this post was submitted on 27 Sep 2023
9 points (100.0% liked)

Selfhosted

40133 readers
614 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
9
Giving up on selfhosted email / Any sane email setups? (szmer.info)
submitted 1 year ago by maf@szmer.info to c/selfhosted@lemmy.world
23 comments fedilink hide all child comments
 

So I've been running self-hosted email using Mailu for a couple of months (after migrating out of Google Workspace). Today it turned that although my server seems to be capable of sending and receiving emails, it also seems to be used by spammers. I've stumbled upon this accidentally by looking through logs. This seems to have been going on for all this time (first "unknown" access happened just a couple of hours after I've set everything up).

While browsing the logs there were just so many crazy things happening - the incoming connections were coming through some kind of proxy built-in to Mailu, so I couldn't even figure out what was their source IP. I have no idea why they could send emails without authorization - the server was not a relay. Every spammy email also got maximum spam score - which is great - but not very useful since SMTP agent ignored it and proceeded to send it out. Debugging was difficult because every service was running in a different container and they were all hooked up in a way that involved (in addition to the already mentioned proxy) bridges, virtual ethernet interfaces and a jungle of iptables-based NAT that was actually nft under the hood. Nothing in this architecture was actually documented anywhere, no network diagrams or anything - everything has to be inferred from netfilter rulesets. For some reason "docker compose" left some configuration mess during the "down" step and I couldn't "docker compose up" afterwards. This means that every change in configuration required a full OS reboot to be applied. Finally, the server kept retrying to send the spammy emails for hours so even after (hypothetically) fixing all the configuration issues, it would still be impossible to tell whether they really were fixed because the spammy emails that were submitted before the fix already got into the retry loop.

I have worked on obfuscation technologies and I'm honestly impressed by the state of email servers. I have temporarily moved back to Google Workspace but I'm still on the lookout for alternatives.

Do you know of any email server that could be described as simple? Ideally a single binary with sane defaults, similarly to what dnsmasq is for DNS+DHCP?

all 24 comments
sorted by: hot top controversial new old
[–] vzq@lemmy.blahaj.zone 5 points 1 year ago (1 children)

After spending a considerable amount of time on it, I have come to the conclusion that there is no completely reliable way to send email without relying on a third party that is considered to have a “good reputation”.

Your set up might work right now, but tomorrow everyone on the internet could stop accepting your mail without explanation and without recourse.

If you own your own IP range, things look a bit brighter, but if you’re dependent on residential and housing provider addresses, you’re boned.

[–] Shdwdrgn@mander.xyz 1 points 1 year ago (1 children)

I agree that a static IP address is an absolute requirement for a mail server to send messages these days. You also need a host of checks in place like SPF, DKIM, and DMARC, along with a strong set of blocklists and spam filters. My own setup includes dual ISP connections from two different providers, and even with all that in place, Microsoft has always been a thorn. They will block me for no apparent reason, their own tools don't even show any detected spam activity, and sometimes they don't even block the same IP address (or provider) that my emails were sent from. Every other spam service on the planet behaves in a rational way, but of course Microsoft has made a point of locking in so many businesses to their own spam-ridden service that you simply can't run a mail server any more without being able to talk to them.

Overall, yeah it can be a pain to run your own mail server. I can't imagine trying to use a pre-built mail server and expect it to run, there's so much that you have to configure to each specific setup. It's not like a web server where you load up a docker container and it just works.

[–] slander@lemm.ee 3 points 1 year ago

unless you realllllly enjoy self hosting your email, IMO it’s just not worth it anymore with the state of things. I use Fastmail and could not be happier.

[–] markstos@lemmy.world 2 points 7 months ago

I hosted email professionally for over a decade... and I can't recommend getting back into the business. At that time we were using Qmail, although I also have experience managing Exim and Postfix. About 90% of incoming email remains spam.

For outgoing email for things like server cron mail, a stub service like msmtpdcan be used to receive local mail and forward it to to a local service.

To receive and host email, Fastmail is good.

[–] Decronym@lemmy.decronym.xyz 2 points 1 year ago* (last edited 7 months ago)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
DNS Domain Name Service/System
Git Popular version control system, primarily for code
IMAP Internet Message Access Protocol for email
IP Internet Protocol
SMTP Simple Mail Transfer Protocol
SSL Secure Sockets Layer, for transparent encryption
TLS Transport Layer Security, supersedes SSL
VPN Virtual Private Network
VPS Virtual Private Server (opposed to shared hosting)

8 acronyms in this thread; the most compressed thread commented on today has 3 acronyms.

[Thread #169 for this sub, first seen 27th Sep 2023, 14:35] [FAQ] [Full list] [Contact] [Source code]

[–] KairuByte@lemmy.dbzer0.com 2 points 1 year ago (1 children)

https://mxroute.com/ is what I went with. They have a $99 lifetime plan. Semi limited, but worth it imho.

[–] chrizl@feddit.ch 0 points 1 year ago (1 children)

Do you maybe have a link for the lifetime plan? Because I cant find it.

[–] Cosmos7349@lemmy.world 1 points 1 year ago

I use fastmail, and I enjoy it a lot. Their masked email is very nice as well, and integrates with bitwarden. So quite convenient to use my personal domain for stuff where my identity matters, and use masked @fastmail addresses for more disposable stuff.

The only thing that ticks me a tiny bit is that their mobile app doesn't have offline mode; but you can use imap client or w/e, so it's not too much of an issue.

Also hear good things about protonmail; I would consider it if I didn't already use/trust fastmail.

[–] originalucifer@moist.catsweat.com 1 points 1 year ago

im an old school email admin. i gave up on my personal exchange box for protonmail years ago.. multiple domains, lots of dns nonsense on my part. zero problems.

i highly recommend them.

[–] cooopsspace@infosec.pub 1 points 1 year ago

Fasmail + domain

[–] benmi@lm.inu.is 1 points 1 year ago (2 children)

I have used https://migadu.com/ for over a year now with no problems. Very happy with them. Setup is well documented.

[–] otl@lemmy.sdf.org 2 points 1 year ago

This was the provider I went with after self-hosting my mail for 7+ years on an OpenBSD VPS. I feel like Migadu is an honest and good-value service.

[–] lemmyvore@feddit.nl 1 points 1 year ago* (last edited 1 year ago)

Great configuration, very flexible and fill of features. They make it easy to get all the DNS records you need to add to your domains and they have a diagnostic tool that checks that everything is set correctly. They even include wildcard aliases (which I'm not sure if it's mentioned in their public pages).

Should also note that they don't limit accounts, domains, aliases or any features, just overall mails and storage space. The only additional limitation on the lite account is inability to set account quotas.

[–] Rearsays@lemmy.ml 0 points 1 year ago (1 children)

Just switch to mail in a box.

[–] RootBeerGuy@discuss.tchncs.de 1 points 1 year ago

Step 1: cut a hole in the box

[–] robert@lemm.ee 0 points 1 year ago* (last edited 1 year ago) (1 children)

I vote for maddy, but one important note for my setup: my family uses always-on VPN, so i only open port 25 for the world. Imap can be accessed only from vpn. In such case server can't be used as relay from internet. Maybe try that way?

[–] Socket462@feddit.it 0 points 1 year ago (1 children)

I am not saying your server is not secure, but just fencing off IMAP from the web is not enough to limit spammers from relaying mail through your server. They usually exploit a misconfigured SMTP server, which does run on port 25 (plain or start TLS mode)

[–] robert@lemm.ee 1 points 1 year ago

That's right, i've mixed two topics. Thanks for pointing that out