The connection was lost. Trying to connect again.

Post by Blaise Alleyne

Earlier in the thread

Jan Wildeboer 😷:krulorange: @jwildeboer@social.wildeboer.net

I #Selfhost my email server (that handles my 20+ domains) since almost 20 years now, currently on a cheap virtual machine running Linux, with 1 CPU core, 2G of RAM, 40G hard drive and unlimited network traffic which costs me less than €5/month.

Many people keep on telling me that running your own email server is more or less impossible. I simply don't listen to them.

I explained my setup in a blog series starting at jan.wildeboer.net/2022/08/Emai

#DigitalAutonomy @homelab

· Public

Jan Wildeboer 😷:krulorange: @jwildeboer@social.wildeboer.net

No webmail, only simple SMTP/IMAP with Postfix and Dovecot. All incoming mails are stored encrypted, all traffic uses TLS with a LetsEncrypt certificate. DKIM, SPF is configured. Admin work consists of keeping the OS and firewall up2date, this means maybe 1-2 hours in total per month. I am not saying you can also do that (I have a lot of experience). But I am saying that those skills can be learned and result in a lot less worries about being reachable :)

#DigitalAutonomy #SelfHost @homelab

· Public · edited

Jan Wildeboer 😷:krulorange: @jwildeboer@social.wildeboer.net

And, as expected, the first replies by people saying that running your own email server isn't something you should do are coming in. As I said in my first post — I ignore them. I have 20 years of practical experience with that, I know what works for me and my users and they have never complained. But, as I also said, that is just me. I am not saying that everyone can or should do it. What I am saying is that it absolutely is possible and that I share what I know in the hope it helps.

@homelab

· Public

Taran Rampersad @knowprose@mastodon.social

@jwildeboer @homelab I think that the main problem relates to spam.

I stopped hosting my own email a few decades ago because of it, but I am headed back that way.

Have to read your posts. I imagine you would have addressed it.

· Public

Taran Rampersad @knowprose@mastodon.social

@jwildeboer @homelab ok, you did not directly, though what you have posted covers most of it manually. Nice writeup. 🙃

· Public

Jan Wildeboer 😷:krulorange: @jwildeboer@social.wildeboer.net

@knowprose In my experience, spam simply isn't the big problem it was anymore. Greylisting and DNS reverse lookups on connecting IPs solve it almost completely. I have blocklist that I keep current for some of the notorious sender domains, but that list has become much shorter over the years. @homelab

· Public

Blaise Alleyne @blaisealleyne@mastodon.social

@jwildeboer @knowprose @homelab On greylisting, it served me really well for several years almost eliminating spam, but I've found it unusable and disabled it about 5 years ago. The problem is that there are too many services that users expect instant email for today, like all the forced 2FA login codes or magic links, where waiting 5-15min for an email is at best a big nuisance and at worst makes it impossible to login to some services (and I couldn't keep up with whitelisting for ~40 users)

· Public

Replies

Jan Wildeboer 😷:krulorange: @jwildeboer@social.wildeboer.net

@blaisealleyne Interesting. I need to check my config, because I haven't run into that problem. Greylisting only kicks in for domains my mail server has never seen before. 2FA typically means the sending domain is well-known so I guess I was lucky. Switching it off completely is also an option, as most spammers sending from botnets don't care about a second try anyway, they just try with a different IP address. Reverse lookup stops that in its tracks. @knowprose @homelab

· Public

Ozzie D, NP-hard :bikepump: :vegan: @ozdreaming@infosec.exchange

@jwildeboer @blaisealleyne @knowprose @homelab A close friend and I have been running a mail+ server out of my basement for over 25 years, starting off on a 1U Sun Netra. The basement, the ISP, the hardware, and the daemons have changed, but it's had the same core for over a decade (exim4, dovecot, spamassassin, prosody, nginx, radicale, rsync backups).

Over the years, our most persistent headache has been poor ISP netblock reputation. For a while we had a separate outbound server, but our current static IP has been blessedly free of RBL bans, so Outlook, Gmail etc accept our messages.

We have custom exim rules to provide per-user local-part delivery filters and sender-callout/greylist whitelists, which makes on-the-fly exceptions easier, but also caused my friend to work hard to rewrite the exim4 config when an update broke it. The dovecot config migration was a lesser pain by comparison.

I would not be able to maintain this system safely without a partner who has more time than I do to attend to "bursty" maintenance problems and mitigate security vulnerabilities. It also helps to have only a half-dozen users! So for now, we keep on trucking...

· Public