Leebra selfhosted
login register

Giving up on selfhosted email / Any sane email setups?

3 years ago by 𝖒𝖆𝖋 to c/selfhosted

save

share

report

So I've been running self-hosted email using Mailu for a couple of months (after migrating out of Google Workspace). Today it turned that although my server seems to be capable of sending and receiving emails, it also seems to be used by spammers. I've stumbled upon this accidentally by looking through logs. This seems to have been going on for all this time (first "unknown" access happened just a couple of hours after I've set everything up).

While browsing the logs there were just so many crazy things happening - the incoming connections were coming through some kind of proxy built-in to Mailu, so I couldn't even figure out what was their source IP. I have no idea why they could send emails without authorization - the server was not a relay. Every spammy email also got maximum spam score - which is great - but not very useful since SMTP agent ignored it and proceeded to send it out. Debugging was difficult because every service was running in a different container and they were all hooked up in a way that involved (in addition to the already mentioned proxy) bridges, virtual ethernet interfaces and a jungle of iptables-based NAT that was actually nft under the hood. Nothing in this architecture was actually documented anywhere, no network diagrams or anything - everything has to be inferred from netfilter rulesets. For some reason "docker compose" left some configuration mess during the "down" step and I couldn't "docker compose up" afterwards. This means that every change in configuration required a full OS reboot to be applied. Finally, the server kept retrying to send the spammy emails for hours so even after (hypothetically) fixing all the configuration issues, it would still be impossible to tell whether they really were fixed because the spammy emails that were submitted before the fix already got into the retry loop.

I have worked on obfuscation technologies and I'm honestly impressed by the state of email servers. I have temporarily moved back to Google Workspace but I'm still on the lookout for alternatives.

Do you know of any email server that could be described as simple? Ideally a single binary with sane defaults, similarly to what dnsmasq is for DNS+DHCP?

vzq 61 points 3 years ago

save

path: 0 3835258, hotness: undefined, score: 61, children: 12
Shdwdrgn 14 points 3 years ago

I agree that a static IP address is an absolute requirement for a mail server to send messages these days. You also need a host of checks in place like SPF, DKIM, and DMARC, along with a strong set of blocklists and spam filters. My own setup includes dual ISP connections from two different providers, and even with all that in place, Microsoft has always been a thorn. They will block me for no apparent reason, their own tools don't even show any detected spam activity, and sometimes they don't even block the same IP address (or provider) that my emails were sent from. Every other spam service on the planet behaves in a rational way, but of course Microsoft has made a point of locking in so many businesses to their own spam-ridden service that you simply can't run a mail server any more without being able to talk to them.

Overall, yeah it can be a pain to run your own mail server. I can't imagine trying to use a pre-built mail server and expect it to run, there's so much that you have to configure to each specific setup. It's not like a web server where you load up a docker container and it just works.

save

path: 0 3835258 3842357, hotness: undefined, score: 14, children: 11
vzq 12 points 3 years ago

save

path: 0 3835258 3842357 3850007, hotness: undefined, score: 12, children: 4
theolodger 1 point 3 years ago

even when they are actually static

Are they often not β€˜actually’ static? In what way?

save

path: 0 3835258 3842357 3850007 4018797, hotness: undefined, score: 1, children: 0
Shdwdrgn 0 points 3 years ago

Well... ok? I've only been running mine since around 2001, I guess I should give up?

save

path: 0 3835258 3842357 3850007 3851921, hotness: undefined, score: 0, children: 2
vzq 6 points 3 years ago

save

path: 0 3835258 3842357 3850007 3851921 3852267, hotness: undefined, score: 6, children: 0
InvertedParallax 2 points 3 years ago

Same, though I too switched to an aws instance and before that linode since 2008 or so.

Miss the old days of not having to worry about IPBL.

save

path: 0 3835258 3842357 3850007 3851921 3890308, hotness: undefined, score: 2, children: 0
witten 4 points 3 years ago

save

path: 0 3835258 3842357 3850211, hotness: undefined, score: 4, children: 5
Chobbes 2 points 3 years ago

I've never heard of anybody relaying just the Microsoft e-mails, but that's a really funny spiteful solution.

Lately I've been able to send to outlook just fine (maybe it's just dumb luck, who knows). I think I had troubles initially because they're really picky about rDNS matching the MX exactly. I also signed up for SNDS just in case, but I don't know if they factor that in...

save

path: 0 3835258 3842357 3850211 3916669, hotness: undefined, score: 2, children: 4
witten 1 point 3 years ago

save

path: 0 3835258 3842357 3850211 3916669 3988940, hotness: undefined, score: 1, children: 1
neo 1 point 3 years ago

In my experience (self hosting mail since 2005) signing up for SNDS does factor in. Although last time I had trouble with delivery to MS, my hosting provider Linode's support also helped out by contacting MS back channels on my behalf. The biggest problem I (rarely) have is when whole IP blocks end up on a ban list that MS seems to really trust. That said, fuck it, I will keep fighting the fight and self host my mail like a stubborn old git :p

save

path: 0 3835258 3842357 3850211 3916669 3979210, hotness: undefined, score: 1, children: 1
daFRAKKINpope 26 points 3 years ago

ProtonMail. 100%.

I set up custom DNS and catchall so yourcompanyname@saltycowboy.org is really how I filter spam.

Please note, saltycowboy.org isn't really my domain.

save

path: 0 3835447, hotness: undefined, score: 26, children: 2
__ghost__ 9 points 3 years ago

So you're saying it's available? πŸ‘€

save

path: 0 3835447 3841696, hotness: undefined, score: 9, children: 0
Unforeseen 2 points 3 years ago

save

path: 0 3835447 3837047, hotness: undefined, score: 2, children: 0
slander 19 points 3 years ago

unless you realllllly enjoy self hosting your email, IMO it’s just not worth it anymore with the state of things. I use Fastmail and could not be happier.

save

path: 0 3835261, hotness: undefined, score: 19, children: 1
specseaweed 3 points 3 years ago

Same here. Gave up and went fastmail. Love em.

save

path: 0 3835261 3851352, hotness: undefined, score: 3, children: 0
Cosmos7349 15 points 3 years ago

I use fastmail, and I enjoy it a lot. Their masked email is very nice as well, and integrates with bitwarden. So quite convenient to use my personal domain for stuff where my identity matters, and use masked @fastmail addresses for more disposable stuff.

The only thing that ticks me a tiny bit is that their mobile app doesn't have offline mode; but you can use imap client or w/e, so it's not too much of an issue.

Also hear good things about protonmail; I would consider it if I didn't already use/trust fastmail.

save

path: 0 3835634, hotness: undefined, score: 15, children: 2
fraydabson 6 points 3 years ago

Another vote for Fastmail. In my recent effort to degoogle I switched to Fastmail and I love it.

save

path: 0 3835634 3837655, hotness: undefined, score: 6, children: 0
BitSound 5 points 3 years ago

For mobile with fastmail, I use fairemail. Works great with it, and provides a nice merged view with my non-fastmail work emails.

save

path: 0 3835634 3839949, hotness: undefined, score: 5, children: 0
originalucifer 11 points 3 years ago

im an old school email admin. i gave up on my personal exchange box for protonmail years ago.. multiple domains, lots of dns nonsense on my part. zero problems.

i highly recommend them.

save

path: 0 3834946, hotness: undefined, score: 11, children: 0
KairuByte 8 points 3 years ago

https://mxroute.com/ is what I went with. They have a $99 lifetime plan. Semi limited, but worth it imho.

save

path: 0 3856530, hotness: undefined, score: 8, children: 5
RegalPotoo 2 points 3 years ago

I'd be super cautious about relying on any company that even offers a "lifetime" plan.

Offers like that are tools to raise cash - take money now for a service that you will provide people in the future. They tend to get used in one of two situations:

  • We need to raise money for investment in upgrades, so take the equivalent of ~2-3 years subscription from people up front, and count on the investment bringing in enough new customers paying regular rates that you can cover the cost of having the lifetime customers out of revenue
  • We need cash now or we aren't going to be able to pay salaries, and it won't matter that we've screwed our customers if we are bankrupt

Even in the best case, it'd be much simpler to raise cash through usual investment mechanisms, so you do have to wonder how viable their business strategy is if they can't get money that way

save

path: 0 3856530 3899499, hotness: undefined, score: 2, children: 0
chrizl 1 point 3 years ago

Do you maybe have a link for the lifetime plan? Because I cant find it.

save

path: 0 3856530 3868477, hotness: undefined, score: 1, children: 3
h3ndrik 3 points 3 years ago

save

path: 0 3856530 3868477 3868992, hotness: undefined, score: 3, children: 2
chrizl 2 points 3 years ago

Ah there is a big lifetime promo link in the homepage, thanks

save

path: 0 3856530 3868477 3868992 3871200, hotness: undefined, score: 2, children: 1
h3ndrik 2 points 3 years ago

de rien

save

path: 0 3856530 3868477 3868992 3871200 3880296, hotness: undefined, score: 2, children: 0
aard 5 points 3 years ago

Nowadays I'd recommend a simple postfix + dovecot setup. If you care about a web-UI and possibly some groupware functions put SOGo on top.

save

path: 0 3834987, hotness: undefined, score: 5, children: 0
Decronym 5 points 3 years ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
DNS Domain Name Service/System
Git Popular version control system, primarily for code
IMAP Internet Message Access Protocol for email
IP Internet Protocol
SMTP Simple Mail Transfer Protocol
SSL Secure Sockets Layer, for transparent encryption
TLS Transport Layer Security, supersedes SSL
VPN Virtual Private Network
VPS Virtual Private Server (opposed to shared hosting)

8 acronyms in this thread; the most compressed thread commented on today has 3 acronyms.

[Thread #169 for this sub, first seen 27th Sep 2023, 14:35] [FAQ] [Full list] [Contact] [Source code]

save

path: 0 3840042, hotness: undefined, score: 5, children: 0
ChojinDSL 5 points 3 years ago

I use mailcow for self hosting.

save

path: 0 3842753, hotness: undefined, score: 5, children: 0
benmi 4 points 3 years ago

I have used https://migadu.com/ for over a year now with no problems. Very happy with them. Setup is well documented.

save

path: 0 3836799, hotness: undefined, score: 4, children: 4
otl 2 points 3 years ago

This was the provider I went with after self-hosting my mail for 7+ years on an OpenBSD VPS. I feel like Migadu is an honest and good-value service.

save

path: 0 3836799 3958057, hotness: undefined, score: 2, children: 0
NightAuthor 2 points 3 years ago

Most reasonable pricing I’ve seen for a family use case.

save

path: 0 3836799 3893124, hotness: undefined, score: 2, children: 0
lemmyvore 2 points 3 years ago

Great configuration, very flexible and fill of features. They make it easy to get all the DNS records you need to add to your domains and they have a diagnostic tool that checks that everything is set correctly. They even include wildcard aliases (which I'm not sure if it's mentioned in their public pages).

Should also note that they don't limit accounts, domains, aliases or any features, just overall mails and storage space. The only additional limitation on the lite account is inability to set account quotas.

save

path: 0 3836799 3866399, hotness: undefined, score: 2, children: 0
benmi 1 point 3 years ago

Additional: It's paid, and you need a domain.

Edit: spelling

save

path: 0 3836799 3836819, hotness: undefined, score: 1, children: 0
emhl 4 points 3 years ago

save

path: 0 3867161, hotness: undefined, score: 4, children: 0
cooopsspace 4 points 3 years ago

Fasmail + domain

save

path: 0 3861090, hotness: undefined, score: 4, children: 0
eros 4 points 3 years ago

I found myself in a similar situation last year. MXRoute's lifetime plan works well for those domains that just need basic email and not a lot of storage.

save

path: 0 3837231, hotness: undefined, score: 4, children: 0
Rearsays 4 points 3 years ago

Just switch to mail in a box.

save

path: 0 3837199, hotness: undefined, score: 4, children: 3
RootBeerGuy 3 points 3 years ago

Step 1: cut a hole in the box

save

path: 0 3837199 3843462, hotness: undefined, score: 3, children: 0
u202307011927 1 point 3 years ago

save

path: 0 3837199 3842519, hotness: undefined, score: 1, children: 1
Rearsays 1 point 3 years ago

The answer bad self hosted apps isn’t less self hosting.

save

path: 0 3837199 3842519 3852706, hotness: undefined, score: 1, children: 0
pqdinfo 3 points 3 years ago

save

path: 0 3840018, hotness: undefined, score: 3, children: 0
techgearwhips 3 points 3 years ago

Protonmail. That's what I use connected to my own domain.

save

path: 0 3835549, hotness: undefined, score: 3, children: 0
Appoxo 3 points 3 years ago

Personally using Ionos.
Not bad experiences so far but you need to watch out at times and check your invoices.

save

path: 0 3836339, hotness: undefined, score: 3, children: 1
stown 2 points 3 years ago

Same, IONOS is cheap and I had no issues when requesting they open port 25 for my mail relay server.

save

path: 0 3836339 3837056, hotness: undefined, score: 2, children: 0
Chobbes 3 points 3 years ago

Oh no! I'm sad to see that you've run into troubles :(.

There are other "fully put together" solutions like mailinabox and mailcow, that could be worth looking into for you. I haven't used them personally, but you might find them worth looking into. I'd never heard of mailu before, actually.

Totally understand the desire to just move to a hosted solution after running into these problems, but even if you do that I think you should keep running a mail server in the back of your mind for the future --- you've already learned a lot about it I'm sure, and maybe with a bit more experience you'll be ready to tackle it again :).

I don't actually use any of the fully assembled solutions like mailinabox, and I wonder if in the future it might be a good idea to try configuring everything manually. You already have some familiarity with how mail works at this point, and having more control over the setup and how everything fits together might actually work out for you. Personally I'm running an OpenSMTPD + Dovecot mailserver and having a great time. I'd recommend it.

https://poolp.org/...

Either way, I think you should keep using a custom domain for e-mail because then you have options in the future :).

save

path: 0 3839914, hotness: undefined, score: 3, children: 0
ninjan 3 points 3 years ago

I use iRedMail but would I call it simple? No. Mail is such old tech that simple really isn't the word for it. Archaic, ancient and dying fits better. But it will take decades more to actually die. iRedMail is available as a single container, which isn't correct from a container perspective but makes everything a lot easier in my opinion. Of the various solutions I've tried it's the one closest to the goal of "It just works". The biggest downside is the manual steps often needed to upgrade version. Not to time consuming but far from "It just works".

save

path: 0 3841872, hotness: undefined, score: 3, children: 4
elbarto777 5 points 3 years ago

save

path: 0 3841872 3842856, hotness: undefined, score: 5, children: 3
ninjan 5 points 3 years ago

Eh, I guess it's a Ship of Theseus kind of thing. So much in the core is roten that if we change it you could argue it will be something different.

save

path: 0 3841872 3842856 3843684, hotness: undefined, score: 5, children: 2
elbarto777 1 point 3 years ago

save

path: 0 3841872 3842856 3843684 3849628, hotness: undefined, score: 1, children: 1
ninjan 2 points 3 years ago

Traditional snail mail has died. For bills and other important documents there are better, digital, solutions out there. Mail has too many security issues to be the answer for that. What do you get by email today that couldn't be chat message, an entry in a RSS feed, part of a social media feed or a to do item of some sort? 95% of my mail box is newsletters and ads. The rest is order confirmations from various sites. But none of that needs to be emails imo.

The only real, proper use case, these days is work related communication. But even there chat is often the better tool and email lacks because it's fundamentally insecure and to make it secure you run into the problem of having to set it up between domains, and if you're already doing that kind of work why not decide on a more secure by design communications channel?

I think in the future communication solutions like Matrix that can talk to (virtually) all other solutions will enable us to move away from email, but it won't happen until we get Matrix like solutions for task management such that I can send someone a task without having to care about which solution they use at X company, and it will still land in that system. Once we have something like that mail won't have anything going for it. That really is the final use case.

save

path: 0 3841872 3842856 3843684 3849628 3859552, hotness: undefined, score: 2, children: 0
beirdobaggins 3 points 3 years ago

Moved from a junky setup where I was forwarding my domain mail to gmail. And sending mail through gmail using the smtp server provided by my web host.

I was having too many issues.

I switched to fastmail. It is quite good. And you can get some free basic web hosting included with your paid service.

save

path: 0 3854015, hotness: undefined, score: 3, children: 1
ssdfsdf3488sd 2 points 3 years ago

This is what I did too, after self hosting and self hosting anonaddy for a while. I really like how it integrates into bitwarden to give me most of what I liked about anonaddy as an included thing. I also did it ofr the same reason. Too many Eh holes out there that just want to bang on the mail server all day.

I ended up on purelymail.com for my machine sending email (it's dirt cheap I think I will be under their minmimum and it will cost something like 10 dollars a year for unlimited unique email addresses for my services)..

save

path: 0 3854015 3860592, hotness: undefined, score: 2, children: 0
rmdes 2 points 3 years ago

save

path: 0 3849900, hotness: undefined, score: 2, children: 0
markstos 2 points 3 years ago

I hosted email professionally for over a decade... and I can't recommend getting back into the business. At that time we were using Qmail, although I also have experience managing Exim and Postfix. About 90% of incoming email remains spam.

For outgoing email for things like server cron mail, a stub service like msmtpdcan be used to receive local mail and forward it to to a local service.

To receive and host email, Fastmail is good.

save

path: 0 9381294, hotness: undefined, score: 2, children: 0
Voroxpete 2 points 3 years ago

Throwing my hat in for Protonmail.

save

path: 0 3835764, hotness: undefined, score: 2, children: 0
ikidd 2 points 3 years ago

Mailcow dockerized.

save

path: 0 3894883, hotness: undefined, score: 2, children: 0
robert 2 points 3 years ago

I vote for maddy, but one important note for my setup: my family uses always-on VPN, so i only open port 25 for the world. Imap can be accessed only from vpn. In such case server can't be used as relay from internet. Maybe try that way?

save

path: 0 3881061, hotness: undefined, score: 2, children: 2
Socket462 2 points 3 years ago

I am not saying your server is not secure, but just fencing off IMAP from the web is not enough to limit spammers from relaying mail through your server. They usually exploit a misconfigured SMTP server, which does run on port 25 (plain or start TLS mode)

save

path: 0 3881061 3895488, hotness: undefined, score: 2, children: 1
robert 1 point 3 years ago

That's right, i've mixed two topics. Thanks for pointing that out

save

path: 0 3881061 3895488 3911105, hotness: undefined, score: 1, children: 0
selfhosted
selfhosted

@lemmy.world

login for more options
63023
6820
6218

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

go to feed...