Hacker News Reader

Comment by kennu | Hacker News Reader

I used to do this for a long time (with Ubuntu), but over the years there was always something popping up that required fixing, updating or other attention. Eventually I decided to let someone else worry about maintaining the mail services and spam filters and put my own focus on other things.

View on HN

By way of a counter-anecdote: I've been running my own email for 8 years and spend almost no time on it. I can't recall having to do any maintenance at all in the last 3 years.

Yeah, I do the same - I plugged in Postfix, Dovecot and SpamAssassin and haven't had to touch it other than occasionally confirming backup scripts and automatic security updates are working.

Does you email get marked as SPAM by gmail?

I do something similar, but when I send an email to a person for the first time, it always ends up in the spam folder by GMail.

Just relay it out via a trusted host, in addition to setting up DKIM, SPF, etc.; that solved all the problems for me. My email server is working excellent for many years now (OpenBSD, OpenSMTPD, dovecot) with Rainloop as web-based frontend.

I have DKIM, SPF, etc. but still gets caught by spam. What do you mean by "trusted host"?

An email provider that is not blacklisted and allows relay. I currently use my ISP for that.

Taken from my smtpd.conf:

  table secrets { mylogin = [email]@ziggo.nl:[pass] }
  accept tagged DKIM for any relay via tls+auth://mylogin@smtp.ziggo.nl:587 auth <secrets>

Oh, I see, thanks!

It kind of defeats the purpose, since now the third-party will be able to read all my outgoing emails, and have control over them.

You're transiting over their network anyway -- the jig is already up even without relaying via their gateway.

Connecting directly to the remote (non-ISP) mailserver with TLS shouldn't reveal any message contents.

Relaying via the ISP's mail server though (even with TLS) seems like it would disclose the message contents.

Is DMARC included in your 'etc'? I think thats needed for gmail these days. If rdns, dkim, spf and dmarc are there, try checking your IPs reputation (senderscore) that could be it.

Thirded, only with qmail. I know mine is a tiny private server, but scaling up would only require more hardware and minimal increase in hours working on it. OTOH, I manage hosted mail solutions for three other domains, and those all require more time, because I'm supporting other people.

This used to work for me but lately, way too much spam. Looking to install rspamd but have not succeeded yet.

Same here. I have owned my domain and ran my email server for six years now. Investing a week worth of afternoons harls really paid off and i can do neat things like having infinite email addresses via a catch-all address.

By the way, give a look at mail-in-a-box, another cool project that implements a ready to use mail server with great functionalities.

Used to manage it all manually, set up https://mailcow.email/ after a server move a couple years ago. It's been great, running inside docker now via docker-compose alongside https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa... for automatic letsencrypt for the web interface along with my additional web services hosted on the same server. I had one minor hiccup when upgrading wherein I had to restart all docker containers, that's about it in terms of maintenance.

I did the same and used my catch-all extensively which I almost regret nowadays because it would make migration to a hosted service much more difficult if I ever wanted to. At least I know of no trustworthy commercial mail hoster which allows catch-all-addresses without requiring a much more expensive 'business' account.

I do this in fastmail with no issues. I'm on an older plan of around $40 a year I think but have zero regrets switching from gmail

For what it's worth, Zoho.com gives catch-all ability with their free tier as long as you supply your own domain.

Do you have the system updates on auto? How do you handle all of that?

On Debian and derivatives, you can install unattended-upgrades to get automatic security updates. See also apt-listchanges, which can send you an email detailing the changes applied.

Similar for RHEL/CentOS/other-EL based distributions too, using the "yum-cron" package.

I'm in your reverse situation, a long time free-email user. Given the latest news, I decided to self-host my email address and not have a 3rd party filter my Inbox.

I'm surprised how easy it is, and having fun with sieve scripts :)

Long time self-hosted email user, then long time Gmail user. Playing with your own server is fun, and I really enjoyed it. But things do go wrong, and they go wrong at the least convenient times. I've lost a whole day of a holiday trying to find a place with internet so I could log in and fix some small thing that had broken (I also hosted for a handful of other people, not all of whom were on holiday). And I've had that sinking feeling when you realise that that important email you've been waiting for has been sitting for a day and a half behind a crashed/misconfigured service somewhere.

Good luck with your endeavour, it is if nothing else a learning experience. But it's important to keep in mind that if email is a critical tool for you (it is for many people, ymmv), toying with it may not be the best idea.

I'm just now experiencing the direct opposite with Fastmail. Used it to avoid setting up my own mail server for a ~50 user gitlab instance. Went from trial user to paying for a full year and one day later my account is now blocked. Found this message in the first rejected email: "We couldn't figure out what the email is for. Please create your issue or comment through the web interface.". Can't send mail through webmail interface. Can't access IMAP nor SMTP. Support emails from their own support doesn't go through.

So, without any means to control it myself I'm now in the mercy of fastmail support unless I set up my own postfix/dovecot in the meantime. I guess it goes both ways.

… hang on, what plan did you ask for for this, and what kind of mail were you actually sending/receiving? As far as I'm aware, Fastmail charges per-user, and isn't advertised as suitable for sending automated mail through. It sounds very strange to use it as a replacement for “setting up a mail server for a GitLab instance”.

What ToS am I violating exactly? I’m _well_ within limits for both incoming and outgoing and all recipients sign up for receiving the emails. The gitlab wiki even uses fastmail as an example for smtp.

For record-keeping: got a reply two days later from support saying that they do not support sending notification emails, which this is classified as.

I try to find a balance - I run my own mail server on a digital ocean droplet, but I use gmail to fetch email from it, and I use gmail as my sender.

I get the best of both worlds; I don't have to worry about being blocked when I send things, and if I ever have issue with gmail, I can stop using them without losing my email address.

You know that some corporations consider GMail as spamhole and block mails sent from it. There is no perfect solution.

Gmail has 1 billion users. Blocking a massive chunk of all possible users seems sort of insane are you sure you didn't mistype yahoo?

I vaguely suspect that GP may refer to the fact that certain corporations block access to the Gmail web interface (and the other big providers) from their network, typically for auditing purposes, in a way to a personally run mail server might evade. In those cases, actually accessing your personal mail server would typically be a gross breach of conduct and lead to immediate termination for cause if caught. This, of course, has nothing at all to do with the deliverability of email from those services, even to these same organisations (they can audit what goes through their own servers, so that's fine).

But, that's a guess, and I obviously can speak on GPs behalf.

Yes and also they block receiving emails from GMail domain for security purposes. So if you want to email someone internal in big co, you have to do it from your own domain. I suppose it is not only for GMail. Probably Yahoo, Microsoft also but I only had one guy trying to use GMail sending mail to corporate users.

Before you said "spamhole", now it's security. In both cases it makes literally no sense to block Gmail and allow random personal domains. I suppose the setup could be based on whitelisting domains, and because Gmail is so big, they won't whitelist it, and it also won't receive emails from anything random, but from specific personal domains. But such a setup specifically isn't for communicating with the world at large, and not any kind of widespread practice.

Also, you should be using your own domain with Gmail (or any other provider) so you aren't tied to anyone, anyway.

Yeah, that seems rather unlikely. Do you have some references for that claim?

Who blocks Gmail?

Any sane corporate security? You can setup gmail account in 5 mins and start phishing people in corporate env. That is why receiving emails from generic domains is no go. I also had actual requirement where we did not allow people to register with gmail account, only non generic domain emails allowed. So that you use your company email for B2B product.

How big is your list of 'generic domains'? There are email providers that give you hundreds of domains to use, and only take 5 minutes to register.

Any? So Gmail users can't email any sane corporation?

Extraordinary claims require extraordinary evidence. Please provide just a single reference to this claim.

How did the service suddenly become misconfigured?

I don't remember the details, but it probably didn't become misconfigured, it would always have been misconfigured, just one particular combination of factors that hadn't been seen before suddenly got caught. I remember at one point that an org I did email for couldn't receive email from a particular other organisation. Turned out that I had configured our MTA to accept TLS, and theirs presented an invalid cert, so the connection was rejected. This wasn't the situation I referred to, because this caused email to bounce hard, so people just routed around (yay for having people have professional contacts send to their hotmail instead).

Or whatever. I remember the feeling, not the mistake that caused it.

It's fun until it becomes a chore. And until you realize you're always one step behind people trying to break through with spam or attacks.

I have almost the exact same setup as OP. I put close to no maintenance time in it. Adding all the extra configuration (SPF, DKIM, etc.) to let the world that you are not a filthy spammer is important, tho.

Same. It’s like I’m a small company. Single server with no active maintenance? Sounds great and why would we ever spend more on it? It works great! ... for a while.

Once that single server goes down it’s suddenly the biggest issue currently keeping us from doing anything. Whether it’s because of something I did or an upstream outage doesn’t matter, I’ve still got to troubleshoot it and try to work around it.

For $5/m you could have FastMail do it for you, or for free you could have Google do it. Yes there are trade offs, but they also have more infrastructure than you do for the same price.

Email is just one of those things I would rather outsource.

I think every FastMail proponent is single, as they are always touting how you get the same thing as running your own email server for $5/mo. But for people with a family it is rather expensive for email.

I'm the opposite. When it was just me I didn't mind running my own mail server and putting up with my self-inflicted downtimes. But when I started adding family members it added more pressure on me to ensure good uptimes etc. So for me, family members were the reason why I migrated to FastMail. I don't see it as being very costly for the quality of service they provide but YMMV.

This hasn't been an issue for me once I moved my mail server into a VPS (ran it from home for a long time). Been running in a VPS now for 10+ years and downtime has never been an issue. The main pain points have been clean IPs and migrating user accounts when I upgrade the server.

We literally just had this thread 3 weeks ago: https://news.ycombinator.com/item?id=16238937

Reply on news.ycombinator.com