Hacker News Reader

Comment by eikenberry | Hacker News Reader

There is also a happy medium. Host your own MX servers but use someone else's SMTP servers. You have complete control over the incoming mail but dodge the filters by using the established business for sending mail.

View on HN

> Host your own MX servers but use someone else's SMTP servers.

Yes. My outgoing email goes out via Sonic's SMTP server, with the SPF records to allow it to have a source address of my own domain. Incoming email goes to my own domains and gets forwarded.

This seems to be trouble-free. The domain is on a cheap shared hosting account. I'm not running a server. I own the domain, and not though the hosting company, so I can switch to another provider if necessary. In 27 years, I've had to do that twice, because the hosting provider went out of business.

This is easy to do, and I don't have to deal with Google. I don't even get much spam. All the spammers seem to be targeting the big services now.

I just looked at my spam folder. I'm regularly being offered dental supplies, large hydraulic sheet metal bending presses, and ammonium sulfate fertilizer. It seems that having your own domain now means you get mostly business-to-business spam. I subscribe to Machine Design, which gets me some heavy industrial marketing, but I have no idea why I get dental supply ads. The fertilizer spams, from China, look like a scam - there's a fertilizer shortage, so that's a spam which might get replies.

>I just looked at my spam folder. I'm regularly being offered dental supplies, large hydraulic sheet metal bending presses, and ammonium sulfate fertilizer. It seems that having your own domain now means you get mostly business-to-business spam. I subscribe to Machine Design, which gets me some heavy industrial marketing, but I have no idea why I get dental supply ads. The fertilizer spams, from China, look like a scam - there's a fertilizer shortage, so that's a spam which might get replies.

I used to have a 'Shirley' email all the time from China about elevator parts. It was such a niche kind of spam that I eventually replied and requested pictures of a bunch of parts. They sent them!

> I used to have a 'Shirley' email all the time from China about elevator parts. It was such a niche kind of spam that I eventually replied and requested pictures of a bunch of parts. They sent them!

https://web.archive.org/web/20030412191437/http://www.penny-...

I remember in grad school, one of my classmates being upset about getting a porn spam email in Chinese and saying, “but don’t they know that I’m a girl?” I pointed out to her that I got the same emails (but had no idea what they were saying) and explaining to her that they send them to everybody.

I do this too with a different provider whose whole business is relaying for self hosters. I have had exactly 0 problems since I started a couple of years ago. Its kind of perfect.

Which provider is this? I'm thinking of switching to this middle ground option too.

It can very much depend on your domain. In the early 2000s I ran a domain for a firm and the domain had 'UT' in it. Well spammers thought it was related to university of Texas at some point and we went from around 10 messages a day to over quarter of a million. The immediate issue I has was poor back scatter protection so I had to configure that in a few days. That stopped 99.99% of the spam, but still caused massive issues with the mailboxes that did exist getting hundreds of messages per day even though we were blocking tens of thousands of mails per valid email addresses.

Spammers are miserable, I don't fault anyone for giving up.

SPF and DKIM no longer have any real value. Just look at SA and the values it assigns by default to mail with those headers. Couple that will the fact that spam now has valid SPF and DKIM - just makes them pointless.

DKIM and SPF, along with DMARC are more about authentication - they let you know that the message has come from where it says it does. This makes spoofing harder, not necessarily spam. Greylisting deals with most of the "spray and prey" spammers, though it does have it's own issues.

Agreed.

This should be made a standard practice.

Third party email providers, the so-called "established businesses", get a free pass as sending SMTP servers that are accepted by almost all receiving STMP servers. Everyone just assumes everything coming from those SMTPs is legit. Establishing this "legitimacy" and getting the "free pass" is difficult and some have suggested, the third parties may employ anticompetive tactics.

However, IMHO the receiving SMTPs is a different issue. Why do we let these third parties receive and store our email. (Why do our homes have their own mailboxes. Why not use a "P.O. Boxes" instead.) Eventually we could move away from letting third parties control the receipt of our mail. Neither "POP3" nor "webmail" was part of the original concept of email.

Today, it is easier than ever to set up overlay networks where we can assign our own IP addresses and run our own SMTP servers that can communicate directly with other SMTP servers on the overlay network. These networks are not open to the world, they may only be open to people we know. Much of our mail is between people who know each other, e.g., friends, family, colleagues. Or businesses that we contact first. We can separate different social and business networks on different overlay networks.

Anyway, the sending and receiving of mail can be separated. We do not need to let a third party control both.

Feel free to do this, nobody will join you so the spam will be virtually nonexistent!

Adding to the happy medium is to teach your friends and family to use Thunderbird so they can easily GPG encrypt [1] their emails keeping the nosey email providers off the email body. Also teach them to use the IMAPS (TLS) endpoint for their mail provider, usually port 993. There are probably simpler how-to's with pictures, I just do not have any of them handy.

[1] - https://support.mozilla.org/en-US/kb/openpgp-thunderbird-how...

I'm sorry to say, that's nowhere near a medium stance or ask.

It could be we have different circles of acquaintances. I have managed to get non technical friends to GPG encrypt their emails. I also talked 2 lawyers into using this and the two lawyers are not only non technical but have nearly zero patience.

I guess a lawyer might know a thing or two about confidential messages.

I think you’d be very surprised at how much lawyers don’t know or care about any of that. They store stuff in the cloud without ever having heard of the Third Party Doctrine (which allows the US government warrantless access to those documents).

> store stuff in the cloud without ever having heard of the Third Party Doctrine (which allows the US government warrantless access to those documents)

Or because they know the third-party doctrine doesn’t apply to attorney work product and privileged materials.

After doing work for lawyers for years, they really are the worst when it comes to understanding computers.

It does no such thing, that’s absurd. See carpenter v. United States (among many, many others).

They do. Most of them use proprietary https web interfaces that usually have "secure email" or "secure messaging" in the description but they are just fancy web portals. I despise those systems. The content is not encrypted at rest and can be leaked. With OpenGPG the emails are only decrypted on the recipients end points and can be deleted by request.

Not all of them. I keep seeing lawyers sending photos of sensitive documents using their cellphone and Whatsapp (before encryption), and most of them don't even care about all those documents still residing on their cellphone, at the mercy of whoever steals it since all the security they have in place is that swipe thing that anyone with good eyes spots in 2 seconds straight.

ok, this is the text book definition of "out of touch"

Yep. On any other site I’d assume that comment was satire. Nothing’s changed in the last decade:

https://moxie.org/2015/02/24/gpg-and-me.html

https://blog.cryptographyengineering.com/2014/08/13/whats-ma...

My canned response to the second article/rant:

* https://articles.59.ca/doku.php?id=pgpfan:wtmwp

even zimmeman says it's too complicated for the unwashed masses and was meant for the techy crowd of the time he came up with it.

Apple mail support GPG easily. No need to use Thunderbird.

Can you please provide a few references to that claim?

They might be talking about S/MIME.

I use https://github.com/Free-GPGMail/Free-GPGMail which is a plugin for GNUPG, without the "support" plan.

https://gpgtools.org

GPG Mail is a paid for add-on, but it works and it works well.

It's not a paid add-on... GnuPG is open source. They are selling a support plan in case you need help with open source.

Here is the same thing, without the paid support. https://github.com/Free-GPGMail/Free-GPGMail

- GPG Suite was released under an Open Source license in the past. Is that stil the case?

You GPG Suite including GPG Mail is still going to be released under an Open Source license.

- Am I still allowed to compile my own version of GPG Mail / GPG Suite removing any code regarding the trial or activation?

You absolutely are, the GPL makes sure of that. You will find the source code on this website next to the download link for GPG Suite.

We would kindly like to ask you not to use our names or icons if you plan to publish a binary for others to use. Also please do not release any complete installers as that may suggest that they are official releases.

https://gpgtools.org/faq

To be pedantic, the version I linked to is a paid addin. However, you are correct - there is/are unofficial unpaid and unsupported versions available that I was unaware of, per the FAQ and the repository that you linked, which has nothing to do with GPGTools GmbH; from the repo, “This does not constitute any endorsement or promotion of our releases by the respective copyright or trademark holders.” Thanks for sharing this.

Most of my friends and family don’t own computers, only phones and sometimes tablets.

there is definitely software to help with pgp on ANY tablet, phone, or PC your friends and family have access to. The universal problem is no one cares to encrypt except a few computer nerds, spooks, and journalists.

It means you now have to worry about key management or else lose access to all your old mail, it possibly complicates logging in on new devices or via webmail, partially breaks server-side (spam) filtering, breaks server-side full-text search… so there are some definitive trade-offs there to be made.

K-9 Mail is an app available for Android which supports PGP (if clunkily).

<https://k9mail.app/>

I'm not going to remotely pretend that this would make PGP attractive or viable for the greater public. I do want to address your valid point that the general-purpose computer seems to be a dying breed, but that there are still options for mobile devices.

I've used K-9 Mail, though rarely do these days (it went poorly-maintained for a while).

There seem to be some options for iOS as well, such as iPG Mail, though I've no experience at all with it.

<https://www.openpgp.org/software/ipgmail/>

Most of my friends and family don't have Android devices.

Perhaps you might care to share with us what types of devices they do have, seeing as my mental telepathy transgizmatron happens to be in the shop presently.

Note that I also listed an iOS option, and mentioned that there are others.

Again: PGP-enabled email apps are available on many platforms, though, again, this addresses only a small part of the larger challenge at encouraging adoption.

Apple supports encryption on Mail:

https://support.apple.com/en-gb/guide/mail/mlhlp1180/mac

protonmail also has nice tools for it if you use them. I suspect tutanota probably does as well.

Not a single member of my friends or family is going to use GPG encryption, not even my mother who loves me dearly. I had a computer geek "penpal" for a while and we did monthly emails to each once a month to catch up via gpg, and even that died off lol

You can also use an MX backup service which will accept mail when your server is offline (and it will resend it when the server comes online)

You can also even keep Gmail as your MX server! Just move messages off of it as soon as they arrive. It's just a mailbox, after all

> You can also even keep Gmail as your MX server! Just move messages off of it as soon as they arrive. It's just a mailbox, after all

Do you have more information about this?

I've been looking to do something similar so that I can have my mail sorted into folders without setting up the same rules on multiple clients. (Gmail's sorting doesn't seem to support some of the sorting I'm currently doing in Thunderbird)

I've been hosting and operating my own MTA MX with Postfix since 2005. I have Postfix set to use "MailDir" format storage (one file per email) and then use Procmail filters to direct emails into per-sender or per-topic specific folders when they arrive on the server - nothing needed to be done in the email client. Dovecot provides the IMAP4 client interface. Thunderbird connects via IMAP4.

Each domain has its own user home directory so for each there is a /home/${domain_name}/Maildir/ directory as the base for storing emails, and each IMAP4 folder has an associated directory. Snippet:

  $ ls -1da  Maildir/.Technology.FOSS.Projects.Linux*
  Maildir/.Technology.FOSS.Projects.Linux
  Maildir/.Technology.FOSS.Projects.LinuxContainers
  Maildir/.Technology.FOSS.Projects.Linux.drbd
  Maildir/.Technology.FOSS.Projects.Linux.kernel
  Maildir/.Technology.FOSS.Projects.Linux.linaro.dev
  Maildir/.Technology.FOSS.Projects.Linux.linux-i2c
  Maildir/.Technology.FOSS.Projects.Linux.linux-input
  Maildir/.Technology.FOSS.Projects.Linux.linux-pci
  Maildir/.Technology.FOSS.Projects.Linux.linux-usb

Here's an extended snippet example from $HOME/.procmailrc that directs deliveries into the correct directory (IMAP4 folder):

  :0H
  * ^List-id: .*linux-usb\.vger\.kernel\.org
  $HOME/Maildir/.Technology.FOSS.Projects.Linux.linux-usb/
  
  :0H
  * ^List-id: .*linux-wireless\.vger\.kernel\.org
  $HOME/Maildir/.Technology.FOSS.Projects.Linux.linux-wireless/
  
  :0H
  * ^List-id: .*yaffs\.lists\.aleph1\.co\.uk
  $HOME/Maildir/.Technology.FOSS.Projects.Linux.yaffs/

  :0H
  * ^List-id: .*util-linux\.vger\.kernel\.org
  $HOME/Maildir/.Technology.FOSS.Projects.Linux.util-linux/


  ### LinuxContainers
  :0H
  * ^List-id: .*lxc-devel\.lists\.linuxcontainers\.org
  $HOME/Maildir/.Technology.FOSS.Projects.LinuxContainers/

  ### Linaro
  
  :0H
  * ^List-id:.*linaro-dev\.lists\.linaro\.org
  $HOME/Maildir/.Technology.FOSS.Projects.Linux.linaro.dev/

  :0H
  * ^List-id:.*linaro-kernel\.lists\.linaro\.org
  $HOME/Maildir/.Technology.FOSS.Projects.Linux.linaro.kernel/

Whose SMTP service you'd recommend?

Sendgrid works well for small volumes

I use zoho.com, $12 a year and I haven't had any issues with blacklists.

Yep SMTP relay is the only sane choice nowadays sadly. Sending your own mail is a losing battle against the email blacklist cartel.

No...it isn't the only sane choice. If it works for you, great. Forunately for Internet freedom, there many of us small timers left who have no issues hosting our own email.

I have no issue hosting, it's just tiresome keeping clear of Spamhaus etc.

Using an SMTP relay was a suitable trade-off, for me, but I respect those who are able to endure the pains of sending non-flagged emails without it.

Reply on news.ycombinator.com