So I’ve been running self-hosted email using Mailu for a couple of months (after migrating out of Google Workspace). Today it turned that although my server seems to be capable of sending and receiving emails, it also seems to be used by spammers. I’ve stumbled upon this accidentally by looking through logs. This seems to have been going on for all this time (first “unknown” access happened just a couple of hours after I’ve set everything up).
While browsing the logs there were just so many crazy things happening - the incoming connections were coming through some kind of proxy built-in to Mailu, so I couldn’t even figure out what was their source IP. I have no idea why they could send emails without authorization - the server was not a relay. Every spammy email also got maximum spam score - which is great - but not very useful since SMTP agent ignored it and proceeded to send it out. Debugging was difficult because every service was running in a different container and they were all hooked up in a way that involved (in addition to the already mentioned proxy) bridges, virtual ethernet interfaces and a jungle of iptables-based NAT that was actually nft under the hood. Nothing in this architecture was actually documented anywhere, no network diagrams or anything - everything has to be inferred from netfilter rulesets. For some reason “docker compose” left some configuration mess during the “down” step and I couldn’t “docker compose up” afterwards. This means that every change in configuration required a full OS reboot to be applied. Finally, the server kept retrying to send the spammy emails for hours so even after (hypothetically) fixing all the configuration issues, it would still be impossible to tell whether they really were fixed because the spammy emails that were submitted before the fix already got into the retry loop.
I have worked on obfuscation technologies and I’m honestly impressed by the state of email servers. I have temporarily moved back to Google Workspace but I’m still on the lookout for alternatives.
Do you know of any email server that could be described as simple? Ideally a single binary with sane defaults, similarly to what dnsmasq is for DNS+DHCP?
You must log in or register to comment.
Removed by mod
I agree that a static IP address is an absolute requirement for a mail server to send messages these days. You also need a host of checks in place like SPF, DKIM, and DMARC, along with a strong set of blocklists and spam filters. My own setup includes dual ISP connections from two different providers, and even with all that in place, Microsoft has always been a thorn. They will block me for no apparent reason, their own tools don’t even show any detected spam activity, and sometimes they don’t even block the same IP address (or provider) that my emails were sent from. Every other spam service on the planet behaves in a rational way, but of course Microsoft has made a point of locking in so many businesses to their own spam-ridden service that you simply can’t run a mail server any more without being able to talk to them.
Overall, yeah it can be a pain to run your own mail server. I can’t imagine trying to use a pre-built mail server and expect it to run, there’s so much that you have to configure to each specific setup. It’s not like a web server where you load up a docker container and it just works.
Removed by mod
even when they are actually static
Are they often not ‘actually’ static? In what way?
Well… ok? I’ve only been running mine since around 2001, I guess I should give up?
Removed by mod
Same, though I too switched to an aws instance and before that linode since 2008 or so.
Miss the old days of not having to worry about IPBL.
I’ve had similar experiences trying to send mail to Microsoft-hosted email addresses. My current “solution” is to send all outgoing mail directly from my VPS-hosted Mailu server… EXCEPT for Microsoft-destined mail. For those messages, they get transparently relayed from Postfix to a third-party email sending service that Microsoft apparently trusts.
The upshot is I can still use my own Postfix daemon for all mail sent to sane (non-Microsoft) providers.
I’ve never heard of anybody relaying just the Microsoft e-mails, but that’s a really funny spiteful solution.
Lately I’ve been able to send to outlook just fine (maybe it’s just dumb luck, who knows). I think I had troubles initially because they’re really picky about rDNS matching the MX exactly. I also signed up for SNDS just in case, but I don’t know if they factor that in…
In my experience (self hosting mail since 2005) signing up for SNDS does factor in. Although last time I had trouble with delivery to MS, my hosting provider Linode’s support also helped out by contacting MS back channels on my behalf. The biggest problem I (rarely) have is when whole IP blocks end up on a ban list that MS seems to really trust. That said, fuck it, I will keep fighting the fight and self host my mail like a stubborn old git :p
Hell yeah :). I’ve heard people have had problems with Linode’s IP blocks with MS… I’m glad to hear that Linode was actually able to help you resolve the problem. The biggest problem seems to be that you just might not realize if your e-mails are being dropped. Not sure if MS will notify you via DMARC if your IP block has been blacklisted, from the sounds of things they probably don’t and just silently drop things, so I guess you have to monitor the blacklists yourself?
Ooh, lucky you! Maybe it was both the rDNS and the SNDS. Part of the problem IMO is it’s such a black box…
Definitely. It’d be nice if there was more reporting when a provider drops your messages.
unless you realllllly enjoy self hosting your email, IMO it’s just not worth it anymore with the state of things. I use Fastmail and could not be happier.
Same here. Gave up and went fastmail. Love em.
https://mxroute.com/ is what I went with. They have a $99 lifetime plan. Semi limited, but worth it imho.
I’d be super cautious about relying on any company that even offers a “lifetime” plan.
Offers like that are tools to raise cash - take money now for a service that you will provide people in the future. They tend to get used in one of two situations:
- We need to raise money for investment in upgrades, so take the equivalent of ~2-3 years subscription from people up front, and count on the investment bringing in enough new customers paying regular rates that you can cover the cost of having the lifetime customers out of revenue
- We need cash now or we aren’t going to be able to pay salaries, and it won’t matter that we’ve screwed our customers if we are bankrupt
Even in the best case, it’d be much simpler to raise cash through usual investment mechanisms, so you do have to wonder how viable their business strategy is if they can’t get money that way
Do you maybe have a link for the lifetime plan? Because I cant find it.
Ah there is a big lifetime promo link in the homepage, thanks
de rien
I use mailcow for self hosting.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters DNS Domain Name Service/System Git Popular version control system, primarily for code IMAP Internet Message Access Protocol for email IP Internet Protocol SMTP Simple Mail Transfer Protocol SSL Secure Sockets Layer, for transparent encryption TLS Transport Layer Security, supersedes SSL VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting)
8 acronyms in this thread; the most compressed thread commented on today has 3 acronyms.
[Thread #169 for this sub, first seen 27th Sep 2023, 14:35] [FAQ] [Full list] [Contact] [Source code]
I found myself in a similar situation last year. MXRoute’s lifetime plan works well for those domains that just need basic email and not a lot of storage.
I have used https://migadu.com/ for over a year now with no problems. Very happy with them. Setup is well documented.
This was the provider I went with after self-hosting my mail for 7+ years on an OpenBSD VPS. I feel like Migadu is an honest and good-value service.
Most reasonable pricing I’ve seen for a family use case.
Great configuration, very flexible and fill of features. They make it easy to get all the DNS records you need to add to your domains and they have a diagnostic tool that checks that everything is set correctly. They even include wildcard aliases (which I’m not sure if it’s mentioned in their public pages).
Should also note that they don’t limit accounts, domains, aliases or any features, just overall mails and storage space. The only additional limitation on the lite account is inability to set account quotas.
Additional: It’s paid, and you need a domain.
Edit: spelling
I use docker-mailserver with sendgrid as smtp relay
Fasmail + domain
Just switch to mail in a box.
Step 1: cut a hole in the box
The answer bad self hosted apps isn’t less self hosting.
im an old school email admin. i gave up on my personal exchange box for protonmail years ago… multiple domains, lots of dns nonsense on my part. zero problems.
i highly recommend them.
Personally using Ionos.
Not bad experiences so far but you need to watch out at times and check your invoices.Same, IONOS is cheap and I had no issues when requesting they open port 25 for my mail relay server.
Moved from a junky setup where I was forwarding my domain mail to gmail. And sending mail through gmail using the smtp server provided by my web host.
I was having too many issues.
I switched to fastmail. It is quite good. And you can get some free basic web hosting included with your paid service.
This is what I did too, after self hosting and self hosting anonaddy for a while. I really like how it integrates into bitwarden to give me most of what I liked about anonaddy as an included thing. I also did it ofr the same reason. Too many Eh holes out there that just want to bang on the mail server all day.
I ended up on purelymail.com for my machine sending email (it’s dirt cheap I think I will be under their minmimum and it will cost something like 10 dollars a year for unlimited unique email addresses for my services)…
Oh no! I’m sad to see that you’ve run into troubles :(.
There are other “fully put together” solutions like mailinabox and mailcow, that could be worth looking into for you. I haven’t used them personally, but you might find them worth looking into. I’d never heard of mailu before, actually.
Totally understand the desire to just move to a hosted solution after running into these problems, but even if you do that I think you should keep running a mail server in the back of your mind for the future — you’ve already learned a lot about it I’m sure, and maybe with a bit more experience you’ll be ready to tackle it again :).
I don’t actually use any of the fully assembled solutions like mailinabox, and I wonder if in the future it might be a good idea to try configuring everything manually. You already have some familiarity with how mail works at this point, and having more control over the setup and how everything fits together might actually work out for you. Personally I’m running an OpenSMTPD + Dovecot mailserver and having a great time. I’d recommend it.
https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-dovecot-and-rspamd/
Either way, I think you should keep using a custom domain for e-mail because then you have options in the future :).
I use Zimbra with an external email gateway that only accepts authenticated email. Zimbra is pretty heavy (it’s intended to be a Microsoft Exchange replacement) but it at least has a huge amount of protection built-in to deal with spam and comes configured out of the box to not relay (well, outside of you setting up aliases and lists.)
That said, it’s not hard to find “incoming email only” configurations that deliver to local mailboxes only, for most email servers. The thing to avoid is having a single server configuration that tries to do both - accepting external email and sending locally originated email out. The configurations do exist to do that, but they’re confusing and tricky.
External email gateways… that bit is hard. I use a mail server I set up myself on a VPS. It does not listen on incoming port 25. It requires credentials. I did this largely because I was trying to send email out via Xfinity’s customer email relay, but the latter kept upping the authentication requirements until one day Zimbra just couldn’t be configured to use it any more. And each time they changed something, I wouldn’t find out until I noticed people had clearly not received the emails I’ve sent out.
VPSes are problematic as some IPs are blocked due to spam. There’s not much you can do about it if you’re stuck with a bad IP, so if you can find a way to send outgoing email via your ISP’s outgoing email server, do that. For Postfix, you can send out authenticated email using something like: in main.cf:
relayhost = [smtp.office365.com]:587 smtp_sasl_auth_enable = yes smtp_sasl_security_options = noanonymous smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd smtp_use_tls = yesand in /etc/postfix/sasl_passwd:
[smtp.office365.com]:587 example@outlook.com:hunter2So in summary:
- Consider an email-in-a-box solution like Zimbra, I understand the wish to go for something light but it might make sense if your aim is just to control your own email
- Regardless of whether you do or not, use separate servers for incoming/outgoing email.
- For incoming email, lock it down to accept local email down if you’re manually doing this rather than using an email-in-a-box solution like Zimbra.
- For outgoing email, use authentication and avoid it listening on port 25. Consider either directly using your ISPs, or if that’s not practical, configuring your outgoing email server to relay in turn to your ISP (see above for how to do this.)
Good luck.
