Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poste.io – Complete Mail Server

poste.io

Post reply on HN
Print view View original

81–90 of 247 posts

Re: Poste.io – Complete Mail Server

#81

Post by AceJohnny2 »

georgyo wrote: post #75
AceJohnny2 wrote: post #73

Offtopic, but have people had any success maintaining a personal email domain as forwarding to the major email providers? I have a vanity domain, and used to be able to use GMail to send email as that domain [1], and forward received mail from that domain back to GMail. But with SPF, DKIM, and DMARC (or something), this has broken and such received email gets marked as spam and/or phishing. I don't know how to fix th…

ARC is what you need, it a similar signing as DKIM, but resigns a message. https://en.m.wikipedia.org/wiki/Authenticated_Received_Chain

Interesting. I see a gotcha though:

> Validating an ARC chain only makes sense if the receiver trusts the ARC signers. In fact, an ARC chain can be counterfeited,[3] so ARC processing applies when receivers trust the good faith of ARC signers, but not so much their filtering practices.

Is there any documentation on how GMail and Hotmail onboard a ARC-using domain? Their documentation is very... sparse.

Re: Poste.io – Complete Mail Server

#82

Post by rerdavies »

stonogo wrote: post #62
andix wrote: post #42

Earlier quoted context omitted.

How many people understand that man page, and how many people understand a web interface? I think it’s a clear winner.

I hate to be an elitist jerk, but if you can't understand a man page describing a single file format then maybe running an email service is something best outsourced.

I hate to be an elitist jerk, but how am I going to teach my mum to get her email using THAT?!

Re: Poste.io – Complete Mail Server

#83

Post by gwbrooks »

sourcecodeplz wrote: post #46

If I want to send unlimited emails from my domain (not 500 max or 2000 per day) and I don't want to worry about hacks AND don't want to pay for overages, simple shared hosting is the (cheapest) way!?

I know of no shared-hosting provider that doesn't throttle emails. The minute you're talking more than about 200 an hour, you're going to either host your own mail server or route through any of the dozens of commercial SMTP providers.

Re: Poste.io – Complete Mail Server

#84

Post by brirec »

sconi wrote: post #29
oarsinsync wrote: post #21

Earlier quoted context omitted.

I use http basic auth in front of every https internet exposed service. The services may have their own auth system on top of that, but htpasswd in front solves the vast majority of problems. Can’t exploit an SQL injection vulnerability if you can’t reach the endpoint in the first place. I’m less concerned about apache2 and nginx http basic auth vulnerabilities. They’ll get fixed much quicker than random webapps. Any…

why not vpn for the https services?

Not OP, but for me I reverse proxy things behind public IPs in an effort to trade a little bit of security and digital footprint for a lot of ease.

Re: Poste.io – Complete Mail Server

#85

Post by hardwaresofton »

Have written a bit about self hosting email[0].

I personally run: - Proton Mail (not self Hosted but for some addresses) - Haraka - Maddy

For people new to self hosting email I recommend maddy over the usual postfix + dovecot

[0]: https://vadosware.io/post/its-never-been-easier-or-harder-to...

Re: Poste.io – Complete Mail Server

#86

Post by johngalt »

AceJohnny2 wrote: post #73

Offtopic, but have people had any success maintaining a personal email domain as forwarding to the major email providers? I have a vanity domain, and used to be able to use GMail to send email as that domain [1], and forward received mail from that domain back to GMail. But with SPF, DKIM, and DMARC (or something), this has broken and such received email gets marked as spam and/or phishing. I don't know how to fix th…

Is there a reason that forwarding is the path chosen for this rather than setting gmail as your MX?

Re: Poste.io – Complete Mail Server

#87

Post by stevenjgarner »

layer8 wrote: post #49
stevenjgarner wrote: post #34

Earlier quoted context omitted.

Even with DKIM, all you need is the recipient of one email from one user on one domain (I have hundreds of domains) of your mail server to file a spam report, and WHAM you are blacklisted. So yes, it is a problem even with DKIM. If you have a solution, I would LOVE to hear about it.

If you’re blacklisted, the mail usually doesn’t even reach the spam folder.

Correct.

One of my clients is a construction firm specializing with churches. It is not infrequent for them to be communicating about a project with a church - often to a role account (e.g. info@church.org), which is step 1 towards being filed as spam - where the role account is shared with a dozen or more people. The building manager will check the email on Mon, Wed and Fri and every other day there will be a number of well-intentioned volunteers at least one of which will click on the spam button dooming my client's email into the abyss. Weeks later we find the church has gone with a different contractor, as they "could never get a response" from my client.

We will go so far as to donate a new IT/Cloud system to the church (small $$ compared with the project) just to ensure reliable communication. But then they think we are just trying to buy them.

Now my client has a blacklisted domain/mail server IP, and bids they send out are rejected as spam by the providers to other churches.

Makes no difference if we are hosting the mail server or if it is a 3rd party mail service. As soon as a customer is sold, we try and move them off email into a web-application framework for ongoing legitimate communication. Again a lot of resistance.

Re: Poste.io – Complete Mail Server

#88

Post by themoonisachees »

x3n0ph3n3 wrote: post #65
zacharyvoase wrote: post #51

> All passwords are by default stored as salted SHA512 hash (5000 rounds). Attackers will have hard time to crack your passwords. SHA512 isn't a good choice for this, because it's optimized for fast low-memory computation. Why not use bcrypt or argon2, which are industry-accepted best practices for password hashing?

This is why I configured fail2ban with my own poste deployment.

How is f2b relevant to hash cracking mitigations?

Re: Poste.io – Complete Mail Server

#89

Post by s17n »

layer8 wrote: post #28
user3939382 wrote: post #25

Earlier quoted context omitted.

> The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes It's amazing that having someone in your address book isn't enough in many cases. Like, why?

Because the from address can be forged, probably.

But to exploit this, an attacker would need to have the address book of every account they are trying to spam.

Re: Poste.io – Complete Mail Server

#90

Post by Karrot_Kream »

stevenjgarner wrote: post #34
c0l0 wrote: post #30

Earlier quoted context omitted.

Not really a problem in the age of DKIM, _if_ you want to solve it.

Even with DKIM, all you need is the recipient of one email from one user on one domain (I have hundreds of domains) of your mail server to file a spam report, and WHAM you are blacklisted. So yes, it is a problem even with DKIM. If you have a solution, I would LOVE to hear about it.

Hashcash was originally proposed to add some form of cost to sending email. Something similar could be a great way to get mail from legitimate people through. Spam wouldn't scale but the average person would only pay in a bit of CPU time/cost.
Post reply on HN