|
|
Subscribe / Log in / New account

I'm not seeing it

I'm not seeing it

Posted Aug 1, 2025 19:58 UTC (Fri) by dskoll (subscriber, #1630)
Parent article: The NNCPNET email network

I do run my own mail server for my domains, and have done so for decades. It seems to me that NNCPNET doesn't really solve any problems that aren't already quite solvable.

As for provider blocks on the SMTP port blocking internal email, that's easily fixed by running a VPN on all your machines and running SMTP over the VPN.


to post comments

I'm not seeing it

Posted Aug 1, 2025 20:51 UTC (Fri) by KJ7RRV (subscriber, #153595) [Link] (18 responses)

Do the problems many people run into with private mail servers only start with high mail volumes? I run a small personal server with two accounts (my personal email and a newsletter-type list that sends one message per day to a few family members), and I've never had deliverability issues that weren't caused by misconfigurations on my part.

I'm not seeing it

Posted Aug 2, 2025 0:46 UTC (Sat) by gerdesj (subscriber, #5446) [Link] (12 responses)

"only start with high mail volumes?"

Well that is one definition of UBE.

My email systems, wot I self manage don't do that. When you go beyond normal human to human style comms and go UBE, then you get blocked. Its not exactly rocket science.

I'm not seeing it

Posted Aug 2, 2025 17:43 UTC (Sat) by Wol (subscriber, #4433) [Link] (11 responses)

> It's not exactly rocket science.

If only it were that simple ...

If it's only UBE, then why do opt-in email lists get clobbered?

If it's only UBE, why do so many people give up running mailservers because they can't send emails?

UBE may be the CAUSE, but the people who get hurt are rarely the people sending it ...

Cheers,
Wol

I'm not seeing it

Posted Aug 3, 2025 7:43 UTC (Sun) by wahern (subscriber, #37304) [Link] (1 responses)

> If it's only UBE, why do so many people give up running mailservers because they can't send emails?

Are there alot that give up for being blocked, relative to the number of hosters? That's the popular wisdom, but there's a dearth of data. The wisdom could be a product of how it's discussed: people who tried and failed being more vocal than those who are successful, similar to restaurants reviews where people with bad experiences are more likely to leave reviews than the bulk of customers who were satisfied, especially for high-volume venues (e.g. McDonalds).

I've been hosting my own e-mail for over 20 years, and it's been at least a decade since I've noticed any delivery issues. Even then it was unclear what the issue was as it was another user on my system using an external client, and they chose to simply stop trying rather than debug. There are plenty of institutions and companies still self-hosting, enough that there's still a market for selling software and hardware e-mail products. And while larger hosters have more resources to attend to deliverability problems, they're also having to deal with users sending messages more likely to trigger filters, e.g. many Cc recipients.

The scope of the problem is just very unclear to me. I don't know what to think. I've switched hosting setups at least a half-dozen times over the decades--colocation, leasing, virtual hosts, etc--and every time I switch I get anxious, but things have worked out pretty well so far. Currently I host from home through a tunnel from Vultr, but before then it was from a private office on a dedicated circuit from Cogent. I also host my own DNS name servers, some domains primary and secondary self-hosted, others primary self-hosted with secondary at EasyDNS. Managing SPF, DKIM, and other records via flat locally controlled zone files feels simpler and more transparent that way, but perhaps for someone new at this game it might seem more opaque than using popular web services and GUIs.

That said, for the few business ventures I've started with others, I just choose GMail. I don't want to get blamed for deliverability problems the sales and marketing side might have. It's like uptime issues--across the years my self-hosted uptimes aren't appreciably worse, and perhaps in some cases might even be better--than is typical for, e.g., AWS-based setups, especially taking into consideration misconfigurations and similar accidents. But when AWS or Google is down, coworkers and customers are understanding; when your self-hosted services are down, you're the unprofessional idiot (classic CYA dynamic--nobody gets fired for buying IBM, Microsoft, AWS, Slack, etc).

I'm not seeing it

Posted Aug 3, 2025 10:02 UTC (Sun) by MarcB (subscriber, #101804) [Link]

> Are there alot that give up for being blocked, relative to the number of hosters? That's the popular wisdom, but there's a dearth of data.

There definitely is a huge shift from on-premise/self-hosted to cloud (Office 365 in particular) in the SMB space. This is mostly previous Exchange setups that Microsoft successfully "convinced" to switch to cloud based solutions; mostly by making self-hosted Exchange more and more horrible to run.
There also is some move from non-Exchange to fully integrated solutions like, again Office 365, or Google Workspace. But this also has little to do with mail getting harder, it's just that mail is just a tiny part of the whole thing.
COVID/home office definitely was and is a driver here. Suddenly, businesses needed much better communication platforms. Mail lost a lot of significance for internal communication, so why all the effort for that, if you can get it as part of a bundle, even with great integration?

Organizations, like universities and so on, remain relatively unchanged. The smaller they are, the higher the chance they switch to some cloud solution; but again, the reason for this is not mail getting harder, but those platforms offering more combined with the hope of reducing staff costs.

Outside the business world things are, as you say, hard to assess. There indeed is some noise about it, but a lot of it is "political"- the Open Source community certainly is not representative here at all. Most small mail systems are hobbyist communities, associations of all kinds, and so on. They have no budget to switch to a cloud solution and seem to continue just as before. They can typically get away with a basic DMARC setup and will not get into any reputation problems, since their mails absolutely are wanted by their members.

So, to sum it up: There absolutely is a move to cloud for small and medium business; but not because mail gets harder, but because they offer much more than just mail. Not so much for everyone else.

I'm not seeing it

Posted Aug 3, 2025 8:30 UTC (Sun) by MarcB (subscriber, #101804) [Link] (8 responses)

> If it's only UBE, then why do opt-in email lists get clobbered?

Most likely, because they do not fulfill the requirements for larger senders.
- all the classic requirements
- Use SPF; ~all is the way to go. Ideally, SPF would have lost most relevance by now, but it can serve as tool to mitigate the increasing problem of DKIM replay, so it actually gained importance over the last year. But ignore recommendations to use -all: Those were not written by people who understand large mail systems and all the complex, indirect mail flows that people and organizations use. (If -all seems to work for you, this is because 1) you either have no users or 2) feedback from your users doesn't reach you or 3) almost all relevant recipients treat your -all like ~all).
- Sign with DKIM
- Align header From and the signing domain; ideally also "envelope from" for those sad recipients that check SPF, but not DKIM
- declare a DMARC policy of at least quarantine
- implement "one-click unsubscribe" as specified in https://datatracker.ietf.org/doc/html/rfc2369 / https://datatracker.ietf.org/doc/html/rfc8058. In practice, this build on top of DMARC. If your reputation is good enough, it can even lead to a users "report spam" action not having any negative impact on you. Instead, systems will treat this as "recipient wants to cancel an originally legitimate subscription".
- set a List-Id header

You really need all of the above nowadays for any non-trivial list.

A mailing list that accepts mails from its subscribers must also munge the From header. There currently is no realistic way around it (it can be avoided for internal mailing lists were all subscribers are using the same domain, or if you control the authentication settings of all domains sending to the list and then do not modify the mails).
Ideally, also implement ARC. This can serve as a way to distance yourself from spam that might be fed into your list by a malicious or compromised subscriber (to a degree!).

> If it's only UBE, why do so many people give up running mailservers because they can't send emails?

Presumably because they try adjusting to modern requirements by trial-and-error. This does not work, because modern anti-spam and reputation systems are highly dynamic. Internally, they use counters on many aspects of a mail and thresholds of those counters determine how much influence (non-)adherence to requirements has (or if a requirement even applies).
Also, parameters of those systems are typically per recipient. You can't send a mail to a test account and then assume that the same mail would be treated the same when sent to any other account.

Alternatively, because a lot of their person to person communications has shifted to instant messengers and the server isn't as valuable anymore.

Ultimately, running your own small server can actually be more reliable than before, in particular if it serves distinct senders with individual domains, because with all this authentication stuff, reputation moves from sending IP to sender domain. But you will still get into IP-related trouble if the ratio of unwanted mails from your IP is too high.

I'm not seeing it

Posted Aug 3, 2025 10:46 UTC (Sun) by iabervon (subscriber, #722) [Link] (3 responses)

Some of that is still necessary even if you only send a couple messages to a couple people each day; since they evaluate domains, rather than mail servers, you need something to keep spammers from sending large amounts of mail from your domain that doesn't violate any policy of yours that Gmail can enforce.

As compared to running a mail server in the 90s, it's a couple more things you have to get right, and it's more complicated agreement between your MTA configuration and your DNS than you used to need, and MTA debugging hasn't really kept up. I think MTAs ought to have a way to look at their configuration and DNS and warn you about any cases where they would send outgoing messages they don't think would be okay, and maybe cases where just anybody could send a message from a domain this server handles that would be okay.

I'm not seeing it

Posted Aug 3, 2025 14:10 UTC (Sun) by dskoll (subscriber, #1630) [Link]

For debugging purposes, there are several services that let validate your SPF/DKIM/DMARC records. I seem to recall a service that let you send an email and then would report back on the results, but I can't find that now.

If you have a gmail.com account, you can send email there and if your email ends up in Spam, you can examine the authentication results as determined by Google.

Does the From header always need to be munged?

Posted Aug 4, 2025 8:37 UTC (Mon) by DemiMarie (subscriber, #164188) [Link] (1 responses)

Is it necessary to munge the From header on a message that is properly DKIM-signed and not modified?

Does the From header always need to be munged?

Posted Aug 4, 2025 10:28 UTC (Mon) by iabervon (subscriber, #722) [Link]

Not the message header, but you do need to change the envelope From line, because you're not allowed to deliver a message as if you were the sender's MTA when you're not. Otherwise, if a spammer got hold of a message you really sent to undisclosed recipients that suited their purposes out of context, they could deliver it to anyone anywhere and make it seem like you'd sent it to everyone.

On the other hand, transmitting a message to people the sender didn't tell their MTA to deliver it to is exactly what the sender and recipients want a mailing list to do, so it gets an envelope that says the delivery event is the responsibility of the mailing list.

I'm not seeing it

Posted Aug 3, 2025 14:37 UTC (Sun) by kleptog (subscriber, #1183) [Link]

The only reason why I ran a mail server at all was so that I could hand out aliases to family with (name)@(surname).org. All I did was set it up to forward to their normal email address.

That doesn't work anymore, for all the same reasons that a dumb mailing list server doesn't work anymore.

In theory it should be possible to setup a simple mail forwarder that munges all the headers just the right way to make it work, but I just didn't consider it worth the effort to maintain. Since an online service did it reliably and for (almost) free and I don't bother anymore.

I'm not seeing it

Posted Aug 3, 2025 14:59 UTC (Sun) by laurent.pinchart (subscriber, #71290) [Link] (2 responses)

> A mailing list that accepts mails from its subscribers must also munge the From header. There currently is no realistic way around it (it can be avoided for internal mailing lists were all subscribers are using the same domain, or if you control the authentication settings of all domains sending to the list and then do not modify the mails).

I used to do so until I read Konstantin's explanation of how he configured kernel mailing lists. https://people.kernel.org/monsieuricon/subspace-mailing-l... is an interesting read. The short summary is that, if your mailing list server sets the Envelope-From to the mailing list domain, and the domain has a correct SPF record, the only corner case that could cause issues is sender domains that set a DMARC policy without signing messages with DKIM. Obviously the mailing list server must not modify the body of the message to add headers or footers, or modify the subject to add a list name prefix.

I'm not seeing it

Posted Aug 3, 2025 18:10 UTC (Sun) by MarcB (subscriber, #101804) [Link] (1 responses)

Well, SPF only DMARC is pure evil. So yes, whoever does that deserves whatever happens.

The approach is basically a variation of the "... if you control the authentication settings of all domains sending to the list and then do not modify the mails" where "control" is replaced by "make requirements towards" or "make assumptions about".

But all in all it is fragile. As soon as any of the headers your list wants or needs to modify is signed, the mail will fail authentication.
For LKML it might work. Users and their employers should be tech savvy enough, but for others this is likely not true.

I'm not seeing it

Posted Aug 7, 2025 12:32 UTC (Thu) by nix (subscriber, #2304) [Link]

> As soon as any of the headers your list wants or needs to modify is signed

Konstantin said (and he's right):

> There should be no changes to any of the existing message headers and no modifications to the message body.

No adding [tags] to the Subject. No adding automatic .sigs. Just add List-Id et al, tweak the envelope sender, and forward on. It just works.

I'm not seeing it

Posted Aug 3, 2025 14:31 UTC (Sun) by bferrell (subscriber, #624) [Link]

I agree and it sort of depends on your ISP and the destination(s)

I've been running my own email for better than 25 years. I have it all properly configured and plenty of anti-spam measures incoming.

Mostly I can send wherever I want and receive from everywhere.

BUT, there are certain large email systems that don't take email from my ISPs block of IP addresses, because the ISP are shite.

And, for where I am, this ISP is the only way to do what I need done.

I DO. think this is funny. He re-invented UUCP and fell prey to "do it with..." and it's "different" somehow. In this case, it's containers.

sigh

I'm not seeing it

Posted Aug 3, 2025 15:07 UTC (Sun) by ametlwn (subscriber, #10544) [Link] (3 responses)

Mail hosting moving to a duopoly makes running a mail server harder in multiple ways:
* Standards move in questionable directions (e.g. rfc 8461 MTA-STS).
* Interest on the free software authors side in SMTP software is waning. e.g. libsrs2, libspf, opendkim, opendmarc are all dead-upstream.

I'm not seeing it

Posted Aug 3, 2025 16:34 UTC (Sun) by dskoll (subscriber, #1630) [Link] (1 responses)

I do agree this is a dangerous trend. As for the upstream projects being dead, maybe they're just finished? The relevant standards (SPF, SRS, DKIM, DMARC) haven't changed in a while and so if the software implements all of the standards, then what more is needed?

To comment on another post that said "To configure all this on a bare Debian installation is way too much work, and error-prone, too.", maybe, or maybe not. I set up everything on a bare Debian installation and it's fine. However, I did own an email security company for 19 years and am the author of Mailmunge, an email filtering framework, so I have a lot of practice!

I also agree that RFC 8461 is a terrible RFC. Having an SMTP client fetch a policy over HTTPS is just too dumb for words.

I'm not seeing it

Posted Aug 3, 2025 16:40 UTC (Sun) by ametlwn (subscriber, #10544) [Link]

At least libspf2 is not finished, which was the reason that nixpkgs switched to a fork. (It was alive then but now looks dead, too.)

I'm not seeing it

Posted Aug 3, 2025 16:35 UTC (Sun) by ametlwn (subscriber, #10544) [Link]

Claiming OpenDmarc was dead was to strong, sorry. I would revise that to the project is struggling.

I'm not seeing it

Posted Aug 2, 2025 0:41 UTC (Sat) by gerdesj (subscriber, #5446) [Link]

If only I could symlink this comment to save on bytes:

It seems it is possible to self-host email!


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds