10 ms·

Spam blocklists are run by an unaccountable cowboy cult that somehow has managed to consolidate a ton of power simply for the fact that most people who run emai

Spam blocklists are run by an unaccountable cowboy cult that somehow has managed to consolidate a ton of power simply for the fact that most people who run email inbox services didn't want to deal with the problem of spam, so they were more than willing to just hand over anti-spam "enforcement" to anyone who was allegedly doing "what was best for the internet." There's no check on these people who run these blacklists, and the system they've built is entirely a black box, antithetical to the principles of the open internet. And if you're not a huge corporation that can afford professional management of your email deliverability, good luck – the individuals and small organizations are just out of luck. It's a miserable racket and for what? If you want to know why there's a new thread each week on HN about why it's impossible to host your own email service, this is why.

multjoy 5y ago
So what's the alternative? SBLs work, clearly, and almost every mail host, in the absence of distributed list, would work up their own lists in short order.
- ILMostro7 5y ago
  Choose your SBL better; spend some time reading about it (doesn't have to be much) or testing it before blindly enabling it.
convolvatron 5y ago
no. its because of spam. just because these people are doing a less than perfect job of keeping the screaming hordes out of my inbox doesn't remove any of the blame from the hordes.
- pixl97 5y ago
  It's been years since I last hosted my own mail server, and even then the HAM to SPAM ratio was well over 1:100. The torrent of absolute crap faced at port 25 is unbelievable.
istillwritecode 5y ago
Let's not classify all spam blacklists as the same. UCEPROTECT is in a special class of extortionist cowboy, because it's basically just an inaccurate protection racket throwing a wide net across cloud providers who won't play their game. Some other blacklists are updated regularly and only contain IP addresses that have actually sent spam. By contrast, UCEPROTECT3 just lumps ISPs into the list even though an address has never sent spam. I run a mail server on AWS, and we use some blacklists to drop mail. It's quite effective and that's why people keep using them. A properly curated blacklist is a powerful tool, and more accurate than the machine learning mush that people have come to rely upon.
- yosamino 5y ago
  > CEPROTECT3 just lumps ISPs into the list even though an address has never sent spam. But this is by design[0] > This blacklist has been created for HARDLINERS. It can, and probably will cause collateral damage to innocent users when used to block email. And it makes for a perfectly usable blocklist. If you use postfix, the postscreen_dnsbl_threshold and postscreen_dnsbl_sites parameters let you create a simple scoring system: postscreen_dnsbl_threshold = 10 postscreen_dnsbl_sites = zen.spamhaus.org*5, bl.spameatingmonkey.net*5, dnsbl.sorbs.net*4, bl.spamcop.net*4, dnsbl-3.uceprotect.net*3 I made up the numbers, because you will need to monitor your system for a while to see if they make sense, but the principle holds. Also make sure that the dnsbl you are using are working for you. But it isn't really a problem with uceprotect, it's about how DNSBLs are used. [0] https://www.uceprotect.net/en/index.php?m=3&s=5 https://www.uceprotect.net/en/index.php?m=3&s=5 [1] http://www.postfix.org/postconf.5.html#postscreen_dnsbl_sites http://www.postfix.org/postconf.5.html#postscreen_dnsbl_site...
- Cadwhisker 5y ago
  I also run an email server. I just used https://mxtoolbox.com/ https://mxtoolbox.com/ to check my status and yep, UCEPROTECTL3 is the ONLY one to have my IP range listed. The article sums it up nicely: IP blacklists have their place, however, please don’t use the overarching neighbouring blacklists such as UCEPROTECTL2 and UCEPROTECTL3.
- Beltalowda 5y ago
garbagecoder 5y ago
Still better than the alternative
Godel_unicode 5y ago
> antithetical to the principles of the open internet. No. These blocklists are employed by the actor receiving the email. They have a perfect right, even on "the open internet", to decide that they want to limit who can send them messages. There are tons of checks on the people who provide those blacklists, in the form of their users complaining about lack of mail delivery and ultimately not using their list anymore. We vote with our wallets, and as a group we have decided that these blocklists are useful. > and for what? To make email usable. Full stop.
- Underphil 5y ago
  Absolutely agree. This doesn't fall under the principles of the open internet nor anything in the 'net neutrality' arena. You have no right to expect anyone to receive traffic from your server if they choose not to. It's a major pitfall of running your own relay, but it's not unethical.
  - samtuke 5y ago
    Unfortunately 50% of the world's mailboxes are hosted by 2 companies. That means the open internet is far as email goes is already dead in practical terms for most people. When they block another host that host no longer has email network access.
- josephcsible 5y ago
  > These blocklists are employed by the actor receiving the email. If I send an email to alice@example.com, Alice is the recipient, not Bob the sysadmin for example.com.
  - Godel_unicode 5y ago
    This is incorrect. The service you are sending the mail to (example.com in this case) is receiving that mail. They are then delivering it to the user, or not, depending on the agreement they have with the user. If example.com and a user of example.com have agreed that example.com is responsible for providing spam filtering, then they would be remiss in delivering the email to their customer. This is the way that email is designed to work and the fact that users and service providers have choice is a feature, not a bug. If you don't want your service provider to do this type of filtering, that is your choice. But you have absolutely no right to say that Alice can't get the service she wants from example.com because it's inconvenient for you. Edit: and just to head off the inevitable "but what about if it's at work and I can't change providers", the domain and email accounts belong to your employer, not you. You are welcome to work somewhere else if you don't like how they configure their systems.

multjoy 5y ago

So what's the alternative? SBLs work, clearly, and almost every mail host, in the absence of distributed list, would work up their own lists in short order.

ILMostro7 5y ago
Choose your SBL better; spend some time reading about it (doesn't have to be much) or testing it before blindly enabling it.

convolvatron 5y ago

no. its because of spam. just because these people are doing a less than perfect job of keeping the screaming hordes out of my inbox doesn't remove any of the blame from the hordes.

pixl97 5y ago
It's been years since I last hosted my own mail server, and even then the HAM to SPAM ratio was well over 1:100. The torrent of absolute crap faced at port 25 is unbelievable.

istillwritecode 5y ago

Let's not classify all spam blacklists as the same. UCEPROTECT is in a special class of extortionist cowboy, because it's basically just an inaccurate protection racket throwing a wide net across cloud providers who won't play their game. Some other blacklists are updated regularly and only contain IP addresses that have actually sent spam. By contrast, UCEPROTECT3 just lumps ISPs into the list even though an address has never sent spam. I run a mail server on AWS, and we use some blacklists to drop mail. It's quite effective and that's why people keep using them. A properly curated blacklist is a powerful tool, and more accurate than the machine learning mush that people have come to rely upon.

yosamino 5y ago
> CEPROTECT3 just lumps ISPs into the list even though an address has never sent spam. But this is by design[0] > This blacklist has been created for HARDLINERS. It can, and probably will cause collateral damage to innocent users when used to block email. And it makes for a perfectly usable blocklist. If you use postfix, the postscreen_dnsbl_threshold and postscreen_dnsbl_sites parameters let you create a simple scoring system: postscreen_dnsbl_threshold = 10 postscreen_dnsbl_sites = zen.spamhaus.org*5, bl.spameatingmonkey.net*5, dnsbl.sorbs.net*4, bl.spamcop.net*4, dnsbl-3.uceprotect.net*3 I made up the numbers, because you will need to monitor your system for a while to see if they make sense, but the principle holds. Also make sure that the dnsbl you are using are working for you. But it isn't really a problem with uceprotect, it's about how DNSBLs are used. [0] https://www.uceprotect.net/en/index.php?m=3&s=5 https://www.uceprotect.net/en/index.php?m=3&s=5 [1] http://www.postfix.org/postconf.5.html#postscreen_dnsbl_sites http://www.postfix.org/postconf.5.html#postscreen_dnsbl_site...
Cadwhisker 5y ago
I also run an email server. I just used https://mxtoolbox.com/ https://mxtoolbox.com/ to check my status and yep, UCEPROTECTL3 is the ONLY one to have my IP range listed. The article sums it up nicely: IP blacklists have their place, however, please don’t use the overarching neighbouring blacklists such as UCEPROTECTL2 and UCEPROTECTL3.
Beltalowda 5y ago

garbagecoder 5y ago

Still better than the alternative

Godel_unicode 5y ago

> antithetical to the principles of the open internet. No. These blocklists are employed by the actor receiving the email. They have a perfect right, even on "the open internet", to decide that they want to limit who can send them messages. There are tons of checks on the people who provide those blacklists, in the form of their users complaining about lack of mail delivery and ultimately not using their list anymore. We vote with our wallets, and as a group we have decided that these blocklists are useful. > and for what? To make email usable. Full stop.

Underphil 5y ago
Absolutely agree. This doesn't fall under the principles of the open internet nor anything in the 'net neutrality' arena. You have no right to expect anyone to receive traffic from your server if they choose not to. It's a major pitfall of running your own relay, but it's not unethical.
- samtuke 5y ago
  Unfortunately 50% of the world's mailboxes are hosted by 2 companies. That means the open internet is far as email goes is already dead in practical terms for most people. When they block another host that host no longer has email network access.
josephcsible 5y ago
> These blocklists are employed by the actor receiving the email. If I send an email to alice@example.com, Alice is the recipient, not Bob the sysadmin for example.com.
- Godel_unicode 5y ago
  This is incorrect. The service you are sending the mail to (example.com in this case) is receiving that mail. They are then delivering it to the user, or not, depending on the agreement they have with the user. If example.com and a user of example.com have agreed that example.com is responsible for providing spam filtering, then they would be remiss in delivering the email to their customer. This is the way that email is designed to work and the fact that users and service providers have choice is a feature, not a bug. If you don't want your service provider to do this type of filtering, that is your choice. But you have absolutely no right to say that Alice can't get the service she wants from example.com because it's inconvenient for you. Edit: and just to head off the inevitable "but what about if it's at work and I can't change providers", the domain and email accounts belong to your employer, not you. You are welcome to work somewhere else if you don't like how they configure their systems.