Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poste.io – Complete Mail Server

poste.io

Post reply on HN
Print view View original

231–240 of 247 posts

Re: Poste.io – Complete Mail Server

#231

Post by imp0cat »

justsomehnguy wrote: post #186
smorrebrod wrote: post #177

Earlier quoted context omitted.

Thanks!

Minor nitpicks: a) you need a plain-text aka telnet client for this b) if you receive a valid, human-readable text then it means what you are not on TLS for sure c) if B succeeds that doesn't means what that SMTP server support STARTTLS, you should check options and try to initite it , eg: 220 smtp.fastmail.com ESMTP ready -> EHLO just.testing.things 250-smtp.fastmail.com 250-PIPELINING 250-SIZE 71000000 250-ENHANCED…

Right, I guess you could also use openssl's s_client like this:

  openssl s_client -starttls smtp -connect smtp.gmail.com:587
  openssl s_client -connect smtp.gmail.com:465

Re: Poste.io – Complete Mail Server

#232

Post by Jansemon »

gog wrote: post #189
Jansemon wrote: post #176

Earlier quoted context omitted.

I am always reading and never experiencing this ( knockonwood ). I'm self hosting email servers for multiple domains for now nearly 25 years. When moving to a new hoster with new IP addresses (especially Hetzner, as it is cheaper and seems to attract more malicious people), I have to contact Google, Microsoft, Yahoo and one or two other big providers to clear my IP address range. This has to be done only once and usu…

How are you contacting Google, Microsoft and Yahoo regarding that?

They provide webpages (forms) where you can insert your info and they'll unblock your ip...

Re: Poste.io – Complete Mail Server

#233

Post by sbuk »

thelittleone wrote: post #228
sbuk wrote: post #190

Earlier quoted context omitted.

It is solved by the product. You tick a box, and internal mail is bypassed. The issue here is that developers and IT folk seem to think that email is easy because the know IT. Email is a complex, and old protocol that has many nuances and, believe it or not, phishers are smart; end users are naive, and often reckless. Spammers, be they benign or otherwise, can be incredibly lazy too, but don't think for one second th…

Check box or not, my point is this should be default behaviour, I.e., don't mark same domain as spam, and instead make that an option to enable. Drives me nuts having to leave a UI to google (ironically) the issue to find a doc to enable a check box.

At scale, that’s not an option. If you have external services that send mail to your Workspace tenant, there is a risk of compromise to the sending service, especially if it is outside of your control. The sending service could have SPF records that permit sending mail on your behalf. That mail needs to be scanned. There is also the threat from bad actors inside your perimeter. Sure if you’re a small operation, or using Workspace as a personal mail host, this may seem like overkill, but I can assure you that the majority of orgs that use Workspace (it a business too after all) would prefer the status quo.

Re: Poste.io – Complete Mail Server

#234

Post by demindiro »

amir734jj wrote: post #178
zacharyvoase wrote: post #51

> All passwords are by default stored as salted SHA512 hash (5000 rounds). Attackers will have hard time to crack your passwords. SHA512 isn't a good choice for this, because it's optimized for fast low-memory computation. Why not use bcrypt or argon2, which are industry-accepted best practices for password hashing?

You are basically saying sha256 is prune to attack. As long as they salt the password, it should be fine.

It is not. Even long/"complicated" passwords usually do not have much bits of entropy, which is why you need an expensive hash to make bruteforce attacks difficult.

Re: Poste.io – Complete Mail Server

#235

Post by adr1an »

fuzzy2 wrote: post #184
foxylad wrote: post #116

Earlier quoted context omitted.

THIS. Spam is a solved problem, thanks to SPF and DKIM. But despite doing all the right things, Microsoft and Google continuously block and rate-limit delivery. Case in point: we deliver 20,000 booking confirmation emails every day, all requested by users and not spam. We have perfect Postmaster Tools metrics: absolutely zero reported spam, 100% IP reputation, high domain reputation, zero feedback loop spam, 100% enc…

Most spam I receive (and that continues to somehow bypass my spam filters) originates from Gmail. So no, spam is not solved, not at all. Spam is only “solved” on big providers because they mostly accept mails only from other big providers. --- I would argue that “running an independent mail server” and mass-mailing are two entirely separate concerns.

Of course I can't prove this and is just from my subjectiviy and limited experience, yet...

I've reasons to believe that Gmail users get more spam emails as they report these.

It would be nice if such outsourcing went into other parts of the net (e.g. captcha).

Re: Poste.io – Complete Mail Server

#236

Post by account42 »

mittermayr wrote: post #170
foxylad wrote: post #116

Earlier quoted context omitted.

THIS. Spam is a solved problem, thanks to SPF and DKIM. But despite doing all the right things, Microsoft and Google continuously block and rate-limit delivery. Case in point: we deliver 20,000 booking confirmation emails every day, all requested by users and not spam. We have perfect Postmaster Tools metrics: absolutely zero reported spam, 100% IP reputation, high domain reputation, zero feedback loop spam, 100% enc…

Spam is only solved by the large mail providers (who have enough data to act on it within a split second). After the great Gmail exodus two years ago (when they killed then unkilled legacy domain accounts), I moved to MXRoute — and the amount of unfiltered spam I get is insane. It's a daily nuisance. I have added about 200 filter words now, blocked hundreds of e-mail addresses, but it's next to impossible to filter o…

I have a wildcard email on my domain. In fact multiple domains. Multiple of these have emails listed in bug trackers, git repos and in plaintext on my website.

The only filter I have is a couple of regular expressions to block the most lazy of spam at submission time. Even without that I got less than 50 spam mails a day, usually quite a bit less - and almost all of those are automatically sorted into my spam folder. How long does it take you to glance over a low two digit number of emails each day? Not a lot for me.

I think the "spam" problem is overrated. Do you get more spam than me or do you just have different expectations?

Re: Poste.io – Complete Mail Server

#237

Post by account42 »

stratosmacker wrote: post #217
gerdesj wrote: post #106

Earlier quoted context omitted.

I've been doing it for well over 20 years now. Ingress - out of the box rspamd is pretty decent and it is rather configurable. Egress - DNS (A,AAAA, PTR), (E)HELO, SPF, DKIM, DMARC. "IP Reputation". There are absolutely no shortcuts and yet most of the problems I diagnose regarding email delivery will find a missing PTR record or a miss-configured (or non configured) HELO. You cannot be lazy when it comes to email. S…

Sorry for naivety, what is HELO in this context? I've been running a mail server with the other aforementioned things set correctly and tested; I've been able to reliably deliver mail to all of the big senders for years now, albeit on a small scale. Am I missing something not knowing what HELO is ??

HELO (or more usually EHLO) is the initial greeting of SMTP protocol which includes the mail server's address.

AFAIK plenty ofservers will outright reject all mail if you only have an IP address and not a domain name there.

Re: Poste.io – Complete Mail Server

#238

Post by account42 »

867-5309 wrote: post #181
mjl- wrote: post #180

Earlier quoted context omitted.

Not my experience. I have run a personal mail server for about 15 years. My mail has almost always been delivered just fine. The network my mail server IP has been in a blocklist less than handful times, but this has always been temporary and resolved without my intervention (perhaps my hosting provider is on top of this). On the other hand, I'm also sending email for a client through AWS SES, and those emails are re…

>It's so annoying if mail is accepted but you don't know if it is actually seen by the recipient. that's what those embedded 1x1px images are for

Are you sure those are GDPR-compliant? Just because you can do something doesn't mean that you should.

Re: Poste.io – Complete Mail Server

#239

Post by account42 »

867-5309 wrote: post #196
Donckele wrote: post #192

Earlier quoted context omitted.

Some users have embedded images disabled in email client by default.

some users have javascript disabled, some have email clients disabled. it's not foolproof but works for the majority of users, i.e. >99%

Any any well designed website will work with javascript disabled unless it is absolutely needed for the task (i.e. we are talking about an actual app).

There is also no guarantee that the image being loaded means that the user opened the mail and it wasn't just preemptively cached by the server/client. There is also no guarantee that the user opening the mail means they read it.

Re: Poste.io – Complete Mail Server

#240

Post by account42 »

smorrebrod wrote: post #155
imp0cat wrote: post #141

Earlier quoted context omitted.

tldr; 465 is obsolete,you should not use it; 25 is for relaying mail between servers; 587 is the default mail submission port today.

Isn't 465 safer since 587 uses STARTTLS and STARTTLS can be downgraded?

STARTTLS is a protocol. Allowing unencrypted connections is a policy. One does not imply the other.
Post reply on HN