5 ms·

Even if your home provider allows you to accept SMTP on port 25, you're going to have a hell of a hard time with outbound delivery. The big mail providers give

Even if your home provider allows you to accept SMTP on port 25, you're going to have a hell of a hard time with outbound delivery. The big mail providers give very low reputation ranking to e-mails originating from consumer connections. Even commercial connections w/ hosting providers need to be "warmed up" for a period of time to get their sending reputation to an appropriate level where they can expect reliable delivery without automatic spam-boxing. What I'd rather see is a company go into partnership with the big providers to certify individual senders at home. The idea is that you'd put up some kind of bond (a few hundred USD?) to help ensure that you won't be sending spam. In exchange for your bond, the company vouches for your IP to Google/Yahoo/Hotmail/etc and you're allowed to send your own email. After some period of use w/o any spam complaints, you get your bond money back.

ghostly_s 11y ago
man, no-one is going to jump on this bandwagon if it requires a several-hundred dollar outlay. Considering the massive volume required for spamning to be a worthwhile venture, wouldn't 50 bucks suffice?
- nmesse 11y ago
  Of course, but the money was not what the author of the post was trying to put across
jsprogrammer 11y ago
Maybe the big mail providers need to update their strategy regarding automatic spam-boxing? Most personal mail servers are not going to be sending mass emails. An algorithm that auto-spam-boxes mail from domains it's never seen before (or only receives a small trickle from) is ignorant.
- vidarh 11y ago
  Most personal mail servers won't, but most sources of e-mail sending un-authenticated e-mail direct to the target mail servers from consumer internet connections are spam these days because almost no consumers does that - instead most e-mail sent that way come from malware. An algorithm that auto-spam-boxes mail from address blocks used for consumer connections or from "new" servers is not ignorant - it is taking into account years worth of evidence that it is an effective counter-measure against spam. I'm saying that as someone who would like to run my own home mail server, and someone who is constantly battling to make sure our (100% opt in) bulk mail servers at work don't get blocked by overzealous spam filters - I wish it wasn't this way, but it is.
  - jsprogrammer 11y ago
    Do you have any data on the percentage of spam email sources (of all email sources) that send 1-10 emails per day? I'd expect that for a spam source to be effective, it'd need to send many more messages. Some spammers may try to run many low-rate sources, but you could likely do statistical analysis on the content of the messages to differentiate the spam sources from the non-spam sources. Further, allowing the occasional doesn't-look-like-spam-but-is-actually-spam message (if such a thing exists), isn't the end of the world. The user can mark it as spam and have the source blocked forever. The real spam problem that needed to be addressed was mailboxes being completely flooded with unsolicited messages. So flooded that it becomes impossible to read or even find the legitimate messages.
    - msandford 11y ago
      > Do you have any data on the percentage of spam email sources (of all email sources) that send 1-10 emails per day? Do you have any method by which all the different mailservers worldwide can successfully collaborate to determine precisely how many emails a particular mailserver sends per day? You're proposing that mailservers with a low emails-per-day metric be trusted. How is that metric established? How does everyone agree on it? Do we have to implement a new protocol in addition to SMTP in order for this to be viable? The most obvious response to this is "well each service provider can just count the stats internally and use that" but it's a non-starter. That means that Google with their, what, 1000 email servers (or more) now has to figure this out. And every other service provider too. Finally, given all the service providers out there, and the total number of "consumer" internet connected computers, giving all the computers a free 1-10 email pass means that spam is back to the worst of 2000-2010 levels. Here's some math: There are 115mm households in the US http://quickfacts.census.gov/qfd/states/00000.html http://quickfacts.census.gov/qfd/states/00000.html 81% internet usage https://en.wikipedia.org/wiki/Internet_in_the_United_States#Access_and_speed https://en.wikipedia.org/wiki/Internet_in_the_United_States#... That's 93mm consumer connections Let's suppose that there are 20 big players in the mail provider category, Google, Yahoo, Microsoft (hotmail, office365, etc), AOL, comcast, at&t, time warner, etc. 20 seems like a good number. Since these systems can't be made to communicate with one another easily about the sent-count of every IP address in the world, they just do it locally. That means that the virus that infected your computer and turned it into a spam-bot gets: 10 free messages * 20 major providers * 93mm computers = 18 billion spams per day And that's just from the computers in the US. Once you take this global, you're probably talking at least 100 major providers and 300-500 million computers. Then you're talking something like a trillion spams a day. Seems like a reasonable idea until you look at how it would actually be implemented. Then it doesn't seem so great.
- jlgaddis 11y ago
  Many ISPs add their own consumer/residential netblocks to some blacklists (such as the Spamhaus PBL [0]) in order to help prevent spam from originating from the PCs of compromised users. Obviously, it is a receiver's choice whether to use such lists or not (although many/most? large mail providers do) but rejecting mail from these netblocks does result in a very noticeable decrease in spam. [0]: https://www.spamhaus.org/pbl/ https://www.spamhaus.org/pbl/
- superuser2 11y ago
  >Most personal mail servers are not going to be sending mass emails. There's no way to tell whether a random host on some residential ISP or VPS provider is doing personal email or spam. >An algorithm that auto-spam-boxes mail from domains it's never seen before (or only receives a small trickle from) is ignorant. Since blacklisting is so prevalent, spammers who aren't idiots will be sending most of their spam from different IPs. They go out harvesting unpatched VPSes and Windows botnets. The latter is patched by residential ISPs blocking port 25, the former is still a problem. >Maybe the big mail providers need to update their strategy regarding automatic spam-boxing? Why? Almost all legitimate email is coming from one of the big mail providers or a big-corporate Exchange server. What reason do they have to let more spam into their users' inboxes?
jlgaddis 11y ago
One option is to pay for mail hosting from a "big mail provider" or hosting company and simply use it only for relaying/sending outbound mail but not for incoming. Assuming 25/TCP inbound is not blocked by your ISP, you can point the MX RR at yourself and handle incoming mail on your own. I work for an ISP and run my own personal mail system. This (25/TCP outbound being blocked/restricted) is, as you mention, one of the biggest hurdles for an average person to be able to run their own mail system (especially on their home connection). I've debated offering up a cheap "outbound relay only" service for fellow geeks but I would have to (initially, at least) institute some pretty low rate restrictions in order to help prevent any spam issues. That's the biggest thing stopping me from doing it so far.
- LoSboccacc 11y ago
  one thing you'd lose that way is the direct secure delivery. not that it'd matter if you send it to someone on google, but you can't trust the relay server not to tamper with the mail unlikely, but if you are the type to run your own mailbox, probably that matters to you
  - jlgaddis 11y ago
    Good point, although if my options were either a) handle inbound myself, rely on a third-party for outbound or b) rely on a third-party for inbound and outbound, I'd pick the latter (although not everyone would, of course). Obviously, you'd have to trust whomever you're using for relaying not to mess with your mail. Another option could be a VPN connection to bypass ISP-level packets filters.
- chrissnell 11y ago
  It would be a nice feature add-on if Own-Mailbox users could add a special TXT record to the DNS that identifies them as Own-Mailbox users. The presence of this record would tell Own-Mailbox that it could do a direct delivery to that user and get the increased end-to-end security. For all other outbound mail, it could use the provider's SMTP relay.
lucb1e 11y ago
> you're going to have a hell of a hard time with outbound delivery. Been there done that. Takes a good while to build up reputation, but it's possible, even without dkim signing or anything like it. Also since it's my personal email, my policy has always been "if you can't receive it because of your mailserver, sucks to be you -- you're using that service so it's on your end."
- aioprisan 11y ago
  Really? So if my email sends get stuck in a client's Gmail spam queue, sucks for me or them? Sucks for me a lot more and I'll move to a hosted service instead that can guarantee email delivery.
  - lucb1e 11y ago
    > a client's Gmail spam queue I mentioned it's my personal email, not really meant for work (though I did use it for that also). But technically yes, if they choose to trust Google with delivering the email and Google doesn't deliver, it's a problem on their end. Setting up your email in a way that a particular service (in this case Google) accepts it, doesn't scale.
    - georgerobinson 11y ago
      Is this not quite risky, even for personal use? How do you contact family and friends who aren't savvy enough to setup their own email server? What about replying to job interviews? It would really suck if you didn't get the job because the hiring manager never received your email.
      - lucb1e 11y ago
        In my few years of using this, and I'm by no means an expert on email servers, I have rarely had issues beyond ending up in Hotmail's and Gmail's spambox. Never outright rejections I think. Google's spamfilter is the most annoying one, followed by Hotmail; everyone else usually works pretty much fine.

ghostly_s 11y ago

man, no-one is going to jump on this bandwagon if it requires a several-hundred dollar outlay. Considering the massive volume required for spamning to be a worthwhile venture, wouldn't 50 bucks suffice?

nmesse 11y ago
Of course, but the money was not what the author of the post was trying to put across

jsprogrammer 11y ago

Maybe the big mail providers need to update their strategy regarding automatic spam-boxing? Most personal mail servers are not going to be sending mass emails. An algorithm that auto-spam-boxes mail from domains it's never seen before (or only receives a small trickle from) is ignorant.

vidarh 11y ago
Most personal mail servers won't, but most sources of e-mail sending un-authenticated e-mail direct to the target mail servers from consumer internet connections are spam these days because almost no consumers does that - instead most e-mail sent that way come from malware. An algorithm that auto-spam-boxes mail from address blocks used for consumer connections or from "new" servers is not ignorant - it is taking into account years worth of evidence that it is an effective counter-measure against spam. I'm saying that as someone who would like to run my own home mail server, and someone who is constantly battling to make sure our (100% opt in) bulk mail servers at work don't get blocked by overzealous spam filters - I wish it wasn't this way, but it is.
- jsprogrammer 11y ago
  Do you have any data on the percentage of spam email sources (of all email sources) that send 1-10 emails per day? I'd expect that for a spam source to be effective, it'd need to send many more messages. Some spammers may try to run many low-rate sources, but you could likely do statistical analysis on the content of the messages to differentiate the spam sources from the non-spam sources. Further, allowing the occasional doesn't-look-like-spam-but-is-actually-spam message (if such a thing exists), isn't the end of the world. The user can mark it as spam and have the source blocked forever. The real spam problem that needed to be addressed was mailboxes being completely flooded with unsolicited messages. So flooded that it becomes impossible to read or even find the legitimate messages.
  - msandford 11y ago
    > Do you have any data on the percentage of spam email sources (of all email sources) that send 1-10 emails per day? Do you have any method by which all the different mailservers worldwide can successfully collaborate to determine precisely how many emails a particular mailserver sends per day? You're proposing that mailservers with a low emails-per-day metric be trusted. How is that metric established? How does everyone agree on it? Do we have to implement a new protocol in addition to SMTP in order for this to be viable? The most obvious response to this is "well each service provider can just count the stats internally and use that" but it's a non-starter. That means that Google with their, what, 1000 email servers (or more) now has to figure this out. And every other service provider too. Finally, given all the service providers out there, and the total number of "consumer" internet connected computers, giving all the computers a free 1-10 email pass means that spam is back to the worst of 2000-2010 levels. Here's some math: There are 115mm households in the US http://quickfacts.census.gov/qfd/states/00000.html http://quickfacts.census.gov/qfd/states/00000.html 81% internet usage https://en.wikipedia.org/wiki/Internet_in_the_United_States#Access_and_speed https://en.wikipedia.org/wiki/Internet_in_the_United_States#... That's 93mm consumer connections Let's suppose that there are 20 big players in the mail provider category, Google, Yahoo, Microsoft (hotmail, office365, etc), AOL, comcast, at&t, time warner, etc. 20 seems like a good number. Since these systems can't be made to communicate with one another easily about the sent-count of every IP address in the world, they just do it locally. That means that the virus that infected your computer and turned it into a spam-bot gets: 10 free messages * 20 major providers * 93mm computers = 18 billion spams per day And that's just from the computers in the US. Once you take this global, you're probably talking at least 100 major providers and 300-500 million computers. Then you're talking something like a trillion spams a day. Seems like a reasonable idea until you look at how it would actually be implemented. Then it doesn't seem so great.
jlgaddis 11y ago
Many ISPs add their own consumer/residential netblocks to some blacklists (such as the Spamhaus PBL [0]) in order to help prevent spam from originating from the PCs of compromised users. Obviously, it is a receiver's choice whether to use such lists or not (although many/most? large mail providers do) but rejecting mail from these netblocks does result in a very noticeable decrease in spam. [0]: https://www.spamhaus.org/pbl/ https://www.spamhaus.org/pbl/
superuser2 11y ago
>Most personal mail servers are not going to be sending mass emails. There's no way to tell whether a random host on some residential ISP or VPS provider is doing personal email or spam. >An algorithm that auto-spam-boxes mail from domains it's never seen before (or only receives a small trickle from) is ignorant. Since blacklisting is so prevalent, spammers who aren't idiots will be sending most of their spam from different IPs. They go out harvesting unpatched VPSes and Windows botnets. The latter is patched by residential ISPs blocking port 25, the former is still a problem. >Maybe the big mail providers need to update their strategy regarding automatic spam-boxing? Why? Almost all legitimate email is coming from one of the big mail providers or a big-corporate Exchange server. What reason do they have to let more spam into their users' inboxes?

jlgaddis 11y ago

One option is to pay for mail hosting from a "big mail provider" or hosting company and simply use it only for relaying/sending outbound mail but not for incoming. Assuming 25/TCP inbound is not blocked by your ISP, you can point the MX RR at yourself and handle incoming mail on your own. I work for an ISP and run my own personal mail system. This (25/TCP outbound being blocked/restricted) is, as you mention, one of the biggest hurdles for an average person to be able to run their own mail system (especially on their home connection). I've debated offering up a cheap "outbound relay only" service for fellow geeks but I would have to (initially, at least) institute some pretty low rate restrictions in order to help prevent any spam issues. That's the biggest thing stopping me from doing it so far.

LoSboccacc 11y ago
one thing you'd lose that way is the direct secure delivery. not that it'd matter if you send it to someone on google, but you can't trust the relay server not to tamper with the mail unlikely, but if you are the type to run your own mailbox, probably that matters to you
- jlgaddis 11y ago
  Good point, although if my options were either a) handle inbound myself, rely on a third-party for outbound or b) rely on a third-party for inbound and outbound, I'd pick the latter (although not everyone would, of course). Obviously, you'd have to trust whomever you're using for relaying not to mess with your mail. Another option could be a VPN connection to bypass ISP-level packets filters.
chrissnell 11y ago
It would be a nice feature add-on if Own-Mailbox users could add a special TXT record to the DNS that identifies them as Own-Mailbox users. The presence of this record would tell Own-Mailbox that it could do a direct delivery to that user and get the increased end-to-end security. For all other outbound mail, it could use the provider's SMTP relay.

lucb1e 11y ago

> you're going to have a hell of a hard time with outbound delivery. Been there done that. Takes a good while to build up reputation, but it's possible, even without dkim signing or anything like it. Also since it's my personal email, my policy has always been "if you can't receive it because of your mailserver, sucks to be you -- you're using that service so it's on your end."

aioprisan 11y ago
Really? So if my email sends get stuck in a client's Gmail spam queue, sucks for me or them? Sucks for me a lot more and I'll move to a hosted service instead that can guarantee email delivery.
- lucb1e 11y ago
  > a client's Gmail spam queue I mentioned it's my personal email, not really meant for work (though I did use it for that also). But technically yes, if they choose to trust Google with delivering the email and Google doesn't deliver, it's a problem on their end. Setting up your email in a way that a particular service (in this case Google) accepts it, doesn't scale.
  - georgerobinson 11y ago
    Is this not quite risky, even for personal use? How do you contact family and friends who aren't savvy enough to setup their own email server? What about replying to job interviews? It would really suck if you didn't get the job because the hiring manager never received your email.
    - lucb1e 11y ago
      In my few years of using this, and I'm by no means an expert on email servers, I have rarely had issues beyond ending up in Hotmail's and Gmail's spambox. Never outright rejections I think. Google's spamfilter is the most annoying one, followed by Hotmail; everyone else usually works pretty much fine.