Cloudflare and FastMail: Your info is safe | Hacker News Reader

Cloudflare and FastMail: Your info is safe

blog.fastmail.com

168 pointsjsingleton96 comments

Love fastmail -- I have six domains. I can send/receive from whatever address I want.

I should just bite the price bullet and move to them. I've moved everything else off Google (even search), it's about time I move my email too.

I've been using FastMail for several years and have nothing but good things to say.

You can configure gmail to forward everything to a different email account, that's what I did when I moved. I have filters in SmarterMail that filter the incoming mail from gmail accordingly.

I remembered why I couldn't move away: I have other family members on that Google Apps domain. However, I just moved my personal domain there, and holy shit is everything faster. Google would just keep Thunderbird spinning and spinning and not sync deletions to my phone and vice-versa (I use K9), but Fastmail is just lightning fast.

The browser notification, their UI, their mobile app, Thunderbird and K9, everything is just super fast. Totally worth whatever price, I'm going to pre-sign-up for three years right now. Thank you!

After using it for a few months I must say I am not very impressed with FastMail's antispam filter: I am receiving quite a bit of spam (tax/home alarm/life insurance/what-have-you spam) to an alias email. About a dozen a day (maybe it's not that much, but still a whole lot more than I am used to coming from Gmail). I always mark them as spam yet new ones, at a glance very similar to the marked ones, keep making it into the inbox.

Admittedly this is partially my fault since the alias is very-common-firstname@one-of-the-many-domains-offered-by-fastmail.com.

Since you've been with them for awhile now, what is your experience in regards to spam?

You need to train your personal spam filter [1]. To do this you will need to mark 200 messages as both spam and non-spam. Once the personal spam filter kicks in, it performs very well. In the control panel there should be a section which tells you how many spam/non-spam messages have been recorded. If you do not have enough recorded non-spam messages, you will need to start archiving legitimate messages so they can be seen as non-spam.

[1] https://www.fastmail.com/help/receive/stopspam.html

My challenge is that I don't get spam very often to begin with. It will be several more months until my personal filter kicks on.

And this seems like a big downside initially, until you realize this means FastMail isn't aggregating data about your mail for other users' benefit. FastMail only sends spam samples that you confirm are spam, by both marking as spam, and then permanently deleting.

I've not really noticed a spam problem at all, but I do things like sign up using microsoft+trap@domain-name.com, but even then I haven't really noticed a lot of traffic through that account.

OTOH, I'm pretty anal about protecting my personal email accounts.

If you let Fastmail control your DNS, you can use neat aliases like website@me.my.domain instead of me+website@my.domain. That gets around websites with "validation" that rejects addresses with "+" in them, and I think it's a bit more secure since the tagging is less obvious to spammers.

You don't need to let it control your DNS, you can just set wildcard MX.

didn't know that, thanks for the tip.

I use 33mail.com for that (with a custom domain), it's great.

Couple of months ago I was asked to provide a non-Gmail-hosted email address for reliable confirmation (while booking a flight with China Airlines). After a bit of investigation I made the decision to jump onto FastMail’s cheapest personal plan.

Guess what, had to give up after 10 minutes or so—their sign-up form kept reporting server error!

Rationally I do realize that whatever it was it’s unlikely to affect their existing customers… Still, anyone can comment on FastMail’s actual uptime?

They publish detailed data here: https://www.fastmailstatus.com/

And anecdotally it's been rock solid for me and my family, never slow.

zero downtime noticed in several years. They are public about their issues but I cannot remember ever being unable to access my mail

https://www.fastmailstatus.com/

I personally never had any issue with Fastmail in about 2 years, it seems very reliable

Eh, I just signed up and am trying to add other domains and the DNS verification is failing, even though the fields have been there for days. Also, trying to verify DKIM unverifies the entire domain, so that seems pretty buggy.

Everything else has been working great, though.

What stops me currently is that free is less than $50, but, then again, I've been having issues with Gmail being shitty when using alternate domains for emails. Everything shows up as "stavros@somedomain.com via someotherdomain.com", does FastMail do that too?

I ended up using Mailgun to send email just to get rid of this stupidity.

Is it stupidity or transparency since they don't know for sure it's legit? Just be a good netizen and use SPF and DKIM for that.

https://support.google.com/mail/answer/1311182?hl=en

http://stackoverflow.com/questions/8236312/how-to-remove-via...

I did use both, they had a weird bug where if you used both, it would show you the "via", and only hide it if you didn't use both. I wrote this up when I discovered it, as it's very counter-intuitive:

https://www.stavros.io/posts/how-properly-configure-google-a...

As someone who loves Inbox and Gmail, what does Fastmail do that Gmail doesn't? It needs to do a lot to make it worth the high price of $36 per year.

I have been a happy customer for some years, after using Google Apps for domains (paid) for more than half a decade.

+ You pay for the service, they are not mining your data.

+ When you have an issue, it is easy to talk to real humans. I had some feature requests, my case was transferred to one of their tech-people in no time. One of my feature requests was rolled out on their beta version in a couple of days.

+ They have a standards-conforming IMAP. So, it works much better with isync/mu4e/mutt/etc.

+ Fastmail is fast.

+ They are a big contributor to the open source Cyrus project. So a lot of their development ends up being available for everyone.

+ They support push notifications in Mail.app in iOS. (Not IMAP IDLE, real push notifications.)

+ subdomain addressing besides plus addresses. E.g. if my e-mail address is me@foobar.xyz I can give out me@quux.foobar.xyz without first creating a virtual host quux.foobar.xyz. It makes it easy to create custom addresses that are a bit less obvious than plus addressing.

- The spam filter is not as good as Google's, even after training it for you personally. I regularly (usually once or twice a week) get spam or malware mails in my inbox.

- The mobile app is acceptable, but not as the Google Mail app. It's basically their webmail in a web frame.

One BIG MINUS is internationalization (couldn't care less about localization though), they still haven't completely fixed full text search for Cyrillic mail. Some weird behavior like not matching partial words, or otherwise omitting some legit search results, makes things difficult to find sometimes.

That said, even with that, it's much better than everything else on the overall UX.

I've been a user for 3 years.

The reason I use Fastmail is they sell you email instead of doing sketchy stuff with your data. As a side effect, this also means they have actual customer service! I've contacted them a handful of times and each time received a real response by a person who understood what they were talking about.

Their web client is as good as it gets except for gmail, and under active development: stuff slowly but seemingly constantly improves. eg they recently added "add Rule from Message" functionality. It remains very responsive with 6G of email.

They also apparently slightly increased prices (with larger data allocations) while I've been a customer and they silently grandfathered me into the old pricing.

Also, one upside of running a domain for your email is you can use [sitename]@kartickv.com for every site. This not only makes routing email very easy, but allows you to both tell who sold your contact info and block that address.

Also the thing rarely mentioned: they have the best web calendar for the desktop. The UX matches that of Fastmail: fast and free from annoyances. Supports sync with thirdparty services, too.

I just switched, and it's much, much faster:

https://news.ycombinator.com/item?id=13729703

The biggest thing is customer support. You can have an issue or even just a question, file a ticket, and a FastMail employee will respond within a matter of hours.

How is their spam filtering? Rackspace's is pretty bad.

I switched recently (kept my old address) and I've had only a few spam messages get through. It has a learning filter that kicks in once it knows enough about you, too. And finally, if you're getting some specific spam you might be able to create a filter for it.

Now that is how a company pro-actively communicates to their userbase and the public at large! Honest information but inspiring confidence in their platform as well as their support. Well done fastmail! Kudos!!

Just to be fair, this is an instance of pro-actively communicating good(ish) news. Not everyone does this, so of course it's good to encourage more of it, but it's much easier than pro-actively communicating bad news.

Would one of the apparently many happy FM subscribers share details of what kind of security they provide?

(It bears repeating: No email can be very secure.)

https://www.fastmail.com/help/ourservice/security.html

- happy FM subscriber for 3 years

Also I didn't see it directly mentioned on that page, they're not subject to US law enforcement requests (unless they go through a Mutual Assistance treaty request) and there's nothing like an NSL in Australia: https://blog.fastmail.com/2013/10/07/fastmails-servers-are-i...

But see: https://en.wikipedia.org/wiki/Five_Eyes

True, but probably still better than the US or UK: https://protonmail.com/blog/investigatory-powers-bill-email-...

Their EU servers are in the Netherlands. Although I guess it's hard to know if any EU traffic goes to the US servers.

Australia does have similar laws but it seems they don't apply in this case: https://blog.fastmail.com/2015/04/09/fastmail-is-not-require...

They support multiple kinds of 2FA tokens (Yubikey, U2F, Google Authenticator, and others). I was even able to disable the phone-based 2FA, which means my account can't be hijacked by someone who's stolen my mobile number [1]. That also means I could get locked out if I lose all my tokens, but I'm willing to take the risk since I have my own domain, which could be easily ported to a new account.

[1] https://www.forbes.com/sites/laurashin/2016/12/20/hackers-ha...

This (although good to hear - I would also be interested in a purely U2F 2FA setup for email) seems to only be concerned with security for the user's perspective. What about the security of the service itself from a more "backed" / overall perspective (those factors beyond the user's control)? As much as I dislike Gmail as a big brother it's hard to beat Google's security team.

Full disk encryption on their servers and they ignore non-Australian court orders

I'm wondering if Fastmail provides better deliverability of incoming emails (have issues with lost emails in free Gmail account)?

Also if something goes wrong is there a mitigation plan in place to recover data and restore access of the user?

That's another major concern - to lose access to the account and not be able to recover it - because Gmail has no support.

The way Fastmail is setup is that there's a master administrator login for each account, and then you create email addresses under that account with their own logins.

So if you somehow lose control of an email login, you can just get your administrator to login and reset it for you.

Presumably if you needed the administrator account reset, you would have to contact Fastmail support, but you don't tend to log in to those much at all so there's less chance of them being stolen.

I use mailgun to send automated alerts from our home network backup processes and security cameras.

When sending to a Gmail account, there is sometimes up to a 2 hour delay before the mail arrives, though usually it's within a few minutes.

Mail sent to a Fastmail account always arrives almost immediately.

MG does some kind of prioritizing based on the domain when using their free account. It's obviously an anti-spam measure. They might also have some kind of "warm-up" feature where if you send enough email with a valid FROM and TO address then they queue it faster, IDK. Not sure if they do the same thing with their paid plans.

My understanding is that they rate limit the number of emails sent to a domain per IP address, per hour. Email service providers assume that if you send "too many" emails to their domain per hour, it's "spam".

The same thing happens with my dedicated IPs (sending ~500k/mo). Yahoo is frequently rate limited. Gmail is less common, though we have years of good reputation on those IPs.

500k/mo ?! Do you mind me asking if this is for a company or personal use?

Although I don't have any idea why even a few person compnay would have to send those many emails, your use of 'my' makes me wonder.

Our product is a SaaS for pet service businesses (grooming, dog daycare/boarding, training). The app has 34 distinct automated email types that are sent at various points. It's a lot of email :).

Since FastMail is a paid service, FastMail has actual customer service. Additionally, they have information about your payment methods on file, so they have more information that can be used to verify your identity than the average free service. I do not know their specific policy on what level of identity confirmation is required though, if they do indeed allow account recovery in this manner.

You can, of course, get an account recovery code, or reset using your phone, as is pretty common.

A key difference though, regarding support, is that if your account gets suspended, there's a path with real humans to get it reactivated. Most Google account issues I've heard of aren't "loss of password" so much as "Google has banned you and has no appeal process".

Regarding deliverability of incoming mail, I will say I've found their web client refreshes faster when inbound mail comes in than Gmail, and when waiting for mail from other common services I've found they arrive faster since switching from Gmail.

> I've found their web client refreshes faster when inbound mail comes in than Gmail

Yes! One of my favorite FastMail features. Same is true for push notifications. I now get annoyed at the delay on my work accounts (G Suite).

It really is crazy fast. I get notifications from my browser and phone about new emails almost simultaneously. And if I read the notification on my browser, it instantly disappears from my phone, and vice versa. Honestly, it works how it just ought to. Can't give higher praise than that.

I've been super happy with Fastmail. Can't recommend it enough. The stuff they're doing with JMAP is really nice too -- should give it a read if you haven't seen it before.

FastMail even supports push notifications for Mail.app on iOS (which AFAIK has previously been limited to iCloud accounts, I think possibly Exchange, and, oddly enough, Yahoo).

Is it better to use two different domains for API and static content then, in order for cookies to be only sent to the API domain/subdomain? That way, if there are requests to the static content that's served by a CDN (ie: Cloudflare), it won't contain sensitive cookie information?

This is good practice anyway because it avoids the overhead of sending cookies for static content when they're not needed.

In HTTP2 the opposite is true.

Single domain will help you with performance

Actually with http2 you can multiplex requests for multiple domains within a single connection. As long as the DNS for the domains is the same IP, and you have a single certificate covering both domains.

Cloudflare forces a cfduid cookie no matter what, even on pure-static-caching

This would still save you having to send all other cookies from your non-static domain.

What amazes me in Fastmail is how fast their web UI both on desktop and mobile. Especially compared to Gmail but it's also more responsive than Slack or Trello.

I've always imagined that the reason that FastMail's web UI is so fast and responsive is because their developers are based in Australia, but their main server presence is in New York. They're optimizing for speed when communicating with a server halfway across the globe, and that benefits everyone.

Nailed it. I work on FastMail's web UI and we really care about latency mitigation; we know if we can make it fast with 300ms round trip times, it will be insanely fast for customers with shorter ping times.

Bravo! This and the comments above have convinced me. I'm subscribing with my next paycheck :)

The fact that I can seemingly load and scroll to the end of a 5,000 email list with no discernable loading, is pretty stunning. It's not like an endless scrolling app where it has to load the next x items or anything, you can scroll pretty much instantly to the bottom.

It does look crazy fast. I'd love to try it, but not worth the cost for personal use.

As someone who switched away from all Google products, including Gmail, I can definitely say it's worth the cost to me. In fact, I'd pay more than the current rate, now that I've had a chance to really use the service. It is fluid and fast in every browser I've thrown at it, including the work-required IE10.

In my opinion, the only thing they could do better is to provide an API for their file storage module, and I believe that is in the works.

You get what you pay for, and while Gmail is a good web client it is far from the best. Fastmail beats it hands down as far as I'm concerned.

I've already (mostly) moved away from google, at least for email. This isn't Google vs. Fastmail to me, this is Fastmail vs. Zoho. (Which I already have a free account with for my domain)

After loosing a bunch of important emails undelivered to my free Gmail account I actually want to pay for the service.

I currently use G Suite, and pay $5 per user per month. FastMail honestly looks like a better client than Gmail, but G Suite provides Google Calendar, Drive, and Docs, which all integrate together beautifully. Hard to justify switching to FastMail for the same cost and losing Drive, Docs, and Calendar.

They do have a calendar, which is something lacking from ProtonMail (although I believe they are working on this). ProtonMail has a free plan and if you only need a single custom domain then it's cheaper than FastMail. FastMail only have a free trial but the standard plan covers multiple domains (you have to pay more for extra domains on ProtonMail).

Edit (numbers):

FastMail = $50/yr (https://www.fastmail.com/pricing/)

Up to 100 domains (https://www.fastmail.com/help/account/limits.html)

They also do DNS and static website hosting (but not with HTTPS)

ProtonMail = $48/yr (https://protonmail.com/pricing)

1 domain, extra domains: $18/yr per domain

ProtonMail seems to be focusing on high security and encryption as their value prop. My interest and needs are more in the web interface UX, speed, workflows, customization, Exchange (iPhone push) support.

FWIW FastMail also comes with file storage and notes.

Thanks FastMail folks. I still use Gmail primarily (multiple labels per message feature), but I pay for an account so that you're still around when I need you to be.

Hm, what's preventing the switch?

I'm not OP, but the answer to your question is in his post: the main thing I miss about Gmail is the tagged labels, which make a lot more sense than folders and are quite an improvement in usability.

Other than that, I'm much happier with FastMail.

You'll be happy to hear that the JMAP work we're doing will make labels a lot easier to do on the FastMail interface

(on the downside, we can't yet account quota cheaply for that, so a message with multiple labels will count multiple times towards your quota usage at first)

That sounds intriguing! Is there a write-up about what you are going to do with labels?

I had high hopes for fastmail and it's an awesome product, just not quite ready for me yet.

I'm not yet at a point where I need to lug my reading glasses everywhere - provided I can adjust font sizes on my phone.

The fastmail app is just a wrapper over the mobile site and you can't adjust the font size. The font as it is is tiny and unusable for me.

I contacted support and while they were curteous and prompt, they basically said too bad and refused to give me a refund, even though I had purchased the year subscription just a few days before.

Still have good things to say about them, just wish the app were more accessible.

Have you tried a "real" email app (i.e., one that's not just a wrapper)? I've used K9 (Android) + FastMail for many years and it's been great. K9 has tons of features, including letting you choose font size (with some granularity - e.g. you can have different sizes for from/subject/body, folder/message view, etc.).

Good tip I'll try k9 out, thanks!

Fuck. I use cloud flare for MX records to ensure I don't completely rely on FastMail for everything.

Pretty sure they're not affected by this thing - it was just http proxy rewriting logic.

(having said that - you may as well rely on us for MX records if all the delivery is coming to us - our DNS infrastructure is more widely distributed than basically anything else for exactly that reason)

That shouldn't be relevant to this bug, though.

Switching to Route53, Dyn, or similar should be a cheap and easy process.

FastMail scores pretty well on this comparison of email providers based on privacy:

https://thatoneprivacysite.net/simple-email-comparison-chart...

The scoring does not make sense:

FastMail has servers in the US and is domiciled in Australia, a Five Eyes country:

https://en.m.wikipedia.org/wiki/Five_Eyes

Mass surveillance and powerful security services do not go together with privacy IMHO.

It does seem a little inconsistent.

https://thatoneprivacysite.net/email-chart-formulas/

"Our headquarters are located in Melbourne, Australia with servers at New York Internet and QuadraNet in the USA, and at Switch Datacenters in the Netherlands."

https://www.fastmail.com/about/company.html

Maybe this?

"We do not participate in, or co-operate with, any kind of blanket surveillance or monitoring. (We also point out that Australia does not have any equivalent to the US National Security Letter, so we cannot be forced to do something without being allowed to disclose it.)

...

Unless prohibited by law, we will disclose to the account holder when we receive a warrant for their account."

https://www.fastmail.com/about/privacy.html

That's a good site. I wonder why Fastmail has a red mark against business ethics. ProtonMail (and even Gmail) are green (not even yellow).

Edit:

ProtonMail seem to be better for activism. I guess because of things like: https://protonmail.com/blog/investigatory-powers-bill-email-...

I have been exploring other email services. I was checking out protonmail recently as fast isn't my top priority. Anyone like protonmail? I'll have to give fastmail a spin soon.

Thank you FM. A happy subscriber

Moved to Fastmail from Google last month, love it!

For when a FastMail guy shows up here: Thanks for the note on this. And hugs, because I love you.

- Happy customer since November.

I wish there were more products like FastMail:

* It does what it's supposed to do

* It doesn't do anything you don't want it to do

* It is the product, not you

* It works really really really well

If Ron Swanson used email at all, he would use FastMail.

It is possibly the fastest, most responsive, most reliable graphical mail client I've used, native apps included.

Thanks for the hugs gang. A bunch of us have been at M3AAWG working on email deliverability and security standards just this week - sitting in a coffee shop in San Mateo right now before flying back to Melbourne again tonight!

FastMail is my first pinned tab. It never slows down, never leaks memory, and has completely alleviated my need for a native mail client.

My entire family has an account with no ads and I'm absolutely happy to pay for it.

Another very happy customer since last year! I even like the UI of the webmail. Very snappy!

Group hug! FastMail is amazing.

Agreed! Paying member for 10 years here :-)

Happy customer since 2014 and will be forever! Love the service and their values.

I ginned up this little tool tonight to help people out instead of grepping.

https://bleed.cloud/index.html

You can also run the python script on the website anonymously on your computer to dig sites out of your email, which is a good indicator that you have an account with them.

Reply on news.ycombinator.com