5 ms·

In the ISP's defense, 99% of the time an SMTP sender in their residential address space is going to be a compromised device sending spam. It's pretty understand

In the ISP's defense, 99% of the time an SMTP sender in their residential address space is going to be a compromised device sending spam. It's pretty understandable that they would just decide that pissing off the relatively very few customers who want to run their own mail servers is a cost they are willing to accept.

koolba 5y ago
I bet it’s more than 99% too. Even amongst the tech savvy, there’s special level of dedication to run your own mail infrastructure. It’s like one in 10-25K.
- oefrha 5y ago
  There’s running your own mail, then there’s running your own mail from residential. The dozens of us who do the former mostly don’t do the latter, thanks to the obvious vicious cycle.
  - cm2187 5y ago
    Though I belong to the former, I do use my residential ip as a failover server for when my primary server is down, to not lose incoming emails.
    - james_in_the_uk 5y ago
      What’s the benefit of this over a cheap VPS? Privacy?
      - cm2187 5y ago
        Just cheaper. I mean again I do pay for a server in a datacentre as my primary server. I have a home server too anyway, so using it as a mail failover adds redundancy for free. Also I am using windows (smartermail) so even a cheap vps isn’t that cheap.
- jjav 5y ago
  No special level of dedication needed. I'm one of the many who run my own email infrastructure and it is very little work. Nearly none, really, aside from initial setup. However, I don't run it from home over residential ISP connection.
  - cm2187 5y ago
    Still, it’s not trivial to set up, particularly if you want TLS connections, monitoring brute force attacks, etc.
    - necovek 5y ago
      Not the poster you are replying to, but as a self-hoster (on a static residential IP though) I don't necessarily care about brute forcing that doesn't completely kill off my connection (I've actually got two residential connections used as fail-over: 1Gbit/200Mbit + 500Mbit/50Mbit, though set up as round-robin on the incoming domains [same priority]). I mostly run the mail for my family and myself, so the attack surface is reasonably small. My network mostly only dies when one of the ISP-provided modems slows down too much without actually killing off the actual connection (so pings seem to keep working from my OpenWRT router to detect dead connections), which requires resetting that modem (happens only every few months, rare enough for me to bother debugging it: it's usually my dad who pings me early the next morning that his email is not working :)).
      - cm2187 5y ago
        Sorry, I didn't mean brute force as in DDOS, but as in brute forcing passwords. Particularly if you run it for your family, you are at the mercy of one having a weak password, and as soon as a bot has access to one of your mail accounts, it will send spam and you can kiss goodbye your IP/domain reputation.
        necovek 5y ago
        Yeah, I got that, and while I am mildly worried about that, it hasn't been an issue in the last almost 20 years. I am only mentioning bandwidth because someone could easily saturate my internet connections by extensively brute forcing, and that's another mild concern (perhaps those are things that kill my modems?). In practice, biggest issue is that Gmail in particular will never rank your server as trusted because you are sending too low a volume (how's that for an anti spam measure?), and 1/3rd of recepients report emails ending up in spam folders. Curiously, only Gmail does that.
- neurostimulant 5y ago
  I remembered finding some mails originating from my laptop in my gmail spam folder around the time I switched to mac from linux around 2012. I was tinkering with an instance of wordpress in that laptop and turns out sendmail in OSX was capable of sending out email to gmail out of the box without any configuration from my part (I don't remember configuring sendmail in that machine). The wordpress instance was simply used php's sendmail support and happily blasting emails without my knowledge (thankfully only to my own's address). I wonder if recent version of mac still ships with sendmail.
pkulak 5y ago
Yeah, but we’re talking about inbound port 25.
- seedie 5y ago
  I guess the argument for inbound blocking is that its way too easy to configure an open relay which is then used to send spam.
  - u801e 5y ago
    But the outbound block would prevent the relay from sending any mail over port 25, so there's no real point to block inbound connections.
    - xanaxagoras 5y ago
      I'm thinking the ISP in upstate New York misunderstood the situation in a way similar to the comment above you.
    - seedie 5y ago
      I've no argument beyond that. You're right.
amelius 5y ago
> In the ISP's defense, 99% of the time an SMTP sender in their residential address space is going to be a compromised device sending spam 99% of people don't use their home computer to write programs. Some people who write computer programs at home cause trouble. Should we therefore ban programming languages for individuals?
- necovek 5y ago
  Most ISPs do not outright ban it. They just default to blocking outgoing port 25 packets. Usually it's a support request away from opening it for a customer, especially with a static IP address (I've done that for the last ~19 years with a Serbian ISP). Of course, how well your support requests are handled is another matter.

koolba 5y ago

I bet it’s more than 99% too. Even amongst the tech savvy, there’s special level of dedication to run your own mail infrastructure. It’s like one in 10-25K.

oefrha 5y ago
There’s running your own mail, then there’s running your own mail from residential. The dozens of us who do the former mostly don’t do the latter, thanks to the obvious vicious cycle.
- cm2187 5y ago
  Though I belong to the former, I do use my residential ip as a failover server for when my primary server is down, to not lose incoming emails.
  - james_in_the_uk 5y ago
    What’s the benefit of this over a cheap VPS? Privacy?
    - cm2187 5y ago
      Just cheaper. I mean again I do pay for a server in a datacentre as my primary server. I have a home server too anyway, so using it as a mail failover adds redundancy for free. Also I am using windows (smartermail) so even a cheap vps isn’t that cheap.
jjav 5y ago
No special level of dedication needed. I'm one of the many who run my own email infrastructure and it is very little work. Nearly none, really, aside from initial setup. However, I don't run it from home over residential ISP connection.
- cm2187 5y ago
  Still, it’s not trivial to set up, particularly if you want TLS connections, monitoring brute force attacks, etc.
  - necovek 5y ago
    Not the poster you are replying to, but as a self-hoster (on a static residential IP though) I don't necessarily care about brute forcing that doesn't completely kill off my connection (I've actually got two residential connections used as fail-over: 1Gbit/200Mbit + 500Mbit/50Mbit, though set up as round-robin on the incoming domains [same priority]). I mostly run the mail for my family and myself, so the attack surface is reasonably small. My network mostly only dies when one of the ISP-provided modems slows down too much without actually killing off the actual connection (so pings seem to keep working from my OpenWRT router to detect dead connections), which requires resetting that modem (happens only every few months, rare enough for me to bother debugging it: it's usually my dad who pings me early the next morning that his email is not working :)).
    - cm2187 5y ago
      Sorry, I didn't mean brute force as in DDOS, but as in brute forcing passwords. Particularly if you run it for your family, you are at the mercy of one having a weak password, and as soon as a bot has access to one of your mail accounts, it will send spam and you can kiss goodbye your IP/domain reputation.
      - necovek 5y ago
        Yeah, I got that, and while I am mildly worried about that, it hasn't been an issue in the last almost 20 years. I am only mentioning bandwidth because someone could easily saturate my internet connections by extensively brute forcing, and that's another mild concern (perhaps those are things that kill my modems?). In practice, biggest issue is that Gmail in particular will never rank your server as trusted because you are sending too low a volume (how's that for an anti spam measure?), and 1/3rd of recepients report emails ending up in spam folders. Curiously, only Gmail does that.
neurostimulant 5y ago
I remembered finding some mails originating from my laptop in my gmail spam folder around the time I switched to mac from linux around 2012. I was tinkering with an instance of wordpress in that laptop and turns out sendmail in OSX was capable of sending out email to gmail out of the box without any configuration from my part (I don't remember configuring sendmail in that machine). The wordpress instance was simply used php's sendmail support and happily blasting emails without my knowledge (thankfully only to my own's address). I wonder if recent version of mac still ships with sendmail.

pkulak 5y ago

Yeah, but we’re talking about inbound port 25.

seedie 5y ago
I guess the argument for inbound blocking is that its way too easy to configure an open relay which is then used to send spam.
- u801e 5y ago
  But the outbound block would prevent the relay from sending any mail over port 25, so there's no real point to block inbound connections.
  - xanaxagoras 5y ago
    I'm thinking the ISP in upstate New York misunderstood the situation in a way similar to the comment above you.
  - seedie 5y ago
    I've no argument beyond that. You're right.

amelius 5y ago

> In the ISP's defense, 99% of the time an SMTP sender in their residential address space is going to be a compromised device sending spam 99% of people don't use their home computer to write programs. Some people who write computer programs at home cause trouble. Should we therefore ban programming languages for individuals?

necovek 5y ago
Most ISPs do not outright ban it. They just default to blocking outgoing port 25 packets. Usually it's a support request away from opening it for a customer, especially with a static IP address (I've done that for the last ~19 years with a Serbian ISP). Of course, how well your support requests are handled is another matter.