Comment by jaytaylor | Hacker News Reader

Comment by jaytaylor | Hacker News Reader

Parent Full thread

Blocking port 25 is pretty annoying. I know there are explanations, but a month ago I really wanted to run a mail server for jaytaylor.com myself. Only to find out it's basically impossible with mainstream ISPs. It's not a realistic option, regardless of Comcast, AT&T Fiber, no big boy ISP supports it at this point.

I don't know if ATT even provides email with my service, much less for a custom domain.

How did the de-facto solution become "Just use Gmail" or pay a third party to do it? It's a little sad for those of us who like running our own servers, total uphill battle. All that work in the early days of the internet to ensure such a feat was possible, only for it to become near impossible for most, regardless of technical prowess.

Just give all your data to a huge company, it's fine. Pft.

Sorry for the rant. Am I really becoming those old hags I used to make fun of on slashdot? Shoot...

p.s. It's easier than ever to do, too, because high-quality docker images are abundant. Tragic for nerds like us!

Port 25 is blocked by default for many ISPs around the world, and it makes sense. Look at it this way: If it was open by default, a lot of IPs would be blacklisted, making them basically unusable for email anyway.

You can always rent a subnet or a server including network and host mail yourself.

you can also call your isp and get port 25 unblocked, gp's experience hasn't been my experience

I suppose you can, but in my experience, I think you'll find that people proactively find the dynamic ranges of IPs in eyeball networks and make it very difficult to get mail accepted. If you want to send email from your own server, you will either have to get a 'business/static IP' account or use an IP in a block where you can both control the RDNS and servers are expected to be. i.e. a VPS provider or colo IP range.

On a related note, what if I want to run a mail server but only for incoming emails? As in I want to buy a domain and create basically a sinkhole email address and create email addresses like hn@example.com

I never need to reply from that email. I just need to be able to read emails I get. Should be much easier, right?

That should be pretty easy. It mostly depends on the exact configuration of the networking where your mail host is and your ability to correctly lock it down so it's not a spam machine.

Receiving email is pretty straight and forward, filtering it can be a little tougher but should be fine.

Residential IPs are generally proactively added to RBLs by the ISPs themselves as a form of spam protection. Before they started doing that it was basically whack-a-spammer all day every day for them.

Which docker images? I've been having trouble finding "simple" mail servers for incoming and outgoing. Stuff like postfix and dovecot make my eyes cross, I just want to point DNS at an IP and send and receive mail there, securely.

It's not that I can't set those other ones up, I just don't want to, nor should I have to for a small service...

I've been using Zimbra 8 for years. Not a docker image but has a single install script and sits on ubuntu. It's a poor-mans enterprise email client for free.

It's a bit chunky and when it doesn't fall apart it has a nice friendly client with support for mobile. Includes all the bells and whistles of spam assassin, dkim, briefcase etc. Mobile view is a bit dated but it works for elementary sending / receiving.

The free version has no backups which is a pain and makes me scared to reinstall/move away from. But for a all-in-one email server client it does have a charm.

Zimbra 9 looks nice but licensing.

Is it for non profit? Maybe you can apply for a license that way?

I've been using Zimbra's free edition for quite some time myself too, since v4 IIRC (back before it moved from TomCat to Jetty). Ran DayJob's mail server from it for a fair few years too.

> The free version has no backups which is a pain and …

I “simply” rsync the key parts off to my usual backup locations (where snapshots are made etc.)⁰. There are a few articles on how to do this floating around. The restore procedure is basically the same as transplanting a Zimbra instance from one install to another¹. For paranoia's sake I have a small extra VM that automatically restores itself from the latest backup daily, and I check occasionally to make sure it is running fine and has recent mail. That VM is not publicly addressable, but if my main instance dies irreparably I could make it so easily and flip DNS over to point its way, probably bumping up its RAM allocation too, losing at most what happened since the last backup. The VM actually thinks it is the “real” primary instance, even with the same local network addresses, as they live behind a split DNS arrangement. A copy of this VM can be used to test upgrades and other major admin to an extent too.

> makes me scared to reinstall...

I've found upgrades work smoothly, if you wait a bit after major versions to let the quick adopters iron out the issues first, so I've not had to completely fresh install. Just don't upgrade the base OS at the same time as Zimbra. For OS upgrade when an Ubuntu TLS release nears its own EOL or Zimbra's support for it does. I do by reinstall rather than upgrade but for Zimbra in the process things are the same as the backup restore operation. There has always been sufficient overlap between Ubuntu LTS lifetimes and what versions Zimbra supports that this has worked for me.

> makes me scared to … move away from

I've successfully used imapsync³ to move mail between various servers in the past, including into, out of, and between, Zimbra instances. Obviously that doesn't cover calendar data, config, and other features, if you use them, but for mail it is a good option. Regular syncing to something else could be an extra fall-back backup option too though I've only used imapsync for one-off bulk transfers.

> Zimbra 9 looks nice but licensing.

Same. Given how many times Zimbra has changed hands I'm surprised similar hasn't already happened sooner and I've had a good run with it! Maybe closer to 8's EOL others will start maintaining reliable builds of the OS parts, though I'm thinking I'll shift to something else next year. I've mainly stuck with Zimbra because it just works, given my needs have changed considerably over the years something lighter will probably be better and if I'm going to have to do more work (or pay, of course) to keep using Zimbra it is definitely time to properly reconsider the state of the many alternatives. At least we've got a decent amount of time to transition.⁴

[0] Hot rsync to local LAN backup first to speed up the part where the instance needs to be down, stop Zimbra, rsync to local LAN again to get a consistent backup there, restart, then soon after that the local backup is rsynced off to the offsites.

[1] Install same OS+Zimrba versions, stop, restore data from backup over the top, some steps to check/fix perms, off you go. Again, there are examples in the docs & forums.

[2] As [1] just with the new OS.

[3] https://github.com/imapsync/imapsync

[4] IIRC 8.x is due to EOL and stop getting security updates at the end of 2023, I'm intending to have something else in place by the end of 2022. If I have time to look around properly and make a decision by then, maybe I'll get around to it over the extended bank holiday weekend at the start of June.

docker-mailserver is pretty good. It does use postfix and dovecot, but at least the default config is very good and you don’t have to touch it much.

Stuff like postfix and dovecot also make my eyes cross

I've been using nodemailin to receive all emails as POST requests. Set the DNS ip address to a vps on hostwinds (they don't seem to block incoming port 25) so it worked for me right away.

https://www.npmjs.com/package/node-mailin

https://www.hostwinds.com/

maddy

It's a single go binary that supports IMAP and SMTP, with a CLI (maddyctl) to help you set it up. TLS can be added with acme.sh.

I pay $15/mo for static IP with att. I just sent a message through the chat in their site, please unblock port 25. They replied ok, and it got unblocked next day

The solution is to pay for business-class Internet at your home.

That's true, even though I'm not a business.

Would it be more cost effective to do a DO droplet? (haven't tried it personally yet).

At least where I am, the business class internet that I have access to doesn't come with static IPs and is approximately three times as expensive as residential for the same service level.

You can tunnel wireguard from a local server to a cheapie DO droplet for about 5$ USD/mo. Only one ipv4 pre dropte though. I read a blogpost that mentioned a free tier cloudflare service for public ips, but have not investigated.

yes, a VPS would absolutely be cheaper. Even if you get the port unblocked, you're still not going to be able to set reverse DNS for spf records unless you have a business connection with static IPs. An IP alone will probably cost you the same as a VPS that will run a tunnel back you your home box.

In my experience, a business connection is usually twice the price and half the bandwidth.

Actually I just remembered, I can probably use my free Oracle OCI VM, not sure if they'd set up reverse DNS, though. Will have to file a ticket or search about it to learn more.

Disclaimer: Currently I work there, and it's true anyone can get a free VM "forever" (I've had one for 4 years).

you need to have a "paid" account to open a support ticket, but it's still very much free

also, newer accounts (from June I think) have port 25 closed by default, you need to open a ticket for that too

I almost did this; but my residential account has a "life-time" price contract which the business-class internet does not have. I worry that the business rates will increase with a higher probability.

:(

Even if it was open, it's very common for spam lists like Spamhaus to block residential dynamic IPs by default

A fair measure imo. You are probably going to see 1 legitimate email server mixed in with 1 million infected spam machines. For the legitimate user, its easier to tell them to rent a $5/month VPS.

> For the legitimate user, its easier to tell them to rent a $5/month VPS.

Quite often blocked, too.

There are free tier at some third parties to redirect for you - usually port 25 is blocked outbound, not inbound (at least mine does this), so you can receive email easily, sending them out you use a free service but they can read all your emails.

> How did the de-facto solution become "Just use Gmail" or pay a third party to do it?

But, also, havn't you read all the cry babies on hackernews talking about how complicated it is to run a mail server? Why would you even try??? And, don't take calculus when you're in high school. That's hard too, I heard.

But, also, havn't you read all the cry babies on hackernews talking about how complicated it is to run a mail server?

Complexity isn't the issue. It's about the utility of doing it. What you gain from running your own mail server is so minute that it's not worth the effort even if you think it's simple and easy. I could run my own MTA from my house, but I pay someone else to because being a sysadmin is so boring.

Reply on news.ycombinator.com