91–100 of 247 posts
Earlier quoted context omitted.
Because the from address can be forged, probably.
But to exploit this, an attacker would need to have the address book of every account they are trying to spam.
There's almost no cost to send an email except time so even when n is large, this does not prove nearly as intractable as one wants it to be.
What advantages does this have over just running RoundCube myself? The things listed on the pricing page seem fairly superficial.
Offtopic, but have people had any success maintaining a personal email domain as forwarding to the major email providers? I have a vanity domain, and used to be able to use GMail to send email as that domain [1], and forward received mail from that domain back to GMail. But with SPF, DKIM, and DMARC (or something), this has broken and such received email gets marked as spam and/or phishing. I don't know how to fix th…
You can't forward email to Gmail - they'll blame your server for forwarded spam regardless of everything else being correctly set up. This is true to an extent for other providers, too. The simplest solution is to set up IMAP on your mail server and have remote mail accounts fetch from it. Most email providers can be configured to fetch via IMAP.
The problem is that there is no such thing as mail forwarding. It is mail re-sending. So, you get a piece of spam and re-send it to Google, and the From address isn't the spammer, it's you. They'll eventually block the email address, and then the whole domain it's on.
Don't forward. SMTP. SMTP is authenticated, which solves the issue.
> All passwords are by default stored as salted SHA512 hash (5000 rounds). Attackers will have hard time to crack your passwords. SHA512 isn't a good choice for this, because it's optimized for fast low-memory computation. Why not use bcrypt or argon2, which are industry-accepted best practices for password hashing?
I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…
They could also provide Cloudflare-like spam and DDoS protection for receiving mail
Earlier quoted context omitted.
Not really a problem in the age of DKIM, _if_ you want to solve it.
Even with DKIM, all you need is the recipient of one email from one user on one domain (I have hundreds of domains) of your mail server to file a spam report, and WHAM you are blacklisted. So yes, it is a problem even with DKIM. If you have a solution, I would LOVE to hear about it.
Earlier quoted context omitted.
Even with DKIM, all you need is the recipient of one email from one user on one domain (I have hundreds of domains) of your mail server to file a spam report, and WHAM you are blacklisted. So yes, it is a problem even with DKIM. If you have a solution, I would LOVE to hear about it.
Hashcash was originally proposed to add some form of cost to sending email. Something similar could be a great way to get mail from legitimate people through. Spam wouldn't scale but the average person would only pay in a bit of CPU time/cost.
Offtopic, but have people had any success maintaining a personal email domain as forwarding to the major email providers? I have a vanity domain, and used to be able to use GMail to send email as that domain [1], and forward received mail from that domain back to GMail. But with SPF, DKIM, and DMARC (or something), this has broken and such received email gets marked as spam and/or phishing. I don't know how to fix th…
Is there a reason that forwarding is the path chosen for this rather than setting gmail as your MX?
Earlier quoted context omitted.
Hashcash was originally proposed to add some form of cost to sending email. Something similar could be a great way to get mail from legitimate people through. Spam wouldn't scale but the average person would only pay in a bit of CPU time/cost.
“spam wouldn’t scale” - unconvinced on this: spammers already mostly use other people’s compromised machines to do the sending; there is no cost to them here.