4 ms·

and if you are rolling your own are you having any issues with spf or spam flags?

spc476 11y ago
I run my own email server [1] using Postfix. I use greylisting [2][3] and it easily stops 50% of all spam. I looked into adding SPF, but decided against it as the effective rate was too low [4]. I've also recently looked at RBL [5] and while there were a few false positives (enough that I decided against immediately adding it) what it did catch was quite impressive [6]. Oddly enough, if I simply drop email addressed to my domain registration email [7] that is NOT from my registrar, then the amount of spam I receive would drop about 70%. But frankly, with the greylisting, the spam that does get through is easy enough to deal with. And I'm the only person who uses my domain for email. [1] I started in the web hosting business in '96 or '97 so this is pretty much old hat for me. [2] Definition: http://projects.puremagic.com/greylisting/ http://projects.puremagic.com/greylisting/ [3] Software I use: http://www.x-grey.com/ http://www.x-grey.com/ [4] http://boston.conman.org/2015/04/12.1 http://boston.conman.org/2015/04/12.1 [5] http://en.wikipedia.org/wiki/DNSBL http://en.wikipedia.org/wiki/DNSBL [6] http://boston.conman.org/2015/05/11.1 http://boston.conman.org/2015/05/11.1 [7] Yeah, I don't bother with the privacy settings on the domain registration.
- JimDabell 11y ago
  I think ironsides was referring to sending email, not receiving it. Sending email from a mail server without a good reputation can often land your email in spam filters these days. It's all very well saying that the amount of spam you get is manageable, but that doesn't really matter if your own outgoing email becomes unreliable because you aren't using a recognised provider.
  - ironsides 11y ago
    Jim, what can we do to increase the odds of our email reaching the intended destination on self-hosted domains?
    - spc476 11y ago
      I'm not Jim, but what I've done is: 1) have a valid PTR record for the email server. 2) Set up SPF records. 3) Just run email on it. If you do run a webserver on the same server, DON'T RUN PHP! In my experience [1] the single most abused attack vector on webservers is PHP and about 60% of the time it's abused to install spam sending software on the server and that leads to the IP address getting marked as a spammer. [1] About fifteen years in web-hosting.
  - e12e 11y ago
    This is sadly true. With just greylisting, spam isn't much of a problem. I get some spam, most of it to an address leaked from the adobe-hack (I don't drop mail to it, I just keep the few spam emails that get through greylisting, for possible future use for training a bayesian spam filter), and some sent to my publicly registered company email (mandated by law in Norway). It's unfortunately pretty hard to tell the difference between people being slow to reply to mails to gmail addresses, and google flagging your mail as spam for no discernibly good reason. Anecdotally they don't care about anyone other than gmail users, so there's not much to do about it other than a) give up on the idea that gmail interops with standard email, b) hope that more people move away from gmail, or c) just tell people that you don't care that your email is filtered as spam because they're using an email provider (gmail) that doesn't deal well with email.
  - spc476 11y ago
    That's not much of a concern for me. My email server also handles outgoing email as well. I'm fortunate in that I've been running my own server on that domain since 1998. And on the current IP address for probably a decade by now. Over the years, there have been only two domains where my email had issues being delivered: AOL [1] and Google mail. For AOL, I had to inform AOL that I was responsible for the IP address of my server and promise not to send spam and that I take care of any spams from my IP address, etc. Annoying, but once done, no issues. Google on the other hand ... I've had a few times where my email was being dropped by Google mail. Annoying, but the issues did seem to clear up on its own after time. I do have a gmail account [2] that I use for testing when I think there are issues but I don't recall the last time I had one. But I have had them. [1] My dad is still on AOL. [2] Google's spam catching ability isn't 100% either. I don't use gmail at all for email, so anything I get there is either 1) a mistake because someone is trying to email a person with my name at gmail or 2) spam. It's mostly spam [3] [3] I just checked my gmail account. 140 new messages since I last cleaned it out in mid-October. All spam. Way to go, Google! (but to be fair, it shunted 726 messages to the spam folder).
marcosdumay 11y ago
I run my email server (it actually does not provide any extra privacy, as it's on a linode), and 99% of the time, no, I don't have problems with spf and spam flags. (In fact, spf is great, I don't get the blame of sending spam anymore since I've set it.) There's an odd email server here and there that suspects anything that isn't gmail, there was even a mail server once that required me to prove I exist, but those are very few, and normally single user installations. The secret is that besides not sending spam, you must receive email. If you don't get enough email, other servers start suspecting you. And, of course, there are configuration problems - since I'm writing my own mail server, I get a few of them, but even on standard software you have to make sure you set it correctly.

I run my own email server [1] using Postfix. I use greylisting [2][3] and it easily stops 50% of all spam. I looked into adding SPF, but decided against it as the effective rate was too low [4]. I've also recently looked at RBL [5] and while there were a few false positives (enough that I decided against immediately adding it) what it did catch was quite impressive [6]. Oddly enough, if I simply drop email addressed to my domain registration email [7] that is NOT from my registrar, then the amount of spam I receive would drop about 70%. But frankly, with the greylisting, the spam that does get through is easy enough to deal with. And I'm the only person who uses my domain for email. [1] I started in the web hosting business in '96 or '97 so this is pretty much old hat for me. [2] Definition: http://projects.puremagic.com/greylisting/ http://projects.puremagic.com/greylisting/ [3] Software I use: http://www.x-grey.com/ http://www.x-grey.com/ [4] http://boston.conman.org/2015/04/12.1 http://boston.conman.org/2015/04/12.1 [5] http://en.wikipedia.org/wiki/DNSBL http://en.wikipedia.org/wiki/DNSBL [6] http://boston.conman.org/2015/05/11.1 http://boston.conman.org/2015/05/11.1 [7] Yeah, I don't bother with the privacy settings on the domain registration.

JimDabell 11y ago
I think ironsides was referring to sending email, not receiving it. Sending email from a mail server without a good reputation can often land your email in spam filters these days. It's all very well saying that the amount of spam you get is manageable, but that doesn't really matter if your own outgoing email becomes unreliable because you aren't using a recognised provider.
- ironsides 11y ago
  Jim, what can we do to increase the odds of our email reaching the intended destination on self-hosted domains?
  - spc476 11y ago
    I'm not Jim, but what I've done is: 1) have a valid PTR record for the email server. 2) Set up SPF records. 3) Just run email on it. If you do run a webserver on the same server, DON'T RUN PHP! In my experience [1] the single most abused attack vector on webservers is PHP and about 60% of the time it's abused to install spam sending software on the server and that leads to the IP address getting marked as a spammer. [1] About fifteen years in web-hosting.
- e12e 11y ago
  This is sadly true. With just greylisting, spam isn't much of a problem. I get some spam, most of it to an address leaked from the adobe-hack (I don't drop mail to it, I just keep the few spam emails that get through greylisting, for possible future use for training a bayesian spam filter), and some sent to my publicly registered company email (mandated by law in Norway). It's unfortunately pretty hard to tell the difference between people being slow to reply to mails to gmail addresses, and google flagging your mail as spam for no discernibly good reason. Anecdotally they don't care about anyone other than gmail users, so there's not much to do about it other than a) give up on the idea that gmail interops with standard email, b) hope that more people move away from gmail, or c) just tell people that you don't care that your email is filtered as spam because they're using an email provider (gmail) that doesn't deal well with email.
- spc476 11y ago
  That's not much of a concern for me. My email server also handles outgoing email as well. I'm fortunate in that I've been running my own server on that domain since 1998. And on the current IP address for probably a decade by now. Over the years, there have been only two domains where my email had issues being delivered: AOL [1] and Google mail. For AOL, I had to inform AOL that I was responsible for the IP address of my server and promise not to send spam and that I take care of any spams from my IP address, etc. Annoying, but once done, no issues. Google on the other hand ... I've had a few times where my email was being dropped by Google mail. Annoying, but the issues did seem to clear up on its own after time. I do have a gmail account [2] that I use for testing when I think there are issues but I don't recall the last time I had one. But I have had them. [1] My dad is still on AOL. [2] Google's spam catching ability isn't 100% either. I don't use gmail at all for email, so anything I get there is either 1) a mistake because someone is trying to email a person with my name at gmail or 2) spam. It's mostly spam [3] [3] I just checked my gmail account. 140 new messages since I last cleaned it out in mid-October. All spam. Way to go, Google! (but to be fair, it shunted 726 messages to the spam folder).

marcosdumay 11y ago

I run my email server (it actually does not provide any extra privacy, as it's on a linode), and 99% of the time, no, I don't have problems with spf and spam flags. (In fact, spf is great, I don't get the blame of sending spam anymore since I've set it.) There's an odd email server here and there that suspects anything that isn't gmail, there was even a mail server once that required me to prove I exist, but those are very few, and normally single user installations. The secret is that besides not sending spam, you must receive email. If you don't get enough email, other servers start suspecting you. And, of course, there are configuration problems - since I'm writing my own mail server, I get a few of them, but even on standard software you have to make sure you set it correctly.