8 ms·

A SpamAssassin Surprise

85 points by rwmj 2y ago

jwr 2y ago
Please do not let a story like that discourage you from running your own mail server. I am really worried about the future where 2-3 adtech corporations control what we receive and read, and we are not far away from that future. As a counterpoint, I have been running my own E-mail server for the last 25 years or so, and haven't found it to be terribly problematic. Yes, there is an occasional issue, but I'd rather control my mail, than hand it off to someone else.
- martin_a 2y ago
  I'd second this. Get yourself some managed hosting package with a TLD at Hetzner or somebody like them and run your own stuff. NextCloud with calendars, mail, maybe a blog will cost you sth. like 3 Euro/month. That's totally fine and the hardest part is finding a good domain name anyways. :-D
- TheDong 2y ago
  [flagged]
  - hnhg 2y ago
    "Be kind. Don't be snarky. Converse curiously; don't cross-examine. Edit out swipes."
    - e40 2y ago
      [flagged]
- bluGill 2y ago
  Don't let the ad companies run your email. There are a number of large email providers who are not ad companies and so have your interest at heart. I moved my email to fastmail over a decade ago and I don't miss running it myself, people who have moved to one of the other non-ad providers also report good results (though fastmail tends to get the largest share of responses when someone suggests running your own)
  - brongondwana 2y ago
    Obviously :) We're just the best! More: Fastmail is a bunch of techies who really enjoy working with email and unlike a lot of the big companies we have a core of people who've been doing this stuff for 20 years, but are also keeping up with (or even writing) the latest standards. It's a good combination. ok, ok - I haven't been at Fastmail for 20 years yet. That's still a couple of weeks away.
    - andrewSC 2y ago
      As a user going on 5+ years now I just wanted to say thanks! Reassuring to hear the team is passionate about what they’re building.
    - hungie 2y ago
      Fastmail is such an obviously better choice than Gmail these days. I moved over a few years ago, and I have zero regrets. I'm a bit nervous that someday they'll sell out or run out of things to build and enshittification will set in, but honestly I haven't seen anything like that yet. The day they start trying to put AI trash in Fastmail, though, is the day I start looking elsewhere.
      - kwanbix 2y ago
        How is it better? Honest question.
        bluGill 2y ago
        They are not an ad company at all and so they don't have a division making a lot of money tracking you. Even if you pay for gmail, that ad division is making a lot more money and is looking for why to track you.
        homebrewer 2y ago
        This applies to any commercial service (I am using a different one, but it's all the same): no tracking because they have no incentive to (they have the opposite incentive, actually), and responsive support provided by real humans when you need it. Search on HN or elsewhere for what happens when Google's automated systems ban your account and you lose access to email and everything tied to it. You have no recourse and no chance to recover it unless you have inside contacts or manage to stir up a social media shitstorm. You can also use your own domain (for example, tied to your real identity: firstname@lastname.com) and move it to a different provider if your current one goes to pieces. Additionally, I use a separate email address for each service (hn@domain.com, paypal@domain.com, amazon@domain.com, etc.) and can simply remove the alias if it starts receiving spam. You know then who leaked your email to spammers. You can add a random "IV" to be sure (i.e. amazon-5VoXwj5@domain.com).
- flyinghamster 2y ago
  I've done so as well, and once it's fine-tuned it isn't a huge deal. But, I'm getting old now, and now that it's time to upgrade my mail server, I'm wondering if I should jump to a hosting service (or SMTP service) instead. I've never had deliverability problems with Google, Hotmail, Comcast, or Charter, but AT&T has always been hostile to me.
  - MaKey 2y ago
    You could go with https://mailcow.email https://mailcow.email, it's pretty easy to setup and keep up to date.
    - throw0101b 2y ago
      Or, if you don't want to do the Docker thing and have daemons running on a 'regular' (Debian) system: * https://workaround.org/ispmail-bookworm/ https://workaround.org/ispmail-bookworm/ (They include instructions for upgrading from their previous iterations, e.g., buster->bullseye->bookworm.)
- dspillett 2y ago
  Same. Though as mine is getting to the point I want to change things around quite a bit, I am wondering if I really have the time or if I should go “hosted”. Running your own mail can be harder from the start than from our position of having done it for years though. All the things that we know and learned one at a time as they came up, a new mail admin needs to learn at the start. Also, I have old domains with no bad rep, and my mail is sent from static IPs that have been reputationally clean for all the time I've had them (well over a decade). If you run your mail server on a VPS provider you might have more trouble from their IP range than I have from mine (though you do always have the option of paying a little for a relay service like mxroute which will deal with deliverability problems for you).
- dewey 2y ago
  > Yes, there is an occasional issue For me it's quite the opposite, I'd rather let someone who does nothing else all day than providing email services to people for money handle the occasional issue.
- layer8 2y ago
  Same. The last time I had to change something for my email server was to add SPF and DMARC support five years ago or so, and that was well-documented and pain-free. Regarding the SpamAssassin issue, TFA doesn’t clarify whether it’s Validity or SpamAssassin that is using the DNSWL interface wrong.
- irunmyownemail 2y ago
  25 years for me too, 2 issues in 25 years. A few years ago, someone on reddit suggested to stop using Spamassassin so I did and found it didn't have much of an impact. I also have my own service I wrote which checks a few things Postfix doesn't and that helps but overall it's not difficult, it is a hobby that demands some of your personal time but I feel it's worth it.
- stackskipton 2y ago
  I used to run my own but for 8 bucks a month (spouse and me) to hand it off to Microsoft, it quickly became a no brainer. Not to mention running my own helped me be a better SRE back in the day, most businesses handed it off as well and it wasn't a skill worth me knowing outside the basics of SMTP.
- mort96 2y ago
  At the same time, don't run your own mail server. E-mail is not, in practice, a federated protocol which anyone can participate in. E-mail is, in practice, a protocol where Microsoft, Apple and Google can send mail between each others' systems. Stop using e-mail.
  - gsich 2y ago
    It is. Don't let people who don't run mailservers tell you otherwise.
  - kstrauser 2y ago
    That’s one problem I never had. With DKIM, SPF, and the other right DNS records in place, I had no worse trouble with deliverability in general than I do with a large host. Every couple of years I’d try to email someone with an rule like “don’t accept email from a VPS, at all, ever”, and shrug it off because they were already use to discarding a huge chunk of valid email so what’s one more.
  - justsomehnguy 2y ago
    > Stop using e-mail. Right after everyone and your grandma stop using e-mail as a UUID. No, phone number doesn't cut.
    - mort96 2y ago
      No, that's the one thing e-mail actually works decently well for. Just stop using it for all these other things.
- deleted 2y ago
  [deleted]
- casenmgreen 2y ago
  I've been running my own for about a decade or so. Recently, I finally gave up running my own outbound email, because I realized that no matter what I do, I'm still being blocked based on my IP address. I now pay FastMail 5 USD a month basically for their IP address, using them for outbound email only. Email is anyway inherently and fundamentally inadequate for security. I'd rather not use it at all now, and stop having an email address.
- noAnswer 2y ago
  I run my own mail server since 7 years. (OpenSMTPD and Dovecot for IMAP (NextCloud for contacts and calendar) on OpenBSD.) Apart from rDNS and FCrDNS (which the connecting host has to have) I don't have a Spam filter (and never had). I create a new mail address for everything. (name-number@...) I have gotten like ~2 Spam mails. (I still have my 25 year old GMX address. (I even have premium.) I use it for my providers in order not to create a chicken and egg problem. Only my MX is public. Everything else is behind a VPN.)
- graemep 2y ago
  I have only been running my own mail server for about two years, and the only problem I have is delivering to Hotmail. It has become a lot easier than it used to be thanks to things like Mailinabox.
- zimpenfish 2y ago
  > I have been running my own E-mail server for the last 25 years or so, and haven't found it to be terribly problematic. Not quite 25 yet but approaching and same view. Keeping on top of DKIM and SPF and all that have reduced the "I can't send mail to XYZ" issues. Pretty much the only thing I get now is family being temporarily locked out of SMTP by fail2ban when the automatic family-unbanner has missed that entry.
- adrian_b 2y ago
  Supporting your counterpoint, I have been also running my own E-mail server for the last 20 years. There were occasional issues, mostly a few years ago, with the big providers dropping silently messages or delaying them by a day or so, but eventually it has always worked well. This year has been a hassle with the new rules forced by Google, but during most years the time spent with managing the E-mail server has been completely negligible.
deng 2y ago
Exactly the same thing for me. While it is clearly not good to suddenly receive a ton of spam, I rather have a ton of false negatives than false positives, so in this case, no real harm was done.
willvarfar 2y ago
> What was once a nice, federated service (in a much simpler time) has become a complex mess with high barriers to entry, pushing users into a small number of large, proprietary services This also describes all other communications and socialness on the web; from bbs and forums to modern "social media". Is there anything small and niche (apart from, literally, HN) that hasn't been completely utterly destroyed by the nasty people online?
- flyinghamster 2y ago
  Basically, it's small(ish) forums that have survived over the years without migrating to Reddit or such, and even those are not immune (and could go away without warning). User upvote/downvote systems can be helpful, provided there are checks and balances against being gamed.
- reaperducer 2y ago
  Is there anything small and niche (apart from, literally, HN) that hasn't been completely utterly destroyed by the nasty people online? Local and specialist fora are doing quite well. Some have been around for decades because they offer what social media promises but doesn't deliver. Examples: https://thestampforum.boards.net https://thehaif.com https://forums.atariage.com Most offer RSS, so you can roll your own "feed" like a social media site, but without being followed, tabulated, and monetized to death. Their secret is friction and moderation. You have to jump through a hoop or two get registered, unlike social media where the barriers to entry are so low that bots step over them without a care. That's because these web sites care about the content, not tallying up monthly user statistics for shareholders. It's like radio. If you're in Los Angeles, you can listen to KROQ, which serves its corporate owners and shareholders far away, or you can listen to KCSN, which serves its listeners locally.
amaccuish 2y ago
Would highly recommend rspamd over SpamAssassin, I've found its results to be much more accurate.
paulnpace 2y ago
What a nothing-burger. Bug discovered in default Spamassassin. Yawn. The number one sources of the very worst spam that lands in my inboxes are Google, Microsoft, and Apple, and by worst I mean the most legitimate-appearing messages that contain the most hideous of links and attachments.
zx8080 2y ago
It feels really strange to read an article starting with some free advice like that. "What do they sell?" is what could expected then.
Macha 2y ago
Huh, I noticed a handful of obvious spam emails make it into my inbox in fastmail over the last few months, wonder if they had a similar issue.
- djbusby 2y ago
  I've got an account on Google apps, and spams have landed in the main mailbox. Attached PDFs was the common thing. Obviously spoofed sender. One new attempt is sharing (virus) files via Dropbox - been getting a bunch of those invites recently.
figassis 2y ago
It's a mistake to think that if self hosting email is hard, then you should not do it. This will incentivise giants to gakekeep by making it even harder. Ideally we should get to a point where self hosted email ecossystem is self sustaining and makes them not irrelevant, but also not so dominant. As developers, we should aim to create out of the box solutions, with batteries included (I've seen more and more such solutions, like maddy, wildduck, etc), that anyone can setup as easily as wordpress. It should have default sane and secure configs, with a simple UI with a setup wizard with options like "Single vs Multi Tenant", integration with DKIM, SPF, DMARC APIs on most DNS providers, etc. The goal is to kill the "misconfigured email server" argument from the giants.
- mort96 2y ago
  At some point, we have to acknowledge that e-mail is already dead. Use something better.
  - gsich 2y ago
    Like?
    - mort96 2y ago
      I don't know, maybe invent something. E-mail is not it. It's almost completely unfederated, and e-mail sent from one client usually doesn't even display properly in other clients. The amount of times I've had to read black text on dark grey backgrounds is insane.
      - graemep 2y ago
        Its not the 90s. You can no longer get traction for new protocols without backing from big tech and they will push walled gardens. I have very rarely had issues reading email.
        mort96 2y ago
deleted 2y ago
[deleted]
hannob 2y ago
I had a quick look into this rule, and I have an entirely different concern. It appears to me Validity is essentially a "pay for good reputation" service. Not sure that aligns with the goals of Spamassassin...
micahdeath 2y ago
The big companies have these issues too. MS started allowing lots a SPAM in a few months ago. Took a couple of weeks for them to fix it. Self-Host or Email as a Service both have their intermittent issues.
xyst 2y ago
rspamd has worked wonderfully for me. It’s operated more or less on the same level as iCloud, Gmail, or Outlook. I feel articles like this overstate the burden. I can agree that running a self-hosted server at scale (multi tenant/multi user) could be very painful and would be a full time job. But if it’s a single user (you), it’s almost set it and forget it. Many resources out there to test your mail server is configured correctly (ie, mailtester). The only painful issues I have had: - if using a “dynamic” IP from a VPS host. You might find that many RBLs block them by default. It’s somewhat easy to get it reset though, and have only had to do it twice (cloudmark and outlook). - occasionally have to deal with obvious brute force attempts to find vulnerable accounts. But this is resolved with fail2ban and setting up alerts on postfix and dovecot logs Also, compared to the old days. There are many projects that make it stupid simple to setup a mail server with sane defaults. Current projects I am watching: - stalw.art - docker mail server I have been considering stalwart. Especially since there are plans to add in CalDAV (Calendar), and CardDAV (Contacts) support. I was previously looking at Cyrus IMAP for this functionality but will ultimately wait/support stalwart for the AIO solution.
- zimpenfish 2y ago
  +1 for rspamd making life much easier.
talkingtab 2y ago
In my view the importance of email is the provide communication between two consenting parties. This function has been co-opted by those entities that have another interest. Google uses gmail in order to enhance it's business. MS is the same. Then there are mailing list companies who have made a business from sending millions of emails. In the current email system who represents the interests of the common user? Not gmail. Not mailchimp. I'm not saying they are bad, just that their interests are not my interests. So perhaps the right thing is to add a layer to email that provides common users control. Email servers that provide consensual service can talk to each other. Not a white list, a trust list. Otherwise just use gmail. How to do this? If you send a non-consensual mail, you pay a fine. A way for mail providers to make money by improving the basic function of common users. I'm just making this up, I'm sure you can come up with a better system. Or perhaps you can help me understand whether the purpose is valid or not?
- ronsor 2y ago
  > If you send a non-consensual mail, you pay a fine. Spam is already illegal, but spammers don't pay a fine because good luck actually finding them.
kstrauser 2y ago
I’m one of the people who gave up on self hosting. After 25 years, I now run my personal domains off Apple, who does it for free if you have a paid iCloud plan. It was fun. It was educational as hell. It was an adventure. It was also an incredible time suck keeping up with new spam and anti-spam and anti-anti-spam methods. I highly recommend the experience for those interested. I also recommend regularly reevaluating whether you’re still having fun doing it.
elfchief 2y ago
I really wish I could move my personal email over to gmail -- I've run my own local email server for 30 years, and tbh I just don't really care to do that anymore. But I'm stuck -- I exclusively use 'tagged' email addresses when giving anyone my email address, so every incoming message is addressed to "myusername-sometag@domain"... and gmail, of course, uses a + instead of a - for doing that kind of tagging. So if I tried to migrate hosts, literally none of my incoming email would arrive anymore. Sucks that a decision I made before gmail even existed now restrains me so much. :/
- akovaski 2y ago
  Several email providers provide catch-all/wildcard functionality which can handle arbitrary tagging. https://www.fastmail.help/hc/en-us/articles/1500000277942-Catch-all-wildcard-aliases https://www.fastmail.help/hc/en-us/articles/1500000277942-Ca... https://help.zoho.com/portal/en/community/topic/receive-only-wildcard-aliases https://help.zoho.com/portal/en/community/topic/receive-only... https://support.google.com/a/answer/12943537?hl=en https://support.google.com/a/answer/12943537?hl=en
- noAnswer 2y ago
  Even the longest journey begins with one step. I have a similar mail address pattern (ebay-534389@foo etc.) When I started 7 years ago. I opened my password safe and changed one account after another. If the old account received something I overlooked and I was still interested in it, I changed this address too. A year later and the old address receives nothing anymore. Nothings stops me or you from changing it back. Update: And yes, there are a million providers that provide a catch-all mechanism. Even some domain registrars provide catch-all forwarding.
- bsder 2y ago
  I think Fastmail can deal with this. I don't know about using "-"(dash), specifically, though ... And never use "+" as a separator. There are zillions of shitty regex email address "validators" that won't take it even though gmail uses it.
jcynix 2y ago
I'm running my own email server for more than 20 years now. And spamassassin still works fine, filtering locally. But even before spamassassin gets stuff to analyse, my postfix server checks if a sender's ip address has a reverse dns mapping (most hacked office clients don't have one) and last but not least asks the postgrey policy server if it should accept an incoming message immediately or tell the sender to retry after some time. That is, I'm using greylisting, and yes, this still blocks quite a number of incoming messages, as spammers do not retry to send their spam, if it doesn't work at the first attempt. So with excellent software like Wietse Venemas Postfix and a rather restrictive setup, an email server is a low maintenance server to use IMHO. Edit: running your own email server gives you enough email address for you and your family to make it much easier to detect phishing emails: one address per shop and you'll notice if an email to the address of a shop tries to pose as your bank or some other sender. And it's easy to block certain senders after their job is done.
mjl- 2y ago
Indeed it's not a great idea to rely on 3rd party services for allow/block-listing. You're giving power to those 3rd parties, and it centralizes email. Ironically, quite some people running their own mail servers use blocklists, pushing deliverability problems due to being blocklisted onto fellow self-hosters. Another reason why it's not great to use allow/block-lists: You're passing the IP's of everyone you're communicating with to those 3rd parties. In mox (a mail server, I'm the author), junk filtering is first done based on known good/bad reputation of the (verified) domain of the address of the sender, based on classifications made by the user (and mox helps with those classifications). That means everyone you've seen good/bad mail from before, can quickly be classified without the need to contact any allow/blocklist. For first-time senders, a bayesian content-based classification is used. That is almost always is good enough. But you can also configure blocklists. They will only be consulted as long as there isn't enough reputation for the sender. Once you've corresponded with someone a few times, the blocklist isn't used for their messages anymore.
TwoNineFive 2y ago
While I like LWN and respect their writings, AND I appreciate and respect a good post-mortem story which involves some "I fucked up", this really just highlights negligence on their sysadmin staff. And, in that respect, I don't they have any business telling other people to not run a mail server given their demonstrated negligence. Not everyone else is a fuck up, but LWN sure is. > configuration was introduced as part of a hurried email server replacement driven by the demise of CentOS 7 They knew for YEARS, and even after the Red Hat controversy of shitting down CentOS, they still sat on their butt and did nothing until the very last minute, and then f*ked it up. That's some serious negligence. Also, any competent self-hoster knows you need to run a recursive DNS resolver on-host to avoid these kinds of issues. Many other DNS-based RBL services already had such limits and those issues were extremely well-known. This is another sign of negligence. This guy is an idiot and should not be running a mail server. And, he/they have no business telling anyone else what to do.

85 points by rwmj 2y ago

jwr 2y ago

Please do not let a story like that discourage you from running your own mail server. I am really worried about the future where 2-3 adtech corporations control what we receive and read, and we are not far away from that future. As a counterpoint, I have been running my own E-mail server for the last 25 years or so, and haven't found it to be terribly problematic. Yes, there is an occasional issue, but I'd rather control my mail, than hand it off to someone else.

martin_a 2y ago
I'd second this. Get yourself some managed hosting package with a TLD at Hetzner or somebody like them and run your own stuff. NextCloud with calendars, mail, maybe a blog will cost you sth. like 3 Euro/month. That's totally fine and the hardest part is finding a good domain name anyways. :-D
TheDong 2y ago
[flagged]
- hnhg 2y ago
  "Be kind. Don't be snarky. Converse curiously; don't cross-examine. Edit out swipes."
  - e40 2y ago
    [flagged]
bluGill 2y ago
Don't let the ad companies run your email. There are a number of large email providers who are not ad companies and so have your interest at heart. I moved my email to fastmail over a decade ago and I don't miss running it myself, people who have moved to one of the other non-ad providers also report good results (though fastmail tends to get the largest share of responses when someone suggests running your own)
- brongondwana 2y ago
  Obviously :) We're just the best! More: Fastmail is a bunch of techies who really enjoy working with email and unlike a lot of the big companies we have a core of people who've been doing this stuff for 20 years, but are also keeping up with (or even writing) the latest standards. It's a good combination. ok, ok - I haven't been at Fastmail for 20 years yet. That's still a couple of weeks away.
  - andrewSC 2y ago
    As a user going on 5+ years now I just wanted to say thanks! Reassuring to hear the team is passionate about what they’re building.
  - hungie 2y ago
    Fastmail is such an obviously better choice than Gmail these days. I moved over a few years ago, and I have zero regrets. I'm a bit nervous that someday they'll sell out or run out of things to build and enshittification will set in, but honestly I haven't seen anything like that yet. The day they start trying to put AI trash in Fastmail, though, is the day I start looking elsewhere.
    - kwanbix 2y ago
      How is it better? Honest question.
      - bluGill 2y ago
        They are not an ad company at all and so they don't have a division making a lot of money tracking you. Even if you pay for gmail, that ad division is making a lot more money and is looking for why to track you.
      - homebrewer 2y ago
        This applies to any commercial service (I am using a different one, but it's all the same): no tracking because they have no incentive to (they have the opposite incentive, actually), and responsive support provided by real humans when you need it. Search on HN or elsewhere for what happens when Google's automated systems ban your account and you lose access to email and everything tied to it. You have no recourse and no chance to recover it unless you have inside contacts or manage to stir up a social media shitstorm. You can also use your own domain (for example, tied to your real identity: firstname@lastname.com) and move it to a different provider if your current one goes to pieces. Additionally, I use a separate email address for each service (hn@domain.com, paypal@domain.com, amazon@domain.com, etc.) and can simply remove the alias if it starts receiving spam. You know then who leaked your email to spammers. You can add a random "IV" to be sure (i.e. amazon-5VoXwj5@domain.com).
flyinghamster 2y ago
I've done so as well, and once it's fine-tuned it isn't a huge deal. But, I'm getting old now, and now that it's time to upgrade my mail server, I'm wondering if I should jump to a hosting service (or SMTP service) instead. I've never had deliverability problems with Google, Hotmail, Comcast, or Charter, but AT&T has always been hostile to me.
- MaKey 2y ago
  You could go with https://mailcow.email https://mailcow.email, it's pretty easy to setup and keep up to date.
  - throw0101b 2y ago
    Or, if you don't want to do the Docker thing and have daemons running on a 'regular' (Debian) system: * https://workaround.org/ispmail-bookworm/ https://workaround.org/ispmail-bookworm/ (They include instructions for upgrading from their previous iterations, e.g., buster->bullseye->bookworm.)
dspillett 2y ago
Same. Though as mine is getting to the point I want to change things around quite a bit, I am wondering if I really have the time or if I should go “hosted”. Running your own mail can be harder from the start than from our position of having done it for years though. All the things that we know and learned one at a time as they came up, a new mail admin needs to learn at the start. Also, I have old domains with no bad rep, and my mail is sent from static IPs that have been reputationally clean for all the time I've had them (well over a decade). If you run your mail server on a VPS provider you might have more trouble from their IP range than I have from mine (though you do always have the option of paying a little for a relay service like mxroute which will deal with deliverability problems for you).
dewey 2y ago
> Yes, there is an occasional issue For me it's quite the opposite, I'd rather let someone who does nothing else all day than providing email services to people for money handle the occasional issue.
layer8 2y ago
Same. The last time I had to change something for my email server was to add SPF and DMARC support five years ago or so, and that was well-documented and pain-free. Regarding the SpamAssassin issue, TFA doesn’t clarify whether it’s Validity or SpamAssassin that is using the DNSWL interface wrong.
irunmyownemail 2y ago
25 years for me too, 2 issues in 25 years. A few years ago, someone on reddit suggested to stop using Spamassassin so I did and found it didn't have much of an impact. I also have my own service I wrote which checks a few things Postfix doesn't and that helps but overall it's not difficult, it is a hobby that demands some of your personal time but I feel it's worth it.
stackskipton 2y ago
I used to run my own but for 8 bucks a month (spouse and me) to hand it off to Microsoft, it quickly became a no brainer. Not to mention running my own helped me be a better SRE back in the day, most businesses handed it off as well and it wasn't a skill worth me knowing outside the basics of SMTP.
mort96 2y ago
At the same time, don't run your own mail server. E-mail is not, in practice, a federated protocol which anyone can participate in. E-mail is, in practice, a protocol where Microsoft, Apple and Google can send mail between each others' systems. Stop using e-mail.
- gsich 2y ago
  It is. Don't let people who don't run mailservers tell you otherwise.
- kstrauser 2y ago
  That’s one problem I never had. With DKIM, SPF, and the other right DNS records in place, I had no worse trouble with deliverability in general than I do with a large host. Every couple of years I’d try to email someone with an rule like “don’t accept email from a VPS, at all, ever”, and shrug it off because they were already use to discarding a huge chunk of valid email so what’s one more.
- justsomehnguy 2y ago
  > Stop using e-mail. Right after everyone and your grandma stop using e-mail as a UUID. No, phone number doesn't cut.
  - mort96 2y ago
    No, that's the one thing e-mail actually works decently well for. Just stop using it for all these other things.
deleted 2y ago
[deleted]
casenmgreen 2y ago
I've been running my own for about a decade or so. Recently, I finally gave up running my own outbound email, because I realized that no matter what I do, I'm still being blocked based on my IP address. I now pay FastMail 5 USD a month basically for their IP address, using them for outbound email only. Email is anyway inherently and fundamentally inadequate for security. I'd rather not use it at all now, and stop having an email address.
noAnswer 2y ago
I run my own mail server since 7 years. (OpenSMTPD and Dovecot for IMAP (NextCloud for contacts and calendar) on OpenBSD.) Apart from rDNS and FCrDNS (which the connecting host has to have) I don't have a Spam filter (and never had). I create a new mail address for everything. (name-number@...) I have gotten like ~2 Spam mails. (I still have my 25 year old GMX address. (I even have premium.) I use it for my providers in order not to create a chicken and egg problem. Only my MX is public. Everything else is behind a VPN.)
graemep 2y ago
I have only been running my own mail server for about two years, and the only problem I have is delivering to Hotmail. It has become a lot easier than it used to be thanks to things like Mailinabox.
zimpenfish 2y ago
> I have been running my own E-mail server for the last 25 years or so, and haven't found it to be terribly problematic. Not quite 25 yet but approaching and same view. Keeping on top of DKIM and SPF and all that have reduced the "I can't send mail to XYZ" issues. Pretty much the only thing I get now is family being temporarily locked out of SMTP by fail2ban when the automatic family-unbanner has missed that entry.
adrian_b 2y ago
Supporting your counterpoint, I have been also running my own E-mail server for the last 20 years. There were occasional issues, mostly a few years ago, with the big providers dropping silently messages or delaying them by a day or so, but eventually it has always worked well. This year has been a hassle with the new rules forced by Google, but during most years the time spent with managing the E-mail server has been completely negligible.

deng 2y ago

Exactly the same thing for me. While it is clearly not good to suddenly receive a ton of spam, I rather have a ton of false negatives than false positives, so in this case, no real harm was done.

willvarfar 2y ago

> What was once a nice, federated service (in a much simpler time) has become a complex mess with high barriers to entry, pushing users into a small number of large, proprietary services This also describes all other communications and socialness on the web; from bbs and forums to modern "social media". Is there anything small and niche (apart from, literally, HN) that hasn't been completely utterly destroyed by the nasty people online?

flyinghamster 2y ago
Basically, it's small(ish) forums that have survived over the years without migrating to Reddit or such, and even those are not immune (and could go away without warning). User upvote/downvote systems can be helpful, provided there are checks and balances against being gamed.
reaperducer 2y ago
Is there anything small and niche (apart from, literally, HN) that hasn't been completely utterly destroyed by the nasty people online? Local and specialist fora are doing quite well. Some have been around for decades because they offer what social media promises but doesn't deliver. Examples: https://thestampforum.boards.net https://thehaif.com https://forums.atariage.com Most offer RSS, so you can roll your own "feed" like a social media site, but without being followed, tabulated, and monetized to death. Their secret is friction and moderation. You have to jump through a hoop or two get registered, unlike social media where the barriers to entry are so low that bots step over them without a care. That's because these web sites care about the content, not tallying up monthly user statistics for shareholders. It's like radio. If you're in Los Angeles, you can listen to KROQ, which serves its corporate owners and shareholders far away, or you can listen to KCSN, which serves its listeners locally.

amaccuish 2y ago

Would highly recommend rspamd over SpamAssassin, I've found its results to be much more accurate.

paulnpace 2y ago

What a nothing-burger. Bug discovered in default Spamassassin. Yawn. The number one sources of the very worst spam that lands in my inboxes are Google, Microsoft, and Apple, and by worst I mean the most legitimate-appearing messages that contain the most hideous of links and attachments.

zx8080 2y ago

It feels really strange to read an article starting with some free advice like that. "What do they sell?" is what could expected then.

Macha 2y ago

Huh, I noticed a handful of obvious spam emails make it into my inbox in fastmail over the last few months, wonder if they had a similar issue.

djbusby 2y ago
I've got an account on Google apps, and spams have landed in the main mailbox. Attached PDFs was the common thing. Obviously spoofed sender. One new attempt is sharing (virus) files via Dropbox - been getting a bunch of those invites recently.

figassis 2y ago

It's a mistake to think that if self hosting email is hard, then you should not do it. This will incentivise giants to gakekeep by making it even harder. Ideally we should get to a point where self hosted email ecossystem is self sustaining and makes them not irrelevant, but also not so dominant. As developers, we should aim to create out of the box solutions, with batteries included (I've seen more and more such solutions, like maddy, wildduck, etc), that anyone can setup as easily as wordpress. It should have default sane and secure configs, with a simple UI with a setup wizard with options like "Single vs Multi Tenant", integration with DKIM, SPF, DMARC APIs on most DNS providers, etc. The goal is to kill the "misconfigured email server" argument from the giants.

mort96 2y ago
At some point, we have to acknowledge that e-mail is already dead. Use something better.
- gsich 2y ago
  Like?
  - mort96 2y ago
    I don't know, maybe invent something. E-mail is not it. It's almost completely unfederated, and e-mail sent from one client usually doesn't even display properly in other clients. The amount of times I've had to read black text on dark grey backgrounds is insane.
    - graemep 2y ago
      Its not the 90s. You can no longer get traction for new protocols without backing from big tech and they will push walled gardens. I have very rarely had issues reading email.
      - mort96 2y ago

deleted 2y ago

[deleted]

hannob 2y ago

I had a quick look into this rule, and I have an entirely different concern. It appears to me Validity is essentially a "pay for good reputation" service. Not sure that aligns with the goals of Spamassassin...

micahdeath 2y ago

The big companies have these issues too. MS started allowing lots a SPAM in a few months ago. Took a couple of weeks for them to fix it. Self-Host or Email as a Service both have their intermittent issues.

xyst 2y ago

rspamd has worked wonderfully for me. It’s operated more or less on the same level as iCloud, Gmail, or Outlook. I feel articles like this overstate the burden. I can agree that running a self-hosted server at scale (multi tenant/multi user) could be very painful and would be a full time job. But if it’s a single user (you), it’s almost set it and forget it. Many resources out there to test your mail server is configured correctly (ie, mailtester). The only painful issues I have had: - if using a “dynamic” IP from a VPS host. You might find that many RBLs block them by default. It’s somewhat easy to get it reset though, and have only had to do it twice (cloudmark and outlook). - occasionally have to deal with obvious brute force attempts to find vulnerable accounts. But this is resolved with fail2ban and setting up alerts on postfix and dovecot logs Also, compared to the old days. There are many projects that make it stupid simple to setup a mail server with sane defaults. Current projects I am watching: - stalw.art - docker mail server I have been considering stalwart. Especially since there are plans to add in CalDAV (Calendar), and CardDAV (Contacts) support. I was previously looking at Cyrus IMAP for this functionality but will ultimately wait/support stalwart for the AIO solution.

zimpenfish 2y ago
+1 for rspamd making life much easier.

talkingtab 2y ago

In my view the importance of email is the provide communication between two consenting parties. This function has been co-opted by those entities that have another interest. Google uses gmail in order to enhance it's business. MS is the same. Then there are mailing list companies who have made a business from sending millions of emails. In the current email system who represents the interests of the common user? Not gmail. Not mailchimp. I'm not saying they are bad, just that their interests are not my interests. So perhaps the right thing is to add a layer to email that provides common users control. Email servers that provide consensual service can talk to each other. Not a white list, a trust list. Otherwise just use gmail. How to do this? If you send a non-consensual mail, you pay a fine. A way for mail providers to make money by improving the basic function of common users. I'm just making this up, I'm sure you can come up with a better system. Or perhaps you can help me understand whether the purpose is valid or not?

ronsor 2y ago
> If you send a non-consensual mail, you pay a fine. Spam is already illegal, but spammers don't pay a fine because good luck actually finding them.

kstrauser 2y ago

I’m one of the people who gave up on self hosting. After 25 years, I now run my personal domains off Apple, who does it for free if you have a paid iCloud plan. It was fun. It was educational as hell. It was an adventure. It was also an incredible time suck keeping up with new spam and anti-spam and anti-anti-spam methods. I highly recommend the experience for those interested. I also recommend regularly reevaluating whether you’re still having fun doing it.

elfchief 2y ago

I really wish I could move my personal email over to gmail -- I've run my own local email server for 30 years, and tbh I just don't really care to do that anymore. But I'm stuck -- I exclusively use 'tagged' email addresses when giving anyone my email address, so every incoming message is addressed to "myusername-sometag@domain"... and gmail, of course, uses a + instead of a - for doing that kind of tagging. So if I tried to migrate hosts, literally none of my incoming email would arrive anymore. Sucks that a decision I made before gmail even existed now restrains me so much. :/

akovaski 2y ago
Several email providers provide catch-all/wildcard functionality which can handle arbitrary tagging. https://www.fastmail.help/hc/en-us/articles/1500000277942-Catch-all-wildcard-aliases https://www.fastmail.help/hc/en-us/articles/1500000277942-Ca... https://help.zoho.com/portal/en/community/topic/receive-only-wildcard-aliases https://help.zoho.com/portal/en/community/topic/receive-only... https://support.google.com/a/answer/12943537?hl=en https://support.google.com/a/answer/12943537?hl=en
noAnswer 2y ago
Even the longest journey begins with one step. I have a similar mail address pattern (ebay-534389@foo etc.) When I started 7 years ago. I opened my password safe and changed one account after another. If the old account received something I overlooked and I was still interested in it, I changed this address too. A year later and the old address receives nothing anymore. Nothings stops me or you from changing it back. Update: And yes, there are a million providers that provide a catch-all mechanism. Even some domain registrars provide catch-all forwarding.
bsder 2y ago
I think Fastmail can deal with this. I don't know about using "-"(dash), specifically, though ... And never use "+" as a separator. There are zillions of shitty regex email address "validators" that won't take it even though gmail uses it.

jcynix 2y ago

I'm running my own email server for more than 20 years now. And spamassassin still works fine, filtering locally. But even before spamassassin gets stuff to analyse, my postfix server checks if a sender's ip address has a reverse dns mapping (most hacked office clients don't have one) and last but not least asks the postgrey policy server if it should accept an incoming message immediately or tell the sender to retry after some time. That is, I'm using greylisting, and yes, this still blocks quite a number of incoming messages, as spammers do not retry to send their spam, if it doesn't work at the first attempt. So with excellent software like Wietse Venemas Postfix and a rather restrictive setup, an email server is a low maintenance server to use IMHO. Edit: running your own email server gives you enough email address for you and your family to make it much easier to detect phishing emails: one address per shop and you'll notice if an email to the address of a shop tries to pose as your bank or some other sender. And it's easy to block certain senders after their job is done.

mjl- 2y ago

Indeed it's not a great idea to rely on 3rd party services for allow/block-listing. You're giving power to those 3rd parties, and it centralizes email. Ironically, quite some people running their own mail servers use blocklists, pushing deliverability problems due to being blocklisted onto fellow self-hosters. Another reason why it's not great to use allow/block-lists: You're passing the IP's of everyone you're communicating with to those 3rd parties. In mox (a mail server, I'm the author), junk filtering is first done based on known good/bad reputation of the (verified) domain of the address of the sender, based on classifications made by the user (and mox helps with those classifications). That means everyone you've seen good/bad mail from before, can quickly be classified without the need to contact any allow/blocklist. For first-time senders, a bayesian content-based classification is used. That is almost always is good enough. But you can also configure blocklists. They will only be consulted as long as there isn't enough reputation for the sender. Once you've corresponded with someone a few times, the blocklist isn't used for their messages anymore.

TwoNineFive 2y ago

While I like LWN and respect their writings, AND I appreciate and respect a good post-mortem story which involves some "I fucked up", this really just highlights negligence on their sysadmin staff. And, in that respect, I don't they have any business telling other people to not run a mail server given their demonstrated negligence. Not everyone else is a fuck up, but LWN sure is. > configuration was introduced as part of a hurried email server replacement driven by the demise of CentOS 7 They knew for YEARS, and even after the Red Hat controversy of shitting down CentOS, they still sat on their butt and did nothing until the very last minute, and then f*ked it up. That's some serious negligence. Also, any competent self-hoster knows you need to run a recursive DNS resolver on-host to avoid these kinds of issues. Many other DNS-based RBL services already had such limits and those issues were extremely well-known. This is another sign of negligence. This guy is an idiot and should not be running a mail server. And, he/they have no business telling anyone else what to do.