10 ms·

A Survival Guide for the Small Mail Server

214 points by Sami_Lehtinen 12y ago

jgroszko 12y ago
I spent a few weeks this past fall trying to configure spamassassin to be useful, but I was getting up to 30 pieces of spam a day and it was getting obnoxious. I configured my setup to use greylisting and it wound up being significantly more effective. I get maybe one piece of junk a week. https://help.ubuntu.com/community/PostfixGreylisting https://help.ubuntu.com/community/PostfixGreylisting
- blfr 12y ago
  I only greylist messages which get at least one point from SpamAssasin. That way obvious ham is delivered immediately.
  - jlgaddis 12y ago
    I'd like to do that, but greylisting is typically done at the SMTP level -- before the messages are anywhere close to SpamAssassin. Can I ask how you're accomplishing this?
    - mike-cardwell 12y ago
      You can run SpamAssassin at SMTP time in the DATA phase. At least, you can with both Exim and Postfix. I assume other MTA's support that too. You can run Greylisting at the same stage after SpamAssassin has been run and before the message has been accepted.
    - dmoo 12y ago
      Have a look at assp, complex set-up but very powerful. http://sourceforge.net/projects/assp/ http://sourceforge.net/projects/assp/
      - jlgaddis 12y ago
        Thanks, the web interface for that looks pretty nice but it'd take too much to move our mail systems to that.
ForHackernews 12y ago
I'll throw in a plug here for http://www.iredmail.org/ http://www.iredmail.org/ which is a great way to set up and configure a personal mail server. Edit: I just noticed iredmail quotes this article on their front page.
2bluesc 12y ago
I'm currently using Fastmail and might be too lazy/busy to switch as I'm currently a trial user. The Android + Web app is better then K9-Mail and Roundcube IMHO. If I did switch back to running my own show, I'd do Digital Ocean + Mailinabox via Docker. Mailinabox aims to do all the things right out of the box: https://mailinabox.email/ https://mailinabox.email/
- Karunamon 12y ago
  What do you think of Fastmail? I'm considering migrating from Gmail (Google Apps) to them.
  - pionar 12y ago
    I've never had a problem with them, and I've been a (paying) customer for over a year now.
  - joedavison 12y ago
    I've used them since 2006. It's probably the only service I have never even questioned whether or not I should renew every year. It is very good.
  - rando3826 12y ago
    Great. The thing I like is that you get maximum flexibility, and good web interface. For example: I run a mail server which handles mail for some subdomains, and the root domain mail I route through them. Every time I give an email out to a company, I name it company-name@one-of-many-short-fastmail-domains.com. I never have to worry about spam from those email address, as I can filter and cycle those at will.
    - tem5050 12y ago
      I do something very similar, but instead of using the company name (or something close to it) I use a long random string instead. It mainly prevents someone from 'company hopping' (i.e. changing 'facebook' to 'google'). The chance of that happening might be small, but I figure I may as well as it isn't really any more effort
geoka9 12y ago
I set up my own Postfix server about a year ago, because I wanted to send newsletters to my users and have an "official" mail box for support requests and such. I used a guide[1] to secure it against spammers. I don't use spam assassin. In the year that followed I received exactly zero spam messages. There have been plenty of attempts to send spam using my server, but the postfix filters intercepted all of them. To make sure that my messages are not treated as spam by the major email providers, I checked that my VPS IP is not in any of the spam blacklists and configured SPF and DKIM records. Gmail spam-flagged the messages for a while, but after a couple of months it learned they're not spam. Surprisingly, other email providers (yahoo, ms, aol) never batted an eye. I'm quite happy with my own server. [1] https://honeypot.net/filtering-spam-with-postfix/ https://honeypot.net/filtering-spam-with-postfix/
- mjn 12y ago
  Fwiw I've had better luck without SPF records than with them (or at least without hard-fail SPF records). As far as I know, the lack of SPF never resulted in lack of delivery (and I have no delivery problems to the big providers). But my previous setup with a hardfail SPF would cause my mail to be rejected from various people's forwarding setups, especially when forwarding to corporate or university email addresses. The problematic scenario is when they have their own domain hosted somewhere with mail forwarding (e.g. via Dreamhost), that sends it onwards to their real email account hosted by an institution. The final-destination email server then sees the forwarding server as the source of the message, and bounces it for failing SPF. Openspf.org has a page about that [1] which recommends email providers allow their users to configure authorized forwarding sources as exempt from SPF checks on their incoming mail, and default to not rejecting based on SPF when users haven't configured the preference. But in my experience few institutions follow this recommendation. Once I ditched the SPF records, I've had no deliverability problems running my own mailserver. [1] http://www.openspf.org/Best_Practices/Forwarding http://www.openspf.org/Best_Practices/Forwarding
- sliverstorm 12y ago
  I got flagged as spam pretty reliably by GMail, but I eventually discovered it was because my mail server was delivering mail to GMail over IPv6, and I had never set up proper records for my IPv6 addresses. GMail was the only one I had that problem with because few mailservers are using IPv6.
Someone1234 12y ago
I think it is absolutely hilarious (and infuriating) that in their opening paragraph they forgot to list spam blacklists, like themselves, as being perhaps the biggest hurdle for small companies and individuals running mail servers. I ran a mail server for almost five years, and 9/10 of the issues I had to resolve were various anti-spam blacklists or individual hosts blocking our emails and then having customers complaining because we never emailed them. There was never any reason given for the blocks, and our logs didn't show any outgoing spam. However all of these spam blacklists would accept a "donation" if you didn't want to wait the 24-72 hours for them to unblock you. Essentially it is a shakedown. I've just given up self-hosting and I recommend others do the same. The issue isn't the spam, it is how much time you'll waste fighting the anti-spam blacklists and large email hosts. A job better left to e.g. SendGrid or SES. PS - We sent tens of thousands of emails a day.
- EvanAnderson 12y ago
  I have a number of Customers who have been self-hosting email since the late 1990's. The only blacklist that I've regularly had any problems with has been one-- ahem-- "fishy" company who, at least in the past, seemed to run their blacklist like a protection racket.
- vacri 12y ago
  I have this problem at one company at the moment. We use gmail with spf and dkim, and have a low mail count and no mass marketing that I'm aware of. We're on two blacklists. One gives zero reason for being on it, and has a 'contact us for reevaluation' form which I've submitted. No feedback, no change, no idea what to do next. The other blacklist suggests that it's our commercial site that's hosted with a provider who uses linode, and the linode CIDR block our company website is on has been 'banned with no recourse to remove' due to the huge amounts of spam it has sent. For that list, it apparently doesn't matter that our mail comes from google, not linode. When I get some free time, I'll try to move that website. What do you do when the vigilantes screw you?
  - fsniper 12y ago
    changing your ip is the solution in these situations. And that's why self hosting is a real hurdle.
exratione 12y ago
Part of the problem talks about the solution. The real problem for a small company mail server isn't setting up a respectably secure operation: set up SPF and DKIM and you're good to go. The problem is maintaining deliverability for anything more than very casual usage of mail into a very complicated ecosystem. At any point in time a random switch can flip on some heuristic somewhere and suddenly a large mail provider will reject you, or you're on a blacklist that provides no explanation or ability to remove your mails, and that isn't isolated: it will spread throughout the ecosystem, and leave a stain that can linger for a long time. I've run a few-thousand person newsletter mail list for more than ten years, and fairly recently switched to SES because it's simply not possible to guarantee deliverability even at that modest scale running it yourself from your own servers. If you're not hooked into the ecosystem then you have to fight ongoing battles that only a professional in the mail deliverability business has time and connections to understand and effectively win. Even then, you have to be very careful: don't mention sums of money (e.g. censor all discussion of research funding), don't trigger dumb spamassassin rules (e.g. sentences with lots of long words in a scientific paper), don't talk about known trigger words (e.g. no scientific articles on the role of growth hormone in mouse aging) and so forth. It is crazy. The absolutely rational response to all of this is to outsource mail delivery.
tristor 12y ago
I have a work-in-progress guide for folks wanting to host their own email servers which provides a step-by-step process for taking a Debian (or Ubuntu) server and building out a secure install of Postfix and Dovecot to provide TLS 1.2/PFS enabled SMTP, IMAP, and webmail services along with competent spam filtering with low false-positive rate and all the required DNS and other settings to ensure your mail is accepted by GMail and the like. I've never really posted it up, but I feel like if you've read this article and are wanting more, this might help you. It's work-in-progress because I've been sidetracked from finishing the Client piece and also creating a Dockerfile that generates a group of self-contained images configured as recommended, but all the steps for the server are complete and tested. You can find it at http://securemail.tristor.ro/#!index.md http://securemail.tristor.ro/#!index.md It's all written in Markdown and I accept pull requests at https://github.com/Tristor/securemail.tristor.ro https://github.com/Tristor/securemail.tristor.ro Hope that anyone in the process of setting up a mail server finds this helpful.
- weaksauce 12y ago
  how well would postgres work instead of mysql for dovecot and postfix? I am not a huge fan of mysql.
  - tristor 12y ago
    I haven't tried it, honestly, but I'd imagine it'd work fine. The SQL usage there isn't very complex, so I'm pretty sure the syntax would even be exactly the same between the two for the few things I'm using it for. There is some difference in the connection strings though. It looks like Gentoo has some good docs on this in their Wiki at https://wiki.gentoo.org/wiki/Complete_Virtual_Mail_Server/Postfix_to_Database https://wiki.gentoo.org/wiki/Complete_Virtual_Mail_Server/Po... Good luck, let me know how it goes, and I'm happy to accept a pull request to add additional instructions for Postgres if you feel up to adding them.
- gog 12y ago
  Hi! I am the author of http://gogs.info/books/debian-mail/chunked/ http://gogs.info/books/debian-mail/chunked/ and I am working on something similar (I have switched to Dovecot and wrote a nice GUI for managing users and domain) but in the end it will be a set of Ansible scripts. The things I did different: * Amavisd-new instead of dspam and OpenDKIM * SQLGrey instead of Postgrey * unbound instead of BIND as a caching DNS server I have been thinking on adding PolicyD for rate limiting accounts but then I get a lot of overlap with other services. How are you satisfied with postfwd?
Spooky23 12y ago
Guide for small server operators is to put a bullet in the server. Buy O365/Google/etc. I ran a smallish email system for a year and a largish email operation for several years. It's a lot of work to do things right and the benefits are really small. The security related issues presented are very niche -- if you are concerned about data leakage for confidential discussions leaving your datacenter perimeter, you probably need to look at alternate solutions anyway.
- MichaelGG 12y ago
  What about lawsuits or other legal issues being able to get a subpoena without your knowledge?
  - Spooky23 12y ago
    That's not true for subpoenas. In some cases a warrant could result in that happening, but that's a smaller proportion. You're subject to the same risk in a commercial office or colo, btw.
    - MichaelGG 12y ago
      Really? Isn't data you give to a 3rd party their data, so they can give it away without penalty? With colo you can have monitoring and pick a friendly jurisdiction. (Market opportunity for a full featured Office 365 competitor that operates entirely in say, Switzerland, Iceland (?) or maybe Russia for a certain demographic.
      - Spooky23 12y ago
        Absolutely not. If that were true, the 4chan guy would have been in jail for possession of illegal material posted there. In the US, the Electronic Communications Privacy Act and Stored Communications Act provide protections here... In the event of a civil or criminal litigation, a subpoena delivered to Microsoft will be redirected to the customer or customer's counsel to respond to or quash. If the customer is non-responsive, Microsoft may be compelled to produce data. There are situations where a criminal investigation will result in a search warrant directed at an individual or organization. Search warrants are a different ballgame... The standards are higher and the cops show up and take everything. Keep in mind in that situation, the cloud has no impact in terms of data privacy -- the police will literally knock down your door or pry the colo cage open to seize what they after. If the nature of your business requires additional layers of secrecy or offshore servers in Iceland, you should not be using email.
tobbyb 12y ago
We[1] have a multi-domain mail server container with imap, pop, GUI admin, webmail, and spam lists that is basically ready to go, based on LXC. You can launch the container in seconds and should be the fastest and perhaps easiest way to have a fully functioning mail server. There is a starter guide [2] and even a [3] video to get you going. However a mail server unlike most other apps is not only complex to install - which we try to address - but also complex to run. For most if not all users mail just can't fail and this needs a fair bit of knowledge of dns, smtp, spam prevention, security. I think in all but the most committed cases it can prove a bit overwhelming for the average user. [1]http://www.flockport.com/containers http://www.flockport.com/containers [2]http://www.flockport.com/using-the-flockport-mailserver/ http://www.flockport.com/using-the-flockport-mailserver/ [3]https://www.youtube.com/watch?v=ysUswy8rGwM https://www.youtube.com/watch?v=ysUswy8rGwM
kefka 12y ago
I just set up my new VPS, which included getting Apache/Wordpress/Postfix/Dovecot set up and secured, along with integration of StartSSL free cert. site: https://crankylinuxuser.net https://crankylinuxuser.net And I secured it down appropriately whilst also using multitude of external scanners to verify what I thought I did. It was somewhat problematic, mainly with the AUTH between dovecot and postfix. And then I do a RBL search. Some idiot spammer did the dirty deed back in September. 3 RBLs, all lesser known ones. So, I responded as they requested, with a justification of why I should be removed. I did that today around noon. I'm now on none of them. So the whole "shakedown" issue, at least for me, seems not to be the case.
jrapdx3 12y ago
Like others have commented, I've been running a small email service for several years. The key point here is "small" meaning serving a few users for mainly personal mail. It's a very low volume affair, no "mass mailings", newletters or anything of that kind. I'm using Exim only because it was the MTA I knew how to configure. It's a simple setup, allows no relays, uses TLS when possible, a few bad actors are RCPT blacklisted, that's about it. I use a webmail program I wrote to retrieve and send mail. It's all quite basic. Have had very little trouble with spam or or being blocked, which may be a benefit of keeping such a low profile. All in all, I've enjoyed the freedom and privacy of running my own email server. I suspect the secret of success is keeping it small, personal and inconspicuous.
leni536 12y ago
> The organization no longer has control of its own email security. Well it's not entirely true. They could have a strict client side encryption policy. However it could be even harder to manage than mail server.
zaroth 12y ago
I run a small server with a few dozen users, the only problem I've had is verizon.net bounces all messages claiming spam from my IP, and steadfastly refuses to whitelist me despite numerous attempts. Always just a form-letter response, despite having checked all the boxes (SPF, DKIM, rDNS). Luckily I'm happy to live without being able to email people on @verizon.net. I'm just not willing to store all my personal and business communication with a 3rd party. It goes against the entire purpose of the standard, and I figure the day it becomes impossible to run my own server is the day I no longer use email.

214 points by Sami_Lehtinen 12y ago

I spent a few weeks this past fall trying to configure spamassassin to be useful, but I was getting up to 30 pieces of spam a day and it was getting obnoxious. I configured my setup to use greylisting and it wound up being significantly more effective. I get maybe one piece of junk a week. https://help.ubuntu.com/community/PostfixGreylisting https://help.ubuntu.com/community/PostfixGreylisting

blfr 12y ago
I only greylist messages which get at least one point from SpamAssasin. That way obvious ham is delivered immediately.
- jlgaddis 12y ago
  I'd like to do that, but greylisting is typically done at the SMTP level -- before the messages are anywhere close to SpamAssassin. Can I ask how you're accomplishing this?
  - mike-cardwell 12y ago
    You can run SpamAssassin at SMTP time in the DATA phase. At least, you can with both Exim and Postfix. I assume other MTA's support that too. You can run Greylisting at the same stage after SpamAssassin has been run and before the message has been accepted.
  - dmoo 12y ago
    Have a look at assp, complex set-up but very powerful. http://sourceforge.net/projects/assp/ http://sourceforge.net/projects/assp/
    - jlgaddis 12y ago
      Thanks, the web interface for that looks pretty nice but it'd take too much to move our mail systems to that.

ForHackernews 12y ago

I'll throw in a plug here for http://www.iredmail.org/ http://www.iredmail.org/ which is a great way to set up and configure a personal mail server. Edit: I just noticed iredmail quotes this article on their front page.

2bluesc 12y ago

I'm currently using Fastmail and might be too lazy/busy to switch as I'm currently a trial user. The Android + Web app is better then K9-Mail and Roundcube IMHO. If I did switch back to running my own show, I'd do Digital Ocean + Mailinabox via Docker. Mailinabox aims to do all the things right out of the box: https://mailinabox.email/ https://mailinabox.email/

Karunamon 12y ago
What do you think of Fastmail? I'm considering migrating from Gmail (Google Apps) to them.
- pionar 12y ago
  I've never had a problem with them, and I've been a (paying) customer for over a year now.
- joedavison 12y ago
  I've used them since 2006. It's probably the only service I have never even questioned whether or not I should renew every year. It is very good.
- rando3826 12y ago
  Great. The thing I like is that you get maximum flexibility, and good web interface. For example: I run a mail server which handles mail for some subdomains, and the root domain mail I route through them. Every time I give an email out to a company, I name it company-name@one-of-many-short-fastmail-domains.com. I never have to worry about spam from those email address, as I can filter and cycle those at will.
  - tem5050 12y ago
    I do something very similar, but instead of using the company name (or something close to it) I use a long random string instead. It mainly prevents someone from 'company hopping' (i.e. changing 'facebook' to 'google'). The chance of that happening might be small, but I figure I may as well as it isn't really any more effort

geoka9 12y ago

I set up my own Postfix server about a year ago, because I wanted to send newsletters to my users and have an "official" mail box for support requests and such. I used a guide[1] to secure it against spammers. I don't use spam assassin. In the year that followed I received exactly zero spam messages. There have been plenty of attempts to send spam using my server, but the postfix filters intercepted all of them. To make sure that my messages are not treated as spam by the major email providers, I checked that my VPS IP is not in any of the spam blacklists and configured SPF and DKIM records. Gmail spam-flagged the messages for a while, but after a couple of months it learned they're not spam. Surprisingly, other email providers (yahoo, ms, aol) never batted an eye. I'm quite happy with my own server. [1] https://honeypot.net/filtering-spam-with-postfix/ https://honeypot.net/filtering-spam-with-postfix/

mjn 12y ago
Fwiw I've had better luck without SPF records than with them (or at least without hard-fail SPF records). As far as I know, the lack of SPF never resulted in lack of delivery (and I have no delivery problems to the big providers). But my previous setup with a hardfail SPF would cause my mail to be rejected from various people's forwarding setups, especially when forwarding to corporate or university email addresses. The problematic scenario is when they have their own domain hosted somewhere with mail forwarding (e.g. via Dreamhost), that sends it onwards to their real email account hosted by an institution. The final-destination email server then sees the forwarding server as the source of the message, and bounces it for failing SPF. Openspf.org has a page about that [1] which recommends email providers allow their users to configure authorized forwarding sources as exempt from SPF checks on their incoming mail, and default to not rejecting based on SPF when users haven't configured the preference. But in my experience few institutions follow this recommendation. Once I ditched the SPF records, I've had no deliverability problems running my own mailserver. [1] http://www.openspf.org/Best_Practices/Forwarding http://www.openspf.org/Best_Practices/Forwarding
sliverstorm 12y ago
I got flagged as spam pretty reliably by GMail, but I eventually discovered it was because my mail server was delivering mail to GMail over IPv6, and I had never set up proper records for my IPv6 addresses. GMail was the only one I had that problem with because few mailservers are using IPv6.

Someone1234 12y ago

I think it is absolutely hilarious (and infuriating) that in their opening paragraph they forgot to list spam blacklists, like themselves, as being perhaps the biggest hurdle for small companies and individuals running mail servers. I ran a mail server for almost five years, and 9/10 of the issues I had to resolve were various anti-spam blacklists or individual hosts blocking our emails and then having customers complaining because we never emailed them. There was never any reason given for the blocks, and our logs didn't show any outgoing spam. However all of these spam blacklists would accept a "donation" if you didn't want to wait the 24-72 hours for them to unblock you. Essentially it is a shakedown. I've just given up self-hosting and I recommend others do the same. The issue isn't the spam, it is how much time you'll waste fighting the anti-spam blacklists and large email hosts. A job better left to e.g. SendGrid or SES. PS - We sent tens of thousands of emails a day.

EvanAnderson 12y ago
I have a number of Customers who have been self-hosting email since the late 1990's. The only blacklist that I've regularly had any problems with has been one-- ahem-- "fishy" company who, at least in the past, seemed to run their blacklist like a protection racket.
vacri 12y ago
I have this problem at one company at the moment. We use gmail with spf and dkim, and have a low mail count and no mass marketing that I'm aware of. We're on two blacklists. One gives zero reason for being on it, and has a 'contact us for reevaluation' form which I've submitted. No feedback, no change, no idea what to do next. The other blacklist suggests that it's our commercial site that's hosted with a provider who uses linode, and the linode CIDR block our company website is on has been 'banned with no recourse to remove' due to the huge amounts of spam it has sent. For that list, it apparently doesn't matter that our mail comes from google, not linode. When I get some free time, I'll try to move that website. What do you do when the vigilantes screw you?
- fsniper 12y ago
  changing your ip is the solution in these situations. And that's why self hosting is a real hurdle.

exratione 12y ago

Part of the problem talks about the solution. The real problem for a small company mail server isn't setting up a respectably secure operation: set up SPF and DKIM and you're good to go. The problem is maintaining deliverability for anything more than very casual usage of mail into a very complicated ecosystem. At any point in time a random switch can flip on some heuristic somewhere and suddenly a large mail provider will reject you, or you're on a blacklist that provides no explanation or ability to remove your mails, and that isn't isolated: it will spread throughout the ecosystem, and leave a stain that can linger for a long time. I've run a few-thousand person newsletter mail list for more than ten years, and fairly recently switched to SES because it's simply not possible to guarantee deliverability even at that modest scale running it yourself from your own servers. If you're not hooked into the ecosystem then you have to fight ongoing battles that only a professional in the mail deliverability business has time and connections to understand and effectively win. Even then, you have to be very careful: don't mention sums of money (e.g. censor all discussion of research funding), don't trigger dumb spamassassin rules (e.g. sentences with lots of long words in a scientific paper), don't talk about known trigger words (e.g. no scientific articles on the role of growth hormone in mouse aging) and so forth. It is crazy. The absolutely rational response to all of this is to outsource mail delivery.

tristor 12y ago

I have a work-in-progress guide for folks wanting to host their own email servers which provides a step-by-step process for taking a Debian (or Ubuntu) server and building out a secure install of Postfix and Dovecot to provide TLS 1.2/PFS enabled SMTP, IMAP, and webmail services along with competent spam filtering with low false-positive rate and all the required DNS and other settings to ensure your mail is accepted by GMail and the like. I've never really posted it up, but I feel like if you've read this article and are wanting more, this might help you. It's work-in-progress because I've been sidetracked from finishing the Client piece and also creating a Dockerfile that generates a group of self-contained images configured as recommended, but all the steps for the server are complete and tested. You can find it at http://securemail.tristor.ro/#!index.md http://securemail.tristor.ro/#!index.md It's all written in Markdown and I accept pull requests at https://github.com/Tristor/securemail.tristor.ro https://github.com/Tristor/securemail.tristor.ro Hope that anyone in the process of setting up a mail server finds this helpful.

weaksauce 12y ago
how well would postgres work instead of mysql for dovecot and postfix? I am not a huge fan of mysql.
- tristor 12y ago
  I haven't tried it, honestly, but I'd imagine it'd work fine. The SQL usage there isn't very complex, so I'm pretty sure the syntax would even be exactly the same between the two for the few things I'm using it for. There is some difference in the connection strings though. It looks like Gentoo has some good docs on this in their Wiki at https://wiki.gentoo.org/wiki/Complete_Virtual_Mail_Server/Postfix_to_Database https://wiki.gentoo.org/wiki/Complete_Virtual_Mail_Server/Po... Good luck, let me know how it goes, and I'm happy to accept a pull request to add additional instructions for Postgres if you feel up to adding them.
gog 12y ago
Hi! I am the author of http://gogs.info/books/debian-mail/chunked/ http://gogs.info/books/debian-mail/chunked/ and I am working on something similar (I have switched to Dovecot and wrote a nice GUI for managing users and domain) but in the end it will be a set of Ansible scripts. The things I did different: * Amavisd-new instead of dspam and OpenDKIM * SQLGrey instead of Postgrey * unbound instead of BIND as a caching DNS server I have been thinking on adding PolicyD for rate limiting accounts but then I get a lot of overlap with other services. How are you satisfied with postfwd?

Spooky23 12y ago

Guide for small server operators is to put a bullet in the server. Buy O365/Google/etc. I ran a smallish email system for a year and a largish email operation for several years. It's a lot of work to do things right and the benefits are really small. The security related issues presented are very niche -- if you are concerned about data leakage for confidential discussions leaving your datacenter perimeter, you probably need to look at alternate solutions anyway.

MichaelGG 12y ago
What about lawsuits or other legal issues being able to get a subpoena without your knowledge?
- Spooky23 12y ago
  That's not true for subpoenas. In some cases a warrant could result in that happening, but that's a smaller proportion. You're subject to the same risk in a commercial office or colo, btw.
  - MichaelGG 12y ago
    Really? Isn't data you give to a 3rd party their data, so they can give it away without penalty? With colo you can have monitoring and pick a friendly jurisdiction. (Market opportunity for a full featured Office 365 competitor that operates entirely in say, Switzerland, Iceland (?) or maybe Russia for a certain demographic.
    - Spooky23 12y ago
      Absolutely not. If that were true, the 4chan guy would have been in jail for possession of illegal material posted there. In the US, the Electronic Communications Privacy Act and Stored Communications Act provide protections here... In the event of a civil or criminal litigation, a subpoena delivered to Microsoft will be redirected to the customer or customer's counsel to respond to or quash. If the customer is non-responsive, Microsoft may be compelled to produce data. There are situations where a criminal investigation will result in a search warrant directed at an individual or organization. Search warrants are a different ballgame... The standards are higher and the cops show up and take everything. Keep in mind in that situation, the cloud has no impact in terms of data privacy -- the police will literally knock down your door or pry the colo cage open to seize what they after. If the nature of your business requires additional layers of secrecy or offshore servers in Iceland, you should not be using email.

tobbyb 12y ago

We[1] have a multi-domain mail server container with imap, pop, GUI admin, webmail, and spam lists that is basically ready to go, based on LXC. You can launch the container in seconds and should be the fastest and perhaps easiest way to have a fully functioning mail server. There is a starter guide [2] and even a [3] video to get you going. However a mail server unlike most other apps is not only complex to install - which we try to address - but also complex to run. For most if not all users mail just can't fail and this needs a fair bit of knowledge of dns, smtp, spam prevention, security. I think in all but the most committed cases it can prove a bit overwhelming for the average user. [1]http://www.flockport.com/containers http://www.flockport.com/containers [2]http://www.flockport.com/using-the-flockport-mailserver/ http://www.flockport.com/using-the-flockport-mailserver/ [3]https://www.youtube.com/watch?v=ysUswy8rGwM https://www.youtube.com/watch?v=ysUswy8rGwM

kefka 12y ago

I just set up my new VPS, which included getting Apache/Wordpress/Postfix/Dovecot set up and secured, along with integration of StartSSL free cert. site: https://crankylinuxuser.net https://crankylinuxuser.net And I secured it down appropriately whilst also using multitude of external scanners to verify what I thought I did. It was somewhat problematic, mainly with the AUTH between dovecot and postfix. And then I do a RBL search. Some idiot spammer did the dirty deed back in September. 3 RBLs, all lesser known ones. So, I responded as they requested, with a justification of why I should be removed. I did that today around noon. I'm now on none of them. So the whole "shakedown" issue, at least for me, seems not to be the case.

jrapdx3 12y ago

Like others have commented, I've been running a small email service for several years. The key point here is "small" meaning serving a few users for mainly personal mail. It's a very low volume affair, no "mass mailings", newletters or anything of that kind. I'm using Exim only because it was the MTA I knew how to configure. It's a simple setup, allows no relays, uses TLS when possible, a few bad actors are RCPT blacklisted, that's about it. I use a webmail program I wrote to retrieve and send mail. It's all quite basic. Have had very little trouble with spam or or being blocked, which may be a benefit of keeping such a low profile. All in all, I've enjoyed the freedom and privacy of running my own email server. I suspect the secret of success is keeping it small, personal and inconspicuous.

leni536 12y ago

> The organization no longer has control of its own email security. Well it's not entirely true. They could have a strict client side encryption policy. However it could be even harder to manage than mail server.

zaroth 12y ago

I run a small server with a few dozen users, the only problem I've had is verizon.net bounces all messages claiming spam from my IP, and steadfastly refuses to whitelist me despite numerous attempts. Always just a form-letter response, despite having checked all the boxes (SPF, DKIM, rDNS). Luckily I'm happy to live without being able to email people on @verizon.net. I'm just not willing to store all my personal and business communication with a 3rd party. It goes against the entire purpose of the standard, and I figure the day it becomes impossible to run my own server is the day I no longer use email.