4 ms·

Honest and non-rhetorical question here: Have any of your customers had an e-mail they've tried to send not arrive because the recipient's system was using a bl

Honest and non-rhetorical question here: Have any of your customers had an e-mail they've tried to send not arrive because the recipient's system was using a black-hole list that, for some erroneous reason, had you blocked? If so, were you able to successfully communicate with and/or reasonably work through whatever issue got you black-holed? I haven't administered e-mail servers for 20 years, but back when I did, this started to be a problem that eventually became insurmountable. I used to manage a small business oriented ISP. We were multi-homed with a /18 that we used for everything. I had a customer that was a reasonably sized organization that dealt with tourism and conventions for a major city. On one of their websites, (which we hosted with IPs that came out of the same /18 as their mail server,) they had a directory of vendors who were associated with them. ONE of those members had a website that had been hacked/defaced. This got our entire /18 on a blac-khole list. They had an employee that was trying to send e-mail to someone on a system that was using this black-hole server to filter spam. When we explained to them what the problem was, we got glassy-eyed stares back at us and a, "just fix it." I told them that, they would need to remove the link to their partner's site from their website in order to get them AND all of our other customers using numbers inside our /18 de-listed from this particular black-hole. They asked, "We have hundreds of partners who pay for membership in our organization and being listed on our website is one of the benefits. How can we possibly police every one of those websites every day to make sure there's no defacement or serving of any problematic material from any URL in any of those domains?" That's a decent argument in my opinion. And I tried to explain that different black-holes have different policies and no black-hole is demanding that anyone use their system for filtering. I tired contacting the organization that was using that black-hole to explain the situation to them, but they weren't interested in discussing it. As far as they were concerned it was our problem to deal with. This kind of problem happened dozens of times with varying degrees of severity but with increasing regularity and it was one of the primary reasons we quit hosting e-mail and started re-selling another vendor's solution. That was a long time ago, and maybe black-hole lists aren't a thing anymore.

belorn 5y ago
(Running a email system for a few thousand users) > If so, were you able to successfully communicate with and/or reasonably work through whatever issue got you black-holed? Yes. Practically all black-lists have a de-list form that one can use, and most seem to auto-delist fairly fast as soon they don't get any more reports from honey-trap and other sources. We do have a few custom written ways to detect hacked accounts, and we don't allow users to set their own passwords. We also tend to discourage/deny users who do newsletters and other "higher risk" form of email. All emails sent by websites is sent through different servers, which also mean that a hacked website does not impact the reputation of the email servers. Events with black lists maybe occur once a year and as I mentioned above, fixed fairly fast. One good tip is to keep an automated eye on the mail queue and react quickly when things start to look wrong.
- ananonymoususer 5y ago
  It's better now, but in the early days of organized blacklists (more than 20 years ago) it was somewhat chaotic. Many large ISPs ran their own blacklists and some were poorly managed. AOL was the worst of them all. Their admin staff was unprofessional and unresponsive when I provided a PoC for their defective spam control system. There are a few sites where you can plug in an IP address to see if it's on any blacklists. A handy thing to do before setting up a new server is to work with your provider to find a clean IP address beforehand. Here's one that I have used: https://mxtoolbox.com/blacklists.aspx https://mxtoolbox.com/blacklists.aspx
  - NetOpWibby 5y ago
    Thanks for the link, I see my email server is on a few lists. I’ve heard that DigitalOcean isn’t good for email servers but I’ve been lax on investigating. Now I have incentive, this is annoying. Maybe I need a static IP as well.
xyzzy_plugh 5y ago
For what it's worth I've run into the same set of issues at corporations using Google and Microsoft's hosted offerings. Hell, sometimes you can't even send it mail between customers!
kortilla 5y ago
That question seems completely unrelated to running a personal mail server?
denton-scratch 5y ago
> Have any of your customers had an e-mail they've tried to send not arrive because the recipient's system was using a black-hole list [...] ? Yes. Twice. In the first case, the mail provider was our ISP; and they got themselves in some mainstream blacklists. The problems getting that sorted out were part of the motivation for bringing mail in-house. In the second case, there was some academic departmental mailserver and they were using some list incorrectly; using an extremely-opinionated list to block when it should at best be used to score. This wasn't in itself a big deal, but one of my boss's correspondents was a senior professor in this department and they had some important business; and the postmaster was a dick, and wouldn't help. Boss didn't want to use some secondary email address; I had to show him how to set up an alias on some commercial server, which was second-best, but he was in a hurry. Boss was angry with me and barked at me. If you run a mailserver for some group, one you assembled yourself, then people expect you to take responsibility for sorting out any mail problems. Well, they're right: you have taken on that responsibility. You made it, and you're running it: who else can they complain to? [Edit] My point is that it's not hard to set up an artisan mail system; what's hard is that you create a job for yourself that is at the same time networking, user-facing, and technical. It's an interesting learning point, and I recommend it. But don't underestimate what you are taking on.
- lostlogin 5y ago
  > Well, they're right: you have taken on that responsibility. You made it, and you're running it: who else can they complain to? Assuming logic applies to humans is painfully wrong. I wish it wasn’t.
- bsder 5y ago
  > [Edit] My point is that it's not hard to set up an artisan mail system; what's hard is that you create a job for yourself that is at the same time networking, user-facing, and technical. It's an interesting learning point, and I recommend it. But don't underestimate what you are taking on. This. So much this. I will happily run my "artisinal" mail system for myself. Would I put customers on it? Oh, hell, no. I, sadly, always recommend that companies pay money to Microsoft for email. You are really paying for the customer support service rather than the email service.

belorn 5y ago

(Running a email system for a few thousand users) > If so, were you able to successfully communicate with and/or reasonably work through whatever issue got you black-holed? Yes. Practically all black-lists have a de-list form that one can use, and most seem to auto-delist fairly fast as soon they don't get any more reports from honey-trap and other sources. We do have a few custom written ways to detect hacked accounts, and we don't allow users to set their own passwords. We also tend to discourage/deny users who do newsletters and other "higher risk" form of email. All emails sent by websites is sent through different servers, which also mean that a hacked website does not impact the reputation of the email servers. Events with black lists maybe occur once a year and as I mentioned above, fixed fairly fast. One good tip is to keep an automated eye on the mail queue and react quickly when things start to look wrong.

ananonymoususer 5y ago
It's better now, but in the early days of organized blacklists (more than 20 years ago) it was somewhat chaotic. Many large ISPs ran their own blacklists and some were poorly managed. AOL was the worst of them all. Their admin staff was unprofessional and unresponsive when I provided a PoC for their defective spam control system. There are a few sites where you can plug in an IP address to see if it's on any blacklists. A handy thing to do before setting up a new server is to work with your provider to find a clean IP address beforehand. Here's one that I have used: https://mxtoolbox.com/blacklists.aspx https://mxtoolbox.com/blacklists.aspx
- NetOpWibby 5y ago
  Thanks for the link, I see my email server is on a few lists. I’ve heard that DigitalOcean isn’t good for email servers but I’ve been lax on investigating. Now I have incentive, this is annoying. Maybe I need a static IP as well.

xyzzy_plugh 5y ago

For what it's worth I've run into the same set of issues at corporations using Google and Microsoft's hosted offerings. Hell, sometimes you can't even send it mail between customers!

kortilla 5y ago

That question seems completely unrelated to running a personal mail server?

denton-scratch 5y ago

> Have any of your customers had an e-mail they've tried to send not arrive because the recipient's system was using a black-hole list [...] ? Yes. Twice. In the first case, the mail provider was our ISP; and they got themselves in some mainstream blacklists. The problems getting that sorted out were part of the motivation for bringing mail in-house. In the second case, there was some academic departmental mailserver and they were using some list incorrectly; using an extremely-opinionated list to block when it should at best be used to score. This wasn't in itself a big deal, but one of my boss's correspondents was a senior professor in this department and they had some important business; and the postmaster was a dick, and wouldn't help. Boss didn't want to use some secondary email address; I had to show him how to set up an alias on some commercial server, which was second-best, but he was in a hurry. Boss was angry with me and barked at me. If you run a mailserver for some group, one you assembled yourself, then people expect you to take responsibility for sorting out any mail problems. Well, they're right: you have taken on that responsibility. You made it, and you're running it: who else can they complain to? [Edit] My point is that it's not hard to set up an artisan mail system; what's hard is that you create a job for yourself that is at the same time networking, user-facing, and technical. It's an interesting learning point, and I recommend it. But don't underestimate what you are taking on.

lostlogin 5y ago
> Well, they're right: you have taken on that responsibility. You made it, and you're running it: who else can they complain to? Assuming logic applies to humans is painfully wrong. I wish it wasn’t.
bsder 5y ago
> [Edit] My point is that it's not hard to set up an artisan mail system; what's hard is that you create a job for yourself that is at the same time networking, user-facing, and technical. It's an interesting learning point, and I recommend it. But don't underestimate what you are taking on. This. So much this. I will happily run my "artisinal" mail system for myself. Would I put customers on it? Oh, hell, no. I, sadly, always recommend that companies pay money to Microsoft for email. You are really paying for the customer support service rather than the email service.