Hacker News Reader

I'll beg to differ. I've been running my own email for almost two decades and although the environment has changed, it is still perfectly accommodating of small operators that keep themselves up-to-date with context (e.g dnswl listing, notifications to major recipients, signed headers, best practise DNS records etc etc).

I changed IP address in the last 18 months and despite great trepidation, was pleasantly surprised that deliverability was not degraded.

Paying a bond feels like protection money for something I think my domains/hosts already have: a good reputation.

So have I, and I have experienced mounting difficulties over the last couple of years, despite decent efforts to keep up with protocol and defense mechanisms. Delivery to gmail and hotmail/outlook accounts is becoming a game of chance.

I shall probably, with huge regret, hand over the delivery process to an external operator in the near future.

> Delivery to gmail and hotmail/outlook accounts is becoming a game of chance.

I haven't had any issues recently, but wonder... Are the failures still well-noticeable? I mean, when Gmail/Hotmail reject the letter - do they do it properly (SMTP 4xx/5xx rejection) or maybe they're now silently discarding it?

When I had the issues (even with large mail providers), my MTA had always generated me a bounce, and it had always contained something sensible and immediately useful - like a message that my DNS records got messed up or IP got in a blacklist. Every error message I saw contained links or clues to how the delivery problem could be resolved. Had this changed?

Yes, hotmail will in some instances accept mail at SMTP level and then silently discard it. You cannot even request de-listing.

I had to deal with delivery issues to hotmail (few years ago though) and despite a few hoops, found them pretty reasonable to deal with. Some tools here: https://mail.live.com/mail/services.aspx and https://mail.live.com/mail/troubleshooting.aspx

No, that's the horror. Often they just drop the thing without as much an error code.

Dropping the connection with mere TCP RST (or whatever it is) is fine by me. Accepting the message, saying 200 and then not delivering it (not even to the "spam" folder) — that's what I feared.

We used to have issues sending password reset emails to users with Outlook hosted email - Outlook would return a 250 status code, then silently discard the email. It never turned up, not even in the spam filter.

Ditto. Except for about 15 years. It's not difficult to run your own mail server and deliverability is fine if you keep on top of changes in the tech.

Interesting. If you would write a blog post or a Show HN on this, I'd love to hear more. I ran my own servers for years but the spam arms race (as a recipient, not a sender) persuaded me to switch to using one of the big providers. I miss the flexibility and privacy of running my own email and if there's a way to do this without a bonded sender program, I'd love to see how it's done.

That was called "Bonded Spammer", from Ironport. They were trying to get ISPs to accept their whitelist.[1] (Ironport tried to call it "Bonded Sender", but nobody in anti-spam took that seriously.)

Ironport was selling mail filtering appliances. They also sold dedicated spamming engines that were whitelisted by the mail filtering appliances. This playing both sides of the street made them something of a joke, and they had to drop the spam engine business. They were eventually acquired by Cisco after that.

[1] https://groups.google.com/forum/#!topic/news.admin.net-abuse...

$200 is kinda expensive for a lot of people who may wish to self-host a personal email server, but also kinda too cheap for a spammer who may gladly pay that for improved deliverability.

Hm. I run my own MTA since 2005 or so. I'm not much of a sender, but haven't had any spam/delivery issues (even though I had double bounce misconfiguration and hit a RDNSBL once).

Many people use dnswl.org

If you're sending mail, you're crazy if you don't get your sending mail servers added there. It's easy to do and helps prove you're not spamming.

I'm always amazed at how many people don't know about, or use in reputation checks.

If people done know about it or use it in reputation checks then how is it so important?

Because lots of big companies are aware of it and do use it. Plus checks for it are written into Spamassassin.

So my point is, lots of anti-spam services check it, but few people sending mail make an attempt to get their server listed in there properly.

Mail Servers get listed in there automatically, but if you go in there and vouch for your mailservers properly you're get a more trusted ranking, which translates into a higher anti-spam ranking when checks are done.

This price point doesn't work, it only hurts small clients who want to send some email.

Pricing in general isn't an effective strategy to stop this unless it becomes more prohibitive than the profit margins - and that's a very big number.

Well, that's sort of what you're paying MailChimp (and more clearly, ReturnPath) for. But I guess they don't give you your money back.

It's strange to me that we need these gyrations to detect and thwart spam. I can detect spam with high accuracy based on nothing but the subject line and sender.

Do you scale? Can you look through 100 million emails tomorrow for me?

People keep repeating that. I not only run my own but I've helped other organizations do it, and if you have a clean IP range it's usually not a problem. No, you can't do it from your home DSL line, but that doesn't mean you can't do it.

I would gladly sign up for this service.

Actually, I'd love a good SMTP service that had a good reputation, but most of what's out there is more bulk-mail oriented. I just want to own my own domain and send email but not be beholden to gmail nor deal with deliverability headaches.

Personally I find that services like Mailgun, Mandrill or SES work well enough for this purpose and are not particularly expensive if your volume per month isn't huge. On Mailgun for example you can send up to 10k emails per month for $0. And that's 10k emails that you can send on your own terms, not just in bulk.

That's just not correct, I run MTA's for many of my clients on their static IP's with no outbound issues. It sometimes takes a few days to settle into a new IP but that doesn't happen that often.

You could have it tied to the business registration like EV certificate. I wish that the yahoos and microsofts of this world would just treat mail from a business with an EV certificate as non-spam by default.

That might be a useful tactic but it would require a lot more work to implement than current/existing solutions...

Let's say a remote mail server connects to mine to deliver an e-mail purporting to be from example.com (your business, which has an EV SSL/TLS certificate for the example.com web site).

The first thing to be done is to somehow verify that the mail is legitimately being send by the company. The best way we have to do this presently is via SPF and DKIM. We query DNS and the IP address of the remote mail server is listed in the TXT RR, so the SPF check passes. We query DNS for the key that the mail is DKIM-signed with, and that passes.

Now what? At minimum, we have to do another DNS query for the A RR for example.com, establish a TLS connection to example.com, retrieve the presented certificate, verify the certificate is valid (date, hostname match, etc.), verify the certificate is chained to a trusted root, and -- somehow -- check that the presented certificate is an EV cert. I don't know enough about EV certs to know if there's an easy, programmatic way to verify that a cert is EV vs. DV, etc., but let's assume that there is. There's also revocation/OCSP, etc., checks to be performed. And so on...

What you're proposing might work. That is, a company with an EV cert is probably unlikely to be sending out blatant spam, but I don't know of any existing tooling to do these types of checks. If it existed and were easily integrated, I would at least be willing to test it and see what the real-world results were (and it would be much more likely to become an acceptable tactic to use for distinguishing spam from non-spam). A plugin for amavis and/or SpamAssassin would probably go a long way towards making this happen.

All that said, do CAs publish lists of EV certs? It would be relatively easy to import a list of domains with valid EV certs and then say "if mail from one of these domains arrives with a valid DKIM signature, assume it is not spam".

There's something to be said for that. If you sign your email with your domain cert, the reputation of the domain can be used.

Yes but are any of the big email companies using this info?

Question: To whom do you want to send mail with your "bonded email server"?

Is it commercial email?

Or are you just interested in sending email to friends and family?

In the case it's both, which one is more important to you?