Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Run Your Own Mail Server (2017)

c0ffee.net

Post reply on HN
Print view View original

231–240 of 339 posts

Re: How to Run Your Own Mail Server (2017)

#231

Post by loup-vaillant »

techsupporter wrote: post #217
smolsky wrote: post #200

Earlier quoted context omitted.

I ran my own mail server (a few VMs in the cloud) for about five years. It's fun as you have control over accounts, aliases, forwarding, sieve tricks as well as backups. It's good to know that your broker and doctor's mail is delivered directly to your server and not Google. It sucks ass when your mail does not get through as GMail/Hotmail rejects a connection from the IP address your cloud company allocated for you,…

> It sucks ass when your mail does not get through as GMail/Hotmail rejects a connection from the IP address your cloud company allocated for you, in spite of DKIM etc. God, yes. Gmail, in particular, really enjoyed just dropping connections from my IPv6 addresses every few months. Sometimes it would return an error, something obtuse and wrong like maybe, "your forward and reverse DNS records do not match" even thoug…

> "your domain reputation is coming back as too new."

Did you follow up on that crap and asked what the fuck could possibly be going on with this nonsense? (More politely than I just did of course.)

Re: How to Run Your Own Mail Server (2017)

#232

Post by sliken »

TYPE_FASTER wrote: post #47

I've hosted my own mail server for a while. I've gone the Postfix/Dovecot route, I've used qmail, etc. My current setup is WebMin/VirtualMin. It works really well, and will run on the cheapest DO droplet. Fighting spam effectively is not trivial.

Seems pretty trivial to me.

1) install spamassassin 2) turn on greylisting

During if you want to to from 1-2 spam a day to 1-2 a month you might want to block the garbage domains like click, link, party, top, webcam, xyz, stream etc. Probably worth enabling a DNS based block list.

So an apt get or two, 2-3 lines in a config file. Seems trivial to me, most every mail server HOWTO mentions them, should be just a cut/paste.

Sure 9-12 months from now it won't work as well, thus updating SA periodically, just like anything else internet facing.

Re: How to Run Your Own Mail Server (2017)

#233

Post by korethr »

pyre wrote: post #222
korethr wrote: post #181

Earlier quoted context omitted.

Honestly, when Windows 9x would crash, it was because something was doing something wrong. Drivers and legacy mode programs written and running under the no-longer-true assumption that they're the only program running on the computer will absolutely wreck your day when they poke in places they don't belong and do things they shouldn't. And if you got rid of those misbehaving programs, Win9x got a lot more stable. I u…

I was commenting more on dismissing the issues of others because you have not personally experienced them. There could be numerous examples used in place of the BSOD.

That's fair and I'll concede that point.

Re: How to Run Your Own Mail Server (2017)

#235

Post by sliken »

TheOtherHobbes wrote: post #37
rootsudo wrote: post #15

Also it's alot of work.

It took about three days to set up postfix and dovecot for multiple domains from a cold start, including certs and spam filtering. Postfix supports a selection of block lists for spam, and I get no spam at all - although unfortunately my gf sends me email from a Yahoo account, and certain Y! servers get blocked, so that mail bounces. She doesn't do it often enough for me to spend more time getting whitelisting to wor…

Yahoo servers don't seem very well managed. Obviously they have lost a billion passwords or so. They also serve malware from their home page often (I've gotten chrome, opendns, and firefox warnings). The ads shown are often pretty ghetto (payday loans and the like).

In the interest of security I'd help your gf to a different provider.

Re: How to Run Your Own Mail Server (2017)

#236

Post by sliken »

tzs wrote: post #214

One thing I'd like to see covered is sender dependent outgoing mail routing. For example, suppose I have things set up so all outgoing mail from my home goes through my SMTP server. If I send an email with a from address of tzs@mydomain, then the setup in the article is perfect. Suppose, though, I send an email from home with my from address set to tzs@employer, where "employer" is my employer's domain? Assume this e…

Handling this server side seems weird. Why not just have a profile in your mail client that lets you send personal email through the personal server and work email through the work server. You end up with a much more robust setup that works without extra hops through a 2nd mail server. It also provides immediate feedback if sending an email fails for some reason.

If Apple mail is broken and keeps dropping things I'd suggest thunderbird.

Re: How to Run Your Own Mail Server (2017)

#237

Post by rhizome »

z3t4 wrote: post #201
Clubber wrote: post #157

Earlier quoted context omitted.

I've run my own mail server since probably 1998 or so. I have had a few problems here and there, but nothing major. The worst is when the power goes out, but smtp has a wonderful resend feature when the destination server isn't responding. I know my emails aren't being farmed from the NSA (at least from my side). I know Google isn't scanning all my emails to sell me garbage. I know it won't be shut down because of so…

You can have a backup server that holds your e-mail until your main server goes back up. You configure priority in DNS zone file.

Backup MX is usually not necessary, especially for home setups. Anything RFC-compliant will retry sending its email to you for days after being rejected.

Re: How to Run Your Own Mail Server (2017)

#238

Post by icelancer »

le-mark wrote: post #210
icelancer wrote: post #94

I use iRedMail and set up my own mail server for my small business. I am beginning to wish I hadn't, even though I've had literally 0 problems outside of a single reboot to fix an issue. https://www.linuxbabe.com/mail-server/ubuntu-16-04-iredmail-... I dunno. I feel like I'm sitting on a timebomb. It's hosted on DigitalOcean and while it works great with RoundCube and gmail... eh. I dunno why I even did it in the fir…

Other than the feeling of 'sitting on a timebomb' are there any other specifics you can cite? Have you looked into contracting someone for a few hours a month to check/update things? I have considered doing what you have done, and your feedback has piqured my curiosity.

Not really. Just everyone smart I talk to says the same thing as everyone else in this thread: Don't do it. I'm not a sysadmin, I'm a developer who runs a company and doesn't even work in IT in my own company anymore. Bleh. So far so good, though....

Re: How to Run Your Own Mail Server (2017)

#239

Post by techsupporter »

loup-vaillant wrote: post #231
techsupporter wrote: post #217

Earlier quoted context omitted.

> It sucks ass when your mail does not get through as GMail/Hotmail rejects a connection from the IP address your cloud company allocated for you, in spite of DKIM etc. God, yes. Gmail, in particular, really enjoyed just dropping connections from my IPv6 addresses every few months. Sometimes it would return an error, something obtuse and wrong like maybe, "your forward and reverse DNS records do not match" even thoug…

> "your domain reputation is coming back as too new." Did you follow up on that crap and asked what the fuck could possibly be going on with this nonsense? (More politely than I just did of course.)

We chatted about it for a little more but he wasn't able to figure it out either, so I gave up and moved the three active users I had over to FastMail that evening. A handful of semi-used mailboxes are still on the other setup that I still keep trying to make work but not nearly with the same force and gusto as I used before.

Re: How to Run Your Own Mail Server (2017)

#240

Post by _jal »

agentultra wrote: post #216
rsync wrote: post #143

Earlier quoted context omitted.

"And then you're scrambling to figure out how the spammers managed to exploit your setup this time." ... " ... writing a MTA with the goal of minimizing configuration and being secure and resistant to attacks by default. " As a 20+ year UNIX sysadmin and fellow owner of my own email infrastructure for 18 of those, I am surprised to read this and am not even sure what you are talking about. Can you explain what you me…

To be fair I've been running my infrastructure for years and it's usually fine. The problem I have is that it's a pain in the ass to setup correctly and when things do go wrong it's really hard to figure out what's going on. > Can you explain what you mean by attacks and exploits from spammers? I haven't encountered a remote exploit (yet) but yes: accidentally running an open relay, backscattering, etc. You also have…

> That's where the idea for a secure-by-default MTA that couldn't possibly be configured to be an open relay came from.

You're close to describing the motivation behind Postfix. Between the design and the documentation, Postfix is hard to screw up, from a security perspective. And it is really easy to configure, at least in contrast to What Came Before - believe me, if you think this is complex, buy a crusty sysadmin a beer sometime and mention 'sendmail.cf'.

The problem here is that almost all mail servers need to selectively relay, and I don't see how the server is going to guess appropriate policy. For instance, trusted IP ranges (mynetworks, in Postfix). I suppose you could demand authentication unconditionally but that tends to break down when not all of your senders are made of meat[1]. Maybe that's acceptable to you, but it won't be for many.

In my other comment in this thread, I recommended gaining an clear understanding the architecture if you're going to do this. That includes things like knowing what (for postfix) mynetworks does - you can get mad at software for not intuiting local policy preferences, but I've never found that to get me very far.

[1] Getting better, but I still depend on a fair bit of software and hardware that doesn't speak SMTP auth.

Post reply on HN