Post by Jan Wildeboer 😷:krulorange:

@jwildeboer @homelab ok, you did not directly, though what you have posted covers most of it manually. Nice writeup. 🙃

@jwildeboer @homelab I think that the main problem relates to spam.

I stopped hosting my own email a few decades ago because of it, but I am headed back that way.

Have to read your posts. I imagine you would have addressed it.

@knowprose In my experience, spam simply isn't the big problem it was anymore. Greylisting and DNS reverse lookups on connecting IPs solve it almost completely. I have blocklist that I keep current for some of the notorious sender domains, but that list has become much shorter over the years. @homelab

@jwildeboer @knowprose @homelab On greylisting, it served me really well for several years almost eliminating spam, but I've found it unusable and disabled it about 5 years ago. The problem is that there are too many services that users expect instant email for today, like all the forced 2FA login codes or magic links, where waiting 5-15min for an email is at best a big nuisance and at worst makes it impossible to login to some services (and I couldn't keep up with whitelisting for ~40 users)

@blaisealleyne Interesting. I need to check my config, because I haven't run into that problem. Greylisting only kicks in for domains my mail server has never seen before. 2FA typically means the sending domain is well-known so I guess I was lucky. Switching it off completely is also an option, as most spammers sending from botnets don't care about a second try anyway, they just try with a different IP address. Reverse lookup stops that in its tracks. @knowprose @homelab

@jwildeboer @blaisealleyne @knowprose @homelab A close friend and I have been running a mail+ server out of my basement for over 25 years, starting off on a 1U Sun Netra. The basement, the ISP, the hardware, and the daemons have changed, but it's had the same core for over a decade (exim4, dovecot, spamassassin, prosody, nginx, radicale, rsync backups).

Over the years, our most persistent headache has been poor ISP netblock reputation. For a while we had a separate outbound server, but our current static IP has been blessedly free of RBL bans, so Outlook, Gmail etc accept our messages.

We have custom exim rules to provide per-user local-part delivery filters and sender-callout/greylist whitelists, which makes on-the-fly exceptions easier, but also caused my friend to work hard to rewrite the exim4 config when an update broke it. The dovecot config migration was a lesser pain by comparison.

I would not be able to maintain this system safely without a partner who has more time than I do to attend to "bursty" maintenance problems and mitigate security vulnerabilities. It also helps to have only a half-dozen users! So for now, we keep on trucking...

@ozdreaming Thank you and your close friend for doing your part to keep the internet decentralised, the way it was designed to be :) @blaisealleyne @knowprose @homelab

@jwildeboer I run my own mail server too, but I wouldn't recommend it to anyone without solid Linux skills.

You need to really understand SMTP, DNS, DKIM and friends, and when something breaks, it's your users' mail that silently lands in spam or gets lost.

That responsibility is what most of the warnings are about, not that it's impossible.

@andre But still, there are literally thousands of outdated Exchange mail servers out there that also JustWork™. Email is quite a robust ecosystem that doesn't change all that drastically. My setup is more or less unchanged since 4 years when I finally added DKIM and DMARC.