3 ms·

I’ve recently been the target of many attempts to hijack my gmail account, including even phone calls with live agents impersonating google “security team”. Suc

I’ve recently been the target of many attempts to hijack my gmail account, including even phone calls with live agents impersonating google “security team”. Successfully hijacking my gmail address could be catastrophic for me and others I assume. Anyway I was wondering if self hosting an email server might allow for a security layer for those of us sophisticated enough. Especially if we own our own domain. Ideally my email address with access to financial services would have 2FA to both read and send emails for example. Don’t even think there are clients or protocols but perhaps with self hosting this can be rigged up with various tricks like port security opening only with a 2FA message. I’d be curious what other perspective on this issue is.

jamal-kumar 2y ago
It's a decent amount of upkeep and cost, but I get paid do it for a bunch of clients who desire this for their companies and have my own which is humming along great. If you go the route of a script to set everything up I found iredmail to be the most mature and reliable solution, even if the upgrade path is super manual at least it gives you a chance to know at what point things went wrong rather than having to pour over logs to fix something broken that is running in production. It also pairs nicely with open source failover solutions and if you need enterprise support they're extremely responsive. Bonus points for getting it working with your phone for backups of contacts, calendar and notes with CalDAV or whatever to really decouple yourself from cloud services with shady terms (I had to pay for an app on my phone for this to really work, but it works great). Setting your whole mailserver up manually is also an option , but be prepared to sink like a month of time into learning how the hell to do that. This is technology from the 1970s with a ton to get it working in the modern world after all. Just be wary that you'll have to upgrade kinda often. I keep subscribed to github alerts for iredmail as they're really prompt about notifying their customers when they need to patch security holes.
- alchemist1e9 2y ago
  That’s very helpful. Thank you. Who do you recommend as a very secure registrar?
xp84 2y ago
A perspective I've read on this (Granted, this was at least 5 years ago) was that it was paradoxically much harder to compromise a Google account than it is to hijack a domain from many registrars. I read an account by someone who had a custom domain and the attacker had social-engineered the registrar into allowing him access, then he proceeded to update the MX, directing the email into the attacker's server. This probably varies from one registrar to the next, and hopefully all have stepped up their game somewhat since that time, but it left an impression on me and caused me to update a lot of my accounts to my Gmail. Obviously, nobody is going to be able to call into a customer service desk and talk them into updating the gmail.com MX record, so for someone to illicitly gain access to mail sent to <me>@gmail.com either I have to be pwned myself (leaked a credential somehow) or there has to be a global 0-day exploit affecting it. In the latter case I am personally willing to bet that mine would not be the first one (or even in the top 10 million) accounts that the hackers would try, so I sleep pretty well.
- alchemist1e9 2y ago
  I understand. For me this raises the question of who is the most secure and reliable registrar for a US citizen. The security of a self-hosted approach appears to be determined by the security of the MX records, the self-hosted server security, and the IP security of the server. With the increasing authoritarian tendencies of governments it seems worth considering since they can clearly pressure the big tech companies to access or hijack your email address.
  - nobody9999 2y ago
    >The security of a self-hosted approach appears to be determined by the security of the MX records, the self-hosted server security, and the IP security of the server. Don't forget DMARC/DKIM/SPF. They're necessary these days as well.
    - alchemist1e9 2y ago
      Definitely and I assume learning all of those will provide enhanced security layers also. I’m looking into MarkMonitor as a registrar with advanced security systems.

jamal-kumar 2y ago

It's a decent amount of upkeep and cost, but I get paid do it for a bunch of clients who desire this for their companies and have my own which is humming along great. If you go the route of a script to set everything up I found iredmail to be the most mature and reliable solution, even if the upgrade path is super manual at least it gives you a chance to know at what point things went wrong rather than having to pour over logs to fix something broken that is running in production. It also pairs nicely with open source failover solutions and if you need enterprise support they're extremely responsive. Bonus points for getting it working with your phone for backups of contacts, calendar and notes with CalDAV or whatever to really decouple yourself from cloud services with shady terms (I had to pay for an app on my phone for this to really work, but it works great). Setting your whole mailserver up manually is also an option , but be prepared to sink like a month of time into learning how the hell to do that. This is technology from the 1970s with a ton to get it working in the modern world after all. Just be wary that you'll have to upgrade kinda often. I keep subscribed to github alerts for iredmail as they're really prompt about notifying their customers when they need to patch security holes.

alchemist1e9 2y ago
That’s very helpful. Thank you. Who do you recommend as a very secure registrar?

xp84 2y ago

A perspective I've read on this (Granted, this was at least 5 years ago) was that it was paradoxically much harder to compromise a Google account than it is to hijack a domain from many registrars. I read an account by someone who had a custom domain and the attacker had social-engineered the registrar into allowing him access, then he proceeded to update the MX, directing the email into the attacker's server. This probably varies from one registrar to the next, and hopefully all have stepped up their game somewhat since that time, but it left an impression on me and caused me to update a lot of my accounts to my Gmail. Obviously, nobody is going to be able to call into a customer service desk and talk them into updating the gmail.com MX record, so for someone to illicitly gain access to mail sent to <me>@gmail.com either I have to be pwned myself (leaked a credential somehow) or there has to be a global 0-day exploit affecting it. In the latter case I am personally willing to bet that mine would not be the first one (or even in the top 10 million) accounts that the hackers would try, so I sleep pretty well.

alchemist1e9 2y ago
I understand. For me this raises the question of who is the most secure and reliable registrar for a US citizen. The security of a self-hosted approach appears to be determined by the security of the MX records, the self-hosted server security, and the IP security of the server. With the increasing authoritarian tendencies of governments it seems worth considering since they can clearly pressure the big tech companies to access or hijack your email address.
- nobody9999 2y ago
  >The security of a self-hosted approach appears to be determined by the security of the MX records, the self-hosted server security, and the IP security of the server. Don't forget DMARC/DKIM/SPF. They're necessary these days as well.
  - alchemist1e9 2y ago
    Definitely and I assume learning all of those will provide enhanced security layers also. I’m looking into MarkMonitor as a registrar with advanced security systems.