Funny seeing this on the top of HN when this is also on the top of HN: https://jan.wildeboer.net/2022/08/Email-0-The-Journey-2022/
After self-hosting my email for twenty-three years I have thrown in the towel
621–630 of 744 posts
Re: After self-hosting my email for twenty-three years I have thrown in the towel
#622Earlier quoted context omitted.
I don't use any kind of block list on my mail server, as I find the concept to be fundamentally flawed. I accept all incoming email as long as basic sanity on the connection is met and then apply bayesian filtering after the email has been accepted. I get just about no spam at all (<10 per month, maybe).
One spam every three days is insanely high IMO (compared to what you will get on gmail)
I get > 1 spam per day on gmail.com.
But I don't find that burdensome at all, in fact I'd prefer that gmail let more stuff through to my spam folder instead of swallowing things that it misclassifies, because I have seen several instances of lost legitimate email, something I still don't understand how is deemed acceptable to the people who wrote it.
But I need to vote with my feet instead of complaining.
Re: After self-hosting my email for twenty-three years I have thrown in the towel
#623I am not a Google employee, but I do work with email anti-spam at scale. There's a lot to critique here but it boils down to three points: 1. Spam filter behavior has changed because spam has increased in volume and sophistication, not because ISPs want to save money, or to eliminate competition. Some techniques that worked well 5 years ago aren't as effective anymore. One of the consequences of this has been a reduc…
> IP range reputation is not easy to assess, sometimes even for email professionals. The article is about a man who has been sending emails from the same address for the last couple of decades, and it has always been in his control. Is it difficult to assess the reputation of his address? You seem to be deflecting some blame onto the victim of the shortcomings of your system.
This is not my system, to be clear, but you might be surprised how little 20 years of data matters to filter accuracy, empirically speaking; recent sending behavior carries orders of magnitude more weight.
Re: After self-hosting my email for twenty-three years I have thrown in the towel
#624I've been hosting my mail for 20+ years now, with minor issues. I guess I've been lucky. Reading the comments here makes me incredibly sad. Every answer that tells me to use a provider misses the point. The Internet was created so that there could be many independent nodes, not so that everybody has to rely on one of several blessed providers. I should be able to run my own E-mail. The real problem is lack of incenti…
I think the problem was this guy was providing email accounts for other people. Other people who probably reused their passwords and had their email in the same DB in the apps they used. That DB was compromised. Hackers got an account to send spam. Then the domain was blacklisted. He alluded to this in > At some point your IP range is bound to be banned, either by one asshole IP neighbor sending spam, one of your use…
I understood that sentence as something that can happen to you even if you believe it won't.
> Please believe me. My current email server IP has been managed by me and used exclusively for personal email with zero spam, zero, for the last ten years.
Re: After self-hosting my email for twenty-three years I have thrown in the towel
#625Earlier quoted context omitted.
First, yes. They (the small providers) have recourse, it’s just annoying. They voluntarily signed up for that annoyance because of their ideology. But much more importantly, that question is orthogonal to my argument. Using blocklists is a good way to cut down on spam, the fact that it might block some trivial percentage of people who for ideological reasons might or might not be on those lists isn’t the receivers pr…
> ideological reasons might or might not be on those lists What's the ideological reasons here?
Apparently people who want to self host email instead of paying some big tech
Re: After self-hosting my email for twenty-three years I have thrown in the towel
#626Earlier quoted context omitted.
"The sweet spot for having control over your email while simultaneously minimizing unforseen headaches is to simply own your domain name" You would think. The issue no one seems to think about is that you need to make sure to pay for the domain for the duration of your life(at least). Otherwise, as soon as you lose your domain you lose ownership of your email. Any one that has control of the domain has control of you…
> The issue no one seems to think about is that you need to make sure to pay for the domain for the duration of your life Is there a registrar that will allow you to do this? Most of the ones I’ve looked at have an upper limit of around 15 years or so
The maximum bound for most gTLD registries is ten years (have a dig around the ICANN website if you'd like to check), not fifteen. Sure, there might be a ccTLD that allows you to register a domain for longer than that, but I'm not aware of any, and ccTLDs usually have lower maximum renewal/registration bounds than the gTLDs.
If a registrar is letting you renew a gTLD for 15 years, they're basically sitting on a third of your money until the domain's expiration date comes up.
Re: After self-hosting my email for twenty-three years I have thrown in the towel
#627Earlier quoted context omitted.
I've been running a private mailserver for myself and a couple of friends since 2002. I hit a similar issue with Microsoft last year. I route outgoing mail to hotmail.com, live.com, outlook.com and msn.com domains via email-smtp.us-east-2.amazonaws.com. I started doing this when I noticed a large portion of e-commerce email I was receiving originated from amazon vms and they clearly had no deliverability issues. The…
File a complaint request, they will fix it, they did for me.
[deleted]
Re: After self-hosting my email for twenty-three years I have thrown in the towel
#628Earlier quoted context omitted.
Not using block lists will inundate mail servers with spam. It's a necessary evil.
I think that gray listing is a great idea to filter out spam. Here's how it works: the very first time an email server get an email from a new IP it answers with a "temporary unavaiable" error. According to specs, a server should retry to deliver the email after a while, so a legitimate server will retry and it's IP will be put in a "withelist" (here in quotes because you can still do further processing of the emails…
The trade off is that even legitimate mail that you are actively expecting (like an account confirmation or password reset mail) will be delayed by however long the sending server's retry interval is.
You also either need to apply the greylisting to some larger IP range (rspamd e.g. apparently uses /19 by default for IPv4) or otherwise specially handle some of the bigger mail providers, because some of them rotate through their servers between retries, so you could be in for a quite a long wait if you do per-individual-IP greylisting.
The biggest culprit I noticed this with was Amazon SES – a former mail provider of mine used per-individual-IP, non-configurable greylisting, and any mail sent through Amazon (which isn't just Amazon itself – quite a few companies are using Amazon SES for transactional mail and suchlike) would consequently almost always arrive several hours late (however randomly long it would take Amazon to finally re-use an IP during a subsequent retry attempt).
Even more infuriating, my mail provider's support would then claim that it wasn't their fault and they didn't know anything about any supposed greylisting.
Re: After self-hosting my email for twenty-three years I have thrown in the towel
#629Earlier quoted context omitted.
I think that gray listing is a great idea to filter out spam. Here's how it works: the very first time an email server get an email from a new IP it answers with a "temporary unavaiable" error. According to specs, a server should retry to deliver the email after a while, so a legitimate server will retry and it's IP will be put in a "withelist" (here in quotes because you can still do further processing of the emails…
> I heard [gray listing] works very well Mostly. But then you get the "click the link in the email within 10 minutes" problem. There's also a non-zero number of "our mail didn't get through first attempt, oh well, give up" people. From running GL on my servers over a couple of years, it mildly cut down spam (on top of blocklists and fail2ban) but I'm now wavering over whether it's worth the hassle.
It cut spam tremendeously for me, but that's on an email address I've used and published openly since early 2000s.
Still, I've given up on it since plenty of email senders are not standard-abiding (they fail to retry), and I've kept losing email. I only caved in in the last 12 months after 15+ years of doing graylisting.
Re: After self-hosting my email for twenty-three years I have thrown in the towel
#630Are the big tech email servers truly not used for spam at all? Because if they are, shouldn't they be permabanning each other as hard as they ban the little guy? Clearly they're using different rules against each other than against small email servers, and I think that's all the evidence you need to get the EU to take action here.
They actually do end up banning each other's endpoints (specific IP addresses, not entire ranges) from time to time. --Even the big companies aren't able to prevent their services from being used for spam even though they shut it down as quickly as they can. And usually the blocks are due to the blacklists like SpamHaus, rather than the email providers explicitly blocking competitors' endpoints.