undefined | Better HN

0 pointsneop1x3y ago0 comments

I have also been self-hosting email for 15 years and only had couple of problems at the beginning, mainly until my IP got enough reputation. I have been hosting it on a bare metal Supermicro server in a proper datacenter, though. It has reverse-DNS, SPF, DKIM, TLS, MTA-STS and even DANE with DNSSEC (on a self-hosted BIND but that's another story). It is implemented using Exim, Dovecot, SpamAssasin, DNSBL and Roundcube with OpenLDAP auth. I can recommend this awesome hand-on guide provided by Netherlands Domain Registration Foundation as a basis of a nice configuration https://www.sidn.nl/en/news-and-blogs/hands-on-implementing-...

I had some troubles with IMAP search. I set up CLucene, it was easy and enough for me (no need for Java Lucene). It just took me a long time to figure out why it wouldn't search a domain part of email addresses. It just required to set up the tokenizations in such a way to split words also on @ character, i.e. don't consider a full email address as a word. :P I also had some troubles with OpenLDAP until I finally decided to read the docs and examples there properly. Since then I have been using this setup happily and it appears I will continue to do so! I also share the LDAP with NextCloud btw.

0 comments

10 comments · 2 top-level

jhugo3y ago· 8 in thread

> I have been hosting it on a bare metal Supermicro server in a proper datacenter, though.

This is a key difference. Many people who have a bad time self-hosting mail set up with a minimum-effort major provider like Hetzner or DO — you're guaranteed to have spammers as neighbours some of the time, and other networks will behave accordingly when deciding whether to accept your mail.

A real server in a proper datacentre is great — I do the same — but as a lower-cost option a virtual server with a small, clueful provider who knows their customers also works just as well.

RockingGoodNite3y ago

I've run my email server in VM's at a variety of ISP's like GoDaddy, Linode and AWS Lightsail and never had an issue, well once when Microsoft banned a group of IP's in a drag net. I filed a request with them and they fixed it in a week or so.

Real hardware servers are not required to host email.

jhugo3y ago

> Real hardware servers are not required to host email.

I agree, and said that in my parent comment.

neop1xOP3y ago

I had tried it on a very inexpensive VPS before having my own physical server. The IP was blocked almost everywhere. Even though I filled out a lot of forms in Outlook, Yahoo, etc, it appeared that those major email providers had blacklisted the entire subnet of the VPS provider, and IP reputation seemed to have made little difference. Choosing the right provider is crucial!

A new VPS provider may work well and make you happy, but later on, many spammers may start abusing it to send spam. Then, major email providers begin to block the entire IP subnets that belong to your VPS provider and you are screwed.

Since spammers typically can't afford to buy and house servers, having your own physical or dedicated server will likely increase the likelihood of everything being fine for a long time or forever.

jhugo3y ago

Selecting the right host is very important. They should be unattractive as a host for spammers. Get this part right and you don't have to worry that tomorrow your neighbour is a spammer. The virtual/dedicated thing is not as important — many providers comingle virtual and dedicated servers in the same address space anyway.

One example of a good signal: if you cannot sign up online, but must make personal contact with the provider (via email or other means) to set up a server. It's a minor inconvenience for you — you're only going to do it once — but spammers expect to have to do it many times and won't bother.

reidrac3y ago

I don't agree, but it is true that some aggressive DNS RBL may include Digital Ocean, for example, just because [1].

The point is not that much that there are such blocking lists, the point is why admins use them. Surely that's blocking a good chunk of spam, but also legit sites.

1: "As you should know now: It is not you, it is your complete provider which got [redacted] listed."

jhugo3y ago

DO regularly shows up on RBLs, even "less aggressive" ones, because it's regularly a source of spam. Same with Hetzner.

jwr3y ago

I don't think it matters which provider you choose. Big corps ban entire IP blocks, and you will get spammers as neighbors both at a low-cost provider and at a "proper datacenter".

FWIW, I've been using Hetzner for the last 10 years or so (but bare metal server, not a VPS) and haven't had issues.

jhugo3y ago

It absolutely matters which provider you choose, assuming the provider is big enough to have their own address allocations (which is not that big, really — plenty of relatively small hosting providers all over the world have their own ASN and address allocations).

My recommendation is to use a provider that doesn't host spammers. Hetzner is not great at that in my experience, but sounds like they've been fine for you. Smaller providers who know their customers and are able to pay attention to how their network is being used are generally quite good at making things difficult enough for spammers that they go elsewhere.

GTP3y ago

How did you get reverse-DNS? When I tried self-hosting, that was a problem for me.

j / k navigate · click thread line to collapse

0 comments

10 comments · 2 top-level

jhugo3y ago· 8 in thread

> I have been hosting it on a bare metal Supermicro server in a proper datacenter, though.

A real server in a proper datacentre is great — I do the same — but as a lower-cost option a virtual server with a small, clueful provider who knows their customers also works just as well.

RockingGoodNite3y ago

Real hardware servers are not required to host email.

jhugo3y ago

> Real hardware servers are not required to host email.

I agree, and said that in my parent comment.

neop1xOP3y ago

Since spammers typically can't afford to buy and house servers, having your own physical or dedicated server will likely increase the likelihood of everything being fine for a long time or forever.

jhugo3y ago

reidrac3y ago

I don't agree, but it is true that some aggressive DNS RBL may include Digital Ocean, for example, just because [1].

The point is not that much that there are such blocking lists, the point is why admins use them. Surely that's blocking a good chunk of spam, but also legit sites.

1: "As you should know now: It is not you, it is your complete provider which got [redacted] listed."

jhugo3y ago

DO regularly shows up on RBLs, even "less aggressive" ones, because it's regularly a source of spam. Same with Hetzner.

jwr3y ago

I don't think it matters which provider you choose. Big corps ban entire IP blocks, and you will get spammers as neighbors both at a low-cost provider and at a "proper datacenter".

FWIW, I've been using Hetzner for the last 10 years or so (but bare metal server, not a VPS) and haven't had issues.

jhugo3y ago

GTP3y ago

How did you get reverse-DNS? When I tried self-hosting, that was a problem for me.

j / k navigate · click thread line to collapse