Hacker News Reader

Comment by klingonopera | Hacker News Reader

Let's see... Postfix, Dovecot, SPF and OpenDKIM on the server-side, each of them with their own config.

Then you've got to set up your domain, and domain headers on your domain host. Oh, DMARC is also another thing.

Then, most ISPs will outright refuse to accept incoming mail from your IP address, since they've basically changed from blacklisting to whitelisting. So you've also got to relay your outgoing mail via your domain host.

And then spam rules. I took the recommended rules from the Debian/Postfix/something-something-sorbs.net website, and I rarely receive email from e.g. eBay, because they've been marked as sending spam. Often happens with gmail addresses, too.

Despite all this... I still run my own mail server, but hotdamn, you're calling this not hard?

EDIT: Oh, and nowdays you've also got to entangle your TLS certificates into the whole process somehow. I managed it, but don't ask me how, I'd need to read up on that.

View on HN

And Postifx is not just one thing, it's: smtp, smtps, submission, relay etc... And Dovecot: pop3, pop3s, imap, imaps, lmtp, passdb, userdb, sql, ldap, seive etc.

Look, I don't want Google changing this tomorrow because to something tied to and controlled by them because they don't do evel, isn't faster or people like it, but please, don't say it's not hard because you will be misleading people for sure

Edit: to be crystal clear, I agree with parent but don't agree with op

Yes... and ooof!

And then there's also the password/username database, that defaults to tying into the Linux pass/user database, so if you want to set up some custom login-data... ugh, I don't even want to think about it.

I set it up once, maintain it here and then, and am keeping it, because dismantling the system is more work than maintaining it presently, but seriously... with the above setup, do it only for educational purposes.

...I'm guessing I spent a week or so properly setting everything up.

...but I'm also willing to try a universal, one-size-fits-all program, if anyone knows anything for Debian?

I used to run postfix/ssmtp/etc on Gentoo. From time to time, when updating the single components, something stopped working and then I had to quickly debug and find a fix. In the end it was too much time-consuming for me to maintain.

I then decided to search for a big-monolithic-do-it-all-solution (from a SW-perspective) and the only option I found was Xeams ( https://www.xeams.com/Xeams.htm ) - I didn't find anything open-source. I'm using it (the free variant) since 2017 and it works.

Runs on Java, provides all services (smtp, pop3, imap), has greylisting, has embedded user administration, users can have email-aliases, has a web-admin-UI, 1-click-sw-updates, etc... .

i've been following these since lenny, https://workaround.org/ispmail

pretty much a set & forget solution. He also writes a new one with all-you-need-to-know extras every time a stable release of debian comes out.

I run my own mail server and as long as you use TLS and the one that’s really easy (I can’t remember if it’s DKim or Dmark) most domains accept mail from you.

I really didn’t have a hard time setting mine up and I’ve done it multiple times. Dovecot is a bit of a pain if you really want imap... but overall none of it is harder than most other things.

> most domains accept mail from you.

And this is precisely why I don’t think it’s worth it. I don’t want to have to worry that “most” domains will accept my mail, I want a big email service that has the clout to force domains to accept my mail. I shouldn’t have to solve the mystery of why my mail was rejected (or rather, why some provider thinks I’m sending spam). That’s why I do Fastmail.

What do you use for automated messages (ie, login emails, password resets)?

I asked Fastmail support, and they basically said, "we're not really built for that." However, most of the other services I looked at had arduous terms (arbitration agreements), and even they were talking about delivery rates in ranges of 85-95%.

My takeaway has been that as an app creator, email is really unreliable, and I should try whenever possible not to make it a critical part of anything I build. If 5-10% of the people using your service can't get a password reset email, what do you do?

As someone without much experience with email of that nature, it doesn't seem like the major services actually solve the deliverability problem. If they have Google-style support where I can't get one of them on the phone if my emails aren't sending, then I might even be worse off using them rather than my own setup that I can at least debug and experiment with.

Keyword is transactional email. I've good experience with Postmark, Sendgrid and Mailgun. Not affiliated, but never had delivery problems

Sorry, to be clear I was talking about personal email. But as another poster said, there are plenty of services that provide transactional email.

And if you try to host it on Digital Ocean, they actually block port 25 out, so you're out of luck...

And you have to manage diskspace, backups, firewall/fail2ban, OS updates etc etc etc

I'm in the same boat as you. Managed to grind my teeth and pull through something like this for my own use and family, but it was painful.

Pretty sure a message to them stating your intended use will result in the block being lifted

I've got a mail server on DigitalOcean. Just tested and port 25 works fine. The internet says you can get the restriction lifted after 60 days: https://github.com/3s3s/opentrade/issues/136#issuecomment-42...

I run my primary mailserver on DigitalOcean. It seems to work fine. I think you have to have either your account, or the Droplet, active for 30+ days before they'll let you have port 25 open.

Last time I asked they categorically said they won’t open port 25.

I think really old droplets might have had them open though. I guess they grandfathered these in

Trying to avoid the landmines of blacklisting is really the biggest peril in all of it. I refuse to move a company I support away from GSuite to self-hosted, because I have a high level of confidence that just one person sending a lot of mail to another person outside the company could result in our domain ending up in RBLs, which is very difficult to reverse. Running a mail server in 2019 is not something I need the headache of.

That's amusing because the bigs all ignore RBLs. RBLs are only used by the little operators.

And RBLs aren't that great. I visited this in January of 2018 [1] and in my case (where I do greylisting [2][3]but nothing else for spam) it wouldn't help.

[1] http://boston.conman.org/2018/01/10.1

[2] https://en.wikipedia.org/wiki/Greylisting

[3] And yes, I do run my own server. It's just for me, so I have no issues with "customer requests" and I've been using the same IP address for about a decade (maybe more). Then again, I've been running my own email sever since 1998.

And upgrade your server software within hours of vulnerabilities being published if you want to stay secure: https://www.openwall.com/lists/oss-security/2019/08/28/3

https://mailinabox.email/ does everything and more. Of course, this doesn't make it easy. You still need to do more things than were you to simply use protonmail/fastmail/etc.

Reply on news.ycombinator.com