Post by Taran Rampersad

@jwildeboer @homelab ok, you did not directly, though what you have posted covers most of it manually. Nice writeup. 🙃

@knowprose In my experience, spam simply isn't the big problem it was anymore. Greylisting and DNS reverse lookups on connecting IPs solve it almost completely. I have blocklist that I keep current for some of the notorious sender domains, but that list has become much shorter over the years. @homelab

@jwildeboer @knowprose @homelab On greylisting, it served me really well for several years almost eliminating spam, but I've found it unusable and disabled it about 5 years ago. The problem is that there are too many services that users expect instant email for today, like all the forced 2FA login codes or magic links, where waiting 5-15min for an email is at best a big nuisance and at worst makes it impossible to login to some services (and I couldn't keep up with whitelisting for ~40 users)

@blaisealleyne Interesting. I need to check my config, because I haven't run into that problem. Greylisting only kicks in for domains my mail server has never seen before. 2FA typically means the sending domain is well-known so I guess I was lucky. Switching it off completely is also an option, as most spammers sending from botnets don't care about a second try anyway, they just try with a different IP address. Reverse lookup stops that in its tracks. @knowprose @homelab

@jwildeboer @blaisealleyne @knowprose @homelab A close friend and I have been running a mail+ server out of my basement for over 25 years, starting off on a 1U Sun Netra. The basement, the ISP, the hardware, and the daemons have changed, but it's had the same core for over a decade (exim4, dovecot, spamassassin, prosody, nginx, radicale, rsync backups).

Over the years, our most persistent headache has been poor ISP netblock reputation. For a while we had a separate outbound server, but our current static IP has been blessedly free of RBL bans, so Outlook, Gmail etc accept our messages.

We have custom exim rules to provide per-user local-part delivery filters and sender-callout/greylist whitelists, which makes on-the-fly exceptions easier, but also caused my friend to work hard to rewrite the exim4 config when an update broke it. The dovecot config migration was a lesser pain by comparison.

I would not be able to maintain this system safely without a partner who has more time than I do to attend to "bursty" maintenance problems and mitigate security vulnerabilities. It also helps to have only a half-dozen users! So for now, we keep on trucking...

@ozdreaming Thank you and your close friend for doing your part to keep the internet decentralised, the way it was designed to be :) @blaisealleyne @knowprose @homelab