Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

After self-hosting my email for twenty-three years I have thrown in the towel

cfenollosa.com

Post reply on HN
Print view View original

641–650 of 744 posts

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#641

Post by prmoustache »

Author do not mention the frictions of going the other side (gmail/hotmail/live):

- you might not receive all the emails people sent to you, for the reasons mentionned in this very article

- you will receive much more spam/unwanted email. I quit using a gmail account because I kept reveiving newsletter and notifications from other people who kept mistaking his account with mine. There was probably a one letter difference in their real email address and mine. I surrendered and gave up trying to tell his relative they weren't reaching the right person, only had fun once by powning his NAS with a "cloud function", and gave up after receiving tons of newsletters and other shit.

- you can lose your account any day, for any reason without any possibility to get it back. I've seen it happen to 2 people with hotmail.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#642

Post by GTP »

neop1x wrote: post #319
jwr wrote: post #250

I've been hosting my mail for 20+ years now, with minor issues. I guess I've been lucky. Reading the comments here makes me incredibly sad. Every answer that tells me to use a provider misses the point. The Internet was created so that there could be many independent nodes, not so that everybody has to rely on one of several blessed providers. I should be able to run my own E-mail. The real problem is lack of incenti…

I have also been self-hosting email for 15 years and only had couple of problems at the beginning, mainly until my IP got enough reputation. I have been hosting it on a bare metal Supermicro server in a proper datacenter, though. It has reverse-DNS, SPF, DKIM, TLS, MTA-STS and even DANE with DNSSEC (on a self-hosted BIND but that's another story). It is implemented using Exim, Dovecot, SpamAssasin, DNSBL and Roundcub…

How did you get reverse-DNS? When I tried self-hosting, that was a problem for me.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#643

Post by berkes »

massaman_yams wrote: post #461
TheRealDunkirk wrote: post #435

Earlier quoted context omitted.

> The filtering behavior reported here is either misunderstood or misrepresented. First, no, no major ISP (Gmail, Yahoo, Microsoft/Outlook, icloud) is going to permanently block an IP range; filters are designed to be dynamic. In severe, ongoing, high-volume spam scenarios, you could see a 2-week block, maybe occasionally 30 days. But never "one strike". You say you're knowledgable, but I also ran my own email server…

The overwhelming majority of legitimate mail will never see anything remotely near a 14-day block. Again, it's reserved for severe, ongoing, high-volume spam scenarios; ISPs use other methods like short-term deferrals for more common/less severe problems. If you find yourself in an IP range involved in a severe, ongoing, high-volume spam scenario that's affecting your delivery, then it means your provider is not mana…

The overwhelming majority of my legitimate mail has seen consistent and irrecoverable 14 day blocks for the last decade+. One on an IP that only did my email for over 6 years. Yet the oligopoly started to block blocks of IPs, including my IP, without recourse.

If you say this problem doesn't exist, you are either not familiar with the problem, misunderstanding it, or simply lying. I hope it is just miscommunication.

Like many here, I gave up self hosting email. To the point that I buy an SMTP service from one of the oligopoly. The incoming mail is handled fine by my server still.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#644

Post by Avamander »

ldng wrote: post #415
Avamander wrote: post #283

Earlier quoted context omitted.

Is it that difficult to grasp that there's a "depends" option between "optional" and "not optional"? Nobody really forces you to use HTTPS either, it's not a "monopolizing" standard if someone doesn't trust you without. And again, if you have a way of establishing just as much trust without such a labour-intensive/expensive verification process, please do share.

> Nobody really forces you to use HTTPS either Yet, in practice, that is exactly what both Chrome and Firefox are trying to do.

Emphasis on the "trying" here, you are not forced.

It's also not just them, it's the vast majority of the internet community that agrees with that.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#645

Post by dvdkon »

zimpenfish wrote: post #618
jjav wrote: post #545

Earlier quoted context omitted.

I don't use any kind of block list on my mail server, as I find the concept to be fundamentally flawed. I accept all incoming email as long as basic sanity on the connection is met and then apply bayesian filtering after the email has been accepted. I get just about no spam at all (<10 per month, maybe).

I use block lists, fail2ban, gray listing, most of rspamd's widgets, and Bayesian filtering. Still getting 10s of spams a day just to my accounts.

Any guess on why people's experiences with spam are so diverse? I self-host and get fewer than 10 true spam emails per year (not counting marketing newsletters).

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#646

Post by Avamander »

jjav wrote: post #545
koheripbal wrote: post #471

Earlier quoted context omitted.

Not using block lists will inundate mail servers with spam. It's a necessary evil.

I don't use any kind of block list on my mail server, as I find the concept to be fundamentally flawed. I accept all incoming email as long as basic sanity on the connection is met and then apply bayesian filtering after the email has been accepted. I get just about no spam at all (<10 per month, maybe).

You are not a valuable target to spammers. At some point even storing the spam letters makes no financial sense.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#647

Post by Avamander »

867-5309 wrote: post #597
zahllos wrote: post #71

I'm on 12 years of self hosting email and counting. Once every so often, I do end up being blocked, usually by Outlook and once by Yahoo. I'm in their 'sender program' and they still don't actually bother to contact postmaster@, but a few emails is usually enough to unblock the block within 24h. Agree with a sibling comment that many major providers fail to operate the SPF/DKIM/DMARC tools they insist you do. Each to…

>VPS provider that disallows things like VPN endpoints this can't exactly be policed

It can be enforced when complaints come in.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#648

Post by yrro »

jeffbee wrote: post #4

Is there actually a "big tech" email provider that accepts a message with a 2xx SMTP code and then deletes it? The only one I personally know of never does that. That one also does not use anything like an IP address blacklist. This article doesn't name names, it just waves its hands and throws around some innuendo. But as far as my own personal experience goes, this author has no idea what they are talking about.

Yes, it's Microsoft (the author confirmed in a thread on Twitter).

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#649

Post by iggldiggl »

franga2000 wrote: post #322
cowtools wrote: post #312

Earlier quoted context omitted.

signup confirm emails are not what i'm describing, because you need to establish and filter the initial offer that they send you via email itself, which is still prone to phishing. What I'm describing is a situation where users themselves have to proactively subscribe to a connection using some sort of out-of-band mechanism. For example, if a website wanted to send you emails, they could produce some sort of "connect…

This makes sense for service emails and is similar to how push notification services like Pushbullet work, but can't work for humans. You need to be able to give your email to someone IRL so they can send you a message. Mutual approval would be possible in the "we just met and want to exchange emails" situation, but that too breaks when you legitimately want to give anyone the chance to message you.

> but that too breaks when you legitimately want to give anyone the chance to message you.

Yup. I do want people to be able to contact me regarding my homepage. It's only a niche page on a niche subject, so only a handful of people has written in, but it was nice hearing from them and some of them did make quite a few valuable contributions.

Some minimal obfuscation seems to be enough to keep mail harvesters away, and beyond that those mails go through the same spam filter as all my other mail traffic. Putting up a contact form would definitively be more of a hassle than just a simple mailto:-link, and then I would additionally have to start worrying about how to keep the bots away from that contact form.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#650

Post by iggldiggl »

KoftaBob wrote: post #363
cowtools wrote: post #297

Earlier quoted context omitted.

I think we ought to move email (or some future incarnation of email, like matrix) to a completely whitelist (opt-in to receive messages) basis.

That's essentially how www.hey.com works! I thought it would be tedious at first, but I don't mind it, and it's done a great job of making it so I only see what I want to see in my inbox.

From a quick read, hey.com still allows arbitrary people to message you and just initially puts them in "The Screener", which doesn't seem like quite the same thing as an absolutely "completely whitelist (opt-in to receive messages) basis".

That's fine by me because

a) I do want to give out some sort of contact info on my homepage and people being able to message me in relation to that (and putting up a contact form leads to its own spam problems), and

b) if you happen to swap contact details offline, you then have to remember that you still need to additionally whitelist that person inside of that message service, which also seems somewhat of a hassle.

Somebody who gets inundated in unwanted messages might have a different opinion on that subject, though, and might indeed prefer a strict opt-in mode, with no exceptions…

Post reply on HN