Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poste.io – Complete Mail Server

poste.io

Post reply on HN
Print view View original

101–110 of 247 posts

Re: Poste.io – Complete Mail Server

#101

Post by makeitdouble »

user3939382 wrote: post #25
c0l0 wrote: post #23

Earlier quoted context omitted.

Having been a part-time postmaster for more than a decade by now, I fully agree, and would even go further: Ingress spam is pretty much a solved problem if you play your cards right. ChatGPT et al. might change that again - but the mechanisms you can deploy today are very effective against the current UBE landscape. The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes.

> The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes It's amazing that having someone in your address book isn't enough in many cases. Like, why?

I’d guess the main issue is, the big guys don’t care about you. Like, at all.

If they pass their log through a scanner, come up with a few dozen small servers that look fishy (e.g your IP is contiguous to some other spammer’s IP), and yours is rope in as false positive, you’re banned.

And from there you’ll have to convince Google that you’ve done nothing wrong.

Re: Poste.io – Complete Mail Server

#102

Post by andix »

rerdavies wrote: post #82
stonogo wrote: post #62

Earlier quoted context omitted.

I hate to be an elitist jerk, but if you can't understand a man page describing a single file format then maybe running an email service is something best outsourced.

I hate to be an elitist jerk, but how am I going to teach my mum to get her email using THAT?!

<3

Re: Poste.io – Complete Mail Server

#103

Post by leros »

armchairhacker wrote: post #95
that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

Some big mail carriers who are more FOSS-friendly should create a service where they will deliver your private mail-server mail to Google and Microsoft inboxes for you. So you can use your own mail server for every other mailbox with more reasonable filtering protocols, and when you have to send mail to a Microsoft inbox you just send it to them and they’ll forward it. They could also provide Cloudflare-like spam and…

You would still deal with the deliverability challenges of getting your private email server trusted by everyone. It will work 95% but there are a bunch of weird edge cases due to old IP blacklists, bad spam rules, etc that will cause you problems and basically require a greybeard email expert to diagnose and fix. Sadly, I think it's just too hard to run your own email server these days.

Re: Poste.io – Complete Mail Server

#104

Post by xeromal »

user3939382 wrote: post #25
c0l0 wrote: post #23

Earlier quoted context omitted.

Having been a part-time postmaster for more than a decade by now, I fully agree, and would even go further: Ingress spam is pretty much a solved problem if you play your cards right. ChatGPT et al. might change that again - but the mechanisms you can deploy today are very effective against the current UBE landscape. The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes.

> The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes It's amazing that having someone in your address book isn't enough in many cases. Like, why?

I've gotten emails from old friend accounts that were totally taken over for spam purposes. Usually a low tech friend who just creates a new account.

Re: Poste.io – Complete Mail Server

#105

Post by Fnoord »

velcrovan wrote: post #2

First thought: oh, huh, a self-hosted CVE generator. In seriousness, installing Roundcube on my own server circa 2006 was the cause of the first and only time I’ve had a server hacked. It’s probably improved since then or it wouldn’t still be around, but it put me off ever hosting my own email. The risks only get worse the further away you get from personal/hobby use.

Funnily enough Roundcube isn't even one of the mail protocols. Its software connecting to the mail servers via a GUI over HTTP(S).

You don't have to give the entire world access to your web server. You could even use something like AuthPF to allow yourself to access it. Or a VPN like Wireguard. I do the latter now, but I used to do the former. Although back then I just used Mutt over SSH usually. Way faster than the web software I ran back then (probably Apache with Horde). What remains is all the stuff required for sending and receiving email. SMTP, IMAP, and the stuff to deal with spam (some kind of tarpitting as well as SPF/DKIM). In fact even the IMAP server could run behind Wireguard. So its only SMTPd and SPF/DKIM. There are some very secure SMTPd written, with great track records. Back in the days I ran Qmail with Courier-IMAP but I don't think SPF and DKIM existed back then.

Re: Poste.io – Complete Mail Server

#106

Post by gerdesj »

c0l0 wrote: post #23
that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

Having been a part-time postmaster for more than a decade by now, I fully agree, and would even go further: Ingress spam is pretty much a solved problem if you play your cards right. ChatGPT et al. might change that again - but the mechanisms you can deploy today are very effective against the current UBE landscape. The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes.

I've been doing it for well over 20 years now.

Ingress - out of the box rspamd is pretty decent and it is rather configurable.

Egress - DNS (A,AAAA, PTR), (E)HELO, SPF, DKIM, DMARC. "IP Reputation".

There are absolutely no shortcuts and yet most of the problems I diagnose regarding email delivery will find a missing PTR record or a miss-configured (or non configured) HELO. You cannot be lazy when it comes to email. SPF + A + AAAA + PTR and (E)HELO is a minimum.

There is one thing that you cannot generally, personally mitigate and that is being on a deny list due to your IP address. This one is a bit more tricky to deal with. You might have to use a relay. Another mitigation might involve IPv6.

Re: Poste.io – Complete Mail Server

#107

Post by michaelteter »

user3939382 wrote: post #25
c0l0 wrote: post #23

Earlier quoted context omitted.

Having been a part-time postmaster for more than a decade by now, I fully agree, and would even go further: Ingress spam is pretty much a solved problem if you play your cards right. ChatGPT et al. might change that again - but the mechanisms you can deploy today are very effective against the current UBE landscape. The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes.

> The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes It's amazing that having someone in your address book isn't enough in many cases. Like, why?

I moved a Gsuite client to Zoho because once or twice a week, an email from one person at the custom domain to another person in the same custom domain (company) would have their direct email get put into spam in Gmail.

You would really think that Google would whitelist emails within the same custom domain which is paying for Gsuite service. Maybe that has changed, but it was definitely a problem 5 years ago.

And we're not talking about an email which had some copy/paste of spam, we're talking about a one or two line sentence giving an instruction or asking a question to a colleague.

Re: Poste.io – Complete Mail Server

#108

Post by daydream »

stevenjgarner wrote: post #87
layer8 wrote: post #49

Earlier quoted context omitted.

If you’re blacklisted, the mail usually doesn’t even reach the spam folder.

Correct. One of my clients is a construction firm specializing with churches. It is not infrequent for them to be communicating about a project with a church - often to a role account (e.g. info@church.org), which is step 1 towards being filed as spam - where the role account is shared with a dozen or more people. The building manager will check the email on Mon, Wed and Fri and every other day there will be a number…

Does this happen even if you move your client to Google Workspace/Office 365? Using one of those two should eliminate the problem. Was that your experience?

Re: Poste.io – Complete Mail Server

#109

Post by michaelteter »

makeitdouble wrote: post #101
user3939382 wrote: post #25

Earlier quoted context omitted.

> The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes It's amazing that having someone in your address book isn't enough in many cases. Like, why?

I’d guess the main issue is, the big guys don’t care about you. Like, at all. If they pass their log through a scanner, come up with a few dozen small servers that look fishy (e.g your IP is contiguous to some other spammer’s IP), and yours is rope in as false positive, you’re banned. And from there you’ll have to convince Google that you’ve done nothing wrong.

> And from there you’ll have to convince Google that you’ve done nothing wrong.

Imagine the conversation with their support when you ask why bob@domainx.com's email was put in spam folder of jan@domainx.com's email, as both are hosted by Gsuite and presumably entirely within the Google network.

The answer, after two levels of support, was, "We don't understand why, but we can open a ticket with the developers." In the business world, you don't have time to wait for that, especially when non-technical business users are making mistakes or losing business because they can't function properly.

Re: Poste.io – Complete Mail Server

#110

Post by nilespotter »

sconi wrote: post #29
oarsinsync wrote: post #21

Earlier quoted context omitted.

I use http basic auth in front of every https internet exposed service. The services may have their own auth system on top of that, but htpasswd in front solves the vast majority of problems. Can’t exploit an SQL injection vulnerability if you can’t reach the endpoint in the first place. I’m less concerned about apache2 and nginx http basic auth vulnerabilities. They’ll get fixed much quicker than random webapps. Any…

why not vpn for the https services?

That's what I do. Mailcow on an isolated machine, 25/587 open on firewall port forwarding to it, the rest of the various services it offers are only accessible via my home network (https, imaps, there's probably more). Then, I am always on my home network.

I started out with a different variation of this that was the same, except instead of using my (thankfully static) home IP in my MX record, I got some cheap hetzner/lightsail/whatever, then routed the incoming 25/587 across a 2 node wg network to the real mail server. It worked fine but ultimately I decided I'd rather expose my real IP in the MX record than pay $5/mo not to.

Of course, the secret to making this work without tearing my hair out is that my outgoing mail server only delivers mail to the relay I pay to deliver my mail to the 3 or 4 corporate behemoths who have taken over a once great decentralized service. I have no interest in tending to my deliverability or making appeals to Microsoft or whoever. Also at a personal mail volume with 0 transactional mail, it's very inexpensive.

Post reply on HN