5 ms·

Ask HN: Trying to be more Gmail-independent with Gandi and email forwarding

10 points by deanmoriarty 8y ago

Hi, I heavily depend on Gmail and still plan on using it since I love the interface and the mobile app, but I don't want to risk the potential massive damages of Google deciding to inadvertently suspend my account for TOS violation, locking me out of my other 300+ accounts that depend on my email address. So, on top of doing periodic data exports with Google Takeout, I also did the following: 1) Registered "lastname.com" domain with Gandi (and enabled u2f authentication) 2) Setup email forwarding of "firstname@lastname.com" to my Gmail address in Gandi 3) Gradually plan on moving all my identity to "firstname@lastname.com", while using Gmail as backend The problem is, I don't like the email forwarding feature, it screws up SPF validations since now there is one mail server in the middle (the Gandi one) that forwards mail it isn't supposed to according to SPF, so all the emails forwarded to Gmail become essentially a SOFTFAIL/NEUTRAL/FAIL (and they show up as that). At the same time, I don't want to create a full mail account on Gandi and then enable the POP3 fetching from Gmail, because that feels very insecure (Gandi doesn't have 2FA/access auditing for mail accounts). If I want to stay in the Google ecosystem, do I really have to convert to GSuite? Any suggestion? Thanks

tarasmatsyk 8y ago
I have not heard about Gandi, added it to my list of useful products. Thanks for discovering. If you will be thinking about changing email service, here I've made a short review on most popular options: https://tarasmatsyk.com/posts/3-how-to-custom-email-address/ https://tarasmatsyk.com/posts/3-how-to-custom-email-address/ PS. There are more services which I review in next posts, currently most popular ones are covered.
OrWhyNot 8y ago
A few options: + Use another email service, such as Fastmail or GSuite (has Gmail!) + Get Gmail to do POP3. The password will only be exposed to Google, so the attack surface is low. + Set up an email filter in Gandi to forward to your Gmail.
scrollaway 8y ago
I used the setup you suggest for a long time. It's an excellent intermediary step but long term, I do recommend you move to either GSuite if you want to keep the gmail interface, or otherwise another provider such as fastmail. My primary Google account is now a GSuite (legacy) account, and my secondary one is a paid GSuite account. I honestly think that if you want to remain in the google ecosystem, paying for it is a generally good idea. $5/month is cheap.
- deanmoriarty 8y ago
  Thanks for your reply. Yes, I might decide to become a GSuite customer at some point (maybe soon). Since you say you used my setup for a long time, are you referring to the forwarding feature or the POP3 feature? If POP3: how did you deal with lack of security? If forwarding: how did you deal with basically all forwarded emails failing SPF validation when reaching the google server? Thanks
  - scrollaway 8y ago
    Forwarding. So, I haven't actually had the SPF issue you mention. I stopped using that setup about 2 years ago in favour of my proper gsuite account and I believe that, at some point since that time, Google's setup changed causing this difference in validation. I had heard of some setups being grandfathered in. I was at the time using the "additional account" email setting in gmail. So in the emails I would send, my @gmail.com would actually appear in the headers, even though the From: was my custom domain. I don't know if this setup is still available.
  - Samon 8y ago
    I actually use both. I use a POP3 enabled account on my hosting provider, but because Gmail only polls for new mail from external accounts on its own schedule (you can't specify the frequency, and when you're on the phone and someone says "I've emailed that through, is X correct?", waiting 5 or 15 minutes for it to appear in your inbox in Gmail isn't ideal, so I also have mail forwarding turned on. This means that for mail where the DKIM policy allows forwarding, you get the email almost instantly, but if the DKIM fails, you will still get it just a few minutes later. I've been doing it this way for years without an issue. I set a very strong password on my POP account (since I only have to enter it once into the Gmail interface to setup the account) and accept the security risk of no 2FA.
    - deanmoriarty 8y ago
      Thanks. What you are implying in your reply is that Google ignores its own SPF validation results for spam purposes/mail acceptance then? When you enable forwarding, even the emails that don't fail DKIM still show up in gmail with the SPF fail (under "Show Original"/"SPF"), and I'm sure they do in your setup as well since it's a logic consequence of doing the forwarding. I'm essentially trying to figure out if any of these conditions can happen with forwarding enabled: 1) SPF validation will fail, the Google mail server will refuse the forwarded message, so the Gandi mail server will bounce it back to the sender without me even knowing, rather than depositing it in the associated mailbox (especially with the domains set with SPF "-all", such as several of the financial institutions I use). So, no POP3 fallback even if it's enabled along with the forwarding. 2) SPF validation will fail, the Google mail server will still accept the forwarded message, but will be more inclined to mark it at spam. Thanks
vkaku 8y ago
I've already started moving stuff to GMX (Mail), SpiderOak (Drive), DDG (Search), !Chrome (Browser). Been on Android (non Google phone), trying to work without Google Play Services - contemplating switching to iOS or Jolla. I wish that Apple Maps/Here Maps were on more platforms.
- deanmoriarty 8y ago
  While admirable, I’m not there yet: let’s just say I don’t have a problem at the moment with Google reading all my activity (I like the ecosystem too much), as long as I can take out my data periodically (Takeout works well enough for me) and an account suspension wouldn’t mean me losing my email address for more than a few hours (which is what I’m trying to fix now).
isaack 8y ago
Does anyone have experience with getting their paid G Suite account locked? If paying them means that I can un-suspend my Google Account easily, I would be more than happy to shell out $5/month just for that privilege.
- scrollaway 8y ago
  In GSuite, you don't get your "account" locked because the account is the responsibility of the organization you sign up with. Now, you might get your organization kicked out as a customer if you really piss Google off (you'd have to do some pretty illegal shit I suspect). There's definitely less risk and more recourse as you would be able to talk to customer support should issues arise. I absolutely think that paying for GSuite is very much a way to "vote with your wallet" that you are willing to pay for support for a critical account.
jamieweb 8y ago
Is it normally quite easy to get your account unsuspended, or are there cases where it's an absolute final decision and you can't do anything? This is assuming that you didn't deliberately do anything bad/illegal, but maybe you accidentally violated the ToS or your test emails were detected as spam.
- deanmoriarty 8y ago
  I luckily never got my account suspended, but I've certainly done some minor violations of the TOS here and there (e.g. in college I downloaded a few copyrighted books and stored them in my Drive for my strictly personal consumption, and I'm sure those files could be fingerprinted and detected by Google, ...). From what I've heard, when it happens it's not quite easy to regain access, in the best case it takes many days, and the frustrating thing is that there's no support to which you can appeal to, you're mostly left to yourself (e.g. Google employees connections, twitter noise, ...). I find it silly that my electronic identity would be held hostage in such cases, so with an external domain I can flip a switch and keep receiving my email somewhere else.
  - jamieweb 8y ago
    I also primarily use a 'flip a switch' setup specifically for this reason. To be honest I think that using your own domain name is the only way to go these days, as even other email providers can have issues resulting in you being completely locked out. At least with a domain name you have multiple paths for recourse or regaining access should something go wrong (domain registrar, hosting provider, DNS provider, mail provider, etc). Now that I've moved to Cloudflare Registrar, I guess in some ways I've made it harder for myself should something go wrong, since my domain and DNS are now hosted in the same place.

10 points by deanmoriarty 8y ago

tarasmatsyk 8y ago

I have not heard about Gandi, added it to my list of useful products. Thanks for discovering. If you will be thinking about changing email service, here I've made a short review on most popular options: https://tarasmatsyk.com/posts/3-how-to-custom-email-address/ https://tarasmatsyk.com/posts/3-how-to-custom-email-address/ PS. There are more services which I review in next posts, currently most popular ones are covered.

OrWhyNot 8y ago

A few options: + Use another email service, such as Fastmail or GSuite (has Gmail!) + Get Gmail to do POP3. The password will only be exposed to Google, so the attack surface is low. + Set up an email filter in Gandi to forward to your Gmail.

scrollaway 8y ago

I used the setup you suggest for a long time. It's an excellent intermediary step but long term, I do recommend you move to either GSuite if you want to keep the gmail interface, or otherwise another provider such as fastmail. My primary Google account is now a GSuite (legacy) account, and my secondary one is a paid GSuite account. I honestly think that if you want to remain in the google ecosystem, paying for it is a generally good idea. $5/month is cheap.

deanmoriarty 8y ago
Thanks for your reply. Yes, I might decide to become a GSuite customer at some point (maybe soon). Since you say you used my setup for a long time, are you referring to the forwarding feature or the POP3 feature? If POP3: how did you deal with lack of security? If forwarding: how did you deal with basically all forwarded emails failing SPF validation when reaching the google server? Thanks
- scrollaway 8y ago
  Forwarding. So, I haven't actually had the SPF issue you mention. I stopped using that setup about 2 years ago in favour of my proper gsuite account and I believe that, at some point since that time, Google's setup changed causing this difference in validation. I had heard of some setups being grandfathered in. I was at the time using the "additional account" email setting in gmail. So in the emails I would send, my @gmail.com would actually appear in the headers, even though the From: was my custom domain. I don't know if this setup is still available.
- Samon 8y ago
  I actually use both. I use a POP3 enabled account on my hosting provider, but because Gmail only polls for new mail from external accounts on its own schedule (you can't specify the frequency, and when you're on the phone and someone says "I've emailed that through, is X correct?", waiting 5 or 15 minutes for it to appear in your inbox in Gmail isn't ideal, so I also have mail forwarding turned on. This means that for mail where the DKIM policy allows forwarding, you get the email almost instantly, but if the DKIM fails, you will still get it just a few minutes later. I've been doing it this way for years without an issue. I set a very strong password on my POP account (since I only have to enter it once into the Gmail interface to setup the account) and accept the security risk of no 2FA.
  - deanmoriarty 8y ago
    Thanks. What you are implying in your reply is that Google ignores its own SPF validation results for spam purposes/mail acceptance then? When you enable forwarding, even the emails that don't fail DKIM still show up in gmail with the SPF fail (under "Show Original"/"SPF"), and I'm sure they do in your setup as well since it's a logic consequence of doing the forwarding. I'm essentially trying to figure out if any of these conditions can happen with forwarding enabled: 1) SPF validation will fail, the Google mail server will refuse the forwarded message, so the Gandi mail server will bounce it back to the sender without me even knowing, rather than depositing it in the associated mailbox (especially with the domains set with SPF "-all", such as several of the financial institutions I use). So, no POP3 fallback even if it's enabled along with the forwarding. 2) SPF validation will fail, the Google mail server will still accept the forwarded message, but will be more inclined to mark it at spam. Thanks

vkaku 8y ago

I've already started moving stuff to GMX (Mail), SpiderOak (Drive), DDG (Search), !Chrome (Browser). Been on Android (non Google phone), trying to work without Google Play Services - contemplating switching to iOS or Jolla. I wish that Apple Maps/Here Maps were on more platforms.

deanmoriarty 8y ago
While admirable, I’m not there yet: let’s just say I don’t have a problem at the moment with Google reading all my activity (I like the ecosystem too much), as long as I can take out my data periodically (Takeout works well enough for me) and an account suspension wouldn’t mean me losing my email address for more than a few hours (which is what I’m trying to fix now).

isaack 8y ago

Does anyone have experience with getting their paid G Suite account locked? If paying them means that I can un-suspend my Google Account easily, I would be more than happy to shell out $5/month just for that privilege.

scrollaway 8y ago
In GSuite, you don't get your "account" locked because the account is the responsibility of the organization you sign up with. Now, you might get your organization kicked out as a customer if you really piss Google off (you'd have to do some pretty illegal shit I suspect). There's definitely less risk and more recourse as you would be able to talk to customer support should issues arise. I absolutely think that paying for GSuite is very much a way to "vote with your wallet" that you are willing to pay for support for a critical account.

jamieweb 8y ago

Is it normally quite easy to get your account unsuspended, or are there cases where it's an absolute final decision and you can't do anything? This is assuming that you didn't deliberately do anything bad/illegal, but maybe you accidentally violated the ToS or your test emails were detected as spam.

deanmoriarty 8y ago
I luckily never got my account suspended, but I've certainly done some minor violations of the TOS here and there (e.g. in college I downloaded a few copyrighted books and stored them in my Drive for my strictly personal consumption, and I'm sure those files could be fingerprinted and detected by Google, ...). From what I've heard, when it happens it's not quite easy to regain access, in the best case it takes many days, and the frustrating thing is that there's no support to which you can appeal to, you're mostly left to yourself (e.g. Google employees connections, twitter noise, ...). I find it silly that my electronic identity would be held hostage in such cases, so with an external domain I can flip a switch and keep receiving my email somewhere else.
- jamieweb 8y ago
  I also primarily use a 'flip a switch' setup specifically for this reason. To be honest I think that using your own domain name is the only way to go these days, as even other email providers can have issues resulting in you being completely locked out. At least with a domain name you have multiple paths for recourse or regaining access should something go wrong (domain registrar, hosting provider, DNS provider, mail provider, etc). Now that I've moved to Cloudflare Registrar, I guess in some ways I've made it harder for myself should something go wrong, since my domain and DNS are now hosted in the same place.