Running your own email is increasingly an artisanal choice, not a practical one • Hacker News Board

Re: Running your own email is increasingly an artisanal choice, not a practical one

#311

Post by behringer » Fri, Dec 24, 2021, 7:19 PM UTC

cm2187 wrote: post #256

throwaway27727 wrote: post #198

Earlier quoted context omitted.

Lots of sister comments here saying that they've been running a mail server for X amount of years, where X is a rather large number. That will obviously come with some reputation for your mail server, reducing the curve of being classified as down. I would be interested in hearing from someone who tried to setup a new mail server in the last 1-2 years who was able to run it without a hitch.

In my case x>10y for a personal server, but that reputation got ruined when some test email account I had created with a weak password and forgotten, got breached and some spammers started sending spam. My mail server (smartermail) notified me within an hour of the abnormal number of emails and I disabled the account immediately. But that was it for the reputation of that IP. Fortunately I could switch to a spare, cl…

i use a very low sending limit in my mail server. If a user were to send out spam, it would end up being relatively few by the time i noticed.

Re: Running your own email is increasingly an artisanal choice, not a practical one

#312

Post by donmcronald » Fri, Dec 24, 2021, 7:20 PM UTC

jacquesm wrote: post #27

rmdes wrote: post #6

Someone should try "artisanal email server" using cloudron or yunohost ! the bigger problem is that "authoritative" email monopolies such as Gmail, 365 and the other big ones arbitrarily define and impose what is a legit email server or not and even with better score than gmail an "artisanal" email server can suffer from being classified into spam by the big tech players just because they can and will do anything to…

This is exactly it. Email is now just another way to squeeze companies and private individuals alike instead of a cheap, secure and free way to communicate. Peer-to-peer email was worth having, in spite of the downsides.

I’ve seen a lot of small businesses go from $50 / year to $500+ / year. And from their point of view all they get is a bunch of nagging about 2FA and a much bigger target on their back when it comes to phishing.

Re: Running your own email is increasingly an artisanal choice, not a practical one

#313

Post by ineedasername » Fri, Dec 24, 2021, 7:21 PM UTC

Last time I hosted was ~2004. I had a very tight qmail implementation, but even then I seem to be getting black-holed or marked as spam. Maybe it was because I was self hosting on my local home ISP and using dyndns to get around potential changes to my ip address from my ISP. Maybe spam filters didn't like inconsistent IP addresses? I don't know. But asking people to whitelist me was a hassle.

At the time I was a heavy Mac user though so I ended up switching to mac.com email, and then Gmail when Apple EOL'ed Mac.com.

Today though there's probably an easy turnkey VM or docker image well-configured to work without too many false positive spam flags... I hope?

Re: Running your own email is increasingly an artisanal choice, not a practical one

#314

Post by jagged-chisel » Fri, Dec 24, 2021, 7:22 PM UTC

jasode wrote: post #274

johnklos wrote: post #253

It's amazing how quickly people with strong feelings about email come out when any mention of self hosting is made. They can't prove a negative, but they valiantly try, often using the very points that are excellent reasons to self-host as reasons we should all just give up. "It doesn't work for me, so it won't work for you" is rather weak when the reasons aren't articulated, when generalizations are made without det…

>"It doesn't work for me, so it won't work for you" is rather weak Maybe I missed it but I scrolled through the comments and I don't see anyone in this thread claiming the above. In fact, I see the people who had problems with personal mail server deliverability acknowledge that others may have success and "that's good for them."

Seemed to me an inditement of the general malaise of all previous discussions, not only this one.

Re: Running your own email is increasingly an artisanal choice, not a practical one

#315

Post by croutonwagon » Fri, Dec 24, 2021, 7:24 PM UTC

anamexis wrote: post #297

croutonwagon wrote: post #273

Earlier quoted context omitted.

Don’t even get me started on outlook.co/o365. If you put an address or domain in the safesenders list; they do literally nothing. Like you can just totally spoof the domain entirely. However if you use transport rules as per their rec, there’s all sorts of stuff that will still get flagged, and you have to to reference ATP, anti-phishing, anti-spam policies. Much of which aren’t even in the Exchange admin panel, rath…

That safesenders list thing sounds insane. How many companies add their own domain to that?

Well....that's how I found out about it when I took on my current role. We had pretty solid phishing attempt slip through. I was able to spin up a VPS as test it on mine and some other known tenants as well (with their permission). And since o365 uses a predictable name for their SMTP receivers for a tenant (domain-com-net-whatever.mail.protection.outlook.com)its easy to kind of....select targets and test it out.

So even if its not listed on the domains MX record but you can suss out they are an office365 tenant receiving mail, you may be able to relay off it and spoof to high heavens (especially if the edge device reccomends you....ahem...whitelist your own domain and not use transport rules). In fact especially if you can do this.

For example i think MS forced proofpoint to change their config recommendations as an outcome.[1]

from the page on [1]:

"Due to major complaints, Proofpoint has opted to change change to the format of ensuring Proofpoint mail is not scored via the O365 system. This rule will allow external email to come in still, but will follow O365 scoring. This is to ensure no mail is lost."

[1] https://web.archive.org/web/20200807173336/https://help.proo...

Re: Running your own email is increasingly an artisanal choice, not a practical one

#316

Post by dqv » Fri, Dec 24, 2021, 7:24 PM UTC

mysterydip wrote: post #113

rmdes wrote: post #6

Someone should try "artisanal email server" using cloudron or yunohost ! the bigger problem is that "authoritative" email monopolies such as Gmail, 365 and the other big ones arbitrarily define and impose what is a legit email server or not and even with better score than gmail an "artisanal" email server can suffer from being classified into spam by the big tech players just because they can and will do anything to…

The most frustrating part is someone who isn't getting your mail will blame it on you. "I get everyone else's (gmail/outlook) email, it must be you."

And my retort is “that you know of”. If mine isn’t getting to you, who else’s isn’t? (For businesspeople) how much business are you losing because Google isn’t letting mail through? It’s one thing if the server is declining email and telling you why. It’s another thing to silently hide email.

Re: Running your own email is increasingly an artisanal choice, not a practical one

#317

Post by kortilla » Fri, Dec 24, 2021, 7:25 PM UTC

jrm4 wrote: post #155

Much more needs to be said about the extreme advantages of paying someone vs. using a free service. I've said this for over two decades: If you have a business, or even just a lot of important stuff going on in email (which is like everybody); it strikes me as insanity to not pay for the peace of mind that comes with "a human you can call up and say 'hey, why can't I get into my email' or 'hey, fix this please" Versu…

> not pay for the peace of mind that comes with "a human you can call up and say 'hey, why can't I get into my email' or 'hey, fix this please"

That stance would make sense if that were an option with google hosted email.

Re: Running your own email is increasingly an artisanal choice, not a practical one

#318

Post by bruiseralmighty » Fri, Dec 24, 2021, 7:26 PM UTC

Not to accuse any one person specifically of anything nefarious, but I do find the historical timing of these articles bemoaning self-hosting of email rather odd.

Currently, there are only a handful of large technology companies in control of most of the world's inbox. Google is the first that comes to mind. At the same time we've just had some of our most highly publicized hearings involving these tech companies (facebook and google) as well as our first hearing on cryptocurrency and the larger web3 infrastructure. There is a rising public awareness and therefore political will to regulate these technologies and companies. This would formally fold google and the like into the USG despite their long standing less formal arrangements with the intelligence agencies.

The one way to make this regulation and upcoming legislation moot? Decentralization by any other name. Self-hosting of email servers, or distributed computing and storage with web3. Perhaps its is only my latent paranoia, but I can't help but shake the feeling that the glut of the 'don't bother hosting your own email server' sentiment is, at least in part, artificially amplified in order for the coming formal regulations to have more of an impact.

It wouldn't surprise me at all if google themselves was helping to facilitate this in order to steer conversation towards stalling any potential competitors as a part of the new regulatory framework. It is for instance a lot easier to argue that outlawing self-hosting of email servers (or requiring a license to do so) makes a lot more sense if you can point to a 'general public sentiment' that hosting your own email server is 'too complicated' and 'less useful' and 'less secure' and therefore would only be done by antisocial actors such as 'criminal elements' and 'terrorists'.

Seeing as we are at the cusp of a new distributed infrastructure movement, all this feels like preemptive damage control to me.

Re: Running your own email is increasingly an artisanal choice, not a practical one

#319

Post by b112 » Fri, Dec 24, 2021, 7:31 PM UTC

coffeecat wrote: post #281

tjoff wrote: post #197

Earlier quoted context omitted.

Well, on the flip side unless you constantly check your spam folder (which pretty much completely defeats the purpose of a spam filter) you most definitely have lost important mails thanks to gmail. I just don't see what people see in gmail part from the google brand - which surely isn't a good thing anymore.

I'm not here to be a Google apologist, but in the 10 or more years that I've used gmail, I don't think I've ever had an important email go to spam.

Incredible.

Most people I know? It is almost a daily occurrence. Including if senders are in address books, and "not spam" is clicked when found in the spam folder.

Most people I know see legit emails in the spam folder, all the time.

Re: Running your own email is increasingly an artisanal choice, not a practical one

#320

Post by dheera » Fri, Dec 24, 2021, 7:43 PM UTC

johnklos wrote: post #253

It's amazing how quickly people with strong feelings about email come out when any mention of self hosting is made. They can't prove a negative, but they valiantly try, often using the very points that are excellent reasons to self-host as reasons we should all just give up. "It doesn't work for me, so it won't work for you" is rather weak when the reasons aren't articulated, when generalizations are made without det…

Yes. I want to create a mail server that auto-rejects e-mail with externally hosted tracking pixels and returns a Mailer-Daemon error that tells the sender to re-send without malware.

Of course with Gmail I disable automatic image loading to avoid being tracked, but I want to take a more active stance against the practice.