Hacker News Reader

Comment by shiftpgdn | Hacker News Reader

I use a managed cPanel host and setup "catch-all" email addresses on my domains to forward to my gmail account. In the event of an outage or Google deciding to delete my gmail account I could change the forwarder or simply begin to use cPanel's built in mail clients. Having your email hosted at your own domain is one of the easiest things to do to gain control over something you normally let somebody else manage.

As to running your own email server? Don't bother. Unless you plan to stay on top of exploits, DKIM keys and SPF records you'll wind up with serious mail delivery problems.

View on HN

I've run my own mail server for many years, and delivery problems are very, very rare.

DKIM & SPF are marginally useful (at best) for ensuring delivery. You're much better off registering your server with http://www.dnswl.org/

DKIM and SPF are not that hard to set up. And it's a low enough barrier for entry considering that's all we have to stop spammers.

Edit: not sure about SenderID, to be honest.

When was the last time anyone had to patch their qmail instance? When was the last time qmail even needed to be patched?

qmail was once a great piece of software. Then it stopped being maintained, and it lived in a licensing no-man's land for quite a while that effectively prevented new maintainers and viable forks from existing.

It's no longer current technology and fails to comply with RFC changes that have happened since it was released, including but not limited to 6522, which standardizes bounce messages.

It still does very well at the job it was originally designed to do, but it's no longer a modern, usable tool. It doesn't belong in the modern email toolbox any longer.

Where do people get these misguided notions about email? You don't need dkim or spf at all, few people check either, and they are just to prevent backscatter. Running your own mail server is trivially easy.

Sorry but that's not true at all. DKIM keys, spf records and gmail: https://support.google.com/mail/answer/81126?hl=en

Recent Exim exploit: http://www.exploit-db.com/exploits/25970/

Dovecot exploit: https://www.rapid7.com/db/modules/exploit/linux/smtp/exim4_d...

I found a few Sendmail exploits as well but nothing from this year. Sure this stuff is easy to install but there is a reason managed email exists.

That "Exim exploit"-link is a little misleading -- that's not a bug in the software, but in (third party) documentation:

https://www.redteam-pentesting.de/de/advisories/rt-sa-2013-0...

By that metric all software on your servers are insecure (consider the number of "just do: 'wget http://trollol.com/pwn.sh|sudo bash -'"-type advice you find looking at install-instruction for random github projects).

If you are going to say "that's not true at all" you need to present an argument for why I am wrong. You posted something completely irrelevant, and a couple of exploits. There are security vulnerabilities found in all kinds of software, so what?

Can you point to a trivially easy set of instructions please? ;-)

And to some document giving confidence that it wouldn't be dangerously insecure or vulnerable to common threats?

https://wiki.debian.org/Exim

apt-get install postfix openldap dovecot

I really don't know what the deal is with email, but since the mid 90s there's been this weird thing where everyone wants to follow some kind of step by step guide. But it is just simple software like anything else. If you can setup a webserver or a database server or anything else you can setup a mail server.

Reply on news.ycombinator.com