Hacker News Reader

Comment by dinowars | Hacker News Reader

> First, I tried mailbox.org, which I can generally recommend without reservation. Unfortunately, you can’t send emails from any address on your own domain without a workaround

I use mailbox for a long time, one account for 2.50EUR/month with multiple custom domains and I can send emails from any address. To send from a different address the process didn't really seem different than other providers.

From Thunderbird mobile on Android I just add a new sender identity. If I need to send from webmail, similarly I just add a new alternative sender. Are these the workarounds you mentioned?

View on HN

I use mailbox for the past few years and I think it's the best option out there. But they have one major issue, which is that anyone can impersonate your domain:

https://userforum-en.mailbox.org/topic/anti-spoofing-for-cus...

Oof, what a drag

I think that is not up to date. Mailbox publishes DKIM records: https://kb.mailbox.org/en/private/custom-domains/spf-dkim-an...

SPF is here https://kb.mailbox.org/en/private/custom-domains/spf-dkim-an...

DMARC is up to the domain owner to set.

Lack of records isn't the issue. You authorize mailbox's servers to send on behalf of your domain. Then they let anyone with a mailbox account set the from to your domain.

I see, so their SMTP authentication is woefully broken and they let anybody who can send an e-mail from their SMTP server to put anything in From: ? That's rather hard to believe. The defaults of most SMTP servers like Postfix prevent that. Since I don't want to get banned I don't really want to test that option with their SMTP server.

I took the https://emailspooftest.com/ and while the "spoof" mail gets delivered to mailbox.org's Inbox, my Thunderbird client is all red and it warns me about DKIM and SPF fails.

I think on the sending side, being able to send from others’ addresses is fixed by now: https://userforum-en.mailbox.org/topic/anti-spoofing-for-cus...

But it definitely used to be possible, I tried once with success.

Anti spoofing for incoming mails was not perfect the last time I checked either, but is a different issue.

For incoming mail, your client should check regardless of the server provider. On Thunderbird I have this extension: https://github.com/mcortt/EagleEye . It checks for any SPF, DKIM and DMARC fails and shows a banner. SPF/DKIM/DMARC is minimum and pretty useless against spam though. All phishing e-mails in my GMail account have impeccable SPF/DKIM records.

I wish they had retained one awesome Thunderbird desktop feature on mobile as well - being able to set the "from" address on the go while composing the email, without having to add an identity/sender-mail in advance. Alas, it seems that hasn't been the case.

I don’t understand why this feature isn‘t more widespread, do people not use subaddressing?

Have been using mailbox.org with a custom domain (including catch-all wildcard) for the last 5 years or so, so it's definitely possible and as far I remember quite straightforward.

I know it is late, but for anyone reading this now, as I am:

Mailbox.org is completely ignoring DMARC since months... And their handling of the issue IMHO is incompetent at best.

See this thread (in German) https://userforum.mailbox.org/topic/10676-mailbox-org-akzept...

That's just inexcusably bad. They claimed to be working on the issue 7 months ago, but that was obviously a straight up lie.

I also use mailbox.org and use my own domain for email. Not sure what issue the author ran into.

SPF or DKIM maybe?

See: https://news.ycombinator.com/item?id=47492820

My understanding is that the number of such sender aliases is limited, at most 50 or 250, depending on the plan. There are ways to use a custom domain for sending where you end up using a larger number of localparts fairly quickly, and it would be a hassle to have to manage them, instead of just typing whatever sender you want (or on replies, having the email client automatically use the address from the original email, without having to worry whether it’s still in the set of registered aliases).

The limit is only enforced in the web interface. You can send from any alias using any third party email client, and on the website you can configure a catchall mailbox and create a rule to filter out the aliases that receive spam.

When you have a custom domain you can list @mydomain.com as sending domain allowing you every string before the at character. So that means you could use 50 different domains with infinite adresses on these domains.

Yea been using mailbox.org for couple months and i can send from any address of my own domain...this is bad article. He probably doesn't know how to.

Can confirm, I use mailbox.org with my own domain and can send from any *@mydomain

Hmmm this looks like a really nice option! Any issues with deliverability?

Works for me as well.

...also migrating AWAY from Fastmail (Australian) and TO an European provider sounds like a very bad idea - I'd kind of want both the US and the EU legally away from my coms at all costs (!)

While I agree in principle, I have to remind you (and to myself) that Australia is part of the Five Eyes: https://en.wikipedia.org/wiki/Five_Eyes

The problem is that, even if Fastmail are Australian, they host exclusively in the US. They state that sure, there is the possibility of interference at the data center level, but they rely on their anti-hacking measures to prevent unlawful access

Is it that different? Being Australia in alliances like "Five Eyes" I don't think you can keep your stuff away from the US at least when using Fastmail.

If you want both US & EU away from your data, I suppose you will have to consider things like Yandex Mail, which comes with its own set of problems too, of course :)

Fastmails servers are in the US IIRC.

As EU citizen I at least got some influence into EU policy. A government far away doesn't even have to pretend to care about me.

Fastmail runs exclusively of AWS in the US.

I looked into this, there are lots of people in forums discussing/ asking for EU based servers.

Fastmail does not run on AWS: https://www.fastmail.com/blog/why-we-use-our-own-hardware/

Reply on news.ycombinator.com