Hacker News Reader

Hacker News

Comment by R_Spaghetti | Hacker News Reader

Parent Full thread

R_Spaghetti

You write: I'm fortunate enough to work at a company (enum.co) where digital sovereignty is not just a phrase.

info.addr.tools shows [1]: MX 1 smtp.google.com. TXT "mailcoach-verification=a873d3f3-0f4f-4a04-a085-d53f70708e84"

TXT "v=spf1 include:_spf.google.com ~all"

TXT "google-site-verification=TTrl7IWxuGQBEqbNAz17GKZzS-utrW7SCZbgdo5tkk0"

This is not just a phrase, it is a DNS entry. Using the most evil in phrases of digital sovereignty.

[1] https://info.addr.tools/enum.co

View on HN

To be fair to enum, the services they sell are around k8, an s3-equivalent, and devops. If they sold/promised self-hosting/sovereign email services, and then were "caught" using gmail, that might be a different story.

Your point stands - they're not fully completely independent. And maybe the language in the OP's article could have been different.. but the OP also specifically says "Oh no, I said the forbidden phrase: Self-hosted mail server. I was always told to never under any circumstances do that. But it's really not that deep."

They're aware of the issue, everyone is aware of the issue. It's an issue :-) But I get your point too.

I think it would be fair for them to use something like proton or enterprise msft relay service. Actually this is only for inbound mail, it can be self hosted without any issues, spf on the other hand (outbound verification) does need a relay at minimum.

Hi R_Spaghetti,

Founder of enum here. That's a fair point, and a good catch.

Honestly, using Google Workspace for our internal email was a pragmatic choice early on to let us focus on building our core product. It's a classic startup trade-off, and one we're scheduled to fix in the coming weeks.

I want to be clear, though: our customer-facing platform and all its data are and always have been 100% sovereign. Our infrastructure is totally independent of Big Tech.

Thanks for holding us accountable!

> Our infrastructure is totally independent of Big Tech

That's wishful thinking. You cannot be truly independent from them, no one can. They control major BGP routes, major ASN, big fiber cables, etc. It's just impossible

'If you wish to make an apple pie from scratch, you must first invent the universe.'

- Carl Sagan

They aren't going to cut the fiber cables if your Google accounts gets locked.

That’s fine. But as R_Spaghetti has kindly pointed out maybe you could try and convince your colleague to change the post to rather accommodate “… digital sovereignty is still just a phrase …” and then possibly add something like “and we are working to change that” :) Just a thought. Of course we all are free to talk anything we want, do anything we want, and definitely write and post anything we want.

Email is the one notable exception for self hosting. I self host everything, but let email be handled by 3rd parties.

Yeah I really will give people a pass here. The state of email is one of the worst collective mistakes I think we've made.

You can literally be an expert in everything relevant - and your mail will still not get delivered just because you're not google/mailgun/etc.

I was trying to do a very simple email-to-self use-case. I was sending mail from my VPS (residential IP not even allowed at all) which was an IPv4 i'd had for literally 2+ years to exactly only myself - my personal gmail. I had it all set up - SPF, DKIM, TLS, etc etc. And I was STILL randomly getting emails sent directly to spam / showing up with the annoying ! icon (grates on my sensibilities). I ended up determining - after tremendous, tremendous pain in researching / debugging - that my DKIM sigs and SPF were all indeed perfect (I had been doubting myself until I realized I could just check what gmail thought about SPF/DKIM/etc. It all passed). And my only sin was just not being in the in-crowd.

Incredibly frustrating. The only winning move is not to play. I ended up just switching from emails-to-self to using a discord webhook to @ myself in my private discord server, so I get a push notification.

And this was just me, sending to myself! Low volume (0-2 emails per WEEK). Literally not even trying to actually send emails to other people.

I'm self-hosting for 17 years and counting.

In my opinion, the pragmatic solution I use is:

1) use a specialized distribution (I use yunohost but there are others). This makes configuring SPF, DKIM, TLS and more a breeze

2) use a reputable relay to send your emails (I use OVH but again there are plenty of other choices)

Of course it means you are not "pure" because emails you send will go trough a 3rd party (the relay) but it solved the delivery issue entirely for me, so that I can continue to benefit from all the other benefits of self-hosting.

I'm self-hosting my mail server without a relay. It is still possible, you just need to be persistent. In the beginning Microsoft might just let your mails vanish and while they won't confirm this when you contact them doing so eventually resolved my delivery issues with their mail servers. With Google I didn't have any issues.

Do you run Yunohost in production? Did you consider Cloudron/Coolify/etc.? I use Yunohost for personal services, it's extremely robust, but has a few lacking features that you'd expect to have in more professional setups.

Self-host receiving email, even if you outsource sending it.

> This is not just a phrase, it is a DNS entry. Using the most evil in phrases of digital sovereignty.

damn, this guy don’t fuck around. respect

> TXT "google-site-verification=TTrl7IWxuGQBEqbNAz17GKZzS-utrW7SCZbgdo5tkk0" just to clarify, this part is not evil, it is just a compromise one makes to prevent Gmail from classifying outgoing email as spam (I think).

Reply on news.ycombinator.com