Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Run Your Own Mail Server (2017)

c0ffee.net

Post reply on HN
Print view View original

291–300 of 339 posts

Re: How to Run Your Own Mail Server (2017)

#291

Post by megous »

cpncrunch wrote: post #282
burgerdev wrote: post #262

Earlier quoted context omitted.

I've been running my mail server for 6 years now. Mail to Microsoft's servers (live.com, etc.) keeps ending up in the spam folder, even though spf, dkim and dmarc are set up and my IP has been clean for the entire period. The bright side is that I only notice this in the rare case of "mail to all contacts", since noone is on outlook.com these days.

Yes, live.com is a problem for us too. It seems they silently blacklist ip addresses and make it very difficult to get off that blacklist. There's a thread here about it with some of us trying to figure out how to solve this problem: https://answers.microsoft.com/en-us/outlook_com/forum/oemail... But other than that, running my own mail server hasn't been much of an issue. Set up sendmail, use public blacklists for s…

Outlook.com/Microsoft blacklists entire subnets because there are spammers in the same IP range. It's ridiculously lazy practice. They should just block IP addresses that are actually sending SPAM. It's not like that's a problem technically. You can fit all IPv4 addresses into a 512MB database.

I'm thinking of solving it by blacklisting outlook.com domain, so that senders at least know that I can't respond to them. I can put a message in the error response, that will be reliably relayed to the sender by the sending system.

Google's slightly better. Recently I did an experiment and created a few gmail accounts and sent some riduculously spammy messages full of typical keywords in between those gmail accounts, and they were all successfully delivered. Always.

Then I sent e-mail from new gmail account to my email server and simply responded and it went to spam. It's ridiculous that such a simple heuristic like someone responding to a message gmail user sends doesn't get the message through spam filters, even though the system can clearly determine taht the message is legit based on many variables (References field referencing message-id of the original message (noone else than the recipient should know this), reply being from a correct source (DKIM/SPF), message having normal looking business content, etc.).

There's way too heavy a weight on sending server IP range reputation.

Re: How to Run Your Own Mail Server (2017)

#292

Post by jcrites »

sigstoat wrote: post #185
heartbreak wrote: post #139

Earlier quoted context omitted.

> frankly if the message can't handle at least a few hours delay then email probably isn't the right medium for it. This may have been the case in the mid-90s, but it is certainly not the case today. I frequently receive emails that require immediate attention, whether from my employer, my bank, or any number of other notifications. Normal email users expect emails to be delivered in seconds, not hours.

> Normal email users expect emails to be delivered in seconds, not hours. their expectations are unreasonable. gmail, etc don't even manage that much of the time, let alone guarantee it.

Most email on the Internet is delivered all the way from the original sender to the end recipient in seconds. Many user experiences require this, such as password reset interactions or email address verification upon new account creation.

When email isn't nearly instantaneous, it's definitely upsetting to users and a violation of the norm. Email is only not instantaneous in well-managed systems when one of the parties is experiencing an operational problem of some kind.

There are exceptions to this, such as large scale marketing systems that deliberately send at a slow rate to avoid overwhelming recipients. Once deciding to actually send a message, though -- if not rate-limited by the receiver -- messages tend to arrive in the inbox in moments.

Email isn't that complicated of a protocol, when you get down to the mechanics of email delivery. Loading a web page is orders of magnitude more complicated than sending an email; there's no reason why sending an email would need to take longer.

Re: How to Run Your Own Mail Server (2017)

#293

Post by cpncrunch »

megous wrote: post #291
cpncrunch wrote: post #282

Earlier quoted context omitted.

Yes, live.com is a problem for us too. It seems they silently blacklist ip addresses and make it very difficult to get off that blacklist. There's a thread here about it with some of us trying to figure out how to solve this problem: https://answers.microsoft.com/en-us/outlook_com/forum/oemail... But other than that, running my own mail server hasn't been much of an issue. Set up sendmail, use public blacklists for s…

Outlook.com/Microsoft blacklists entire subnets because there are spammers in the same IP range. It's ridiculously lazy practice. They should just block IP addresses that are actually sending SPAM. It's not like that's a problem technically. You can fit all IPv4 addresses into a 512MB database. I'm thinking of solving it by blacklisting outlook.com domain, so that senders at least know that I can't respond to them. I…

With gmail you can at least request that they unblock you, and they will do that. With live.com and icloud.com you have to spend inordinate amounts of time bouncing between useless support people before you get anywhere. gmail in general seems to have the best spam filter (lowest false positives and negatives).

Re: How to Run Your Own Mail Server (2017)

#294

Post by agentultra »

natbobc wrote: post #162
agentultra wrote: post #41

I run my own mail infrastructure. To say the least I wouldn't recommend it even to my worst enemies. It's horrible. Actually it's fine until it's not. Then your email doesn't work and you could be missing out on important communications. And then you're scrambling to figure out how the spammers managed to exploit your setup this time. And you have to learn a tonne of crap in order to manage it... and the text files!…

What stack are you using for SMTP and POP/IMAP? Do you use a secondary relay to hold you e-mail in case it goes down?

Postfix, dovecot, fail2ban, spamassassin. I don't have a secondary; I just keep up to date image snapshots and regularly backup the disks. It's only for my personal communications so I try to keep things as simple as I can.

Re: How to Run Your Own Mail Server (2017)

#295

Post by megous »

cpncrunch wrote: post #293
megous wrote: post #291

Earlier quoted context omitted.

Outlook.com/Microsoft blacklists entire subnets because there are spammers in the same IP range. It's ridiculously lazy practice. They should just block IP addresses that are actually sending SPAM. It's not like that's a problem technically. You can fit all IPv4 addresses into a 512MB database. I'm thinking of solving it by blacklisting outlook.com domain, so that senders at least know that I can't respond to them. I…

With gmail you can at least request that they unblock you, and they will do that. With live.com and icloud.com you have to spend inordinate amounts of time bouncing between useless support people before you get anywhere. gmail in general seems to have the best spam filter (lowest false positives and negatives).

Hmm, but where do you ask for that?

Re: How to Run Your Own Mail Server (2017)

#296

Post by aaron_m04 »

icelancer wrote: post #268
toomim wrote: post #261

Earlier quoted context omitted.

> I've been self-hosting mail for ages with a postfix + dovecot + cyrus + spamassassin + opendkim + dkimproxy + lets encrypt stack. So you call it easy to configure together 7 different systems just to get a working mail server?

iRedMail will do this for you in one shot. I've done it. I still don't recommend it, but it's pretty easy.

Why don't you recommend it?

Re: How to Run Your Own Mail Server (2017)

#297

Post by mozumder »

perlgod wrote: post #272
mozumder wrote: post #224

Earlier quoted context omitted.

Nope. When you ask your ISP for a static-IP address, your service goes from Residential to a more expensive Business account, and they open up outgoing mail ports. (At least for Verizon FIOS that I'm on, pretty sure Comcast is same as well.) Cloud IP addresses are probably more problematic for spam blocklists.

Glad it works for you. My comcast connection is far too unreliable to ever rely on for email! Curious though, can you also set your own reverse DNS entry for your static ip? I’ve found many mail servers will reject your mail if rDNS records don’t match up.

I've never had to worry about reverse-DNS, and I email thousands of fashion/media/tech companies around the world, big and small. Are there really servers that block based on reverse-DNS? I've never seen it.

It seems to be a flaw to have reverse-DNS block mail servers, since a single mail server might serve multiple domains. (My server serves email for multiple domains)

Re: How to Run Your Own Mail Server (2017)

#298

Post by mozumder »

jaskerr wrote: post #290
mozumder wrote: post #73

Earlier quoted context omitted.

How much of this is common to a Mac OS Server mail setup?

Unfortunately, mail and mail-related services are being deprecated in macOS Server: Prepare for changes to macOS Server https://support.apple.com/en-us/HT208312 The services deprecated include davmail, dovecot and postfix. They say the changes are "to focus more on management of computers, devices, and storage."

FFFFFffffffffffffff!!!

Guess I have to move everything to my FreeBSD server now..

Re: How to Run Your Own Mail Server (2017)

#299

Post by Jaruzel »

MartijnBraam wrote: post #277
Jaruzel wrote: post #270

Earlier quoted context omitted.

Agreed. I would love to ditch the customisations and run something standard!

Can't you just replace the custom MTA with postfix? That's what the previous company I worked at did

Yeah, I asked about that elsewhere in this thread...

https://news.ycombinator.com/item?id=16239809

Re: How to Run Your Own Mail Server (2017)

#300

Post by brongondwana »

Shoothe wrote: post #259
Mister_Snuggles wrote: post #198

Earlier quoted context omitted.

Some of the underlying technologies are, yes. Off the top of my head, DKIM and SPF are somewhat new, using TLS for server-to-server communication is somewhat new and not fully deployed, etc. Mail server operators need to keep track of new developments and update their software and infrastructure to account for them. There is no possible way that the current state of email is how it will be forever.

According to Wikipedia DKIM was conceived in 2004 and SPF was standardized in 2005 (although designs date a few years before that). I wouldn't call them particularly new (it's almost 14 years now). Even DMARC was here in 2010, that's 8 years. One recent thing is MTA STS but the progress is slow on this front (from my POV).

Yeah, it's still underway at the IETF. Last session we came close to finialising most of the documents in the UTA working group, which includes MTA STS.

Meanwhile, there's ARC which is still in early stages of deployment, and hopes to fix the indirect mailflow problems of DKIM.

(and of course there's JMAP on the client side, which is super exciting for those of us working on it)

Post reply on HN