Live data from Hacker News

After self-hosting my email for twenty-three years I have thrown in the towel

cfenollosa.com

181–190 of 744 posts

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#181
post #172

Earlier quoted context omitted.

There is also a happy medium. Host your own MX servers but use someone else's SMTP servers. You have complete control over the incoming mail but dodge the filters by using the established business for sending mail.

Whose SMTP service you'd recommend?

Sendgrid works well for small volumes

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#182

Earlier quoted context omitted.

There is also a happy medium. Host your own MX servers but use someone else's SMTP servers. You have complete control over the incoming mail but dodge the filters by using the established business for sending mail.

Adding to the happy medium is to teach your friends and family to use Thunderbird so they can easily GPG encrypt [1] their emails keeping the nosey email providers off the email body. Also teach them to use the IMAPS (TLS) endpoint for their mail provider, usually port 993. There are probably simpler how-to's with pictures, I just do not have any of them handy. [1] - https://support.mozilla.org/en-US/kb/openpgp-thund…

Most of my friends and family don’t own computers, only phones and sometimes tablets.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#183

It was a huge mistake for email receivers to take on the cost of filtering spam. Of course given the evolution of the internet and email it is easy to see how that mistake happened. Nobody had a crystal ball. But the only solution here is to raise the cost of sending email to the point where spam is no longer profitable. It seems like one solution is to bcrypt hash (or some similarly expensive algorithm) the email an…

That is a clever idea but I think it'll still fail so long as email (SMTP) is a fire-and-forget architecture. As long as you have that asymmetry, your SNR is going to suck.

If it were a back-and-forth protocol, more like TCP, then you have way more options for congestion control, error reporting, load balancing, and the like. The server can choose to accept the incoming request, ask for more verification, or interrogate the client in various ways. This could be something just like DKIM / DMARC / SPF, or even something more exotic, like making the client do proof-of-work with difficulty tied to how suspicious that client is to the server, and also the delivery scope/scale. Or forcing the client to wait for ACK for valid delivery while slow-walking it.

This gets around some of the issues in cousin comments, with respect to punishing botnets and rewarding lawful players. Established, high-trust players pay no cost. Suspicious players can still get through, albeit with a tax (that should be trivial for low-volume personal MX, but expensive for high-volume spam). Furthermore, it's adaptable.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#184
post #80

Sending email out is a royal pain. Trying to deal with a Microsoft ban on my IP even though it’s sparkling clean for several years. DKIM, DMARC, SPF etc all ser up, reverse dns, you name it. Looks like Linode is being blocked as a whole pretty much? Hate the level of centralization, particularly since there’s still a shit ton of spam still around. Sorry for the rant. https://docs.microsoft.com/en-us/answers/questions…

Wouldn't surprise me if Linode were entirely blocked. Also anything in M247 Ltd's ASN. They host a lot of VPN endpoints, including Mullvad's. Step 1, I'd move off Linode. Find a local DC or business you can support by hosting a VPS or dedi box with them. LowEndBox might be an interesting place to search but avoid anything too famous. Step 2, join this https://sendersupport.olc.protection.outlook.com/pm/services... .…

IMO, any low-cost VPS provider is going to have a poor reputation. I've even had trouble running websites on some of them, as some "endpoint security" products have their IP addresses blacklisted, causing users to get alarming warnings if they try to visit sites hosted there.

You'll run into the same issues with the "free/trial" tiers of bulk email services like Mailgun.

I agree with OP, you pretty much have to at least send your outgoing email via an established, widely-accepted SMTP service provider, or in some other way pay a lot for a "clean" reputation.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#185

Earlier quoted context omitted.

There is also a happy medium. Host your own MX servers but use someone else's SMTP servers. You have complete control over the incoming mail but dodge the filters by using the established business for sending mail.

You can also use an MX backup service which will accept mail when your server is offline (and it will resend it when the server comes online) You can also even keep Gmail as your MX server! Just move messages off of it as soon as they arrive. It's just a mailbox, after all

> You can also even keep Gmail as your MX server! Just move messages off of it as soon as they arrive. It's just a mailbox, after all

Do you have more information about this?

I've been looking to do something similar so that I can have my mail sorted into folders without setting up the same rules on multiple clients. (Gmail's sorting doesn't seem to support some of the sorting I'm currently doing in Thunderbird)

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#188
post #51

I can't send mail to mit.edu addresses. It gets rejected with a message that says I should talk to Microsoft. I frequently end up in GMail's spam folders. No idea why. I see no more than one piece of 'spam' a week; everything else is caught by a combination of a 15 minute greylist, the zen spamhaus BL, and SpamAssassin evaluating things. There are a bunch of spammers who send from accounts with valid SPF and DKIM, by…

I might be reading into this a little, but you seem to be arguing that "Spam is a reasonably solved problem at my scale, therefore spam is a reasonably solved problem at global scale", and those are very different things. One of the key differences is: a small domain like yours is multiple orders of magnitude less attractive of a target, vs. Gmail, and as a result Gmail's filters are subject to constant, high-volume adversarial attacks, and you are not.

SPF and DKIM are pretty explicit in their RFCs that passing authentication isn't a sign the mail is legitimate. The presence of passing auth in a message does change how filters should handle it, but for most larger-scale production filtering systems (not spamassassin) that mostly ends up as "change the weight of certain reputation identifiers in the spam filtering inputs", more or less.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#189

Earlier quoted context omitted.

> It's just not something I want to babysit anymore because I have other things to focus on Dont know about you, but I have setup my mailserver years ago, and outside of regular OS updates, havent had to touch it.

Where is it hosted? Isn’t the primary issue being blocked by the major providers due to spam filters?

I have used Mailinabox on a Hetzner server for about an year. My email delivers to all the major providers. However, small providers will occasionally block my email. So I continue to use my Gmail address for now.

With small amounts of evidence, I think if my contacts on those providers email me first, and I reply to those emails, then my domain is not blocked.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#190

Earlier quoted context omitted.

I wonder what the underlying problem is. Gabe Newell once said that "Piracy is not a pricing issue. It's a service issue". I believe this has been proven by netflix/spotify as well. Is spam just a symptom of a much deeper problem? If so what is it? Or is it naive to think of spam this way?

> I wonder what the underlying problem is. The underlying problem is that a sufficiently motivated spammer can target tens or hundreds of millions of people with their spam without too much effort. As a result, every possible scam and spam with even the slightest possibility of converting 0.00001% of recipients can now be a viable spam campaign. The underlying problem is that it’s so easy to scale spam to a lot of ta…

Yup. Just requesting the sender to solve some riddle (and waste their energy in process) would turn the tables completely because the cost of sending would be non-zero. Unfortunately it would also mean that we would be sacrificing our planet again. But maybe the difficulty of the challenge could adapt according to some trust score?
Post reply on HN