6 ms·

You were probably waiting for this, but how do you handle IP reputation? I REALLY would like to host my own e-mail server but when I've previously tried this o

You were probably waiting for this, but how do you handle IP reputation? I REALLY would like to host my own e-mail server but when I've previously tried this on the various vendors platforms (Digital Ocean, AWS, Azure), I naturally end up with an IP that has either no rep or bad rep. I did everything I could with regards to proving my mail server was legit but still ran into issues with my e-mails being flagged as spam. I know I could use someone like SendGrid or whatever to handle my outgoing e-mail, but now I'm back into the whole privacy concern area...

johnklos 9y ago
In most instances, you get what you pay for. I handle IP reputation by colocating with good, if somewhat conservative, colo providers. The most recent colo provider contacted me after placing my order to ask what services I intended to run, to match my provided address with WHOIS on the main domain I planned to use, and to ask me to explain the discrepancy between the IP from which I filled out their web form and my given address. Some people would be indignant about this. I certainly was not. I'd rather ALL people have to jump through many stupid hoops, myself included, than have a network where money is the only prerequisite to joining. That provider, if anyone is looking, is Turnkey Internet. They're definitely worth considering if you want to deal with real people. Once you have an address (or a new-to-you address), you have to break it in, so to speak. I did this by setting up reverse DNS (of course) which unambiguously matches the hostname, the primary IP, and the HELO / EHLO name given by the server. I then set up SMTP-auth so I could use it for little bits of email here and there. I did this for several weeks before I started increasing the volume. At the same time, I configured a long running server elsewhere to allow relaying from this machine and started sending email list traffic through the new server, which relayed through the long running server so that services like Google, Yahoo, Hotmail and others would get more exposure to the new server, albeit indirectly. I also took the time to proactively register the new server and IPs with anti-spam sites and blocklists. This usually involves providing proof that the contact information is real and works, but it helps lots. Barracuda gave problems - they listed my new IPs even after requesting delisting TWICE, but an email that got to a human fixed this more permanently. While frustrating at first, the fact that you can correspond with a human is always a good thing. After more than a month of this, I started sending directly from this new server. As anyone who has done it can tell you, running a mailman list these days is hardly trivial considering how quick most services are to consider mail lists spam. But regardless of how much time it takes, it's worth it to take the time, to be careful and deliberate. I've only had to do this four times in the last decade, but not rushing is always worth the extra energy. Of course, VPS IPs are often much more "beat up" and are usually considered undesirable neighborhoods, more so than colo networks. That's partly due to the more transient nature of VPSes. When you colocate, you're more invested, generally speaking, so you're more apt to keep the IP for many years.
- nikofeyn 9y ago
  i have some honest questions for you though. i write software daily yet don’t have much knowledge of what you have described here and have even less inkling to want to do any of that. so i think setting up an effective e-mail server is simply beyond the scope of nearly everyone. moving to the “cloud” isn’t some fad for e-mail, it’s just not everyone has the IT knowledge and even less want to have it. what is the real benefit beyond not having your e-mails crawled? is your server really more secure than google’s or microsoft’s?
  - johnklos 9y ago
    Saying that setting up an email server is "simply beyond the scope of nearly everyone" is... Well, it's a bit sad, if you honestly believe that. At the same time, it's also pessimistic and disingenuous. It's disingenuous because you do a thing that some people might incorrectly generalize as, "simply beyond the scope of nearly everyone," even though we all know that there are lots of six year olds are learning Python. Granted, there are likely more six year olds learning Python than people in general learning from scratch to stand up email servers, but we both know that your characterization is quite stretched. So let me ask you, since your post carries a similar sentiment as many others: Why do you feel that you should express a dismissive opinion about the practice when you've also made it clear you have no inkling to want to do it? For your information, I set up a how-to to show people how to set up an email server from scratch. No, it's not wildly popular, but several people have used it and have written to thank me, so I don't agree in the least that it is "simply beyond the scope of nearly everyone," and I also have evidence that this is clearly not the case. To answer your questions, not having my emails crawled is just one benefit, but it's a very important one. Plenty of people say crazy and ignorant things like, "I have nothing to hide," not realizing that it's not about that - not even a tiny bit. If we dismiss the fundamental right to privacy because we have "nothing to hide" right now, we can't later on get privacy back. But, obviously, this isn't a concern of yours, and most people can't consider how the principle applies to historical lessons or how it applies to a possible path to totalitarianism. So what ARE the benefits? I mentioned that my email servers are deterministic. I can say with precision why a thing happened or didn't happen. Now it may be true that writing Sendmail rules is "simply beyond the scope of nearly everyone," programmers included, but the option is there to decide, again with precision, what I want my servers to accept or reject. I even wrote my own Sendmail rules to refuse email from servers that lie about their HELO / EHLO, or, optionally, only accept from servers where the HELO / EHLO name resolves to the connecting IP. Add procmail to the mix, and now you can have rules than programmers can easily create and change. Another benefit is precise control of all of my email information. If I delete something, I can be sure it's deleted. It's my information, and I want to control it. Is my server (well, servers) really more secure than Google's or Microsoft's? Unambiguously yes. Microsoft only ever ends up in a state of relative security after long periods of trial-and-error while non-technical managers come up with design goals which are antithetical to security, bad things happen, then those same non-technical managers demand adding security as an afterthought. Google, I believe (and really, we never can know all that much), genuinely tries to get security right, but how many employees do they have? How many have access to private data? Take a clean, concise, easy to understand OS, install it on a non-x86, non-IPMI, non-VM computer, install a minimum of things to run only what it's intended to run, do so cleanly without extra cruft or OS specific idiosyncrasies, keep up to date with security vulnerability announcements, and colocate in a trustworthy place, and yes, my servers are definitely more secure than Google's or Microsoft's.

johnklos 9y ago

In most instances, you get what you pay for. I handle IP reputation by colocating with good, if somewhat conservative, colo providers. The most recent colo provider contacted me after placing my order to ask what services I intended to run, to match my provided address with WHOIS on the main domain I planned to use, and to ask me to explain the discrepancy between the IP from which I filled out their web form and my given address. Some people would be indignant about this. I certainly was not. I'd rather ALL people have to jump through many stupid hoops, myself included, than have a network where money is the only prerequisite to joining. That provider, if anyone is looking, is Turnkey Internet. They're definitely worth considering if you want to deal with real people. Once you have an address (or a new-to-you address), you have to break it in, so to speak. I did this by setting up reverse DNS (of course) which unambiguously matches the hostname, the primary IP, and the HELO / EHLO name given by the server. I then set up SMTP-auth so I could use it for little bits of email here and there. I did this for several weeks before I started increasing the volume. At the same time, I configured a long running server elsewhere to allow relaying from this machine and started sending email list traffic through the new server, which relayed through the long running server so that services like Google, Yahoo, Hotmail and others would get more exposure to the new server, albeit indirectly. I also took the time to proactively register the new server and IPs with anti-spam sites and blocklists. This usually involves providing proof that the contact information is real and works, but it helps lots. Barracuda gave problems - they listed my new IPs even after requesting delisting TWICE, but an email that got to a human fixed this more permanently. While frustrating at first, the fact that you can correspond with a human is always a good thing. After more than a month of this, I started sending directly from this new server. As anyone who has done it can tell you, running a mailman list these days is hardly trivial considering how quick most services are to consider mail lists spam. But regardless of how much time it takes, it's worth it to take the time, to be careful and deliberate. I've only had to do this four times in the last decade, but not rushing is always worth the extra energy. Of course, VPS IPs are often much more "beat up" and are usually considered undesirable neighborhoods, more so than colo networks. That's partly due to the more transient nature of VPSes. When you colocate, you're more invested, generally speaking, so you're more apt to keep the IP for many years.

nikofeyn 9y ago
i have some honest questions for you though. i write software daily yet don’t have much knowledge of what you have described here and have even less inkling to want to do any of that. so i think setting up an effective e-mail server is simply beyond the scope of nearly everyone. moving to the “cloud” isn’t some fad for e-mail, it’s just not everyone has the IT knowledge and even less want to have it. what is the real benefit beyond not having your e-mails crawled? is your server really more secure than google’s or microsoft’s?
- johnklos 9y ago
  Saying that setting up an email server is "simply beyond the scope of nearly everyone" is... Well, it's a bit sad, if you honestly believe that. At the same time, it's also pessimistic and disingenuous. It's disingenuous because you do a thing that some people might incorrectly generalize as, "simply beyond the scope of nearly everyone," even though we all know that there are lots of six year olds are learning Python. Granted, there are likely more six year olds learning Python than people in general learning from scratch to stand up email servers, but we both know that your characterization is quite stretched. So let me ask you, since your post carries a similar sentiment as many others: Why do you feel that you should express a dismissive opinion about the practice when you've also made it clear you have no inkling to want to do it? For your information, I set up a how-to to show people how to set up an email server from scratch. No, it's not wildly popular, but several people have used it and have written to thank me, so I don't agree in the least that it is "simply beyond the scope of nearly everyone," and I also have evidence that this is clearly not the case. To answer your questions, not having my emails crawled is just one benefit, but it's a very important one. Plenty of people say crazy and ignorant things like, "I have nothing to hide," not realizing that it's not about that - not even a tiny bit. If we dismiss the fundamental right to privacy because we have "nothing to hide" right now, we can't later on get privacy back. But, obviously, this isn't a concern of yours, and most people can't consider how the principle applies to historical lessons or how it applies to a possible path to totalitarianism. So what ARE the benefits? I mentioned that my email servers are deterministic. I can say with precision why a thing happened or didn't happen. Now it may be true that writing Sendmail rules is "simply beyond the scope of nearly everyone," programmers included, but the option is there to decide, again with precision, what I want my servers to accept or reject. I even wrote my own Sendmail rules to refuse email from servers that lie about their HELO / EHLO, or, optionally, only accept from servers where the HELO / EHLO name resolves to the connecting IP. Add procmail to the mix, and now you can have rules than programmers can easily create and change. Another benefit is precise control of all of my email information. If I delete something, I can be sure it's deleted. It's my information, and I want to control it. Is my server (well, servers) really more secure than Google's or Microsoft's? Unambiguously yes. Microsoft only ever ends up in a state of relative security after long periods of trial-and-error while non-technical managers come up with design goals which are antithetical to security, bad things happen, then those same non-technical managers demand adding security as an afterthought. Google, I believe (and really, we never can know all that much), genuinely tries to get security right, but how many employees do they have? How many have access to private data? Take a clean, concise, easy to understand OS, install it on a non-x86, non-IPMI, non-VM computer, install a minimum of things to run only what it's intended to run, do so cleanly without extra cruft or OS specific idiosyncrasies, keep up to date with security vulnerability announcements, and colocate in a trustworthy place, and yes, my servers are definitely more secure than Google's or Microsoft's.