7 ms·

I have been managing my own mail server for 6 years now, and enabling and configuring all the mail security features (DKIM, SPF, etc), and keeping up with them,

by lqet 6y ago

I have been managing my own mail server for 6 years now, and enabling and configuring all the mail security features (DKIM, SPF, etc), and keeping up with them, is indeed the most difficult part. I regularly check my mail server against tools like this: https://mxtoolbox.com/diagnostic.aspx https://mxtoolbox.com/diagnostic.aspx. If you just do one thing wrong, you will end up on some black list from which it is very difficult to get off. So far, I did not have any major problems, but after the initial default installation of Postfix in 2014, all my test mails to Google Mail went straight to Junk. My server is at Hetzner, and there are some blacklists which block Hetzner IPs by default. You have to contact them, explain that your server is not a spam server, and hope to get whitelisted. In my case, it worked. T-Online in Germany also blocked my IP as well, but they were amazingly quick to whitelist it after I send them an email. They apologized and explained that they also block mail from Hetzner IPs by default.

windexh8er 6y ago
This. So many people don't take the 10 minutes to configure DMARC, DKIM and SPF. I've been hosting my own domains since 1996 and I haven't ever had a problem with any of them sending mail to any of the big hosters. If your DMARC passes and you actually have a policy set to REJECT you're almost guaranteed to not have a problem as long as your domain isn't a few days old. The first thing I do for any new domain I plan to use is get all of those items configured ASAP and start sending mail into Google and O365 to test and thereby end up in their domain analysis. Given all the horror stories I've moved all but one domain off of Gmail (mainly to preserve my grandfathered G-Suite. I don't use `@ gmail dot com` for anything other than Google services. And if you are using GMail back it up! MailArchiva [0] is free for less than 10 mailboxes and works well. In this regard at least you still have access to your mail and can possibly prove something if those emails contain any identifying information (hopefully not, but you never know what will help). If your email is that important to you then don't run it for free. Pay for someone to host it - I've been more than happy with Fastmail for many years and also use paid for ProtonMail accounts with custom domains. At the end of the day if you don't control the domain and don't pay for the service I don't feel like I can trust the provider to do the right thing or expect any level of support. Bring email back from the monopolized "free" tier! [0] https://mailarchiva.com/ https://mailarchiva.com/
- mbeex 6y ago
  > So many people don't take the 10 minutes to configure DMARC, DKIM and SPF. Another commentator here mentioned this and the hint was worth gold. In the meantime, I changed/adjusted this in the interface of my website provider (I am also using his SMTP server) and solved an actual problem of this kind immediately (maybe also explaining the shortcomings in the past). In general, I would admit that it is not a compelling excuse not to know something. The problem is, that I was not even aware of these keywords and after looking them up, I seemingly solved things quickly and - hopefully - permanently. People just don't constantly check all things. Especially with long term reliable services with rare, subtle and not obvious (in this case without any hint) errors.
- npsimons 6y ago
  > So many people don't take the 10 minutes to configure DMARC, DKIM and SPF. Having just done this recently, it's more than 10 minutes, especially if it's your first time. But yes, everyone should be doing it, as well as doing their best to get off of blacklists[0]. Still doesn't stop incompetents like MS mail admins (so, @hotmail.com, @msn.com, @live.com and @outlook.com) from keeping their own internal blocklists, that you can't get off of, no matter how many times you fill out their form[1]. [0] http://multirbl.valli.org/dnsbl-lookup/ http://multirbl.valli.org/dnsbl-lookup/ [1] https://support.microsoft.com/en-us/supportrequestform/8ad563e3-288e-2a61-8122-3ba03d6b8d75 https://support.microsoft.com/en-us/supportrequestform/8ad56...
- deleted 6y ago
  [deleted]
- mlindner 6y ago
  > So many people don't take the 10 minutes to configure DMARC, DKIM and SPF. Considering I've actually never heard of any of those things despite multiple people telling me to set up a mail server. I'm not sure why you're surprised.

by lqet 6y ago

windexh8er 6y ago

This. So many people don't take the 10 minutes to configure DMARC, DKIM and SPF. I've been hosting my own domains since 1996 and I haven't ever had a problem with any of them sending mail to any of the big hosters. If your DMARC passes and you actually have a policy set to REJECT you're almost guaranteed to not have a problem as long as your domain isn't a few days old. The first thing I do for any new domain I plan to use is get all of those items configured ASAP and start sending mail into Google and O365 to test and thereby end up in their domain analysis. Given all the horror stories I've moved all but one domain off of Gmail (mainly to preserve my grandfathered G-Suite. I don't use `@ gmail dot com` for anything other than Google services. And if you are using GMail back it up! MailArchiva [0] is free for less than 10 mailboxes and works well. In this regard at least you still have access to your mail and can possibly prove something if those emails contain any identifying information (hopefully not, but you never know what will help). If your email is that important to you then don't run it for free. Pay for someone to host it - I've been more than happy with Fastmail for many years and also use paid for ProtonMail accounts with custom domains. At the end of the day if you don't control the domain and don't pay for the service I don't feel like I can trust the provider to do the right thing or expect any level of support. Bring email back from the monopolized "free" tier! [0] https://mailarchiva.com/ https://mailarchiva.com/

mbeex 6y ago
> So many people don't take the 10 minutes to configure DMARC, DKIM and SPF. Another commentator here mentioned this and the hint was worth gold. In the meantime, I changed/adjusted this in the interface of my website provider (I am also using his SMTP server) and solved an actual problem of this kind immediately (maybe also explaining the shortcomings in the past). In general, I would admit that it is not a compelling excuse not to know something. The problem is, that I was not even aware of these keywords and after looking them up, I seemingly solved things quickly and - hopefully - permanently. People just don't constantly check all things. Especially with long term reliable services with rare, subtle and not obvious (in this case without any hint) errors.
npsimons 6y ago
> So many people don't take the 10 minutes to configure DMARC, DKIM and SPF. Having just done this recently, it's more than 10 minutes, especially if it's your first time. But yes, everyone should be doing it, as well as doing their best to get off of blacklists[0]. Still doesn't stop incompetents like MS mail admins (so, @hotmail.com, @msn.com, @live.com and @outlook.com) from keeping their own internal blocklists, that you can't get off of, no matter how many times you fill out their form[1]. [0] http://multirbl.valli.org/dnsbl-lookup/ http://multirbl.valli.org/dnsbl-lookup/ [1] https://support.microsoft.com/en-us/supportrequestform/8ad563e3-288e-2a61-8122-3ba03d6b8d75 https://support.microsoft.com/en-us/supportrequestform/8ad56...
deleted 6y ago
[deleted]
mlindner 6y ago
> So many people don't take the 10 minutes to configure DMARC, DKIM and SPF. Considering I've actually never heard of any of those things despite multiple people telling me to set up a mail server. I'm not sure why you're surprised.