server, and I get very little spam. Sometimes I go for days without a single spam message even getting through to my spam folder, much less my inbox. The last spam mail that got through to my spam folder was on November 25th. And it's not because spammers don't try, my server has rejected 206 mails in the last ~24 hours (and that's not counting the attempted open relay abuse). My setup consists of P…

May want to throw postgrey in a mix.

Incredulously, asking first-time senders to retry in a bit still filters out the vast majority of spam.

Re: Mail-in-a-Box – one-click, easy-to-deploy email server

#67

Post by ashleyhindle »

This is the exact reason I built Fodor: https://fodor.xyz - it lets you easily setup GitHub projects on DigitalOcean so it truly is one~ click (usually about 4, but hey pretty good?)

You add a fodor.json file, add a link to Fodor and it makes it super easy to get it setup for yourself

Re: Mail-in-a-Box – one-click, easy-to-deploy email server

#68

Post by insertnickname »

eps wrote: post #66
insertnickname wrote: post #60

Earlier quoted context omitted.

I run my own mail server, and I get very little spam. Sometimes I go for days without a single spam message even getting through to my spam folder, much less my inbox. The last spam mail that got through to my spam folder was on November 25th. And it's not because spammers don't try, my server has rejected 206 mails in the last ~24 hours (and that's not counting the attempted open relay abuse). My setup consists of P…

May want to throw postgrey in a mix. Incredulously, asking first-time senders to retry in a bit still filters out the vast majority of spam.

I intend to switch to rspamd soon, which has built-in greylisting. However, in my test run with rspamd I did not get good enough results because my current SpamAssassin setup relies heavily on rejecting spam that hits two or more content filters (bayes, pyzor, etc.). I will need to implement at least a pyzor plugin for rspamd before I can switch.

rspamd, in addition to bayes filtering, has it's own fuzzy fingerprinting system. You can use your own fingerprint db and/or a public one. The public one that is configured in rspamd by default didn't seem to catch any of the spam I get though.

Re: Mail-in-a-Box – one-click, easy-to-deploy email server

#69

Post by SturgeonsLaw »

benevol wrote: post #63
mr_blobs wrote: post #2

I setup my own mail server last year and shortly gave up on the idea. Setting the server up isn't the problem. The problem is keeping your IP off of all the major blacklists. I wasn't even sending out mass emails and 30%+ of my email would never be delivered. I had to constantly check to see if my IP addresses were on the various spam lists (and fight to get my IPs off) and I just got tired of it. Companies like Goog…

> The problem is keeping your IP off of all the major blacklists. I run several email servers, and this is NOT the problem. You just need to configure things correctly. It's not 1996 anymore, you need to set up things like DKIM, SPF, etc. Also make sure your hosting provider has not sold you an IP that was previously used by a spammer. [0] That's all there is to your "problem". Besides that: Your solution to Google's…

I completely agree, especially with your "defeatism is doing your opponent's work for them" viewpoint, but if your goal is keeping information off the big provider's systems, then it's not gonna leave you with many people to email...

Re: Mail-in-a-Box – one-click, easy-to-deploy email server

#70

Post by eps »

insertnickname wrote: post #68
eps wrote: post #66

Earlier quoted context omitted.

May want to throw postgrey in a mix. Incredulously, asking first-time senders to retry in a bit still filters out the vast majority of spam.

I intend to switch to rspamd soon, which has built-in greylisting. However, in my test run with rspamd I did not get good enough results because my current SpamAssassin setup relies heavily on rejecting spam that hits two or more content filters (bayes, pyzor, etc.). I will need to implement at least a pyzor plugin for rspamd before I can switch. rspamd, in addition to bayes filtering, has it's own fuzzy fingerprinti…

Don't know about rspamd, but SpamAssassin used to be way too aggressive in its stock config. E.g., it had a default rule for some "MS-Outlook" headers that just happen to be in every email sent from Outlook via a non-Exchnage mail server. That created a ton of false positives - wasn't hard to fix, but still it was a hassle.
Post reply on HN