2 ms·

> the big providers are seemingly relying less and less on IP address in determining spamminess... It's not the big providers that you need to worry about. Set

by gardnr 9y ago

> the big providers are seemingly relying less and less on IP address in determining spamminess... It's not the big providers that you need to worry about. Setup SPF and most of them are fine. Some will look at your DKIM record too. The problem is every mid-level smtp service that has been configured by a varying number of people with varying levels of policies and ideas around how to mitigate spam. If your system triggers their spam detection then sometimes you get an email saying it was returned to sender and marked as spam. Sometimes, it will quietly go into their spam folder. I only ever got DMARC reports from Google. One needs an IP registered to their own AS number owned by a real company to reliably deliver email to the entire web. You can't run an MTA on a VPS or most home internet connections without spending a lot of time monitoring and troubleshooting delivery. Using a 3rd party service for sending while hosting the MX at home is still the most secure and reliable setup. What would be really useful is a "bounce_forwarding_mta" where bounced emails would always attempt to redeliver through the 2nd MTA. Then you could send everything through your own MTA on your home internet connection and if one bounces then the system automatically attempts to send it through whatever smtp SaaS the user configures. Things on the internet usually suck because of corporate policy, not usually because of the technology.

SwellJoe 9y ago
Yeah, I agree with most of what you say, though I disagree about needing your own AS; we've never had one and almost none of our clients have one. Nonetheless, there's a lot of pressure toward using the big providers, and that's dangerous, IMHO. Also, the mail client landscape isn't great (lots of people are working on it, including my company, but a great Open Source webmail client comparable to GMail does not yet exist...and, the mobile client situation is probably even worse than the state of webmail). Nonetheless, we have never outsourced our mail, and we deliver several thousand emails a day (forum and tracker notifications, mostly, but also expiration notices and billing failure notices) to thousands of different domains from our own MTAs. We are on static IPs in a colocation provider on our own physical server. We lived on the same IP for about five years and then moved to a new one a couple of years ago (same colocation). We only had one deliverability problem on the fresh IP, which was with Hotmail/Outlook, who seem to block every IP by default and you have to ask to be unblocked. But, once we jumped through their hoops we've never had deliverability problems since. We may be dealing with less troublesome recipients. Our users are mostly Linux/UNIX users at small-ish companies. They probably care about people being able to send them mail reliably more than maybe bigger companies with layers of security theater to deal with. I like the idea of a bounce forwarding MTA. That's actually a pretty brilliant approach to the problem; having something like Sendgrid or Mailjet or whatever as the backup would be a pretty neat thing (and for such a low volume of mail it'd be cheap or free for the small companies we deal with). Briefly googling didn't really turn up anything about that approach to bounces (googling anything related to bounces is tough because it can be about backscatter, my mail bouncing, my mail server bouncing incoming mail, delivery of bounces, etc.). It's already possible to detect bounces in Postfix, but I dunno how one would turn the bounce message (which are infinitely varied in their contents) into a forward for the original email. Maybe just instant rejections would be handleable in such a case. That'd be a reasonable start on the problem. And, in the case of email, corporate policy sucks because abuse sucks (and people are dumb about security practices). Because somebody is gonna click on that virus attachment if it finds its way through, IT is expected to act like the TSA and engage in all manner of security theater to prevent it, at any cost.
- gardnr 9y ago
  > there's a lot of pressure toward using the big providers, and that's dangerous This is true and you mention this in other posts. The resounding answer to "how do I run my own mail server" is "don't" and that creates a dangerous environment where we abandon a previously working and useful decentralized part of the core internet because corporations do not accept our individual participation. This is a form of censorship and I really don't know the best way to approach it. If a message is signed with DKIM there is a statistically insignificant probability that it is not from the asserted sender. Every MX should block based on content and behavior after initially accepting based on sender validation (SPF/DKIM). It seems like we need an email advocacy group to fight the long fight and tighten the screws on individual companies with overly protective policies like comcast and att. Perhaps even working at a federal/eu policy level would make sense.

by gardnr 9y ago

SwellJoe 9y ago

Yeah, I agree with most of what you say, though I disagree about needing your own AS; we've never had one and almost none of our clients have one. Nonetheless, there's a lot of pressure toward using the big providers, and that's dangerous, IMHO. Also, the mail client landscape isn't great (lots of people are working on it, including my company, but a great Open Source webmail client comparable to GMail does not yet exist...and, the mobile client situation is probably even worse than the state of webmail). Nonetheless, we have never outsourced our mail, and we deliver several thousand emails a day (forum and tracker notifications, mostly, but also expiration notices and billing failure notices) to thousands of different domains from our own MTAs. We are on static IPs in a colocation provider on our own physical server. We lived on the same IP for about five years and then moved to a new one a couple of years ago (same colocation). We only had one deliverability problem on the fresh IP, which was with Hotmail/Outlook, who seem to block every IP by default and you have to ask to be unblocked. But, once we jumped through their hoops we've never had deliverability problems since. We may be dealing with less troublesome recipients. Our users are mostly Linux/UNIX users at small-ish companies. They probably care about people being able to send them mail reliably more than maybe bigger companies with layers of security theater to deal with. I like the idea of a bounce forwarding MTA. That's actually a pretty brilliant approach to the problem; having something like Sendgrid or Mailjet or whatever as the backup would be a pretty neat thing (and for such a low volume of mail it'd be cheap or free for the small companies we deal with). Briefly googling didn't really turn up anything about that approach to bounces (googling anything related to bounces is tough because it can be about backscatter, my mail bouncing, my mail server bouncing incoming mail, delivery of bounces, etc.). It's already possible to detect bounces in Postfix, but I dunno how one would turn the bounce message (which are infinitely varied in their contents) into a forward for the original email. Maybe just instant rejections would be handleable in such a case. That'd be a reasonable start on the problem. And, in the case of email, corporate policy sucks because abuse sucks (and people are dumb about security practices). Because somebody is gonna click on that virus attachment if it finds its way through, IT is expected to act like the TSA and engage in all manner of security theater to prevent it, at any cost.

gardnr 9y ago
> there's a lot of pressure toward using the big providers, and that's dangerous This is true and you mention this in other posts. The resounding answer to "how do I run my own mail server" is "don't" and that creates a dangerous environment where we abandon a previously working and useful decentralized part of the core internet because corporations do not accept our individual participation. This is a form of censorship and I really don't know the best way to approach it. If a message is signed with DKIM there is a statistically insignificant probability that it is not from the asserted sender. Every MX should block based on content and behavior after initially accepting based on sender validation (SPF/DKIM). It seems like we need an email advocacy group to fight the long fight and tighten the screws on individual companies with overly protective policies like comcast and att. Perhaps even working at a federal/eu policy level would make sense.