131–140 of 339 posts
I even put together a self-contained single-DVD installer that would install and set everything up securely and solidly. (I don't think I have a copy any longer and if I did it's very out of date)
I still don't recommend doing it. Even for the security-concious. It's just not worth it.
Earlier quoted context omitted.
Spamassassin plus DNSBL works great for me. Before I enabled that, I would get 100+ spam emails a day. Now I barely get one a month.
This is what I am using as well.
since the machine is a webhost as well, also hooked up spamc to mysql for better SA performance while still keeping per-user procmail + sa config
I think what I'm trying to say is that it's not harder than it used to be (though some problems, like spam and security requirements for safety, have gotten worse in absolute terms). With modern tools and packaging on modern Linux distributions, you can be up and running pretty quickly. My company ships a turn-key solution as part of Virtualmin, but you can build something similar without that in an afternoon or two if you're reasonably Linux-savvy and have some notion of how all the pieces fit together (maybe a couple extra afternoons if you don't know the basics; DKIM and SPF can be tricky, since you also have to know or learn you some DNS).
It's harder than a web server or DNS server, but not something you should flee in terror from. Admittedly, it's gotten cheaper in recent years to outsource it...and with microservice-based architectures, maybe it makes more sense to have some other API than SMTP (though SMTP is very easy to use from every language I've ever worked in). But, there are problems and complexities with outsourcing, as well.
I run my own mail infrastructure. To say the least I wouldn't recommend it even to my worst enemies. It's horrible. Actually it's fine until it's not. Then your email doesn't work and you could be missing out on important communications. And then you're scrambling to figure out how the spammers managed to exploit your setup this time. And you have to learn a tonne of crap in order to manage it... and the text files!…
>Then your email doesn't work and you could be missing out on important communications
Pretty much every E-mail server will retry sending your E-mail for a long time (like 2 days is default on postfix). Once your mail server comes back up all of your E-mail you missed during the downtime will come in slowly as messages are retried
>you're scrambling to figure out how the spammers managed to exploit your setup this time
Any tutorial should point you in the right direction restricting open relay on your mail server, just basically requiring authentication to send E-mail outside of your server.
>I started writing an SMTP protocol handler in Haskell
Do you have any link to your progress? Postfix's configuration definitely shows age, but all of the options do important things that you could actually want to change. It seems other MTAs either have just as complicated configuration (to do the same things), or have stunted functionality.
>being secure and resistant to attacks by default
I agree about sensible and more secure defaults in configuration. But the application security of postfix and dovecot are both pretty robust[0][1]. Considering they are 19 and 15 years old, both applications have seen several developer-lifetimes of effort.
>we need more guides like this for us poor souls who do go down this route
I agree, though mediocre howtoforge tutorials seem to have worked fine for this poor soul.
[0] https://www.cvedetails.com/product/14794/Postfix-Postfix.htm...
Yeesh, there's so much involved. I've been running my own mail server with https://mailinabox.email for ~2 years and can heartily recommend it. Still, even with that there are gotchas if you want to be able to send messages from your server to Google et al, eg. reverse-DNS-records, DKIM, SPF. Not for the pressed-for-time.
This isn't bad. I ended up creating an Ansible role to do it for me, and it works great. I thought about Fastmail, but its too expensive when you want to do more than one email address or domain. I run mine on a $5 server from DigitalOcean.
Every time a thread about running your own email server comes up I think "Oh yeah, I was going to set up FastMail for my domain" The current pricing[0] seems to let you have 100 domains plus 600 aliases[1] for $5/mo. I've got this thought that I will create aliases for every different thing I sign up for and use them to track who's selling my email address to who. I think that a domain plus aliases will do the trick…
Earlier quoted context omitted.
How much of this is common to a Mac OS Server mail setup?
I believe OS X uses many of the same components under the hood. I have toyed with OS X Server.app (mostly just to get the necessary certificates to get IMAP push notifications working with iOS/Dovecot[1]) and it seems like a really solid choice. Not sure how you go about colocating a Mac Mini in a datacenter though. [1] https://www.c0ffee.net/blog/dovecot-push-notifications
> Before we dive in, an important caveat: You will become a sysadmin of your own mail server. This for me is the deal breaker. I say this as a sysadmin. It's all well and good running a single server but if that shits the bed then you have to deal with it immediately. So to run something that doesn't require 24/7 support I now have to run a cluster of servers. I'll also need something to manage those servers like sal…
I've been running my own mail servers since the mid-90s, and always only a single server. SMTP keeps retrying, so you can be offline. The transport layer was designed to deliver mail to servers even if those servers only dialled in to one of the "internets" once per day, so it's fine to have some downtime. It's totally up to you how you prioritise getting a server back up again, and frankly if the message can't handl…
Sadly, I haven't figured out a proper fully-redundant solution. Syncing mailboxes with e.g. Syncthing is way too fragile. Recently, I wanted to experiment with DBMail + CockroachDB cluster but haven't yet found time for that.
Never found any MRA that uses document-oriented database like RethinkDB; and GlusterFS is way too sensitive to high latencies - so DBMail+CRDB looks like the only readily accessible option sans of trying more "raw" programmable solutions like Salmon or Haraka and writing own storage backend.
> Before we dive in, an important caveat: You will become a sysadmin of your own mail server. This for me is the deal breaker. I say this as a sysadmin. It's all well and good running a single server but if that shits the bed then you have to deal with it immediately. So to run something that doesn't require 24/7 support I now have to run a cluster of servers. I'll also need something to manage those servers like sal…
I've been running my own mail servers since the mid-90s, and always only a single server. SMTP keeps retrying, so you can be offline. The transport layer was designed to deliver mail to servers even if those servers only dialled in to one of the "internets" once per day, so it's fine to have some downtime. It's totally up to you how you prioritise getting a server back up again, and frankly if the message can't handl…
This may have been the case in the mid-90s, but it is certainly not the case today. I frequently receive emails that require immediate attention, whether from my employer, my bank, or any number of other notifications. Normal email users expect emails to be delivered in seconds, not hours.
I run my own mail infrastructure. To say the least I wouldn't recommend it even to my worst enemies. It's horrible. Actually it's fine until it's not. Then your email doesn't work and you could be missing out on important communications. And then you're scrambling to figure out how the spammers managed to exploit your setup this time. And you have to learn a tonne of crap in order to manage it... and the text files!…
I run an E-mail server with over 250,000 users. I started by following some generic "dovecot+postfix+mysql" tutorial on howtoforge and I'm still using mostly the same setup over 4 years later. >Then your email doesn't work and you could be missing out on important communications Pretty much every E-mail server will retry sending your E-mail for a long time (like 2 days is default on postfix). Once your mail server co…
For larger scale e-mail sending I built my own MTA (https://github.com/zone-eu/zone-mta), our main instance sends about 750k emails a day (mostly normal ISP traffic, maybe 25% marketing emails) and its most valuable feature is juggling with IP addresses and blacklist detection, so if some mailbox gets hacked, starts sending out spam and the IP ends up in Spamhaus et al then this IP is removed from the list for other users automatically. Has saved us a ton of time.