9 ms·

Judging by the number of times I've had this fight with developers, and seen other people argue it online, I'd suggest the biggest falsehood programmers believe

Judging by the number of times I've had this fight with developers, and seen other people argue it online, I'd suggest the biggest falsehood programmers believe is: Your random VPS can just send email from any address you like and expect it to be delivered.

nix23 4y ago
Just because you cannot setup a mail-server correctly, i have installed 100's of email-server (2022) from AWS to Hetzner to Vultr andandand. Yes your random static ip can deliver reliable email IF you have: -Static IP (4 and 6) -Correct Reverse DNS for IP4 and 6 -Correct Hostname -Site-verification for gmail/microsoft -DMARK -DKIM -SPF for IP4 and 6
- slyall 4y ago
  So not: "Your random VPS can just send email from any address you like and expect it to be delivered"
  - nix23 4y ago
    Sure it can, if you configure it correctly.
    - Denvercoder9 4y ago
      Note the from any address part. You can send from any address on a domain you own if you set it up correctly, not from any address in general.
      - nix23 4y ago
        Wow that's new that you have to configure something correctly so it works.....
        Dylan16807 4y ago
        "Sure it can, if you configure it correctly." implies that doing it correctly is basically always possible. If you are trying to imply that, it's reasonable to counter-argue that no, it's not always possible. It's not some easy "sure it can". If you're not trying to imply that, then you're burying the lede and hiding the important part of the equation. The ability to do things correctly is not going to fix the problem.
- technion 4y ago
  My point was that the fact anyone needs to do any of those things means a developer can't randomly put any address they want into PHP's mail() function (without telling anyone) and expect it to work. There's no point accusing me of not being able to do things here - I've run my share of mail servers.
  - nix23 4y ago
    Sorry i completely misunderstood you. You could have given that example and one could understand what you mean: >can't randomly put any address they want into PHP's mail() function (without telling anyone)
    - Dylan16807 4y ago
      I feel like it was implied just fine by "any address you like".
      - nix23 4y ago
        Any sender you like would be more correct.
        Dylan16807 4y ago
        In terms of source vs. destination, they already said "from" so that's taken care of. When it comes to "from any sender you like" vs. "from any address you like", I'd be more likely to interpret the former as talking about the username. Which would be the wrong interpretation. So I think your suggested wording would be unhelpful.
- Godel_unicode 4y ago
  And your IP was never on a blocklist before it was allocated to you. And your domain name doesn’t get blocked for being too algorithmic looking according to the spam ML model. And your domain is old enough not to get greylisted. And not too many of your users get reported as spam. And your domain isn’t in .ru or .cn. And your netblock isn’t accidentally put into those regions in maxmind.
  - nix23 4y ago
    >IP was never on a blocklist before Reallocate new IP >domain name doesn’t get blocked for being too algorithmic looking according to the spam ML model Check your domain on your own SpamD/Spamassasin but i never had that problem. >And your domain is old enough not to get greylisted Everything is greylisted at first contact, email servers don't know how "old" a domain is. >And not too many of your users get reported as spam. Yes you can be a spam-bot too, that's why you check your outgoing emails for spam too and limit the recipients and mail frequency outside your domain. >And your domain isn’t in .ru or .cn That's another problem, i talk about technical stuff and not political ones, if your recipient don't want Chinese mails than this is your (or his) (non-)problem, that's a human problem. >And your netblock isn’t accidentally put into those regions in maxmind. Change your VPS-Provider, they are plain incapable -> https://www.maxmind.com/en/geoip-data-correction-request https://www.maxmind.com/en/geoip-data-correction-request
    - themoonisachees 4y ago
      Adding to that, if tour IP was on a blocklist before, you van request an unblock at spamhaus. Might take a few days but they generally comply.
    - pjc50 4y ago
      I'm reminded of the "cryptocurrency is easy to secure if you just follow these fifty three steps with no errors" advocacy. (I used to run my own email and gave up years ago, it's too much hassle to do part time)
      - 4y ago
- noneeeed 4y ago
  > Your random VPS can just send email from any address you like and expect it to be delivered. You're response backs up the parent's point, that a lot of developers don't realise that you have to do all those things to stand any chance of reliable email delivery. Too many people think you can just slap a mail server on a VPS and expect it to be able to reliably deliver mail.
  - denton-scratch 4y ago
    > Too many people think you can just slap a mail server on a VPS Depends on how you parse "slap".
- mike256 4y ago
  All true until it comes to outlook.com and your sent mail just vanishes without any error. It just accepts the mail but doesn't deliver. Not in Inbox, not in Junk.
- oscarcp 4y ago
  Oh boy. I just set up my company a few months back, unfortunately I never had to go into email too much, so I didn't set up DKIM/SPF/DMARC. Then I started receiving emails from my own domain, I panicked because spoooofingg (read with spooky voice) and set up all three. I was bashed for an entire week with reports from all major email services with DMARC reports. Fortunately I still only have a couple clients so no one was the wiser. UPDATE: It ended up in a simple scare, nothing was affected and I'm not in any list that I know of, in case you're wondering
  - nix23 4y ago
    Yeah, it's not a small field...like anything legacy ;) Like the small 1024-bit DKIM because older system (hello exchange) don't accept the 4096 standard. BTW: That's a good delivery-basetest for your mails you should get a 10/10 https://www.mail-tester.com/ https://www.mail-tester.com/
    - Avamander 4y ago
      MECSA is nice as well https://mecsa.jrc.ec.europa.eu/en/ https://mecsa.jrc.ec.europa.eu/en/
AtNightWeCode 4y ago
Or any SAAS for that matter. It takes some effort to get email sending right. It is also a field like SEO where there is a large chance that you get lucky, and things works even when the setup is incorrect.
quickthrower2 4y ago
Yet that is common sense to anyone who enjoys not getting spam due to their spam filter!

nix23 4y ago

Just because you cannot setup a mail-server correctly, i have installed 100's of email-server (2022) from AWS to Hetzner to Vultr andandand. Yes your random static ip can deliver reliable email IF you have: -Static IP (4 and 6) -Correct Reverse DNS for IP4 and 6 -Correct Hostname -Site-verification for gmail/microsoft -DMARK -DKIM -SPF for IP4 and 6

slyall 4y ago
So not: "Your random VPS can just send email from any address you like and expect it to be delivered"
- nix23 4y ago
  Sure it can, if you configure it correctly.
  - Denvercoder9 4y ago
    Note the from any address part. You can send from any address on a domain you own if you set it up correctly, not from any address in general.
    - nix23 4y ago
      Wow that's new that you have to configure something correctly so it works.....
      - Dylan16807 4y ago
        "Sure it can, if you configure it correctly." implies that doing it correctly is basically always possible. If you are trying to imply that, it's reasonable to counter-argue that no, it's not always possible. It's not some easy "sure it can". If you're not trying to imply that, then you're burying the lede and hiding the important part of the equation. The ability to do things correctly is not going to fix the problem.
technion 4y ago
My point was that the fact anyone needs to do any of those things means a developer can't randomly put any address they want into PHP's mail() function (without telling anyone) and expect it to work. There's no point accusing me of not being able to do things here - I've run my share of mail servers.
- nix23 4y ago
  Sorry i completely misunderstood you. You could have given that example and one could understand what you mean: >can't randomly put any address they want into PHP's mail() function (without telling anyone)
  - Dylan16807 4y ago
    I feel like it was implied just fine by "any address you like".
    - nix23 4y ago
      Any sender you like would be more correct.
      - Dylan16807 4y ago
        In terms of source vs. destination, they already said "from" so that's taken care of. When it comes to "from any sender you like" vs. "from any address you like", I'd be more likely to interpret the former as talking about the username. Which would be the wrong interpretation. So I think your suggested wording would be unhelpful.
Godel_unicode 4y ago
And your IP was never on a blocklist before it was allocated to you. And your domain name doesn’t get blocked for being too algorithmic looking according to the spam ML model. And your domain is old enough not to get greylisted. And not too many of your users get reported as spam. And your domain isn’t in .ru or .cn. And your netblock isn’t accidentally put into those regions in maxmind.
- nix23 4y ago
  >IP was never on a blocklist before Reallocate new IP >domain name doesn’t get blocked for being too algorithmic looking according to the spam ML model Check your domain on your own SpamD/Spamassasin but i never had that problem. >And your domain is old enough not to get greylisted Everything is greylisted at first contact, email servers don't know how "old" a domain is. >And not too many of your users get reported as spam. Yes you can be a spam-bot too, that's why you check your outgoing emails for spam too and limit the recipients and mail frequency outside your domain. >And your domain isn’t in .ru or .cn That's another problem, i talk about technical stuff and not political ones, if your recipient don't want Chinese mails than this is your (or his) (non-)problem, that's a human problem. >And your netblock isn’t accidentally put into those regions in maxmind. Change your VPS-Provider, they are plain incapable -> https://www.maxmind.com/en/geoip-data-correction-request https://www.maxmind.com/en/geoip-data-correction-request
  - themoonisachees 4y ago
    Adding to that, if tour IP was on a blocklist before, you van request an unblock at spamhaus. Might take a few days but they generally comply.
  - pjc50 4y ago
    I'm reminded of the "cryptocurrency is easy to secure if you just follow these fifty three steps with no errors" advocacy. (I used to run my own email and gave up years ago, it's too much hassle to do part time)
    - 4y ago
noneeeed 4y ago
> Your random VPS can just send email from any address you like and expect it to be delivered. You're response backs up the parent's point, that a lot of developers don't realise that you have to do all those things to stand any chance of reliable email delivery. Too many people think you can just slap a mail server on a VPS and expect it to be able to reliably deliver mail.
- denton-scratch 4y ago
  > Too many people think you can just slap a mail server on a VPS Depends on how you parse "slap".
mike256 4y ago
All true until it comes to outlook.com and your sent mail just vanishes without any error. It just accepts the mail but doesn't deliver. Not in Inbox, not in Junk.
oscarcp 4y ago
Oh boy. I just set up my company a few months back, unfortunately I never had to go into email too much, so I didn't set up DKIM/SPF/DMARC. Then I started receiving emails from my own domain, I panicked because spoooofingg (read with spooky voice) and set up all three. I was bashed for an entire week with reports from all major email services with DMARC reports. Fortunately I still only have a couple clients so no one was the wiser. UPDATE: It ended up in a simple scare, nothing was affected and I'm not in any list that I know of, in case you're wondering
- nix23 4y ago
  Yeah, it's not a small field...like anything legacy ;) Like the small 1024-bit DKIM because older system (hello exchange) don't accept the 4096 standard. BTW: That's a good delivery-basetest for your mails you should get a 10/10 https://www.mail-tester.com/ https://www.mail-tester.com/
  - Avamander 4y ago
    MECSA is nice as well https://mecsa.jrc.ec.europa.eu/en/ https://mecsa.jrc.ec.europa.eu/en/

AtNightWeCode 4y ago

Or any SAAS for that matter. It takes some effort to get email sending right. It is also a field like SEO where there is a large chance that you get lucky, and things works even when the setup is incorrect.

quickthrower2 4y ago

Yet that is common sense to anyone who enjoys not getting spam due to their spam filter!