> our residential ISPs [...] generally only block port 25 (SMTP)
While outbound connections to port 25 may be blocked, the ISP we are with still allows inbound connections to port 25.
I have a few accounts on the net tied to an old domain, and what I've done with that domain is that I now have the MX record for that domain set to my home IP address, but I reject connections to port 25. Then, when I need to reset a password for an account tied to an email address on the old domain, I start a simple mail server on my computer that accepts incoming mail, and I open for incoming connections on port 25.
I receive the password reset mail, and then I block port 25 again and shut down the mail server program.
For services that are actually important, I’ve changed the email address associated with the account to a hosted one, so that I receive mails about billing and such related to those services.
For less important accounts where I only need to be able to receive password reset mails but otherwise don't want mail related to the service, I keep them associated with the mail address of the old domain that has its MX record set to my home internet IP address, and where I only accept incoming connections when I am doing a password reset.
This way I can receive those password reset emails while avoiding most spam since I only keep port 25 open for incoming connections for short and infrequent periods of time.
It’s certainly too peculiar of a setup for most people. But I figure some others here on HN may find that they might want to do something similar.
So if your ISP allows incoming connections on port 25, you could set up MX records on a new domain or on a subdomain of an existing domain, and run your own server for the sole purpose of registering accounts or receiving password reset emails, and like I do only run that server when you are creating an account or resetting the password for an account.
It’s sort of a fourth option to other alternatives that I more often see other people use. The four ways that I commonly see others do it is:
- Some use “+” addressing with your Gmail account. Not ideal because spammers know of the “+” trick and can just strip the suffix.
- Some self host catch all mail. Not ideal because spammers also blast out email to commonly used names for email addresses. So if you have a domain and you accept mail to any address at that domain you will get spam for addresses like bob@ your domain, sales@ your domain and all sorts of random names @ your domain.
- Some generate a uuid as name portion of email address, unique for each service, or some other scheme with unique name portion per service. This is pretty good but has a couple of drawbacks still. One of which is that you need to explicitly create a new account in your mail system each time, which also can take time – this can be set up so that the operation is pretty simple but still.
- Some use a throwaway email from a free service like Guerrilla Mail or similar. Mostly fine if the account you are registering is really just some temporary thing, but if you do decide that you want access to it later then because the mail address was temporary you will not be able with most throwaway mail services to read mail for that address after like 1 hour or 24 hours or whatever limit they have set. So then password reset becomes difficult or impossible. Also some sites maintain lists of domains from such services and will not allow you to create an account with an email address using any of those domains.
Whereas what you might do instead, which is what I am doing now, is to run catch all but only during the moments where you know you will be receiving an account creation or password reset mail.
For this I use a very basic mail server that receives the mail and just dumps the mail in the terminal that the program is running in. Portions of some mail may be base64 encoded, but you can just copy the encoded text, run a base64 decoding program in another terminal and paste it into that. macOS, FreeBSD, most Linux distros etc all come with a base64 encoding and decoding program shipped with the default install of the system. At a glance it may seem like a bit of work, but I find this the simplest and fastest for the purpose of receiving one-off password reset mails.
First of all, forward port 25 TCP from your router to your computer.
Then, create an MX record on the domain or subdomain that you'll be using.
Install aiosmtpd:
pip3 install aiosmtpd
And then run it:
sudo aiosmtpd -l 192.168.x.x:25 -n
where again 192.168.x.x is the LAN IP address of your computer.
Then when an email is sent to any address at your domain you should see the message show up in the terminal where you have aiosmtpd running.
When you've received the mail, shut down aiosmtpd on your computer and disable the port forwarding of port 25 TCP on your router. Also, remember to update the MX record next time you want to receive an email if your global IP address has changed in the meantime.
Also, instead of running aiosmtpd as root you should find out how to bind it port 25 as a non-privileged user. See for example https://stackoverflow.com/questions/413807/is-there-a-way-fo...
See also https://aiosmtpd.readthedocs.io/en/latest/cli.html for aiosmtpd command line usage and https://aiosmtpd.readthedocs.io/en/latest/ for other details about aiosmtpd.
If you are feeling adventurous you could write some code to make this even simpler to use. Perhaps going as far as to both automatically enabling and disabling the port forwarding for your router (for example by emulating the login and other HTTP calls that your browser would send when you manually manage the router), and updating the MX record for your domain if needed, as well as to write received mail to disk in Maildir format. https://en.wikipedia.org/wiki/Maildir