Discussion
Pinned post:
- Yes, you can run your own mail server on a cheap VPS (Virtual Private Server)
- Yes, it's cheap. €5/month for a VPS and €10/year for your own domain, if you take a .eu
- Yes, you should configure SPF, DKIM, DMARC
- Yes, with that in place Google, Microsoft and other big providers will accept your emails
- Yes, you can manage incoming spam in effective and automated ways
- Yes, all Open Source.
- No, it doesn't need a lot of admin work, 5 min/day
1/2
@jwildeboer 5min/day for doing what? I'm interested
@spaziale I have a few scripts that check the mailserver logs for typical abuse patterns (mass login attempts with password guessing or spam senders) and add them to the firewall. The few spam mails that somehow make it get reported to Spamcop or I send emails to the abuse address of the sending domain/network. All during my first cup of coffee in the morning.
@jwildeboer @spaziale for mass login i've setup fail2ban, needs a litte attention sometimes after a dist-upgrade but helps alot with webmail/smtp and imap login flooding.
Wrong username? Your ip gets banned after the second try. For passwords its after 20 attemps. It gets bots but keeps human false positive to a minimum. Yes this is a bleichenbacher like weakness, but thats not a goal to aim for at that level.
@jwildeboer i can’t believe i never thought about this as a way to leave @protonprivacy
- Yes, you might get caught up in a block list due to the behaviour of other VPS on IPs 'near' to yours.
1. Outlook blindly use Spamhaus DNSBL to straight up block senders.
2. OVH are apparently not good enough at dealing with bad actors for Spamhaus's liking.
3. So Spamhaus block an entire IPv6 /48, with no white listing of known good actors.
I don't think using only IPv4 is any guarantee of not running into this problem.
So, be careful about your choice of VPS provider.
@AthanSpod Weird. I can send and receive mails from/to Microsoft on both IPv4 and IPv6 from my OVH server.
@jwildeboer You must have lucked out with not being in *that* /48.
I opened a ticket with Spamhaus about it, and that was their response "too much spam from that /48, not enough action from OVH, so we block it all".
Due to Outlook hosted domains the only option I had was to go IPv4 only for outbound.
Yeah, I have my mailserver (currently) on a OVH instance and while it's usually pretty uneventful¹, occasionally some provider will just opt to reject my mail outright, despite not being on any RBLs.
⸻
¹ the "5min/day" feels generous. I think I spend maybe 5min/month at best in maintenance, usually just skimming/deleting my system cron messages re. cert-renewals or OS patches and upgrade logs.
@gumnos I run some shell scripts daily to collect IP addresses that behave in abusive ways [1]. These scripts generate emails that I like to read in the morning to spot patterns before I add them to my firewall. Sure, I could automate that, but I like to stay aware of what is happening on my mail server 😊 @AthanSpod
[1] https://codeberg.org/jwildeboer/gists/src/branch/main/2023/20230422LogCheck.md
@AthanSpod I plan to move my mailserver to netcup midterm. Mainly because I don't like all those emails I get from OVH every month telling me about each step they take to bill me for my little VPS ;)
@jwildeboer Thanks, and it needs to be pinned.
On the other hand,would you help to boost our work as we are looking for sponsors and donors to make us achieve the community land goal?
@jwildeboer How many years of education, training and trials did it take so you can do it in 5 min/day? How long would it take me if I start from scratch? Not a Linux guy by heart.
@eincarsten It took me a week of spare time in the evenings to educate myself on the basics of how email works and how to setup my own server for that. Depending on how deep you want to get into it, it could be longer. And if that all feels too much, that's perfectly fine! You could put some time in finding local, small providers that offer email services for you. To have an alternative to the big ones.
@jwildeboer Do you have ethical recommendations? Bc i would honestly like to get away from Google spy machine, but then I hear controversy related to Proton for example & Thunderbird (I think?) And then I'm not sure who to trust - both for ethical operations and long term likelihood to exist in 10yrs..
@Joy_intl I can't really help. I hear good things about tutanota and mailbox.org but my ethical choice was to selfhost 😊 @eincarsten
(and get your popcorn for the expected barrage of replies with counter arguments, trying to tell you that you shouldn't even think about owning your infrastructure ;)
My mailserver is running since 15+ years. So yes, I have a lot of experience and knowledge and I know what I am talking about. I am happy to share all my knowledge on this. On my blog at https://jan.wildeboer.net/2022/08/Email-0-The-Journey-2022/ and here, as long as you ask nicely :)
And do note: I say you CAN run your own mailserver. I don't say you MUST!
2/2
Jan Wildeboer
@jwildeboer
Same Here. Server runs Mailcow since a long time. It's not that difficult, but get's me a catch all. I like it a lot
@jwildeboer Eine Frage habe ich auch. Betreibe selbst seit rund 20 Jahren meinen eMail Server. Bekomme gerade oft Spam aus dem OVH Netz. Du schriebst dass du Spam Cop dies Spam meldest. Wie hast du das automatisiert gemacht? Der Header muss ja immer dabei sein.
@thorsten Ich mache das manuell. Sind ja nur 5-10 Spam Mails im Monat. Im Mail client den Source mit Header anzeigen lassen, copy, und bei Spamcop pasten, kurzer Kommentar dazu wie "Phishing - Trezor" und done.
@jwildeboer Vielen Dank. Bei mir kommt das immer etwas mehr an
@jwildeboer The important difference between ”can” and ”must” is something many people get confused about.
I feel like I ”must” do something like this. Not fully self hosted, but self managed at least. Because I know how, and why.
@jwildeboer You should reference @mwl 's excellent Run your own mail server book.
@jwildeboer Well said. Now I feel like many of us should pin this.
@jwildeboer 5min/day is much too much for most no-tech people with busy schedules.
@Mela Most spend far more time on TikTok or Facebook ;)
@jwildeboer oh no, how can they choose relaxing or communication with fellows humans over work they have to do in addition to their job. How dare they!
@Mela Now you're trolling 😞 I try to raise positive awareness for more decentralisation and knowledge sharing. I don't expect you to agree. But snide and sarcastic comments are not needed, in my opinion.
@jwildeboer Wait, that reaction was meant as a serious argument?
@jwildeboer the cheaper the vpns, the higher the chance you get a sender ip that is already included in a ton of blacklists (says my personal experience from like 5 years ago where i tried hetzner, ovh and a local freebie and all 3 servers came with spamhaus entry included)
@cy That was 5 years ago. My mailserver is running at OVH and has never been blocklisted in the past 10 years. Blocklists mostly affect IPv4 addresses, but for IPv6 they stopped making sense anyway. My mailserver happily sends and receives with both IPv4 and IPv6.
@jwildeboer
I ran a mail server from home for years, and it was relitively easy.
But I never setup IPV6, is it a pain?
@cy
@erik I am truly sorry, but 30(!) years after the introduction of IPv6 it shouldn't really be a problem to add an IPv6 address and a reverse lookup in DNS for a VPS. https://mricher.fr/post/ipv6-the-summary/ is a good starting point, followed by https://gist.github.com/timothyham/dd003dbad5614b425a8325ec820fd785 @bws @greenpete @cy
@jwildeboer @bws @greenpete @cy Agree 100%.
It gets fuzzy when you start dealing with IPv6 on most “residential“ systems, and even many hosted environments where you don’t have control over the reverse lookup domains. But it shouldn’t be this way.
IPv6 *should* be easier
@erik But that's a general rule. If you don't have control over the reverse lookup, you cannot use that machine for running a mail server. Having that control is an absolute requirement. @bws @greenpete @cy
@jwildeboer i've been procrastinating getting into self-hosting for a while. maybe ill give it a go again
ty
@jwildeboer mailcow for suggestions:)
@george I prefer basic postfix+dovecot, but everyone has their preferences.
@jwildeboer I would add monitoring (system readiness, blocklist entries...) to that list. It's nice to know early when something is wrong.
And for everyones popcorn consumption: I disagree with the big ones accepting your mail if you do everything correctly. I've had especially Microsoft block my server out of nowhere, and the error reasons given were extremely unhelpful. If it's just you using the server, it's no big deal. But if family and friends are using it as well, it's annoying. And certainly always at a very inconvenient time. And give your server some "bake-in" time. New servers are punished for being new by some ranking systems. Bring it up and running for some time and use it for non-important domains before moving your important ones. And have fun.