81–90 of 744 posts
The fix here is use a commercial provider for outbound smtp but continue to self-host inbound. Not ideal, but it works.
It would be possible to solve the spam problem once and for all with a crypto currency: if (Sender is whitelisted by receiver): All emails arrive in the inbox else: Sender has to send $1 for their email to arrive in the inbox The $1 will be returned if the receiver replies
We have cryptographic identity in SMTP already. In fact, almost all our protocols and formats for signing and identity were first adapted from email standards. This has already failed.
"You might be an anti-spam kook" does need to be updated to also include cryptocurrency solutions. You're neglecting the transaction costs associated with cryptocurrency, which might be punitive both for senders and for those attempting to collect the spam bounty. Of course the big email providers could aggregate settlements... but now we're back to having big email providers.
Hosting an email server on a consumer IP does seem to a losing proposition, Hosting an email server on a cheap (reputable) cloud server and doing the basics (PTR records, SPF etc) still works well.
How do you know? SMTP wasn't designed for reliable delivery. You don't know if your emails are being received, and even i they are, you don't know if they'll be received tomorrow.
Doesn't give full certainty, but can be well enough. (If all my recipients respond I don't care about the ones I don't send to anyways)
Funny thing happened to me today: Gmail sent its own Google Fi customer support email to spam. Haha, wish I noticed that before spending my morning going in circles with chat support.
> You cannot set up a home email server.
This is true enough to not care about edge cases.
> You cannot set it up on a VPS.
This is definitely not true.
> You cannot set it up on your own datacenter.
This is absolutely, unambiguously untrue.
I get that there are many people out there who don't want to administer an email server, or who administer one (or more) and are tired of trying to train users to DTRT and care about security. The truth is that if you have lots of users, it's likely that one will get compromised, and their account will be used to send spam.
Is it the end of the world? Heck, no, unless you let it go on for days. "It's not if, it's when. Say goodbye to your email. Game over. No recourse." That's just plain not the case at all, unless, again, you don't have monitors in place.
A super simple example: a script which counts the number of email sent by any given user in a certain timeframe is really not complicated. I've used something like this and it has caught a mail loop which wouldn't end because the entity causing the looping was rewriting so much that typical anti-loop checks failed.
So a user gets compromised. If this is a real concern (say, for instance, you have a lot of Windows users), your script should send an alert to you when this user's account has sent several hundred messages over the past hour. You disable the user's account, you clean the mail queue, and you deal with the fallout. Sure, that may mean watching your logs for a few days for rejections and visiting other networks' delisting pages, but it happens.
So there's the largest problem with running your own email server handled. Boom. Done. If you've hosted email for years yet can't / won't do this little bit of work, then that's you. The rest of us understand this.
What about deliverability in general? Isn't that the largest problem, you ask? No. No, it isn't at all. You can even run an email server on your home Internet connection, if your ISP allows incoming connections, the same way you can handle any other general deliverability issue: smarthosting.
If you want to claim that there are NO ISPs out there that can reliably send email outside of Yahoo / Outlook / Google / Amazon, then you might say smarthosting isn't a solution. However, you'd be flatly wrong, so wrong you shouldn't be hosting email.
If your home network can't send email (it almost certainly can't), and your VPS can't send email (it'd probably have issues), and your datacenter can't send email (you're clearly doing something wrong, but let's pretend), then you can smarthost through an email provider that has a good reputation. Period.
Anyone who wants to argue that hosting your own server can't be done today because of deliverability ignores this super obvious solution, which negates this entire article.
Let's move past that and look at the suggestions this article makes:
Should we throw in the towel, proverbially speaking? Certainly not. I disagree with this emphatically.
"This doesn't only affect contrarian nerds." No, it doesn't, but discouraging others isn't the solution. Your lack of solutions isn't a good reason for others to throw in the towel. But why are so many "contrarian nerds" so quick to tell others to NOT do something? Do you tell people to not paint or draw, because it's too hard for you? Or to carve, or write fiction, because you're not good at those things?
"You can no longer set up postfix to manage transactional emails for your business. The emails just go to spam or disappear." Nope. You're accepting that as normal and equal. It isn't. This is the same basic idea as "I can't afford to not run Windows, because everyone else runs Windows" - it's a fundamental misunderstanding on your part that leads you to assume you're the victim, and you're powerless. If your email is being silently dropped, then you need to tell the recipients that they need to 1) complain to their provider, and / or 2) find real, deterministic email services. I've told many people that I'm not responsible for overzealous spam filtering, and I provide proof that the email was delivered. It's on them after that. "But I can't afford to do that!" Then smarthost. This isn't difficult.
"One strike and you're out. For the rest of your life." Nope. Demonstrably, nope, unless you're letting spam flow from your servers for days at a time.
Your recommendations:
"Let's keep antispam measures." Sure, but consider the fact that they're part of the problem. Spam filtering shouldn't be arbitrary - for instance, I do ZERO content filtering, unless or until I can prove to myself that there are no false positives. Email with "storage.googleapis.com" URLs? 100% spam. Email from random addresses / networks with Gmail Reply-To? Absolutely 100% spam. Email from servers with a HELO / EHLO name that doesn't exist? Rejected. But keywords? No. That's stupid. I've seen, for instance, too many abuse email addresses that don't accept spam complaints because of content-based, rather than behavior-based, spam filtering. The problem with Gmail is that they do too much content based filtering, with no rules and no logs that we can see.
"Change blacklisting protocols so they are not permanent and use an exponential cooldown penalty." Fair.
"Blacklists should not include whole IP blocks." I disagree. If your network neighbors are shitty, then you should 1) ask for your IPs to be SWIP'd to you, 2) find a better company that punishes spammers / scammers, and/or 3) smarthost.
"Stop blackholing." Yep. But, "No need to bounce every email" - 100% disagree. If you're sending so many messages that you're overwhelmed by returns, then you're doing something horribly wrong. Every email needs a bounce. This is how email works.
"There should be a recourse for legitimate servers." 100% agree. I think someone who has the time and resources should take all the large providers to court to compel them to have methods for correcting interoperability. If Google, for instance, wants to be like a utility, then they should be forced to act like one and they should have real ways to interoperate. As it is right now, it it not possible to reach an actual human at Google about anything via email. Every single message goes nowhere. They shouldn't be allowed to operate like that, or if they want to be arbitrary, they should lose the right to be called RFC compliant email and the use of Gmail accounts shouldn't be usable for anything public. That's another whole battle, though - why should a company get to call themselves an email provider when they don't provide reliable, repeatable service? Sigh.
"Email discrimination is not only unethical; it's a risk for the industry." Agreed. I think there's already legislation proposed, if not already passed, making certain types of communication unblockable. It's shitty legislation, but it's a first step at a precedent we all need - we need to be able to dictate to large corporations the parameters of what they can do and can't do if they want to be considered email.
Hosting an email server on a consumer IP does seem to a losing proposition, Hosting an email server on a cheap (reputable) cloud server and doing the basics (PTR records, SPF etc) still works well.
How do you know? SMTP wasn't designed for reliable delivery. You don't know if your emails are being received, and even i they are, you don't know if they'll be received tomorrow.
It seems like one solution is to bcrypt hash (or some similarly expensive algorithm) the email and include the hash in a header. Of course you need to hash per receiver or a spammer can just hash it once and spam away.
The receiving client hashes the email and compares the result with the value in the header and discards emails that don't match.
You'll never get industry buy in though - the FAANG companies don't want to pay that cost for their semi-legitimate email. They prefer to keep that cost externalized.
I believe there have been attempts at something like this, but it clearly never went anywhere.
It would be possible to solve the spam problem once and for all with a crypto currency: if (Sender is whitelisted by receiver): All emails arrive in the inbox else: Sender has to send $1 for their email to arrive in the inbox The $1 will be returned if the receiver replies
I will stop replying to my mail for sure