3 ms·

No, it is not. It really grinds my gears if people are spreading misinformation about 'being on the same network as a spammer', 'indiscriminate blacklists' and

by LeonM 6y ago

No, it is not. It really grinds my gears if people are spreading misinformation about 'being on the same network as a spammer', 'indiscriminate blacklists' and corporate overlords for being the reason on why their email is not being delivered. Spam filters have been content driven for a long time now. IP addresses and domain names are ephemeral and so are 'blacklists'. With the amount of spam being send, we would have blacklisted the entire internet by now. If a spam filter gives false positives, it hurts the receiver just as much as the sender. The real problem with self-hosting is that the majority of self-hosted e-mail servers are terribly configured. Getting the SMTP server running is one thing, but getting DKIM, DMARC, SPF, TLS and MTA-STS running properly is often overlooked. What was the last time you checked the validity of the TLS certificate of your SMTP server? Get your server and domain setup properly. Sign your email with DKIM, setup an SPF and DMARC policy and perform DMARC monitoring to spot problems. Setup TLS and an MTA-STS policy service for your incoming email. Throw in SMTP-TLS-reporting for good measure. E-mail servers are not set-and-forget if you want to do it right. And this is not the fault of large corps, it's the spammers who got us in this situation. It's really easy to blame large services or blaming your email deliverability problems on being on the same IP block as a spammer, but really it's almost always a misconfiguration on your side. Disclaimer: I'm the founder of Mailhardener (https://www.mailhardener.com https://www.mailhardener.com), we do e-mail hardening and solve deliverability issues.

gravitas 6y ago
My corporate overlord (~10k ppl) has a policy to place all incoming email from domains less than 30 days old into the Junk folder, it's a tier 1 rule which cannot be overridden or circumvented by user rules. No amount of properly configured mail services will matter in this scenario. :-/
- judge2020 6y ago
  That's probably more of a phishing defense, but not really effective either way. 'Good' spammers will be constantly registering domains and only use the ones that are a few months old since time-based spam policies are fairly common. This type of policy only works for low-barrel spam and shady operations that register domains with stolen credit cards and end up losing their domain within a few weeks once the chargebacks get to the registrar.
  - gravitas 6y ago
    Yah, I do not defend it in any way - it's security theatre to me; they also wholescale block entire TLDs (more than one) under the same umbrella, block access (HTTP) to any domain less than 30 days old as well. It is in my experience that most companies of size implement compliance checkbox solutions and do not really care about internal user experience, you (me, we) are expendable and replaceable. Comply or face sanction/termination of employment, compliance is what matters to the business.

by LeonM 6y ago

gravitas 6y ago

My corporate overlord (~10k ppl) has a policy to place all incoming email from domains less than 30 days old into the Junk folder, it's a tier 1 rule which cannot be overridden or circumvented by user rules. No amount of properly configured mail services will matter in this scenario. :-/

judge2020 6y ago
That's probably more of a phishing defense, but not really effective either way. 'Good' spammers will be constantly registering domains and only use the ones that are a few months old since time-based spam policies are fairly common. This type of policy only works for low-barrel spam and shady operations that register domains with stolen credit cards and end up losing their domain within a few weeks once the chargebacks get to the registrar.
- gravitas 6y ago
  Yah, I do not defend it in any way - it's security theatre to me; they also wholescale block entire TLDs (more than one) under the same umbrella, block access (HTTP) to any domain less than 30 days old as well. It is in my experience that most companies of size implement compliance checkbox solutions and do not really care about internal user experience, you (me, we) are expendable and replaceable. Comply or face sanction/termination of employment, compliance is what matters to the business.