6 ms·

I've run my own email server since the mid 1990s. While it's not trivial, it's certainly not all that difficult. What I find strange and suspicious, though, is

I've run my own email server since the mid 1990s. While it's not trivial, it's certainly not all that difficult. What I find strange and suspicious, though, is how quickly and readily people go out of their way to actively discourage others, and how there's this crazy push to move everyone and everything in to the "cloud". This even happens in places where running one's own email server is expected, such as the selfhosted reddit channel. There are two problems with that, broadly speaking. One, if we care about privacy and security, the "cloud" doesn't have that. Google can genuinely try all they want to keep things secure, but we know without doubt, thanks to Mr. Snowden, that people who actually work for TLA agencies are working at Google (and Amazon, and Microsoft, and Yahoo, et cetera). So is our data REALLY safe? Even if they're not interested in our data specifically, the data can't be said to be safe. The other problem is that email with Gmail and others is not deterministic. In the real world of email, you either get an email or you don't. If you don't, you can look at your logs and see why. You'll end up with a precise reason why delivery failed. With Gmail and friends, though, they might simply not like the choice of subject, or they might not like the attached picture, or they may simply not like the cut of the sending server's jib. I've been told that access to email logs for businesses is better than it used to be, but do you think a user who gets free Gmail gets to know why a specific email wasn't delivered? Finally, I think Gmail accounts shouldn't be usable for WHOIS and for abuse addresses because they can't accept abuse complaints. I consider any WHOIS or any Internet service provider which uses Gmail to be amateurish and unprofessional. There's nothing less professional than setting up an email for incoming abuse complaints that filters abuse complains.

LinuxBender 9y ago
I agree with everything johnklos said and I do the same for the same reasons. I enforce TLS for certain domains and sometimes for all domains, depending on if I am subscribing to something for the first time and unsure if they support TLS. I read emails with strings and more. If there isn't a plain text version, I just delete it.
johnnycarcin 9y ago
You were probably waiting for this, but how do you handle IP reputation? I REALLY would like to host my own e-mail server but when I've previously tried this on the various vendors platforms (Digital Ocean, AWS, Azure), I naturally end up with an IP that has either no rep or bad rep. I did everything I could with regards to proving my mail server was legit but still ran into issues with my e-mails being flagged as spam. I know I could use someone like SendGrid or whatever to handle my outgoing e-mail, but now I'm back into the whole privacy concern area...
- johnklos 9y ago
  In most instances, you get what you pay for. I handle IP reputation by colocating with good, if somewhat conservative, colo providers. The most recent colo provider contacted me after placing my order to ask what services I intended to run, to match my provided address with WHOIS on the main domain I planned to use, and to ask me to explain the discrepancy between the IP from which I filled out their web form and my given address. Some people would be indignant about this. I certainly was not. I'd rather ALL people have to jump through many stupid hoops, myself included, than have a network where money is the only prerequisite to joining. That provider, if anyone is looking, is Turnkey Internet. They're definitely worth considering if you want to deal with real people. Once you have an address (or a new-to-you address), you have to break it in, so to speak. I did this by setting up reverse DNS (of course) which unambiguously matches the hostname, the primary IP, and the HELO / EHLO name given by the server. I then set up SMTP-auth so I could use it for little bits of email here and there. I did this for several weeks before I started increasing the volume. At the same time, I configured a long running server elsewhere to allow relaying from this machine and started sending email list traffic through the new server, which relayed through the long running server so that services like Google, Yahoo, Hotmail and others would get more exposure to the new server, albeit indirectly. I also took the time to proactively register the new server and IPs with anti-spam sites and blocklists. This usually involves providing proof that the contact information is real and works, but it helps lots. Barracuda gave problems - they listed my new IPs even after requesting delisting TWICE, but an email that got to a human fixed this more permanently. While frustrating at first, the fact that you can correspond with a human is always a good thing. After more than a month of this, I started sending directly from this new server. As anyone who has done it can tell you, running a mailman list these days is hardly trivial considering how quick most services are to consider mail lists spam. But regardless of how much time it takes, it's worth it to take the time, to be careful and deliberate. I've only had to do this four times in the last decade, but not rushing is always worth the extra energy. Of course, VPS IPs are often much more "beat up" and are usually considered undesirable neighborhoods, more so than colo networks. That's partly due to the more transient nature of VPSes. When you colocate, you're more invested, generally speaking, so you're more apt to keep the IP for many years.
chatmasta 9y ago
I’m quite paranoid and put a lot of effort into maintaining a good security posture. Rather than worrying about the security of my emails, however, I simply assume that any email I send or receive may become public one day. Remember, there is always a third party on the other end of the email, and you cannot control what they do with their copy of it. You can have the most secure email server in the world, but unless you’re sending emails to yourself, that security goes out the window once another correspondent is involved. Consider this: every time you send an email to someone with a @gmail.com address, there is a copy of your email stored on google servers (not to mention it might even get spam filtered). So did you do all that work to secure your email for nothing? The one exception is for security related, primarily inbound, emails (password resets, OTP codes, etc.). Here I can see the argument for self hosting. Ideally you would keep a separate email for all signups / transactional emails that is used 99% for inbound, and isolated from any of your public email addresses.

LinuxBender 9y ago

I agree with everything johnklos said and I do the same for the same reasons. I enforce TLS for certain domains and sometimes for all domains, depending on if I am subscribing to something for the first time and unsure if they support TLS. I read emails with strings and more. If there isn't a plain text version, I just delete it.

johnnycarcin 9y ago

You were probably waiting for this, but how do you handle IP reputation? I REALLY would like to host my own e-mail server but when I've previously tried this on the various vendors platforms (Digital Ocean, AWS, Azure), I naturally end up with an IP that has either no rep or bad rep. I did everything I could with regards to proving my mail server was legit but still ran into issues with my e-mails being flagged as spam. I know I could use someone like SendGrid or whatever to handle my outgoing e-mail, but now I'm back into the whole privacy concern area...

johnklos 9y ago
In most instances, you get what you pay for. I handle IP reputation by colocating with good, if somewhat conservative, colo providers. The most recent colo provider contacted me after placing my order to ask what services I intended to run, to match my provided address with WHOIS on the main domain I planned to use, and to ask me to explain the discrepancy between the IP from which I filled out their web form and my given address. Some people would be indignant about this. I certainly was not. I'd rather ALL people have to jump through many stupid hoops, myself included, than have a network where money is the only prerequisite to joining. That provider, if anyone is looking, is Turnkey Internet. They're definitely worth considering if you want to deal with real people. Once you have an address (or a new-to-you address), you have to break it in, so to speak. I did this by setting up reverse DNS (of course) which unambiguously matches the hostname, the primary IP, and the HELO / EHLO name given by the server. I then set up SMTP-auth so I could use it for little bits of email here and there. I did this for several weeks before I started increasing the volume. At the same time, I configured a long running server elsewhere to allow relaying from this machine and started sending email list traffic through the new server, which relayed through the long running server so that services like Google, Yahoo, Hotmail and others would get more exposure to the new server, albeit indirectly. I also took the time to proactively register the new server and IPs with anti-spam sites and blocklists. This usually involves providing proof that the contact information is real and works, but it helps lots. Barracuda gave problems - they listed my new IPs even after requesting delisting TWICE, but an email that got to a human fixed this more permanently. While frustrating at first, the fact that you can correspond with a human is always a good thing. After more than a month of this, I started sending directly from this new server. As anyone who has done it can tell you, running a mailman list these days is hardly trivial considering how quick most services are to consider mail lists spam. But regardless of how much time it takes, it's worth it to take the time, to be careful and deliberate. I've only had to do this four times in the last decade, but not rushing is always worth the extra energy. Of course, VPS IPs are often much more "beat up" and are usually considered undesirable neighborhoods, more so than colo networks. That's partly due to the more transient nature of VPSes. When you colocate, you're more invested, generally speaking, so you're more apt to keep the IP for many years.

chatmasta 9y ago

I’m quite paranoid and put a lot of effort into maintaining a good security posture. Rather than worrying about the security of my emails, however, I simply assume that any email I send or receive may become public one day. Remember, there is always a third party on the other end of the email, and you cannot control what they do with their copy of it. You can have the most secure email server in the world, but unless you’re sending emails to yourself, that security goes out the window once another correspondent is involved. Consider this: every time you send an email to someone with a @gmail.com address, there is a copy of your email stored on google servers (not to mention it might even get spam filtered). So did you do all that work to secure your email for nothing? The one exception is for security related, primarily inbound, emails (password resets, OTP codes, etc.). Here I can see the argument for self hosting. Ideally you would keep a separate email for all signups / transactional emails that is used 99% for inbound, and isolated from any of your public email addresses.