Hacker News Reader

Comment by pandemicsoul | Hacker News Reader

Spam blocklists are run by an unaccountable cowboy cult that somehow has managed to consolidate a ton of power simply for the fact that most people who run email inbox services didn't want to deal with the problem of spam, so they were more than willing to just hand over anti-spam "enforcement" to anyone who was allegedly doing "what was best for the internet." There's no check on these people who run these blacklists, and the system they've built is entirely a black box, antithetical to the principles of the open internet. And if you're not a huge corporation that can afford professional management of your email deliverability, good luck – the individuals and small organizations are just out of luck. It's a miserable racket and for what?

If you want to know why there's a new thread each week on HN about why it's impossible to host your own email service, this is why.

View on HN

Let's not classify all spam blacklists as the same. UCEPROTECT is in a special class of extortionist cowboy, because it's basically just an inaccurate protection racket throwing a wide net across cloud providers who won't play their game. Some other blacklists are updated regularly and only contain IP addresses that have actually sent spam. By contrast, UCEPROTECT3 just lumps ISPs into the list even though an address has never sent spam.

I run a mail server on AWS, and we use some blacklists to drop mail. It's quite effective and that's why people keep using them. A properly curated blacklist is a powerful tool, and more accurate than the machine learning mush that people have come to rely upon.

> CEPROTECT3 just lumps ISPs into the list even though an address has never sent spam.

But this is by design[0]

> This blacklist has been created for HARDLINERS. It can, and probably will cause collateral damage to innocent users when used to block email.

And it makes for a perfectly usable blocklist. If you use postfix, the postscreen_dnsbl_threshold and postscreen_dnsbl_sites parameters let you create a simple scoring system:

  postscreen_dnsbl_threshold      = 10
  postscreen_dnsbl_sites          =
    zen.spamhaus.org*5,
    bl.spameatingmonkey.net*5,
    dnsbl.sorbs.net*4,
    bl.spamcop.net*4,
    dnsbl-3.uceprotect.net*3

I made up the numbers, because you will need to monitor your system for a while to see if they make sense, but the principle holds. Also make sure that the dnsbl you are using are working for you.

But it isn't really a problem with uceprotect, it's about how DNSBLs are used.

[0] https://www.uceprotect.net/en/index.php?m=3&s=5 [1] http://www.postfix.org/postconf.5.html#postscreen_dnsbl_site...

I also run an email server. I just used https://mxtoolbox.com/ to check my status and yep, UCEPROTECTL3 is the ONLY one to have my IP range listed.

The article sums it up nicely: IP blacklists have their place, however, please don’t use the overarching neighbouring blacklists such as UCEPROTECTL2 and UCEPROTECTL3.

UCEPROTECT is just horrible, full stop. Stuff like [1] read like it's written by a 13 year old. Lots more where that came from; as near as I can tell UCEPROTECT is run by a single person who is consistently vitriolic like this to anyone offering even the mildest of criticisms (supposedly multiple people have involved over the years, but their, ehm, distinct colourful personalities are so alike that I'm inclined to think it's just the same person using different aliases).

People have been complaining about this for a very long time; as long as I can remember. In the past they've also just permanently added people's IPs after complaining their IPs were wrongfully listed (not sure if they still do that).

The UCEPROTECT blacklist should be blacklisted by everyone. Yes, we need a blacklist of blacklists.

[1]: http://www.uceprotect.org/cart00neys/2021-001.html

I think I understand a lot more about UCEPROTECT now that I've read the message you linked. This is pretty extraordinarily sexist and unprofessional, and you can really get a sense of how much the author despises anyone who criticizes him.

Spamhaus, which (as far as I can tell) is seen as the "most legitimate" blacklist is just as bad, if not worse. UCEPROTECT might be extorting you, but at least you know the name of the game. With Spamhaus, any email sender can get blacklisted for whatever nonsense rules Spamhaus comes up with – many times a set of entrapments they themselves have devised – and they have zero urgency or clarity around resolving it. "Fix the problem" they say. Okay, what's the problem? "Be a better sender." Okay, how? It's like a conversation with Yoda.

To be clear: I DON'T think blacklists are the problem. I think the problem is that a half-dozen major blacklists are controlled by unaccountable organizations who make up rules willy nilly, and privilege major email senders while punishing smaller senders / home hobbyists.

> antithetical to the principles of the open internet.

No. These blocklists are employed by the actor receiving the email. They have a perfect right, even on "the open internet", to decide that they want to limit who can send them messages.

There are tons of checks on the people who provide those blacklists, in the form of their users complaining about lack of mail delivery and ultimately not using their list anymore. We vote with our wallets, and as a group we have decided that these blocklists are useful.

> and for what?

To make email usable. Full stop.

Absolutely agree. This doesn't fall under the principles of the open internet nor anything in the 'net neutrality' arena. You have no right to expect anyone to receive traffic from your server if they choose not to. It's a major pitfall of running your own relay, but it's not unethical.

Unfortunately 50% of the world's mailboxes are hosted by 2 companies. That means the open internet is far as email goes is already dead in practical terms for most people. When they block another host that host no longer has email network access.

> These blocklists are employed by the actor receiving the email.

If I send an email to alice@example.com, Alice is the recipient, not Bob the sysadmin for example.com.

This is incorrect. The service you are sending the mail to (example.com in this case) is receiving that mail. They are then delivering it to the user, or not, depending on the agreement they have with the user. If example.com and a user of example.com have agreed that example.com is responsible for providing spam filtering, then they would be remiss in delivering the email to their customer.

This is the way that email is designed to work and the fact that users and service providers have choice is a feature, not a bug. If you don't want your service provider to do this type of filtering, that is your choice. But you have absolutely no right to say that Alice can't get the service she wants from example.com because it's inconvenient for you.

Edit: and just to head off the inevitable "but what about if it's at work and I can't change providers", the domain and email accounts belong to your employer, not you. You are welcome to work somewhere else if you don't like how they configure their systems.

I'd hardly say this is a feature. It's an artifact of the fact that once upon a time computers were expensive, so many people had to share a server with multiple email accounts, and a netop had to run this server. The fact that Alice is beholden to example.com helps nobody but example.com. In an ideal world, Alice would not have to couple her infrastructure with a blocklist and Alice would have the choice of blocklist herself.

Spam is inevitable. Opining about ideal worlds is fun, but it's also irrelevant because that world is gone and it will never come back because it can't.

Alice is not beholden to example.com, she can use any hosting provider she wants. Moving providers isn't even that difficult. It's also totally irrelevant, because again spam is inevitable.

no. its because of spam. just because these people are doing a less than perfect job of keeping the screaming hordes out of my inbox doesn't remove any of the blame from the hordes.

It's been years since I last hosted my own mail server, and even then the HAM to SPAM ratio was well over 1:100. The torrent of absolute crap faced at port 25 is unbelievable.

So what's the alternative? SBLs work, clearly, and almost every mail host, in the absence of distributed list, would work up their own lists in short order.

Choose your SBL better; spend some time reading about it (doesn't have to be much) or testing it before blindly enabling it.

Still better than the alternative

Reply on news.ycombinator.com