181–190 of 190 posts
> Notes from setting up a truly minimal self-hosted email server with Postfix and OpenDKIM. Covers TLS, SPF, DKIM, DMARC, DNS, reverse DNS, multiple domains, and delivering to Gmail.
great article and discussion nevertheless, awesome to see people still doing it
Earlier quoted context omitted.
DR: MX and retry email has easily one of the best responses to failure modes ever and its ancient! Most smtp daemons will put outbound emails in a queue and run the queue. If the other end is unavailable then it will generally retry on a schedule with some sort of increasing period and then give up after a week or so. You can easily define multiple inbound relays via your MX records which predate SRV and generic TXT…
I had a client domain banned by Gmail due to a missing DKIM, even though they had fewer than 1000 emails per month and SPF was correctly set up a decade ago. The bounce message explicitly said they are bouncing because DKIM is missing.
I have had a Gmail email account since they were invite only back in the day and I run my company email system and by my company I mean my (ie MD) so I'm quite keen on it working.
I recently migrated the whole shebang to MS365 from Exchange on prem. I have kept our MX records pointing to our on prem SMTP daemon (Exim). That means that I can redirect mail to mailboxes as I wish - I am not beholden to MS. Several addresses end up being delivered to an on prem imapd (Dovecot).
Anyway, I did set up DKIM when it was invented and then DMARC and then I ditched them because it messed up with mail lists. That has all been sorted but I still don't have DKIM on my company domain.
I have never setup DKIM on my personal vanity domain collection. The only recent fix I had to carry out was to fix up reverse DNS (PTR record) for an SMTP/MX address. That is proper old school and only one recipient domain even noticed and dropped mail.
The bounce message you received may have said DKIM but it may have been lying or simply that was the last thing that went wrong or whatever.
The big email systems are run by reasonable people who do not discriminate against well run tiddly email systems. They will absolutely crap on spammers inbound (despite hosting them) and IP reputation is king. There are a lot more rules too and it is rare that any transgression is final - pretty much all systems are score based rather than absolute on one failure.
Earlier quoted context omitted.
Email for me is a critical service, and the reasons I stopped self hosting after about 15 years is: 1. Because I couldn't ensure consistent backup and restore with regular monitoring, 2. no disaster recovery plan and in doing so it'd be more expensive than going through another email provider, 3. not always on top of security (my friend that I colo'd with also ran an email server and his system was struck with ransom…
> Email for me is a critical service This is exactly why I only trust myself to do it. I almost lost my gmail account a couple of times in the past, and every time it was quite stressful. Since then, I use gmail as a backup email provider, than is, pretty much never. Due to the way mail servers work, you have a couple of days to sort out your troubles before you will start missing emails. At worst, you can always buy…
In theory that makes sense, one thing I specifically omit as to why I stopped running my own service is in the past in a bout of paranoia due to the onset of a mental condition, I literally rm -rf'd my laptop, including a lot of files that were unrecoverable. Thankfully I didn't do this to my server at the time. Even though I've been stable for a long time, all it takes is a relapse (or even just a lapse of judgement) and boom your servers (and backups) become vulnerable.
I also don't trust that I can secure my systems and backups better than a company that dedicates itself to running a service for multiple users and have dedicated security/infrastructure teams. Sure I've never actually had an issue, but as with the anecdote of my friend, it just takes one failure. Also economies of scale helps with security; it is easy for an attacker to exfil or do damage to a smaller corpus of data (few to no customers [users]), than a large corpus of data across 1000s of customers.
I wouldn't trust a free service or a service that doesn't provide adequate support such as Microsoft or Google, but there's obviously a good selection of email providers out there that do an excellent job, much better than those self-hosting because they work with economies of scale.
(had to dug my comment from under a flagged parent) I self-hosted for well over 20 years, I did not throw the towel and I do not plan to. Self-hosting is a sign of pride. Neither my government nor my Prime Minister nor even my Ministry of Interior or Foreign Ministry can host their own email. Last time I checked, only State Security self-hosted. I was probably lucky, but I rarely had delivery problems. The last one w…
No delivery problems if you set up everything correctly. It's not luck, just the same reason why well maintained car runs smoother than something that's seen last maintenance 100,000 miles ago.
Earlier quoted context omitted.
> treat self-hosting like a hobby and learn to enjoy it. This is why I have stepped away from a lot of my self hosting. I have turned my attention/time elsewhere. Apparently though the time/money balance is shifting a bit again, so it may be worth it to go back. My biggest hesitance to self hosting email specifically is dealing with spam. What does that look like these days and do you have any pointers to share?
> My biggest hesitance to self hosting email specifically is dealing with spam. What does that look like these days and do you have any pointers to share? Postfix can easily be configured to reject incoming emails from senders without a reverse DNS mapping for their IP address, which makes it reject a lot of spam. For spammers with reverse mapping greylisting still works fine, they almost never retry. Certain commerc…
Historically some corporate domains ignore that rule (yea, in 2025!), so I would advise not to reject any email and run everything through spam analysis daemon. This way you won't lose any email at expense of elevated load on your server
Earlier quoted context omitted.
>I get 99% deliverability with 0 repuation since i do dkim and spf correct. Your anecdote of success doesn't matter to the others that correctly configured DKIM/SPF and still don't get their emails delivered to Gmail/Outlook/Yahoo/etc. E.g. : https://news.ycombinator.com/item?id=32715437 One of the reasons for hard-to-diagnose sending failures is that Gmail/Outlook have "extra invisible rules" that override correct D…
I hate the fact that your comment got flagged / greyed out / whatever even though it's perfectly correct. I'm one of those people who had configured everything perfectly. Score of 100 on mail-tester, SPF, DKIM, DMARC, you name it. Examining the headers in an e-mail sent to gmail: pass, pass, pass. Everything green. Microsoft however? Denied, 100% of the time. Spam folder, or even plain rejected. Why? No idea, they wo…
Because this adds the need to sign every single mail for every single recipient (expensive) its safe to filter for this as a SPAM-Server will sign mail once, then distribute.
That's why your mail is filtered - not because your non-blacklisted IP is the problem or whatever.
Earlier quoted context omitted.
I hate the fact that your comment got flagged / greyed out / whatever even though it's perfectly correct. I'm one of those people who had configured everything perfectly. Score of 100 on mail-tester, SPF, DKIM, DMARC, you name it. Examining the headers in an e-mail sent to gmail: pass, pass, pass. Everything green. Microsoft however? Denied, 100% of the time. Spam folder, or even plain rejected. Why? No idea, they wo…
>I hate the fact that your comment got flagged / greyed out / whatever even though it's perfectly correct. [...] I don't know why our experiences are considered "anecdotes", and not the other way round. It's because people who successfully self-host think their situation universally applies to everyone. Here's another example from 2017 of someone replying to my previous reasonable comment about self-hosting by overco…
It's usually relaxed DMARC triggering Microsoft. Gmail accepts relaxed.
I at least maintain administrative control while using free resources. I looked at the completely self hosted route a long time ago and didn’t want to deal with that. Fast forward to today and I’m dealing with a friend who has the polar opposite. Now their mental faculties are reduced and they lost devices. Couple this with not paying previous management entities and it’s a digital lock out. Recovering from this is a…
Could you say more about what your friend did differently than you and what makes it so difficult? Are/were they self hosting but don't remember how it all works?
IMHO, there are two components to "email" that do not necessarily need to be connected 1. receving mail 2. sending mail Only #2 became difficult Internet subscribers receive lots of email to which they never reply Sometimes "throwaway" disposable email addresses are useful^1 Various third parties offer this as a "service", i.e., #1 is disconnected from #2 Self-hosting #1 can provide an alternative to using third part…
But this is not the only purpose for which these disposble addresses may be used
Earlier quoted context omitted.
I have self hosted my email for about twenty years; fr about ten or fifteen I just forwarded everything to Gmail but had to revert to local ( started with local mail in emacs, but switched to imapd to solve the airplane ticket in the airport issue) because so much important stuff was marked as spam. Like in the middle of a conversation between me and on other person their reply to my email (which I always bcc:ed ack…
How do you guarantee uptime for yourself?