Hacker News Reader

Comment by habibur | Hacker News Reader

Reading it I get that AWS now by default restricts email by

  - 200 mails per day max. 1 per second.  
  - Can only send mail to verified addresses. Not sure how they verify though.  
  - Can only send mail from the domain you own and verified.

All these are good steps. Guess that will gradually take AWS IPs out of all those mail blacklists.

And while we are on the topic, I find IP based mail blacklist services such as BRBL obsolete and possibly harmful. Now that we have domain verification services like DKIM SPF etc. Blacklist the domain. Not ip addresses as most institutions don't own their IPs like in the past. Most of all are hosted, and that IP might get assigned to someone else a few days later.

View on HN

These restrictions are only for the SES sandbox mode. You fill in a form to get out of sandbox mode and then you can send many more per day (still only 14/second or so).

You only verify addresses you want to send from (for testing you might verify one to try sending to as per the sandbox rules). You wouldn't get customers to verify their addresses here, as that would let you send email on their behalf.

See here: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/reques...

All very good info that as far as I know is all pretty unique to SES regarding the default/sandbox vs the upgraded production capabilities. The set up makes a lot of sense to prevent abuse and it works just fine out of the box for dev purposes. The production version also operates way more how you'd actually expect an email service to work.

All that said, I don't know of any other services that have this "production" upgrade that is needed other than maybe just the general service limits (which have always seemed more of a "protect you from yourself" situation) so it can be a touch confusing.

Sandbox mode is also great for low-volume internal mail like notifications from cron.

My guess is that the main argument for sandbox mode is that it requires you to explicitly say you don’t spam and will handle reports, giving them carte blanche to yank your account if you do. Given how slimy email marketing is I suspect someone at AWS didn’t want to deal with people lying to their support people all of the time.

And once you are out of sandbox mode, it scales pretty well. We regularly send millions of mails in 24hr periods. Some gotchas come in when you need to set up DKIM/etc and other providers may need to handle mail for the same domain.

> I find IP based mail blacklist services such as BRBL obsolete and possibly harmful. Now that we have domain verification services like DKIM SPF etc. Blacklist the domain.

SPF and DKIM require opt-in by the sending domain, of which the majority of non-commercial non-US outgoing MTAs do not do. IP-based blocklists, including Spamhaus PSBL Mailspike etc, are all valuable to catch IP addresses that should not be directly connecting to your MTA. I agree that signing up for an outgoing MTA service such as Sendgrid makes some IP-based checks obsolete but that's not where the majority of spam is coming from. Botnets continue to be the number one source of junk email and will likely continue as we add more and more insecure doorbells, garage openers, refrigerators, etc, to our home networks.

> Botnets continue to be the number one source of junk email and will likely continue as we add more and more insecure doorbells, garage openers, refrigerators, etc, to our home networks.

Surely that's an argument against blocking IPs?

Unless I suppose you argue they're predominantly in homes; and homes are predominantly not running (intentional, well-behaved) email servers, so sorry-not-sorry those who are.

Yes. The days of running a legitimate MTA at home are unfortunately over. Many US-based consumer ISPs block port 25 entirely except for connections to their own MTAs, but for the ones who don't, very very many of those IP addresses wind up on policy-based blacklists -- eg "this network is a bunch of consumer addresses and should never be connecting directly to an MTA"

Running from home IP sucks for other reasons too, like non-static IP addresses, or lack of public IPv4/use of CGNAT.

I certainly would not risk my emails being delivered to someone else's computer just because IP address changed, and DNS still points to the previous one.

But having the server and data at home is still possible via VPN.

> Guess that will gradually take AWS IPs out of all those mail blacklists.

Are you thinking of EC2? SES has never had a problem with this in my experience.

Regarding verification, you can verify any email address where you can receive a link long enough to click on it. Domain validation is only needed if you want to send mail from arbitrary addresses without that step.

Individual SES IP's have been [temporarily] blacklisted before. We hit this issue earlier this year with one spam filter/service, and you can find plenty of past examples in the SES forums.

e.g.

https://forums.aws.amazon.com/thread.jspa?threadID=233001

https://forums.aws.amazon.com/thread.jspa?threadID=323992

Sorry, I should have said significant problems. If you send email on anything like a large-scale basis you’ll get on some kind of blacklist at some time – all you need is one user sending email to someone with a twitchy spam reporting reflex. What I was thinking about, though, is that it’s usually transient – e.g. out of hundreds of thousands of emails I’ve never had one bounce that way instead of being delayed, which is better then self-hosting on a long-time class B over a similar timeframe.

SES is pretty good at monitoring your email usage, such that it maintains a "reputation" score calculated by monitoring the hard bounce rate generated by your account. The premise being that high bounce rates (AWS define this as >5%) strongly indicate you're not managing your email recipient list properly i.e. sending untargeted SPAM.

RE: verification

AWS sends an email to the destination address and ask them to click a link to receive emails from SES.

There's no way for the email sender to verify an address. The email recipient has to click on the link in the email SES sends them.

"I find IP based mail blacklist services such as BRBL obsolete and possibly harmful"

Fully agree to this. I've always wonder why spam filters don't place more importance on domain reputation. So many senders runs on the same IP for deliveries and it's really silly to blatantly block someone based on IP.

For example, $89.95/mo is the starting price to get a dedicated IP for sending with Sendgrid.

If the smtp server is allowing spam to be sent through it, then it is not trustworthy. It doesn't matter which domain it was sending on behalf of. Though the real reason is that we've only had spf records and what not for a relatively short amount of time, so most systems are designed from the perspective that you can't trust the domain a message is claiming to be from.

It is hard to fool an IP-address-based blocking system. Because it's easy to fake a domain name, but hard to fake an IP-address

IPs are still a precious commodity, hence the threat of being listed by a high quality blocklist like Spamhaus provides an effective degree of encouragement for senders to clean up their act.

Domain blocklists also exist, but the stick isn’t as sharp, because domains are a dime a dozen.

IPv6 has entered the chat.

Meh. Something like 95% of mail servers wont work with IPv6 last I checked. Source: I helped build and maintain an MTA that moved over a trillion emails last year.

Deployed mail servers are very homogenous, there are probably 10000 implementations of MTA software but 99.999% of mail is handled by the top 10.

> 200 mails per day max. 1 per second

They've been limiting max sends per day for a long time. I set up an account around 4-5 years ago and they had a limit back then. I forgot the exact amount but it was 200 or less.

But, they do make it pretty easy to get the limit raised. I filled out a form and about a day later they bumped my limit to 50,000 per day and I think I only requested 10k per day. The form required basic information like providing a reason why I wanted a higher limit and a link to my main site where I was collecting emails from. It seemed to be human reviewed.

They must just give 50k as the baseline. I asked for the minimum, which I think was 200, and they gave me 50k. I was surprised because my plan for handling bounced email was “by hand.” Lol.

>> I find IP based mail server blacklist services such as BRBL as obsolete and possibly harmful. Now that we have domain verification services like DKIM SPF etc. Blacklist the domain. Not the ip

Agree with you 100%. I want to run a mail server on my AWS server and not use Yahoo so that Verizon doesnt snoop on my mail and insert creepy ads that seem like emails. But this is impossible as my mail would get dropped into a blackhole.

Here's an illustrated guide to getting out of SES Sandbox: https://docs.sendwithses.com/how/send-email/how-to-increase-...

Verifying emails just involves SES sending an opt-in / verification link to the recipient email address in question.

Reply on news.ycombinator.com