8 ms·

Let's see... Postfix, Dovecot, SPF and OpenDKIM on the server-side, each of them with their own config. Then you've got to set up your domain, and domain heade

Let's see... Postfix, Dovecot, SPF and OpenDKIM on the server-side, each of them with their own config. Then you've got to set up your domain, and domain headers on your domain host. Oh, DMARC is also another thing. Then, most ISPs will outright refuse to accept incoming mail from your IP address, since they've basically changed from blacklisting to whitelisting. So you've also got to relay your outgoing mail via your domain host. And then spam rules. I took the recommended rules from the Debian/Postfix/something-something-sorbs.net website, and I rarely receive email from e.g. eBay, because they've been marked as sending spam. Often happens with gmail addresses, too. Despite all this... I still run my own mail server, but hotdamn, you're calling this not hard? EDIT: Oh, and nowdays you've also got to entangle your TLS certificates into the whole process somehow. I managed it, but don't ask me how, I'd need to read up on that.

swiley 7y ago
I run my own mail server and as long as you use TLS and the one that’s really easy (I can’t remember if it’s DKim or Dmark) most domains accept mail from you. I really didn’t have a hard time setting mine up and I’ve done it multiple times. Dovecot is a bit of a pain if you really want imap... but overall none of it is harder than most other things.
- xienze 7y ago
  > most domains accept mail from you. And this is precisely why I don’t think it’s worth it. I don’t want to have to worry that “most” domains will accept my mail, I want a big email service that has the clout to force domains to accept my mail. I shouldn’t have to solve the mystery of why my mail was rejected (or rather, why some provider thinks I’m sending spam). That’s why I do Fastmail.
  - danShumway 7y ago
    What do you use for automated messages (ie, login emails, password resets)? I asked Fastmail support, and they basically said, "we're not really built for that." However, most of the other services I looked at had arduous terms (arbitration agreements), and even they were talking about delivery rates in ranges of 85-95%. My takeaway has been that as an app creator, email is really unreliable, and I should try whenever possible not to make it a critical part of anything I build. If 5-10% of the people using your service can't get a password reset email, what do you do? As someone without much experience with email of that nature, it doesn't seem like the major services actually solve the deliverability problem. If they have Google-style support where I can't get one of them on the phone if my emails aren't sending, then I might even be worse off using them rather than my own setup that I can at least debug and experiment with.
    - bauerd 7y ago
      Keyword is transactional email. I've good experience with Postmark, Sendgrid and Mailgun. Not affiliated, but never had delivery problems
    - xienze 7y ago
      Sorry, to be clear I was talking about personal email. But as another poster said, there are plenty of services that provide transactional email.
andrerm 7y ago
And Postifx is not just one thing, it's: smtp, smtps, submission, relay etc... And Dovecot: pop3, pop3s, imap, imaps, lmtp, passdb, userdb, sql, ldap, seive etc. Look, I don't want Google changing this tomorrow because to something tied to and controlled by them because they don't do evel, isn't faster or people like it, but please, don't say it's not hard because you will be misleading people for sure Edit: to be crystal clear, I agree with parent but don't agree with op
- klingonopera 7y ago
  Yes... and ooof! And then there's also the password/username database, that defaults to tying into the Linux pass/user database, so if you want to set up some custom login-data... ugh, I don't even want to think about it. I set it up once, maintain it here and then, and am keeping it, because dismantling the system is more work than maintaining it presently, but seriously... with the above setup, do it only for educational purposes. ...I'm guessing I spent a week or so properly setting everything up. ...but I'm also willing to try a universal, one-size-fits-all program, if anyone knows anything for Debian?
  - zepearl 7y ago
    I used to run postfix/ssmtp/etc on Gentoo. From time to time, when updating the single components, something stopped working and then I had to quickly debug and find a fix. In the end it was too much time-consuming for me to maintain. I then decided to search for a big-monolithic-do-it-all-solution (from a SW-perspective) and the only option I found was Xeams ( https://www.xeams.com/Xeams.htm https://www.xeams.com/Xeams.htm ) - I didn't find anything open-source. I'm using it (the free variant) since 2017 and it works. Runs on Java, provides all services (smtp, pop3, imap), has greylisting, has embedded user administration, users can have email-aliases, has a web-admin-UI, 1-click-sw-updates, etc... .
  - simpss 7y ago
    i've been following these since lenny, https://workaround.org/ispmail https://workaround.org/ispmail pretty much a set & forget solution. He also writes a new one with all-you-need-to-know extras every time a stable release of debian comes out.
gingerlime 7y ago
And if you try to host it on Digital Ocean, they actually block port 25 out, so you're out of luck... And you have to manage diskspace, backups, firewall/fail2ban, OS updates etc etc etc I'm in the same boat as you. Managed to grind my teeth and pull through something like this for my own use and family, but it was painful.
- AviationAtom 7y ago
  Pretty sure a message to them stating your intended use will result in the block being lifted
- Kwpolska 7y ago
  I've got a mail server on DigitalOcean. Just tested and port 25 works fine. The internet says you can get the restriction lifted after 60 days: https://github.com/3s3s/opentrade/issues/136#issuecomment-428072756 https://github.com/3s3s/opentrade/issues/136#issuecomment-42...
- muppetman 7y ago
  I run my primary mailserver on DigitalOcean. It seems to work fine. I think you have to have either your account, or the Droplet, active for 30+ days before they'll let you have port 25 open.
  - gingerlime 7y ago
    Last time I asked they categorically said they won’t open port 25. I think really old droplets might have had them open though. I guess they grandfathered these in
beams_of_light 7y ago
Trying to avoid the landmines of blacklisting is really the biggest peril in all of it. I refuse to move a company I support away from GSuite to self-hosted, because I have a high level of confidence that just one person sending a lot of mail to another person outside the company could result in our domain ending up in RBLs, which is very difficult to reverse. Running a mail server in 2019 is not something I need the headache of.
- bt848 7y ago
  That's amusing because the bigs all ignore RBLs. RBLs are only used by the little operators.
  - spc476 7y ago
    And RBLs aren't that great. I visited this in January of 2018 [1] and in my case (where I do greylisting [2][3]but nothing else for spam) it wouldn't help. [1] http://boston.conman.org/2018/01/10.1 http://boston.conman.org/2018/01/10.1 [2] https://en.wikipedia.org/wiki/Greylisting https://en.wikipedia.org/wiki/Greylisting [3] And yes, I do run my own server. It's just for me, so I have no issues with "customer requests" and I've been using the same IP address for about a decade (maybe more). Then again, I've been running my own email sever since 1998.
pas 7y ago
https://mailinabox.email/ https://mailinabox.email/ does everything and more. Of course, this doesn't make it easy. You still need to do more things than were you to simply use protonmail/fastmail/etc.
kbwt 7y ago
And upgrade your server software within hours of vulnerabilities being published if you want to stay secure: https://www.openwall.com/lists/oss-security/2019/08/28/3 https://www.openwall.com/lists/oss-security/2019/08/28/3

swiley 7y ago

I run my own mail server and as long as you use TLS and the one that’s really easy (I can’t remember if it’s DKim or Dmark) most domains accept mail from you. I really didn’t have a hard time setting mine up and I’ve done it multiple times. Dovecot is a bit of a pain if you really want imap... but overall none of it is harder than most other things.

xienze 7y ago
> most domains accept mail from you. And this is precisely why I don’t think it’s worth it. I don’t want to have to worry that “most” domains will accept my mail, I want a big email service that has the clout to force domains to accept my mail. I shouldn’t have to solve the mystery of why my mail was rejected (or rather, why some provider thinks I’m sending spam). That’s why I do Fastmail.
- danShumway 7y ago
  What do you use for automated messages (ie, login emails, password resets)? I asked Fastmail support, and they basically said, "we're not really built for that." However, most of the other services I looked at had arduous terms (arbitration agreements), and even they were talking about delivery rates in ranges of 85-95%. My takeaway has been that as an app creator, email is really unreliable, and I should try whenever possible not to make it a critical part of anything I build. If 5-10% of the people using your service can't get a password reset email, what do you do? As someone without much experience with email of that nature, it doesn't seem like the major services actually solve the deliverability problem. If they have Google-style support where I can't get one of them on the phone if my emails aren't sending, then I might even be worse off using them rather than my own setup that I can at least debug and experiment with.
  - bauerd 7y ago
    Keyword is transactional email. I've good experience with Postmark, Sendgrid and Mailgun. Not affiliated, but never had delivery problems
  - xienze 7y ago
    Sorry, to be clear I was talking about personal email. But as another poster said, there are plenty of services that provide transactional email.

andrerm 7y ago

And Postifx is not just one thing, it's: smtp, smtps, submission, relay etc... And Dovecot: pop3, pop3s, imap, imaps, lmtp, passdb, userdb, sql, ldap, seive etc. Look, I don't want Google changing this tomorrow because to something tied to and controlled by them because they don't do evel, isn't faster or people like it, but please, don't say it's not hard because you will be misleading people for sure Edit: to be crystal clear, I agree with parent but don't agree with op

klingonopera 7y ago
Yes... and ooof! And then there's also the password/username database, that defaults to tying into the Linux pass/user database, so if you want to set up some custom login-data... ugh, I don't even want to think about it. I set it up once, maintain it here and then, and am keeping it, because dismantling the system is more work than maintaining it presently, but seriously... with the above setup, do it only for educational purposes. ...I'm guessing I spent a week or so properly setting everything up. ...but I'm also willing to try a universal, one-size-fits-all program, if anyone knows anything for Debian?
- zepearl 7y ago
  I used to run postfix/ssmtp/etc on Gentoo. From time to time, when updating the single components, something stopped working and then I had to quickly debug and find a fix. In the end it was too much time-consuming for me to maintain. I then decided to search for a big-monolithic-do-it-all-solution (from a SW-perspective) and the only option I found was Xeams ( https://www.xeams.com/Xeams.htm https://www.xeams.com/Xeams.htm ) - I didn't find anything open-source. I'm using it (the free variant) since 2017 and it works. Runs on Java, provides all services (smtp, pop3, imap), has greylisting, has embedded user administration, users can have email-aliases, has a web-admin-UI, 1-click-sw-updates, etc... .
- simpss 7y ago
  i've been following these since lenny, https://workaround.org/ispmail https://workaround.org/ispmail pretty much a set & forget solution. He also writes a new one with all-you-need-to-know extras every time a stable release of debian comes out.

gingerlime 7y ago

And if you try to host it on Digital Ocean, they actually block port 25 out, so you're out of luck... And you have to manage diskspace, backups, firewall/fail2ban, OS updates etc etc etc I'm in the same boat as you. Managed to grind my teeth and pull through something like this for my own use and family, but it was painful.

AviationAtom 7y ago
Pretty sure a message to them stating your intended use will result in the block being lifted
Kwpolska 7y ago
I've got a mail server on DigitalOcean. Just tested and port 25 works fine. The internet says you can get the restriction lifted after 60 days: https://github.com/3s3s/opentrade/issues/136#issuecomment-428072756 https://github.com/3s3s/opentrade/issues/136#issuecomment-42...
muppetman 7y ago
I run my primary mailserver on DigitalOcean. It seems to work fine. I think you have to have either your account, or the Droplet, active for 30+ days before they'll let you have port 25 open.
- gingerlime 7y ago
  Last time I asked they categorically said they won’t open port 25. I think really old droplets might have had them open though. I guess they grandfathered these in

beams_of_light 7y ago

Trying to avoid the landmines of blacklisting is really the biggest peril in all of it. I refuse to move a company I support away from GSuite to self-hosted, because I have a high level of confidence that just one person sending a lot of mail to another person outside the company could result in our domain ending up in RBLs, which is very difficult to reverse. Running a mail server in 2019 is not something I need the headache of.

bt848 7y ago
That's amusing because the bigs all ignore RBLs. RBLs are only used by the little operators.
- spc476 7y ago
  And RBLs aren't that great. I visited this in January of 2018 [1] and in my case (where I do greylisting [2][3]but nothing else for spam) it wouldn't help. [1] http://boston.conman.org/2018/01/10.1 http://boston.conman.org/2018/01/10.1 [2] https://en.wikipedia.org/wiki/Greylisting https://en.wikipedia.org/wiki/Greylisting [3] And yes, I do run my own server. It's just for me, so I have no issues with "customer requests" and I've been using the same IP address for about a decade (maybe more). Then again, I've been running my own email sever since 1998.

pas 7y ago

https://mailinabox.email/ https://mailinabox.email/ does everything and more. Of course, this doesn't make it easy. You still need to do more things than were you to simply use protonmail/fastmail/etc.

kbwt 7y ago

And upgrade your server software within hours of vulnerabilities being published if you want to stay secure: https://www.openwall.com/lists/oss-security/2019/08/28/3 https://www.openwall.com/lists/oss-security/2019/08/28/3