4 ms·

> But how much time do you spend dealing with that? Is it worth it? Oh not much now -- to be honest with you 99% of the time when it's an issue it's because I

> But how much time do you spend dealing with that? Is it worth it? Oh not much now -- to be honest with you 99% of the time when it's an issue it's because I changed something on my side. Maybe I got lucky with the IPs I have (I use dedicated servers), and I've held them a while. What was jarring about the original post by Carlos is that he did all that AND he's been doing it 23 years and it was still a problem. It made me recall that one of the things I struggled with a long time ago was just setting up Postfix/Dovecot correctly. These days no one should be running into that. > I self hosted my email for more than a decade but I gave up when the time spent was just too much. Unfortunately I don't doubt this assessment. I just want people to know that if difficulty/technical work was a blocker, it is now mostly not (with the news software out there). As other people pointed out, there are services for improving deliverability that could fix the other (bigger) issue, and hopefully people could consider doing that going forward. At the end of the day people have to do what's right for them of course but I just want people to know that things HAVE gotten easier. It's the big companies that are making it hard now.

mrb 4y ago
But Carlos did not do "all that". He said he tried VPS servers, not dedicated servers. Maybe that's his problem. VPS servers tend to have IP addresses with low reputation, whereas dedicated servers tend to have higher reputation IPs. Deliverability really depend on solid reputation of IP address blocks, including reputation of your neighbors. Ideally you want an IP near other IPs who also send high volume of non-spam.
- denton-scratch 4y ago
  I used to self-host, on my home internet connection, for 20 years. I used ISPs that were email-friendly, and gave me clean IPs. I started out with Sendmail, but switched to Postfic/Dovecot after a few years. I stopped a couple of years ago, and moved my mail to my ISPs servers (they let me use my own domain). I switched because of the hassle of keeping the thing up, backing-up the mailstore and so on; and because I was moving home, so I wanted a service that couldn't be knocked-out by the move. Not because of any deliverability issues. I haven't had deliverability issues since about 2010, and those were probably because I couldn't be bothered with DMARC. My ISP is a niche outfit, targeted at nerds; their mailservers are Postfix/Dovecot, which suits me. They support Sieve, and they have a control panel with various knobs and buttons. As an ISP they're a bit pricey, but for email hosting they're cheap.
gwd 4y ago
One thing that was really buried in that article was this bit: > At some point your IP range is bound to be banned, either by one asshole IP neighbor sending spam, one of your users being pwned [emphasis mine], due to arbitrary reasons, by mistake, it doesn't matter. It's not if, it's when. In other words, at least some of the time, the one of his users' accounts had been compromised, and as a result, his servers were actually sending out spam. But rather than take responsibility for detecting and blocking outgoing spam on his own servers, he's blaming The System for doing exactly what it was meant to do.
- cm2187 4y ago
  This exact thing happened to me. A test account I created with a weak password that I should have deleted but forgot about got pwned. I have spam detection in place and within an hour I disabled that account. But that was enough to send over 30,000 spam emails, and then your IP reputation is gone for a very long time. The point being that outgoing spam detection won't save you, by the time you are pwned it's too late. My solution is to have a script that scans the mail server log files and aggressively block ips of failed authentication attempts that are not quickly followed by a successful authentication attempt, and get immediate notification when there is a successful authentication attempt from an unexpected country (I think it's not the same bot that scans for vulnerable accounts and sends spam so you have maybe an hour to react). That works well for a small user base.
  - jelly 4y ago
    That sounds interesting, could you share the script? I've encountered a few obvious login attempts like that, but since they come from a broad pool of IPs it's not something fail2ban can easily handle without collateral damage.
    - cm2187 4y ago
      It’s parsing smartermail logs which have a kind of funky format and the script quite tied to my setup (I have a central IP ban list because I also momitor non mail related protocols on multiple machines), so not sure it would be very useful to someone else.

mrb 4y ago

But Carlos did not do "all that". He said he tried VPS servers, not dedicated servers. Maybe that's his problem. VPS servers tend to have IP addresses with low reputation, whereas dedicated servers tend to have higher reputation IPs. Deliverability really depend on solid reputation of IP address blocks, including reputation of your neighbors. Ideally you want an IP near other IPs who also send high volume of non-spam.

denton-scratch 4y ago
I used to self-host, on my home internet connection, for 20 years. I used ISPs that were email-friendly, and gave me clean IPs. I started out with Sendmail, but switched to Postfic/Dovecot after a few years. I stopped a couple of years ago, and moved my mail to my ISPs servers (they let me use my own domain). I switched because of the hassle of keeping the thing up, backing-up the mailstore and so on; and because I was moving home, so I wanted a service that couldn't be knocked-out by the move. Not because of any deliverability issues. I haven't had deliverability issues since about 2010, and those were probably because I couldn't be bothered with DMARC. My ISP is a niche outfit, targeted at nerds; their mailservers are Postfix/Dovecot, which suits me. They support Sieve, and they have a control panel with various knobs and buttons. As an ISP they're a bit pricey, but for email hosting they're cheap.

gwd 4y ago

One thing that was really buried in that article was this bit: > At some point your IP range is bound to be banned, either by one asshole IP neighbor sending spam, one of your users being pwned [emphasis mine], due to arbitrary reasons, by mistake, it doesn't matter. It's not if, it's when. In other words, at least some of the time, the one of his users' accounts had been compromised, and as a result, his servers were actually sending out spam. But rather than take responsibility for detecting and blocking outgoing spam on his own servers, he's blaming The System for doing exactly what it was meant to do.

cm2187 4y ago
This exact thing happened to me. A test account I created with a weak password that I should have deleted but forgot about got pwned. I have spam detection in place and within an hour I disabled that account. But that was enough to send over 30,000 spam emails, and then your IP reputation is gone for a very long time. The point being that outgoing spam detection won't save you, by the time you are pwned it's too late. My solution is to have a script that scans the mail server log files and aggressively block ips of failed authentication attempts that are not quickly followed by a successful authentication attempt, and get immediate notification when there is a successful authentication attempt from an unexpected country (I think it's not the same bot that scans for vulnerable accounts and sends spam so you have maybe an hour to react). That works well for a small user base.
- jelly 4y ago
  That sounds interesting, could you share the script? I've encountered a few obvious login attempts like that, but since they come from a broad pool of IPs it's not something fail2ban can easily handle without collateral damage.
  - cm2187 4y ago
    It’s parsing smartermail logs which have a kind of funky format and the script quite tied to my setup (I have a central IP ban list because I also momitor non mail related protocols on multiple machines), so not sure it would be very useful to someone else.