12 ms·

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email serve

This sounds great but Google has been making it harder and harder to run your own mail server even for personal use. I think they would be happy of email servers were only run by a few large companies. They make it sound like they are doing the right thing but really they are bully the industry to do it their way. So many people have Gmail accounts that you can't run an email server that cannot send email to Google. I've run my own email server for about 15 years. Every now and then I have to drop everything and implement some new technology that Gmail demands I have. Granted SPF, DMARC and TLS are all great technologies but I take issue with Google making the decision that everyone is going to switch, now and with out sufficient warning.

tantalor 11y ago
> some new technology that Gmail demands > everyone is going to switch, now The article is pretty clear that gmail users can keep emailing others who don't support TLS or authentication; they will just now see an additional icon informing them of that condition. Nobody is being demanded to switch anything. disclaimer: works for Google
- gscott 11y ago
  For now they will just warn on it. In a few months they will send it to spam. Just wait.
  - wnevets 11y ago
    >For now they will just warn on it. In a few months they will send it to spam. Just wait. How many months is a "few"?
  - michaelmior 11y ago
    Maybe. But that's far from "without warning."
  - sangnoir 11y ago
    > For now they will just warn on it. In a few months they will send it to spam As a recipient of all kinds of mail, I'm okay with that. I'd rather not see that unencrypted email than have it QUANTUM INSERT'd or whatever the Chinese equivalent is.
    - vidarh 11y ago
      There's nothing stopping the spammers from getting certs.
      - sangnoir 11y ago
        My comment has nothing to do with spammers, and everything to do with the possibility of unencrypted email I receive (spam or not) being nefariously tampered with while in transit (see QUANTUM INSERT)
- pera 11y ago
  Hi there, I have two questions: first, which CAs will you use? and second, what will you do when a CA gets compromised? Thanks!
  - tantalor 11y ago
    This might help: https://support.google.com/mail/answer/21291?hl=en https://support.google.com/mail/answer/21291?hl=en What are the SSL certificate authority requirements? We do not accept self-signed certificates. For a certificate to be valid it needs to chain up to a valid CA, like one in the Mozilla CA list.
    - zAy0LfpBZLC8mAC 11y ago
      That's obviously for mail retrieval, so doesn't apply here.
    - deleted 11y ago
      [deleted]
wdewind 11y ago
Just to play devil's advocate: the vast majority of (even technical) people have no interest in running a mail server. Who should Google optimize for?
- joshstrange 11y ago
  Couldn't agree more. I run a number of my own services on my own servers but email is not one of them. I don't have the time or energy to keep up with it and it's imperative that I receive all emails sent to me and all my sent emails are received. Google apps does that perfectly for me and I don't have to worry about it. As far as "I take issue with Google making the decision that everyone is going to switch, now and with out sufficient warning." it would be nice to get some notice on these changes no doubt but email is shit. It just is but we are stuck with it and at least google is attempting to drag it forward even if in doing so they leave some outdated servers/services behind. I'll take more secure of infinitely backwards compatible any day.
  - vonklaus 11y ago
    To play devil's advocate, why is email shit? It is pretty much a way to send someone a document in the original way Berners Lee defined html which was essentially sgml. I get not letting people mail active scripts, but every large mail provider also makes a browser. So email is shitty because providers fuck with it at the mailserver level (i think this is the case, and have heard that about providers) as it doesn't seem to be a problem at the view level. So this is sort of the issue. We couldn't get consensus on this early on, so no one was able to force standardization, now only a few players have the ability to define standards but they all own large scale messaging channels outside of email. edit: meant to say that browsers obviously view html and css3 is pretty good as well. We could probably standardize this enough to allow people to write emails in this format and embed imagery. We would not allow JS for obvious reasons, but sending cool emails would be fun and we could also add new features. I mean, the web has developed somewhat shittily, but adding a few new features outside of like the 16 original tags would be cool. Not sure what percentage of tags and attributes actually work, but then again, no one is...
VikingCoder 11y ago
Their users are suffering because of phishing. Measurably. And as to "sufficient warning," sure, I can see that it would be nice to have given people like you more lead time. But then again, "GMail has always supported encryption in transit using TLS," and if you care about running your own email server, it feels to me like the writing has been on the wall for that one for a long time.
emergentcypher 11y ago
Now I can just get a free cert and turn on TLS. What's the problem, exactly? Most people are not capable of running their own mail server. The convenience of services like Google, plus the risk of turning your mail box into a spam machine, vastly outweighs the downsides for most people.
- hueving 11y ago
  >Now I can just get a free cert and turn on TLS. What's the problem, exactly? Certs weren't free for business use until let's encrypt.
  - joshschreuder 11y ago
    That's kind of the point. They weren't but now are, and now there's even less of an excuse not to have a cert.
    - dsp1234 11y ago
      Is it possible to get a Let's Encrypt certificate without a public facing website (which is unrelated to wanted to run a mail server)?
      - tokenizerrr 11y ago
        Yes, they recently enabled the DNS validation. Otherwise, it wants to use a webserver to validate ownership. It can spin up an embedded webserver if you don't have one already.
    - zAy0LfpBZLC8mAC 11y ago
      I would say the opposite: There is no excuse for cementing the role of CAs for SMTP. DANE doesn't need any CA, and there is no problem with legacy clients that require CA-signed certs.
  - nly 11y ago
    WoSign never seemed to care.
emergentcypher 11y ago
Now I can just get a free cert and turn on TLS. What's the problem, exactly? Most people are not capable of running their own mail server. The convenience of services like Google, plus the risk of turning your mail box into a spam machine, vastly outweighs the downsides for most people.
Navarr 11y ago
These aren't requirements. Gmail is a mail client. What it is doing is adding warnings. Without SPF/DKIM you can't be authenticated. Google is showing the user that they cannot verify the sender. Without TLS email is sent in the clear. Google is showing the user that sensitive information will be visible when sent over the network. You can run your server fine without this, but users will be warned that you're not following best practices. It is not Gmail's fault that you're late to best practices.
- mynameisvlad 11y ago
  > These aren't requirements Well, except they are. Before, yes, they were just best practices. It was great if you had them but by no means required and didn't really impact your experience much if at all. With this switch, though, they became requirements to getting a "normal" experience in Gmail. Even having a warning is a degraded experience at this point.
  - abalos 11y ago
    I'd actually consider that an improved experience. Sure, the sender using the improperly created personal mailbox will be inconvenienced if people ask about it. However, the actual user of gmail benefits from this.
  - chii 11y ago
    I don't think there's anything wrong with gmail upping the game. It's not like they are using tech that no one else can get. If I ran a restaurant that provided extra services, that doesn't stop anyone else from opening a restaurant and provide similar levels of service.
- lmm 11y ago
  No, best practices are to avoid using any of that and trusting anyone's servers. S/MIME if you trust the CA system, PGP if you don't. Supporting either of those would be a real step forward for privacy - but of course if Google can't snoop on your email then it's not helping them target their ads.
jms703 11y ago
> Google has been making it harder and harder to run your own insecure mail server
- fungi 11y ago
  You can tick every box securing your email server and still get rejected or flagged as spam.
- wzdd 11y ago
  This is not entirely true. Gmail (and other big email providers) blacklist blocks of IP addresses belonging to hosting providers who are perhaps not as proactive as they should be at detecting and removing spammers. If you unwittingly sign up at one of these providers, it doesn't matter how perfect your mail configuration is: anything you send to a gmail address is gonna go to spam. Gmail of course doesn't publish these lists, so the only way to find out about them is to run into one. I understand gmail's problem, and I don't have a better solution, but it's not just about insecure mail servers.
inopinatus 11y ago
I'm in the same boat as you - running a personal/friends/family mail toaster for 16 years now. But I disagree that Google have made the administration harder. Internet mail servers don't live in isolation, and context has always been changing. I have no issue with adapting configuration as expectations change, so Gmail's evolution has never inhibited my ability to exchange email with the world. This move is no different. Really, I feel that the elephant has been tremendously careful not to tread on the mice. I don't believe this particular change materially improves security, since it isn't representing an end-to-end behaviour, but if it raises awareness and challenges mass surveillance then so much the better. Personally I would like them to advocate for other necessary infrastructure advances and include, for non-IPv6-capable MTAs, an icon of a lurching monster that refuses to die.
- Lunatic666 11y ago
  That's not right, I host some email servers for small companies and private people who all have problems with Google accounts although supporting DKIM, SPF and a TLS connection. They block them as bulk mail and in their FAQ the option hosting your own server isn't even listed. Of course contacting them is impossible, so the only way left is creating a ton of fake accounts on gmail and add the addresses to their contacts or ask friends with gmail accounts to add them and mark them as no spam. Google definitely IS the email bully and there's not much you can do about it.
  - inopinatus 11y ago
    Maybe they have a reputation system in which I've gained a good standing and you haven't. Have you considered that your attempts to game their system have actually been regarded as abuse?
    - jonknee 11y ago
      All major email providers do similar things because this is exactly the setup you'd have if you were a spam operation. Email is just something that you shouldn't try and do yourself on a small scale.
jankins 11y ago
I disagree - I run a personal mail server and dkim+spf just took a little bit of research to set up, so I'm very glad this brought them to my attention because I want to do what I can to make my emails trustworthy. If there are any potential downsides to these things I'm interested to hear them, but it seems like they're generally agreed good practices, and hosting your own mail means you're signing up for some ongoing learning and maintenance anyway.
746F7475 11y ago
Maybe I'm in an odd position, but is email really such a big communication tool? I mean sure in business world, but for that companies have their own email servers anyway. I only receive email from 2FA-things and order confirmations/paypal recipes. I hardly ever actually send anything from Gmail or receive anything from actual people. All my communication with actual people is either through apps like Signal or WhatsApp or through IM like IRC
treenyc 11y ago
Main complain to Google or other big company. Stop putting email in spam that doesn't have reverse DNS set. Why should one IP be tight to one email domain?
rphlx 11y ago
Well, it would be much worse if they refused to implement those enhancements, or tried to force proprietary or gmail-specific alternatives. They pretty much had to do something to improve e-mail's abysmal confidentiality and authenticity, and at least they used open technologies which can be configured on a Debian VPS in a couple of hours using a HOWTO.
collinmanderson 11y ago
If you run your own postfix server, the first part is as easy as setting smtp_tls_security_level = may. You don't need to certificate or anything. The DKIM authentication just requires a self-signed certificate. It doesn't need to be signed by a CA, I believe.

tantalor 11y ago

> some new technology that Gmail demands > everyone is going to switch, now The article is pretty clear that gmail users can keep emailing others who don't support TLS or authentication; they will just now see an additional icon informing them of that condition. Nobody is being demanded to switch anything. disclaimer: works for Google

gscott 11y ago
For now they will just warn on it. In a few months they will send it to spam. Just wait.
- wnevets 11y ago
  >For now they will just warn on it. In a few months they will send it to spam. Just wait. How many months is a "few"?
- michaelmior 11y ago
  Maybe. But that's far from "without warning."
- sangnoir 11y ago
  > For now they will just warn on it. In a few months they will send it to spam As a recipient of all kinds of mail, I'm okay with that. I'd rather not see that unencrypted email than have it QUANTUM INSERT'd or whatever the Chinese equivalent is.
  - vidarh 11y ago
    There's nothing stopping the spammers from getting certs.
    - sangnoir 11y ago
      My comment has nothing to do with spammers, and everything to do with the possibility of unencrypted email I receive (spam or not) being nefariously tampered with while in transit (see QUANTUM INSERT)
pera 11y ago
Hi there, I have two questions: first, which CAs will you use? and second, what will you do when a CA gets compromised? Thanks!
- tantalor 11y ago
  This might help: https://support.google.com/mail/answer/21291?hl=en https://support.google.com/mail/answer/21291?hl=en What are the SSL certificate authority requirements? We do not accept self-signed certificates. For a certificate to be valid it needs to chain up to a valid CA, like one in the Mozilla CA list.
  - zAy0LfpBZLC8mAC 11y ago
    That's obviously for mail retrieval, so doesn't apply here.
  - deleted 11y ago
    [deleted]

wdewind 11y ago

Just to play devil's advocate: the vast majority of (even technical) people have no interest in running a mail server. Who should Google optimize for?

joshstrange 11y ago
Couldn't agree more. I run a number of my own services on my own servers but email is not one of them. I don't have the time or energy to keep up with it and it's imperative that I receive all emails sent to me and all my sent emails are received. Google apps does that perfectly for me and I don't have to worry about it. As far as "I take issue with Google making the decision that everyone is going to switch, now and with out sufficient warning." it would be nice to get some notice on these changes no doubt but email is shit. It just is but we are stuck with it and at least google is attempting to drag it forward even if in doing so they leave some outdated servers/services behind. I'll take more secure of infinitely backwards compatible any day.
- vonklaus 11y ago
  To play devil's advocate, why is email shit? It is pretty much a way to send someone a document in the original way Berners Lee defined html which was essentially sgml. I get not letting people mail active scripts, but every large mail provider also makes a browser. So email is shitty because providers fuck with it at the mailserver level (i think this is the case, and have heard that about providers) as it doesn't seem to be a problem at the view level. So this is sort of the issue. We couldn't get consensus on this early on, so no one was able to force standardization, now only a few players have the ability to define standards but they all own large scale messaging channels outside of email. edit: meant to say that browsers obviously view html and css3 is pretty good as well. We could probably standardize this enough to allow people to write emails in this format and embed imagery. We would not allow JS for obvious reasons, but sending cool emails would be fun and we could also add new features. I mean, the web has developed somewhat shittily, but adding a few new features outside of like the 16 original tags would be cool. Not sure what percentage of tags and attributes actually work, but then again, no one is...

VikingCoder 11y ago

Their users are suffering because of phishing. Measurably. And as to "sufficient warning," sure, I can see that it would be nice to have given people like you more lead time. But then again, "GMail has always supported encryption in transit using TLS," and if you care about running your own email server, it feels to me like the writing has been on the wall for that one for a long time.

emergentcypher 11y ago

Now I can just get a free cert and turn on TLS. What's the problem, exactly? Most people are not capable of running their own mail server. The convenience of services like Google, plus the risk of turning your mail box into a spam machine, vastly outweighs the downsides for most people.

hueving 11y ago
>Now I can just get a free cert and turn on TLS. What's the problem, exactly? Certs weren't free for business use until let's encrypt.
- joshschreuder 11y ago
  That's kind of the point. They weren't but now are, and now there's even less of an excuse not to have a cert.
  - dsp1234 11y ago
    Is it possible to get a Let's Encrypt certificate without a public facing website (which is unrelated to wanted to run a mail server)?
    - tokenizerrr 11y ago
      Yes, they recently enabled the DNS validation. Otherwise, it wants to use a webserver to validate ownership. It can spin up an embedded webserver if you don't have one already.
  - zAy0LfpBZLC8mAC 11y ago
    I would say the opposite: There is no excuse for cementing the role of CAs for SMTP. DANE doesn't need any CA, and there is no problem with legacy clients that require CA-signed certs.
- nly 11y ago
  WoSign never seemed to care.

emergentcypher 11y ago

Navarr 11y ago

These aren't requirements. Gmail is a mail client. What it is doing is adding warnings. Without SPF/DKIM you can't be authenticated. Google is showing the user that they cannot verify the sender. Without TLS email is sent in the clear. Google is showing the user that sensitive information will be visible when sent over the network. You can run your server fine without this, but users will be warned that you're not following best practices. It is not Gmail's fault that you're late to best practices.

mynameisvlad 11y ago
> These aren't requirements Well, except they are. Before, yes, they were just best practices. It was great if you had them but by no means required and didn't really impact your experience much if at all. With this switch, though, they became requirements to getting a "normal" experience in Gmail. Even having a warning is a degraded experience at this point.
- abalos 11y ago
  I'd actually consider that an improved experience. Sure, the sender using the improperly created personal mailbox will be inconvenienced if people ask about it. However, the actual user of gmail benefits from this.
- chii 11y ago
  I don't think there's anything wrong with gmail upping the game. It's not like they are using tech that no one else can get. If I ran a restaurant that provided extra services, that doesn't stop anyone else from opening a restaurant and provide similar levels of service.
lmm 11y ago
No, best practices are to avoid using any of that and trusting anyone's servers. S/MIME if you trust the CA system, PGP if you don't. Supporting either of those would be a real step forward for privacy - but of course if Google can't snoop on your email then it's not helping them target their ads.

jms703 11y ago

> Google has been making it harder and harder to run your own insecure mail server

fungi 11y ago
You can tick every box securing your email server and still get rejected or flagged as spam.
wzdd 11y ago
This is not entirely true. Gmail (and other big email providers) blacklist blocks of IP addresses belonging to hosting providers who are perhaps not as proactive as they should be at detecting and removing spammers. If you unwittingly sign up at one of these providers, it doesn't matter how perfect your mail configuration is: anything you send to a gmail address is gonna go to spam. Gmail of course doesn't publish these lists, so the only way to find out about them is to run into one. I understand gmail's problem, and I don't have a better solution, but it's not just about insecure mail servers.

inopinatus 11y ago

I'm in the same boat as you - running a personal/friends/family mail toaster for 16 years now. But I disagree that Google have made the administration harder. Internet mail servers don't live in isolation, and context has always been changing. I have no issue with adapting configuration as expectations change, so Gmail's evolution has never inhibited my ability to exchange email with the world. This move is no different. Really, I feel that the elephant has been tremendously careful not to tread on the mice. I don't believe this particular change materially improves security, since it isn't representing an end-to-end behaviour, but if it raises awareness and challenges mass surveillance then so much the better. Personally I would like them to advocate for other necessary infrastructure advances and include, for non-IPv6-capable MTAs, an icon of a lurching monster that refuses to die.

Lunatic666 11y ago
That's not right, I host some email servers for small companies and private people who all have problems with Google accounts although supporting DKIM, SPF and a TLS connection. They block them as bulk mail and in their FAQ the option hosting your own server isn't even listed. Of course contacting them is impossible, so the only way left is creating a ton of fake accounts on gmail and add the addresses to their contacts or ask friends with gmail accounts to add them and mark them as no spam. Google definitely IS the email bully and there's not much you can do about it.
- inopinatus 11y ago
  Maybe they have a reputation system in which I've gained a good standing and you haven't. Have you considered that your attempts to game their system have actually been regarded as abuse?
  - jonknee 11y ago
    All major email providers do similar things because this is exactly the setup you'd have if you were a spam operation. Email is just something that you shouldn't try and do yourself on a small scale.

jankins 11y ago

I disagree - I run a personal mail server and dkim+spf just took a little bit of research to set up, so I'm very glad this brought them to my attention because I want to do what I can to make my emails trustworthy. If there are any potential downsides to these things I'm interested to hear them, but it seems like they're generally agreed good practices, and hosting your own mail means you're signing up for some ongoing learning and maintenance anyway.

746F7475 11y ago

Maybe I'm in an odd position, but is email really such a big communication tool? I mean sure in business world, but for that companies have their own email servers anyway. I only receive email from 2FA-things and order confirmations/paypal recipes. I hardly ever actually send anything from Gmail or receive anything from actual people. All my communication with actual people is either through apps like Signal or WhatsApp or through IM like IRC

treenyc 11y ago

Main complain to Google or other big company. Stop putting email in spam that doesn't have reverse DNS set. Why should one IP be tight to one email domain?

rphlx 11y ago

Well, it would be much worse if they refused to implement those enhancements, or tried to force proprietary or gmail-specific alternatives. They pretty much had to do something to improve e-mail's abysmal confidentiality and authenticity, and at least they used open technologies which can be configured on a Debian VPS in a couple of hours using a HOWTO.

collinmanderson 11y ago

If you run your own postfix server, the first part is as easy as setting smtp_tls_security_level = may. You don't need to certificate or anything. The DKIM authentication just requires a self-signed certificate. It doesn't need to be signed by a CA, I believe.