5 ms·

I've managed my own mail server since 1993, and my email address has been the same that entire time. Here are some tips for maintaining sanity: Greylisting st

by tacon 11y ago

I've managed my own mail server since 1993, and my email address has been the same that entire time. Here are some tips for maintaining sanity: Greylisting still works amazingly well. With a long, long whitelist and greylisting plus DNSBL, I don't even bother running a spam filter, since the little bit of spam and emails from new senders ends up in its own directory as it came from a non-whitelisted sender. Comcast finally started blocking residential mail server ports inbound a few years ago, so I had to migrate to a smarthost environment using a VPS as email server for $15/yr.[1] Last year for a few months, Gmail was dropping everything I sent into the spam folder, even after recipients were marking it not spam. I eventually discovered the "Authentication-Results:" header that Gmail adds to every inbound message. It is under the "Show Original" dropdown menu. That showed that I "hadn't changed anything"(!) on my mail server, but suddenly Gmail was connecting to my mail server over an IPv6 interface, and I had never bothered to put the IPv6 block into the SPF record. Gmail was nice enough to explain exactly what it didn't like about those emails. [1] http://lowendbox.com/blog/top-provider-poll-2014-q3-the-results/ http://lowendbox.com/blog/top-provider-poll-2014-q3-the-resu...

niravshah 11y ago
> Greylisting still works amazingly well. With a long, long whitelist and greylisting plus DNSBL, I don't even bother running a spam filter, since the little bit of spam and emails from new senders ends up in its own directory as it came from a non-whitelisted sender. Any good tips on this section in particular? If I'm running my own mail server, how would I get started making sure this is in order?
- dijit 11y ago
  old but valid HOWTO blog post. http://blog.philippheckel.com/2010/01/28/how-to-postfix-as-mail-relay-with-greylisting-support/ http://blog.philippheckel.com/2010/01/28/how-to-postfix-as-m...
- tacon 11y ago
  I have been running exim4 for years, but I'm in the process of moving to postfix, as postfix is considerably easier to set up all the DKIM, etc., machinery that is now required. Inbound email comes through procmail and is mainly read in emacs (mh-e), which is kind of old fashioned. I have a small script that makes a new email address within my domain for each new use. I sign up for a lot of mailing lists and groups, and my /etc/aliases is more than 5300 lines. I can track if domainA's address starts coming from domainB and disable that address, but that doesn't happen very often, which is a pleasant surprise. I also have a small script that puts a new sender on my whitelist of sender email addresses. My whitelist is 12000+ lines right now, collected over many years. Procmail sorts to mailing lists and vendor folders, and finally puts things that are not on the whitelist into a "possible spam" folder. From the five or ten items a day, it is easy to spot legitimate emails and I add those to the whitelist. The majority of spam is blocked by the combination of greylisting and DNSBL lists, as the delay of greylisting (ten minutes for me) is enough for them to make the blackhole list, if they happen to ever attempt delivery again. I was thinking recently that I should be collecting statistics on the use of a lot of those aliases and whitelisted emails, and maybe start garbage collecting my lists. There are various reputation reports and services that can tell you how your mail is doing in the major ISPs, but a lot of those require higher traffic than a personal or small business generates. There is one service, DMARC[1], that is free and can give you some visibility into how email from your domain is being processed. I put the txt record in my DNS, and Google, Facebook, Comcast, Yahoo, Fastmail, and a few others send me reports about email they have processed from my domain. It's not that interesting at the moment because things are working, but it might help to debug issues if your email was being rejected. At least I see a few spammers are trying to use my domain from their servers. [1] https://dmarc.org/ https://dmarc.org/
  - chei0aiV 11y ago
    If you are using emacs, you might want to try the emacs UI for notmuch: http://notmuchmail.org/ http://notmuchmail.org/
schoen 11y ago
> suddenly Gmail was connecting to my mail server over an IPv6 interface, and I had never bothered to put the IPv6 block into the SPF record Whoa, I think you just solved the problem I've been having with my outbound e-mail for the last two months! Thanks so much!
- degenerate 11y ago
  To confirm: If my server is ipv4 only, there is nothing special I need to add to my SPF record regarding ipv6 addresses, correct?
  - GauntletWizard 11y ago
    You probably should add the v6 representation of your V4 address, in case your ISP adds a 4to6 gateway in front of you at some point down the line.
sydney6 11y ago
One "could" have a VPS SMTP server transporting inbound mail to a mail server at home and relay outbound mail through e.g. Amazon SES via the same vps-smtp host. But still.. this is bullshit.
- mhurron 11y ago
  I have a VPS for sending, it is set up as a smarthost to relay from my internal mail server. It is included the SPF record for my domains along with MX records. I receive on my firewall at home, that host is what the MX record points at. It is very easy to set up. The full setup for inbound mail is - OpenBSD spamd (greylisting) -> internal postfix Outbound is - internal postfix -> VPS postfix
ChuckMcM 11y ago
This one caught me out too, Comcast Business decided to give me an IP6 block, didn't notify me, and my mail server ended up with an IPV6 address. Everything still worked (Yay IP V6 I guess) except that now Google was throwing everything away. The "quick" fix was to tell my mail server not to use IPV6 and the "longer" fix was to update the DNS records according.
jcrites 11y ago
> suddenly Gmail was connecting to my mail server over an IPv6 interface Nitpick: when sending email, the sending mail server establishes a connection to the receiving server, not vice versa. The sender is responsible for looking up the domain name's MX record, choosing a hostname from those listed, initiating a connection, establishing an SMTP conversation, and negotiating protocol enhancements like SSL. That said, I could see a change in behavior like this resulting from action on the receiver's side. Though the sending server makes the choice of how to connect, that choice can be influenced by the presentation of the MX record. I haven't specifically run into this before, but I could see this happening if, for example, the MX record advertised a host with an A record first (IPv4), and then was changed to list a host with only an AAAA record first (IPv6). There's quite a lot of arcana in the email space that's difficult to manage without careful, deliberate effort. Sending email is harder than it should be, and a lot of that difficulty results from anti-spam or general anti-abuse efforts. If it was easy to bring a server up and begin sending with a new domain name and IP address while successfully reaching the inbox, then spammers would do exactly that. So new identities are put through the wringer to prove they're legitimate. Well-known platforms have an easier time sending email because they can relay traffic from infrastructure that the ISPs already trust; and in turn they maintain that trust by keeping abuse off their platform.
- deleted 11y ago
  [deleted]
joveian 11y ago
What kind of bandwith usage do you see? I'm not sure I'd be brave enough to try this anyway, but one thing I worry about is exceeding bandwith quotas and ending up with a large bill. Also, do you just have one server or a backup as well?
- 9248 11y ago
  I setup my own server recently and could share my experience. Using postfix + dovecot(imap) + thunderbird. 1 user, set to check mail every 9 minutes. Not even sure if I have IDLE on my server (unless it's on by default). The SolusVM control panel shows 15-30 bytes/second (in+out) when it's idling. Now add how much your email weights and you got your bandwidth.

by tacon 11y ago

niravshah 11y ago

> Greylisting still works amazingly well. With a long, long whitelist and greylisting plus DNSBL, I don't even bother running a spam filter, since the little bit of spam and emails from new senders ends up in its own directory as it came from a non-whitelisted sender. Any good tips on this section in particular? If I'm running my own mail server, how would I get started making sure this is in order?

dijit 11y ago
old but valid HOWTO blog post. http://blog.philippheckel.com/2010/01/28/how-to-postfix-as-mail-relay-with-greylisting-support/ http://blog.philippheckel.com/2010/01/28/how-to-postfix-as-m...
tacon 11y ago
I have been running exim4 for years, but I'm in the process of moving to postfix, as postfix is considerably easier to set up all the DKIM, etc., machinery that is now required. Inbound email comes through procmail and is mainly read in emacs (mh-e), which is kind of old fashioned. I have a small script that makes a new email address within my domain for each new use. I sign up for a lot of mailing lists and groups, and my /etc/aliases is more than 5300 lines. I can track if domainA's address starts coming from domainB and disable that address, but that doesn't happen very often, which is a pleasant surprise. I also have a small script that puts a new sender on my whitelist of sender email addresses. My whitelist is 12000+ lines right now, collected over many years. Procmail sorts to mailing lists and vendor folders, and finally puts things that are not on the whitelist into a "possible spam" folder. From the five or ten items a day, it is easy to spot legitimate emails and I add those to the whitelist. The majority of spam is blocked by the combination of greylisting and DNSBL lists, as the delay of greylisting (ten minutes for me) is enough for them to make the blackhole list, if they happen to ever attempt delivery again. I was thinking recently that I should be collecting statistics on the use of a lot of those aliases and whitelisted emails, and maybe start garbage collecting my lists. There are various reputation reports and services that can tell you how your mail is doing in the major ISPs, but a lot of those require higher traffic than a personal or small business generates. There is one service, DMARC[1], that is free and can give you some visibility into how email from your domain is being processed. I put the txt record in my DNS, and Google, Facebook, Comcast, Yahoo, Fastmail, and a few others send me reports about email they have processed from my domain. It's not that interesting at the moment because things are working, but it might help to debug issues if your email was being rejected. At least I see a few spammers are trying to use my domain from their servers. [1] https://dmarc.org/ https://dmarc.org/
- chei0aiV 11y ago
  If you are using emacs, you might want to try the emacs UI for notmuch: http://notmuchmail.org/ http://notmuchmail.org/

schoen 11y ago

> suddenly Gmail was connecting to my mail server over an IPv6 interface, and I had never bothered to put the IPv6 block into the SPF record Whoa, I think you just solved the problem I've been having with my outbound e-mail for the last two months! Thanks so much!

degenerate 11y ago
To confirm: If my server is ipv4 only, there is nothing special I need to add to my SPF record regarding ipv6 addresses, correct?
- GauntletWizard 11y ago
  You probably should add the v6 representation of your V4 address, in case your ISP adds a 4to6 gateway in front of you at some point down the line.

sydney6 11y ago

One "could" have a VPS SMTP server transporting inbound mail to a mail server at home and relay outbound mail through e.g. Amazon SES via the same vps-smtp host. But still.. this is bullshit.

mhurron 11y ago
I have a VPS for sending, it is set up as a smarthost to relay from my internal mail server. It is included the SPF record for my domains along with MX records. I receive on my firewall at home, that host is what the MX record points at. It is very easy to set up. The full setup for inbound mail is - OpenBSD spamd (greylisting) -> internal postfix Outbound is - internal postfix -> VPS postfix

ChuckMcM 11y ago

This one caught me out too, Comcast Business decided to give me an IP6 block, didn't notify me, and my mail server ended up with an IPV6 address. Everything still worked (Yay IP V6 I guess) except that now Google was throwing everything away. The "quick" fix was to tell my mail server not to use IPV6 and the "longer" fix was to update the DNS records according.

jcrites 11y ago

> suddenly Gmail was connecting to my mail server over an IPv6 interface Nitpick: when sending email, the sending mail server establishes a connection to the receiving server, not vice versa. The sender is responsible for looking up the domain name's MX record, choosing a hostname from those listed, initiating a connection, establishing an SMTP conversation, and negotiating protocol enhancements like SSL. That said, I could see a change in behavior like this resulting from action on the receiver's side. Though the sending server makes the choice of how to connect, that choice can be influenced by the presentation of the MX record. I haven't specifically run into this before, but I could see this happening if, for example, the MX record advertised a host with an A record first (IPv4), and then was changed to list a host with only an AAAA record first (IPv6). There's quite a lot of arcana in the email space that's difficult to manage without careful, deliberate effort. Sending email is harder than it should be, and a lot of that difficulty results from anti-spam or general anti-abuse efforts. If it was easy to bring a server up and begin sending with a new domain name and IP address while successfully reaching the inbox, then spammers would do exactly that. So new identities are put through the wringer to prove they're legitimate. Well-known platforms have an easier time sending email because they can relay traffic from infrastructure that the ISPs already trust; and in turn they maintain that trust by keeping abuse off their platform.

deleted 11y ago
[deleted]

joveian 11y ago

What kind of bandwith usage do you see? I'm not sure I'd be brave enough to try this anyway, but one thing I worry about is exceeding bandwith quotas and ending up with a large bill. Also, do you just have one server or a backup as well?

9248 11y ago
I setup my own server recently and could share my experience. Using postfix + dovecot(imap) + thunderbird. 1 user, set to check mail every 9 minutes. Not even sure if I have IDLE on my server (unless it's on by default). The SolusVM control panel shows 15-30 bytes/second (in+out) when it's idling. Now add how much your email weights and you got your bandwidth.