5 ms·

It's kind of a bummer that small companies and home users can't send email through their own servers any more. I have this idea for a "bonded email server". T

It's kind of a bummer that small companies and home users can't send email through their own servers any more. I have this idea for a "bonded email server". The idea is that smaller senders would pay a bond (say, $200) plus a small monthly fee to a bonding company, which has a trusted relationship with Google, Yahoo, Hotmail, etc. The bond ensures that you won't send spam through your mail servers and in exchange, the big hosts agree to whitelist the mail you're sending. After some period of time, you get your bond money back if you've been true to your word. You'd still pay your small monthly fee to the bonding company. The database of "certified good" hosts could be maintained by means of DNS run by the bonding company. The problem with the idea is that there's so little incentive for the big mail hosts to accept email from small senders. They'd much rather you use a Mailchimp for bulk sending and their own service (or one of their large competitors) for individual sending because they know that these are reliable partners.

drdaeman 10y ago
Hm. I run my own MTA since 2005 or so. I'm not much of a sender, but haven't had any spam/delivery issues (even though I had double bounce misconfiguration and hit a RDNSBL once).
eli 10y ago
$200 is kinda expensive for a lot of people who may wish to self-host a personal email server, but also kinda too cheap for a spammer who may gladly pay that for improved deliverability.
epaulson 10y ago
I would gladly sign up for this service. Actually, I'd love a good SMTP service that had a good reputation, but most of what's out there is more bulk-mail oriented. I just want to own my own domain and send email but not be beholden to gmail nor deal with deliverability headaches.
- Mahn 10y ago
  Personally I find that services like Mailgun, Mandrill or SES work well enough for this purpose and are not particularly expensive if your volume per month isn't huge. On Mailgun for example you can send up to 10k emails per month for $0. And that's 10k emails that you can send on your own terms, not just in bulk.
__b__ 10y ago
Question: To whom do you want to send mail with your "bonded email server"? Is it commercial email? Or are you just interested in sending email to friends and family? In the case it's both, which one is more important to you?
danieltillett 10y ago
You could have it tied to the business registration like EV certificate. I wish that the yahoos and microsofts of this world would just treat mail from a business with an EV certificate as non-spam by default.
- Animats 10y ago
  There's something to be said for that. If you sign your email with your domain cert, the reputation of the domain can be used.
  - danieltillett 10y ago
    Yes but are any of the big email companies using this info?
- jlgaddis 10y ago
  That might be a useful tactic but it would require a lot more work to implement than current/existing solutions... Let's say a remote mail server connects to mine to deliver an e-mail purporting to be from example.com (your business, which has an EV SSL/TLS certificate for the example.com web site). The first thing to be done is to somehow verify that the mail is legitimately being send by the company. The best way we have to do this presently is via SPF and DKIM. We query DNS and the IP address of the remote mail server is listed in the TXT RR, so the SPF check passes. We query DNS for the key that the mail is DKIM-signed with, and that passes. Now what? At minimum, we have to do another DNS query for the A RR for example.com, establish a TLS connection to example.com, retrieve the presented certificate, verify the certificate is valid (date, hostname match, etc.), verify the certificate is chained to a trusted root, and -- somehow -- check that the presented certificate is an EV cert. I don't know enough about EV certs to know if there's an easy, programmatic way to verify that a cert is EV vs. DV, etc., but let's assume that there is. There's also revocation/OCSP, etc., checks to be performed. And so on... What you're proposing might work. That is, a company with an EV cert is probably unlikely to be sending out blatant spam, but I don't know of any existing tooling to do these types of checks. If it existed and were easily integrated, I would at least be willing to test it and see what the real-world results were (and it would be much more likely to become an acceptable tactic to use for distinguishing spam from non-spam). A plugin for amavis and/or SpamAssassin would probably go a long way towards making this happen. All that said, do CAs publish lists of EV certs? It would be relatively easy to import a list of domains with valid EV certs and then say "if mail from one of these domains arrives with a valid DKIM signature, assume it is not spam".
Animats 10y ago
That was called "Bonded Spammer", from Ironport. They were trying to get ISPs to accept their whitelist.[1] (Ironport tried to call it "Bonded Sender", but nobody in anti-spam took that seriously.) Ironport was selling mail filtering appliances. They also sold dedicated spamming engines that were whitelisted by the mail filtering appliances. This playing both sides of the street made them something of a joke, and they had to drop the spam engine business. They were eventually acquired by Cisco after that. [1] https://groups.google.com/forum/#!topic/news.admin.net-abuse.email/LDENwnUJpqk https://groups.google.com/forum/#!topic/news.admin.net-abuse...
muppetman 10y ago
Many people use dnswl.org If you're sending mail, you're crazy if you don't get your sending mail servers added there. It's easy to do and helps prove you're not spamming. I'm always amazed at how many people don't know about, or use in reputation checks.
- Neil44 10y ago
  If people done know about it or use it in reputation checks then how is it so important?
  - muppetman 10y ago
    Because lots of big companies are aware of it and do use it. Plus checks for it are written into Spamassassin. So my point is, lots of anti-spam services check it, but few people sending mail make an attempt to get their server listed in there properly. Mail Servers get listed in there automatically, but if you go in there and vouch for your mailservers properly you're get a more trusted ranking, which translates into a higher anti-spam ranking when checks are done.
manigandham 10y ago
This price point doesn't work, it only hurts small clients who want to send some email. Pricing in general isn't an effective strategy to stop this unless it becomes more prohibitive than the profit margins - and that's a very big number.
inopinatus 10y ago
I'll beg to differ. I've been running my own email for almost two decades and although the environment has changed, it is still perfectly accommodating of small operators that keep themselves up-to-date with context (e.g dnswl listing, notifications to major recipients, signed headers, best practise DNS records etc etc). I changed IP address in the last 18 months and despite great trepidation, was pleasantly surprised that deliverability was not degraded. Paying a bond feels like protection money for something I think my domains/hosts already have: a good reputation.
- interfixus 10y ago
  So have I, and I have experienced mounting difficulties over the last couple of years, despite decent efforts to keep up with protocol and defense mechanisms. Delivery to gmail and hotmail/outlook accounts is becoming a game of chance. I shall probably, with huge regret, hand over the delivery process to an external operator in the near future.
  - drdaeman 10y ago
    > Delivery to gmail and hotmail/outlook accounts is becoming a game of chance. I haven't had any issues recently, but wonder... Are the failures still well-noticeable? I mean, when Gmail/Hotmail reject the letter - do they do it properly (SMTP 4xx/5xx rejection) or maybe they're now silently discarding it? When I had the issues (even with large mail providers), my MTA had always generated me a bounce, and it had always contained something sensible and immediately useful - like a message that my DNS records got messed up or IP got in a blacklist. Every error message I saw contained links or clues to how the delivery problem could be resolved. Had this changed?
    - NathanOsullivan 10y ago
      Yes, hotmail will in some instances accept mail at SMTP level and then silently discard it. You cannot even request de-listing.
      - 10y ago
pbreit 10y ago
Well, that's sort of what you're paying MailChimp (and more clearly, ReturnPath) for. But I guess they don't give you your money back.
ams6110 10y ago
It's strange to me that we need these gyrations to detect and thwart spam. I can detect spam with high accuracy based on nothing but the subject line and sender.
- smt88 10y ago
  Do you scale? Can you look through 100 million emails tomorrow for me?
xorcist 10y ago
People keep repeating that. I not only run my own but I've helped other organizations do it, and if you have a clean IP range it's usually not a problem. No, you can't do it from your home DSL line, but that doesn't mean you can't do it.
Neil44 10y ago
That's just not correct, I run MTA's for many of my clients on their static IP's with no outbound issues. It sometimes takes a few days to settle into a new IP but that doesn't happen that often.

drdaeman 10y ago

Hm. I run my own MTA since 2005 or so. I'm not much of a sender, but haven't had any spam/delivery issues (even though I had double bounce misconfiguration and hit a RDNSBL once).

eli 10y ago

$200 is kinda expensive for a lot of people who may wish to self-host a personal email server, but also kinda too cheap for a spammer who may gladly pay that for improved deliverability.

epaulson 10y ago

I would gladly sign up for this service. Actually, I'd love a good SMTP service that had a good reputation, but most of what's out there is more bulk-mail oriented. I just want to own my own domain and send email but not be beholden to gmail nor deal with deliverability headaches.

Mahn 10y ago
Personally I find that services like Mailgun, Mandrill or SES work well enough for this purpose and are not particularly expensive if your volume per month isn't huge. On Mailgun for example you can send up to 10k emails per month for $0. And that's 10k emails that you can send on your own terms, not just in bulk.

__b__ 10y ago

Question: To whom do you want to send mail with your "bonded email server"? Is it commercial email? Or are you just interested in sending email to friends and family? In the case it's both, which one is more important to you?

danieltillett 10y ago

You could have it tied to the business registration like EV certificate. I wish that the yahoos and microsofts of this world would just treat mail from a business with an EV certificate as non-spam by default.

Animats 10y ago
There's something to be said for that. If you sign your email with your domain cert, the reputation of the domain can be used.
- danieltillett 10y ago
  Yes but are any of the big email companies using this info?
jlgaddis 10y ago
That might be a useful tactic but it would require a lot more work to implement than current/existing solutions... Let's say a remote mail server connects to mine to deliver an e-mail purporting to be from example.com (your business, which has an EV SSL/TLS certificate for the example.com web site). The first thing to be done is to somehow verify that the mail is legitimately being send by the company. The best way we have to do this presently is via SPF and DKIM. We query DNS and the IP address of the remote mail server is listed in the TXT RR, so the SPF check passes. We query DNS for the key that the mail is DKIM-signed with, and that passes. Now what? At minimum, we have to do another DNS query for the A RR for example.com, establish a TLS connection to example.com, retrieve the presented certificate, verify the certificate is valid (date, hostname match, etc.), verify the certificate is chained to a trusted root, and -- somehow -- check that the presented certificate is an EV cert. I don't know enough about EV certs to know if there's an easy, programmatic way to verify that a cert is EV vs. DV, etc., but let's assume that there is. There's also revocation/OCSP, etc., checks to be performed. And so on... What you're proposing might work. That is, a company with an EV cert is probably unlikely to be sending out blatant spam, but I don't know of any existing tooling to do these types of checks. If it existed and were easily integrated, I would at least be willing to test it and see what the real-world results were (and it would be much more likely to become an acceptable tactic to use for distinguishing spam from non-spam). A plugin for amavis and/or SpamAssassin would probably go a long way towards making this happen. All that said, do CAs publish lists of EV certs? It would be relatively easy to import a list of domains with valid EV certs and then say "if mail from one of these domains arrives with a valid DKIM signature, assume it is not spam".

Animats 10y ago

That was called "Bonded Spammer", from Ironport. They were trying to get ISPs to accept their whitelist.[1] (Ironport tried to call it "Bonded Sender", but nobody in anti-spam took that seriously.) Ironport was selling mail filtering appliances. They also sold dedicated spamming engines that were whitelisted by the mail filtering appliances. This playing both sides of the street made them something of a joke, and they had to drop the spam engine business. They were eventually acquired by Cisco after that. [1] https://groups.google.com/forum/#!topic/news.admin.net-abuse.email/LDENwnUJpqk https://groups.google.com/forum/#!topic/news.admin.net-abuse...

muppetman 10y ago

Many people use dnswl.org If you're sending mail, you're crazy if you don't get your sending mail servers added there. It's easy to do and helps prove you're not spamming. I'm always amazed at how many people don't know about, or use in reputation checks.

Neil44 10y ago
If people done know about it or use it in reputation checks then how is it so important?
- muppetman 10y ago
  Because lots of big companies are aware of it and do use it. Plus checks for it are written into Spamassassin. So my point is, lots of anti-spam services check it, but few people sending mail make an attempt to get their server listed in there properly. Mail Servers get listed in there automatically, but if you go in there and vouch for your mailservers properly you're get a more trusted ranking, which translates into a higher anti-spam ranking when checks are done.

manigandham 10y ago

This price point doesn't work, it only hurts small clients who want to send some email. Pricing in general isn't an effective strategy to stop this unless it becomes more prohibitive than the profit margins - and that's a very big number.

inopinatus 10y ago

I'll beg to differ. I've been running my own email for almost two decades and although the environment has changed, it is still perfectly accommodating of small operators that keep themselves up-to-date with context (e.g dnswl listing, notifications to major recipients, signed headers, best practise DNS records etc etc). I changed IP address in the last 18 months and despite great trepidation, was pleasantly surprised that deliverability was not degraded. Paying a bond feels like protection money for something I think my domains/hosts already have: a good reputation.

interfixus 10y ago
So have I, and I have experienced mounting difficulties over the last couple of years, despite decent efforts to keep up with protocol and defense mechanisms. Delivery to gmail and hotmail/outlook accounts is becoming a game of chance. I shall probably, with huge regret, hand over the delivery process to an external operator in the near future.
- drdaeman 10y ago
  > Delivery to gmail and hotmail/outlook accounts is becoming a game of chance. I haven't had any issues recently, but wonder... Are the failures still well-noticeable? I mean, when Gmail/Hotmail reject the letter - do they do it properly (SMTP 4xx/5xx rejection) or maybe they're now silently discarding it? When I had the issues (even with large mail providers), my MTA had always generated me a bounce, and it had always contained something sensible and immediately useful - like a message that my DNS records got messed up or IP got in a blacklist. Every error message I saw contained links or clues to how the delivery problem could be resolved. Had this changed?
  - NathanOsullivan 10y ago
    Yes, hotmail will in some instances accept mail at SMTP level and then silently discard it. You cannot even request de-listing.
    - 10y ago

pbreit 10y ago

Well, that's sort of what you're paying MailChimp (and more clearly, ReturnPath) for. But I guess they don't give you your money back.

ams6110 10y ago

It's strange to me that we need these gyrations to detect and thwart spam. I can detect spam with high accuracy based on nothing but the subject line and sender.

smt88 10y ago
Do you scale? Can you look through 100 million emails tomorrow for me?

xorcist 10y ago

People keep repeating that. I not only run my own but I've helped other organizations do it, and if you have a clean IP range it's usually not a problem. No, you can't do it from your home DSL line, but that doesn't mean you can't do it.

Neil44 10y ago

That's just not correct, I run MTA's for many of my clients on their static IP's with no outbound issues. It sometimes takes a few days to settle into a new IP but that doesn't happen that often.