I'm not seeing it
I'm not seeing it
Posted Aug 1, 2025 19:58 UTC (Fri) by dskoll (subscriber, #1630)Parent article: The NNCPNET email network
I do run my own mail server for my domains, and have done so for decades. It seems to me that NNCPNET doesn't really solve any problems that aren't already quite solvable.
As for provider blocks on the SMTP port blocking internal email, that's easily fixed by running a VPN on all your machines and running SMTP over the VPN.
Posted Aug 1, 2025 20:51 UTC (Fri)
by KJ7RRV (subscriber, #153595)
[Link] (18 responses)
Posted Aug 2, 2025 0:46 UTC (Sat)
by gerdesj (subscriber, #5446)
[Link] (12 responses)
Well that is one definition of UBE.
My email systems, wot I self manage don't do that. When you go beyond normal human to human style comms and go UBE, then you get blocked. Its not exactly rocket science.
Posted Aug 2, 2025 17:43 UTC (Sat)
by Wol (subscriber, #4433)
[Link] (11 responses)
If only it were that simple ...
If it's only UBE, then why do opt-in email lists get clobbered?
If it's only UBE, why do so many people give up running mailservers because they can't send emails?
UBE may be the CAUSE, but the people who get hurt are rarely the people sending it ...
Cheers,
Posted Aug 3, 2025 7:43 UTC (Sun)
by wahern (subscriber, #37304)
[Link] (1 responses)
Are there alot that give up for being blocked, relative to the number of hosters? That's the popular wisdom, but there's a dearth of data. The wisdom could be a product of how it's discussed: people who tried and failed being more vocal than those who are successful, similar to restaurants reviews where people with bad experiences are more likely to leave reviews than the bulk of customers who were satisfied, especially for high-volume venues (e.g. McDonalds).
I've been hosting my own e-mail for over 20 years, and it's been at least a decade since I've noticed any delivery issues. Even then it was unclear what the issue was as it was another user on my system using an external client, and they chose to simply stop trying rather than debug. There are plenty of institutions and companies still self-hosting, enough that there's still a market for selling software and hardware e-mail products. And while larger hosters have more resources to attend to deliverability problems, they're also having to deal with users sending messages more likely to trigger filters, e.g. many Cc recipients.
The scope of the problem is just very unclear to me. I don't know what to think. I've switched hosting setups at least a half-dozen times over the decades--colocation, leasing, virtual hosts, etc--and every time I switch I get anxious, but things have worked out pretty well so far. Currently I host from home through a tunnel from Vultr, but before then it was from a private office on a dedicated circuit from Cogent. I also host my own DNS name servers, some domains primary and secondary self-hosted, others primary self-hosted with secondary at EasyDNS. Managing SPF, DKIM, and other records via flat locally controlled zone files feels simpler and more transparent that way, but perhaps for someone new at this game it might seem more opaque than using popular web services and GUIs.
That said, for the few business ventures I've started with others, I just choose GMail. I don't want to get blamed for deliverability problems the sales and marketing side might have. It's like uptime issues--across the years my self-hosted uptimes aren't appreciably worse, and perhaps in some cases might even be better--than is typical for, e.g., AWS-based setups, especially taking into consideration misconfigurations and similar accidents. But when AWS or Google is down, coworkers and customers are understanding; when your self-hosted services are down, you're the unprofessional idiot (classic CYA dynamic--nobody gets fired for buying IBM, Microsoft, AWS, Slack, etc).
Posted Aug 3, 2025 10:02 UTC (Sun)
by MarcB (subscriber, #101804)
[Link]
There definitely is a huge shift from on-premise/self-hosted to cloud (Office 365 in particular) in the SMB space. This is mostly previous Exchange setups that Microsoft successfully "convinced" to switch to cloud based solutions; mostly by making self-hosted Exchange more and more horrible to run.
Organizations, like universities and so on, remain relatively unchanged. The smaller they are, the higher the chance they switch to some cloud solution; but again, the reason for this is not mail getting harder, but those platforms offering more combined with the hope of reducing staff costs.
Outside the business world things are, as you say, hard to assess. There indeed is some noise about it, but a lot of it is "political"- the Open Source community certainly is not representative here at all. Most small mail systems are hobbyist communities, associations of all kinds, and so on. They have no budget to switch to a cloud solution and seem to continue just as before. They can typically get away with a basic DMARC setup and will not get into any reputation problems, since their mails absolutely are wanted by their members.
So, to sum it up: There absolutely is a move to cloud for small and medium business; but not because mail gets harder, but because they offer much more than just mail. Not so much for everyone else.
Posted Aug 3, 2025 8:30 UTC (Sun)
by MarcB (subscriber, #101804)
[Link] (8 responses)
Most likely, because they do not fulfill the requirements for larger senders.
You really need all of the above nowadays for any non-trivial list.
A mailing list that accepts mails from its subscribers must also munge the From header. There currently is no realistic way around it (it can be avoided for internal mailing lists were all subscribers are using the same domain, or if you control the authentication settings of all domains sending to the list and then do not modify the mails).
> If it's only UBE, why do so many people give up running mailservers because they can't send emails?
Presumably because they try adjusting to modern requirements by trial-and-error. This does not work, because modern anti-spam and reputation systems are highly dynamic. Internally, they use counters on many aspects of a mail and thresholds of those counters determine how much influence (non-)adherence to requirements has (or if a requirement even applies).
Alternatively, because a lot of their person to person communications has shifted to instant messengers and the server isn't as valuable anymore.
Ultimately, running your own small server can actually be more reliable than before, in particular if it serves distinct senders with individual domains, because with all this authentication stuff, reputation moves from sending IP to sender domain. But you will still get into IP-related trouble if the ratio of unwanted mails from your IP is too high.
Posted Aug 3, 2025 10:46 UTC (Sun)
by iabervon (subscriber, #722)
[Link] (3 responses)
As compared to running a mail server in the 90s, it's a couple more things you have to get right, and it's more complicated agreement between your MTA configuration and your DNS than you used to need, and MTA debugging hasn't really kept up. I think MTAs ought to have a way to look at their configuration and DNS and warn you about any cases where they would send outgoing messages they don't think would be okay, and maybe cases where just anybody could send a message from a domain this server handles that would be okay.
Posted Aug 3, 2025 14:10 UTC (Sun)
by dskoll (subscriber, #1630)
[Link]
For debugging purposes, there are several services that let validate your SPF/DKIM/DMARC records. I seem to recall a service that let you send an email and then would report back on the results, but I can't find that now.
If you have a gmail.com account, you can send email there and if your email ends up in Spam, you can examine the authentication results as determined by Google.
Posted Aug 4, 2025 8:37 UTC (Mon)
by DemiMarie (subscriber, #164188)
[Link] (1 responses)
Posted Aug 4, 2025 10:28 UTC (Mon)
by iabervon (subscriber, #722)
[Link]
On the other hand, transmitting a message to people the sender didn't tell their MTA to deliver it to is exactly what the sender and recipients want a mailing list to do, so it gets an envelope that says the delivery event is the responsibility of the mailing list.
Posted Aug 3, 2025 14:37 UTC (Sun)
by kleptog (subscriber, #1183)
[Link]
That doesn't work anymore, for all the same reasons that a dumb mailing list server doesn't work anymore.
In theory it should be possible to setup a simple mail forwarder that munges all the headers just the right way to make it work, but I just didn't consider it worth the effort to maintain. Since an online service did it reliably and for (almost) free and I don't bother anymore.
Posted Aug 3, 2025 14:59 UTC (Sun)
by laurent.pinchart (subscriber, #71290)
[Link] (2 responses)
I used to do so until I read Konstantin's explanation of how he configured kernel mailing lists. https://people.kernel.org/monsieuricon/subspace-mailing-l... is an interesting read. The short summary is that, if your mailing list server sets the Envelope-From to the mailing list domain, and the domain has a correct SPF record, the only corner case that could cause issues is sender domains that set a DMARC policy without signing messages with DKIM. Obviously the mailing list server must not modify the body of the message to add headers or footers, or modify the subject to add a list name prefix.
Posted Aug 3, 2025 18:10 UTC (Sun)
by MarcB (subscriber, #101804)
[Link] (1 responses)
The approach is basically a variation of the "... if you control the authentication settings of all domains sending to the list and then do not modify the mails" where "control" is replaced by "make requirements towards" or "make assumptions about".
But all in all it is fragile. As soon as any of the headers your list wants or needs to modify is signed, the mail will fail authentication.
Posted Aug 7, 2025 12:32 UTC (Thu)
by nix (subscriber, #2304)
[Link]
Konstantin said (and he's right):
> There should be no changes to any of the existing message headers and no modifications to the message body.
No adding [tags] to the Subject. No adding automatic .sigs. Just add List-Id et al, tweak the envelope sender, and forward on. It just works.
Posted Aug 3, 2025 14:31 UTC (Sun)
by bferrell (subscriber, #624)
[Link]
I've been running my own email for better than 25 years. I have it all properly configured and plenty of anti-spam measures incoming.
Mostly I can send wherever I want and receive from everywhere.
BUT, there are certain large email systems that don't take email from my ISPs block of IP addresses, because the ISP are shite.
And, for where I am, this ISP is the only way to do what I need done.
I DO. think this is funny. He re-invented UUCP and fell prey to "do it with..." and it's "different" somehow. In this case, it's containers.
sigh
Posted Aug 3, 2025 15:07 UTC (Sun)
by ametlwn (subscriber, #10544)
[Link] (3 responses)
Posted Aug 3, 2025 16:34 UTC (Sun)
by dskoll (subscriber, #1630)
[Link] (1 responses)
I do agree this is a dangerous trend. As for the upstream projects being dead, maybe they're just finished? The relevant standards (SPF, SRS, DKIM, DMARC) haven't changed in a while and so if the software implements all of the standards, then what more is needed?
To comment on another post that said "To configure all this on a bare Debian installation is way too much work, and error-prone, too.", maybe, or maybe not. I set up everything on a bare Debian installation and it's fine. However, I did own an email security company for 19 years and am the author of Mailmunge, an email filtering framework, so I have a lot of practice!
I also agree that RFC 8461 is a terrible RFC. Having an SMTP client fetch a policy over HTTPS is just too dumb for words.
Posted Aug 3, 2025 16:40 UTC (Sun)
by ametlwn (subscriber, #10544)
[Link]
Posted Aug 3, 2025 16:35 UTC (Sun)
by ametlwn (subscriber, #10544)
[Link]
Posted Aug 2, 2025 0:41 UTC (Sat)
by gerdesj (subscriber, #5446)
[Link]
It seems it is possible to self-host email!
I'm not seeing it
I'm not seeing it
I'm not seeing it
Wol
I'm not seeing it
I'm not seeing it
There also is some move from non-Exchange to fully integrated solutions like, again Office 365, or Google Workspace. But this also has little to do with mail getting harder, it's just that mail is just a tiny part of the whole thing.
COVID/home office definitely was and is a driver here. Suddenly, businesses needed much better communication platforms. Mail lost a lot of significance for internal communication, so why all the effort for that, if you can get it as part of a bundle, even with great integration?
I'm not seeing it
- all the classic requirements
- Use SPF; ~all is the way to go. Ideally, SPF would have lost most relevance by now, but it can serve as tool to mitigate the increasing problem of DKIM replay, so it actually gained importance over the last year. But ignore recommendations to use -all: Those were not written by people who understand large mail systems and all the complex, indirect mail flows that people and organizations use. (If -all seems to work for you, this is because 1) you either have no users or 2) feedback from your users doesn't reach you or 3) almost all relevant recipients treat your -all like ~all).
- Sign with DKIM
- Align header From and the signing domain; ideally also "envelope from" for those sad recipients that check SPF, but not DKIM
- declare a DMARC policy of at least quarantine
- implement "one-click unsubscribe" as specified in https://datatracker.ietf.org/doc/html/rfc2369 / https://datatracker.ietf.org/doc/html/rfc8058. In practice, this build on top of DMARC. If your reputation is good enough, it can even lead to a users "report spam" action not having any negative impact on you. Instead, systems will treat this as "recipient wants to cancel an originally legitimate subscription".
- set a List-Id header
Ideally, also implement ARC. This can serve as a way to distance yourself from spam that might be fed into your list by a malicious or compromised subscriber (to a degree!).
Also, parameters of those systems are typically per recipient. You can't send a mail to a test account and then assume that the same mail would be treated the same when sent to any other account.
I'm not seeing it
I'm not seeing it
Does the From header always need to be munged?
Does the From header always need to be munged?
I'm not seeing it
I'm not seeing it
I'm not seeing it
For LKML it might work. Users and their employers should be tech savvy enough, but for others this is likely not true.
I'm not seeing it
I'm not seeing it
I'm not seeing it
* Standards move in questionable directions (e.g. rfc 8461 MTA-STS).
* Interest on the free software authors side in SMTP software is waning. e.g. libsrs2, libspf, opendkim, opendmarc are all dead-upstream.
I'm not seeing it
I'm not seeing it
I'm not seeing it
I'm not seeing it