Subject: Re: [ietf-smtp] own mail server: DNS / static IP / no bad reputation?

From: Claus Assmann <[email-masked]>
Date: Fri, 9 Oct 2020 22:32:31 +0200

On Sun, Sep 27, 2020, John R Levine wrote:

> On the other hand, if you want to run your own mail server, setting up a BSD
> or Linux VPS with matching f/rDNS is not hard and not expensive.  I have a
> tiny one (20GB disk, 512MB RAM, 1TB/mo) for $27/yr and a reasonably cqpable
> one (30GB/1GB/2TB) for $43.20/yr.  To set the rDNS I just put in a ticket

Could you please share the information about the hosting companies
who can provide this kind of deal? ISPs in my new location do not
offer static IPs :-(

Setting up a mail server "in the cloud" (e.g., Amazon) seems to be
fairly useless with all the "bad reputation", so I'm looking for
something that can actually "reliably" be used for mail delivery
-- just for a private person for communication with friends and
companies, e.g., banks, so the mail should not be rejected/filtered
by their ISPs because it is coming from the "wrong" hosting companies.

---

From: "John Levine" <[email-masked]>
Date: 9 Oct 2020 16:45:10 -0400

>who can provide this kind of deal? ISPs in my new location do not

Here in the US every VPS provider still gives you a static IPv4 IP,
and the competent ones give you v6 as well, either automatically or on
request.

The place I use is called Tektonic, http://tektonic.net/

>fairly useless with all the "bad reputation", ...

Agreed, hosting mail at Amazon is a losing battle. Tektonic does
(mostly) transparent outbound mail filtering so their reputation seems
pretty good. The only time it got me, I really was sending spam to
people for analysis, and when I explained that (and they saw I had
been a customer for a while with no complaints) they turned it off.

R's,
John

PS: If you use this link I get a rebate: https://manage.tektonic.net/?affid=119

---

From: Claus Assmann <[email-masked]>
Date: Mon, 12 Oct 2020 09:34:45 +0200

[please use only the list for replies, thanks.]

> The place I use is called Tektonic, http://tektonic.net/

Thanks, unfortunately they don't support the OS I'm using.
But now that you wrote about "VPS" I know what to look for
(not simply "hosting" - that showed mostly "web hosting")

> (mostly) transparent outbound mail filtering so their reputation seems

If STARTTLS is used, they shouldn't be able to do it, unless they
mess with SMTP (or much worse: with TLS), right?

---

From: Sam Varshavchik <[email-masked]>
Date: Mon, 12 Oct 2020 07:04:17 -0400

> mess with SMTP (or much worse: with TLS), right?

They intercept outbound port 25, and simply don't advertise STARTTLS.
Only STS will catch that.

Alternatively, STARTTLS existed way before easy availability of
low/free certificates, and it was not unusual for STARTTLS giving out
self-signed certs. Hardly noticed, especially since STARTTLS was
optional, and non-encrypted was always available as a fallback. The
senders has to tear down the connection and reconnect, but that was
doable, and was done.

---

From: Claus Assmann <[email-masked]>
Date: Mon, 12 Oct 2020 13:13:18 +0200

> They intercept outbound port 25, and simply don't advertise STARTTLS.

That's what I feared (like that Cisco "FW"). Is that a common
behaviour of VPS providers?  If so, those would be useless for me.
I guess I have to check their policies / ask them.

> Only STS will catch that.

Or DANE or "hand configured" setups enforcing STARTTLS.

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Mon, 12 Oct 2020 15:53:42 +0200

> Only STS will catch that.

See https://toroid.org/vodafone-smtp-mitm for example. Vodafone India makes 
it so that when mobile phones connect to SMTP servers outside Vodafone's 
network, they simply don't receive any STARTTLS advertisement.

Arnt

---

From: Ned Freed <[email-masked]>
Date: Mon, 12 Oct 2020 05:29:39 -0700 (PDT)

> mess with SMTP (or much worse: with TLS), right?

Add to that the reality that VPS solutions are far from immune to the
same sort of blocking issues you get from a cloud provider.

Several of the people I know using VPS solutions to send small amounts of
legitimate commercial email have been hit by IP reputation blocks recently. In
at least two cases all it took was a single noisy neighbor sending a bit too
much mail without jumping through the necessary hoops. AFAICT no spam,
phishing, etc. was involved.

Keith may have expressed himself badly, but like it or not, he has a point.
Operating a mail system is increasingly difficult, and a lot of that difficulty
is associated with limits and restrictions imposed by large providers in a
fairly arbitrary way.

And no, I don't have a solution to this problem. But claiming the problem
doesn't exist, or that VPS solutions or whatever are the necessary magic, isn't
helpful.

Now if you'll excuse me, I need to get back to figuring how the limit changes
one of the MSPs has just implemented so the small amount of opt-in mailing list
mail I send to them isn't unnecessarily delayed.

				Ned

---

From: "John Levine" <[email-masked]>
Date: 12 Oct 2020 11:54:08 -0400

>I guess I have to check their policies / ask them.

I certainly hope so, since the alternative is to have a cloud full of
infected spambots.  There are plenty of those.

Tektonic turned off the filtering when I asked them to, but I had
already been a customer for a while.

---

From: "John Levine" <[email-masked]>
Date: 12 Oct 2020 14:43:03 -0400

>is associated with limits and restrictions imposed by large providers in a

It's not just large providers. Spam filtering is a statistical process
and history tells us that if a network is leaking spam and doesn't
have a history of sending legit mail, if you block the whole range you
will likely block a lot of spam and not a lot of legit mail. It is
possible that by exerting arbitrarily more effort recipient systems
can make the filtering somewhat more accurate, but nowhere is it
written that it is my job to spend my money because [generic] you
picked an unfortuante mail setup.

I agree this makes it hard to set up a small mail server and I wish I
had better options to suggest. Neither "Don't filter" or "Filter
perfectly" are on the table.

R's,
John

---

From: Ned Freed <[email-masked]>
Date: Mon, 12 Oct 2020 13:04:04 -0700 (PDT)

> picked an unfortuante mail setup.

Please reread my message, this time noting the examples I gave. This goes well
past happenstance spam sewer adjacency and into legit senders not following
rules somebody just made up or changed.

> perfectly" are on the table.

Is "filter responsibly" also off the table?

				Ned

---

From: "John R Levine" <[email-masked]>
Date: 12 Oct 2020 16:38:24 -0400

> rules somebody just made up or changed.

Could you be clearer about "a single noisy neighbor sending a bit too
much mail without jumping through the necessary hoops."

I've seen individual senders blocked for being new (it was pretty comical 
what MS did when I set up a 30 day test account at O365 last month) but I 
haven't seen that block an entire IP range.  Bot spam will do that.

> Is "filter responsibly" also off the table?

Depends how much you want to pay people to accept your mail.  I don't 
think we want to go there.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Ned Freed <[email-masked]>
Date: Mon, 12 Oct 2020 14:03:57 -0700 (PDT)

> much mail without jumping through the necessary hoops."

Since this is a neighbor of a friend (I'm relying on what was said when the
block was removed) I don't know for sure the specific hoop that wasn't jumped
through, but given the players involved I'd venture to guess that it had to do
with exceeding a rate limit.

In contrast, the problem I was dealing with on my own mail system was resolved
by a combination of limiting the number of open connections and the number of
transactions attempted on those connections, along with setting up an MX rollup
so all the domains this particular MSP serves come under the same restriction.

> haven't seen that block an entire IP range.  Bot spam will do that.

I don't think I've seen a block or rate limit for being new propogate to other,
established IPs in the range. But I have seen the time it takes for a source to
be considered "OK" increase.

Our commercial delivery service has dozens - hundreds - of rules implementing a
myraid of restrictions in order to be able to send commercial opt-in mail
successfully. And that's fine, I guess, but when an elaborate setup is needed
just to be a small sender, and even that can be blown away on a whim, I think
things have gone too far.

> think we want to go there.

My problem here is that that you seem content with coming up with an excuse
for any blocking people do, no matter how capricious, no matter how arbitrary.

Left unchecked, the outcome will be that email becomes the sole province of a
handful of large MSP/ISPs. And while I'm sure these providers think they are
smart enough to keep the current email service running in such a world,
experience with other sorts of social media indicates they aren't nearly as
smart as they need to be, or for that matter as think they are.

				Ned

---

From: Dave Crocker <[email-masked]>
Date: Mon, 12 Oct 2020 14:40:19 -0700

> Is "filter responsibly" also off the table?

Actually, it seems like the perfect goal.

But it's not clear to me how that is achievable, absent something in the 
realm that defines in a way that is substantial and deterministic.

And it's not clear to me that that's viable while remaining effective, 
given that it ewill almost certainly enable bad actors to game the filter.

Or will it?

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: "John R Levine" <[email-masked]>
Date: 12 Oct 2020 17:59:42 -0400

> I don't think I've seen a block or rate limit for being new propogate to 
> other, established IPs in the range. But I have seen the time it takes 
> for a source to be considered "OK" increase.

Yes, I've certainly seen that.

> for any blocking people do, no matter how capricious, no matter how 

I'm not saying that what they're doing is great.  But when I talk to large 
mail system operators at M3 meetings is is crystal clear that their main 
goal is to keep their users happy, and they absolutely Do Not Care about 
senders except insofar as their users are happy to get those senders' 
mail.  One of the reasons your commercial senders have to deal with so 
many rules is that at the recipient end it is often hard to tell opt-in 
commercial mail from spam (indeed the exact same mail can be opt-in to 
someone who asked for it and spam to someone else on a purchased list.), 
In my experience the most of the people who receive commercial mail do not 
care whether they get it or not.  The incentives are poorly aligned and I 
don't see any way to align them better that won't make things worse 
overall.

> handful of large MSP/ISPs.

There is a very long tail, small senders stil figure out how to do the 
hoop jumping.

Regards,

---

From: Evert Mouw <[email-masked]>
Date: Tue, 13 Oct 2020 00:10:12 +0200

To add a short personal story to this discussion; I run my personal mail server at home, using XS4all (a Dutch ISP). Very low outbound rate, I think on average 10 emails a day. Using SFP / DKIM / DMARC. Most of my mails get through without problems. I guess XS4all IP blocks have a good reputation as the provider is very security aware and permits users to run their own servers using a dedicated IP address with a reverse DNS hostname. Unfortunately XS4all seems to get absorbed by KPN.

Of course setting up your own mailserver is somewhat time consuming, but there are many tutorials. In a perfect world one wouldn't need a static IP, but being part of a somewhat chaotic federated communications network has a price. Setting up your own XMPP or SIP server also relies on DNS and using those services without a static IP is difficult.

I feel that some of the discussion about running one's own mail server should be more appropriate on the mailop mailinglist. It is not a protocol problem. The only thing I don't like for small setups is that a few newer anti-spam methods rely on https resources at the sender's end.

Evert

---

From: Sam Varshavchik <[email-masked]>
Date: Mon, 12 Oct 2020 18:31:31 -0400

> for any blocking people do, no matter how capricious, no matter how arbitrary.

I don't believe I ever offered a single excuse on anyone else's
behalf. Stating that anyone is free to run their mail server in
whichever way they see fit, and employ whichever filtering approach
works for them -- that is not an excuse of any kind. I'm not passing
judgement on, or asserting as to the merits of, their mail filtering
strategies, and I don't feel any obligation to defend their specific
decisions, or their merits.

To me, it boils down to a very simple concept. It's someone else's
mail server. It's not my mail server. They pay for its electricity,
bandwidth, and hosting fees, and it is no one's business to tell them
whose mail they must accept or reject, and why. I don't see that as
excusing anything, only stating a fairly basic principle. I have no
business telling anyone how to configure their mail server, but I
would appreciate the same courtesy extended to me, which is that
nobody has any business telling me how I must configure mine's.

I understand that some may feel that someone else is being arbitrary
and capricious in their E-mail receiving policies. Well, perhaps they
are. Perhaps I am arbitrary and capricious, but it's my business, too.
It's still their mail server, or my mail server; and they can be as
arbitrary and capricious with their mail server, or I can be arbitrary
and capricious with mine's, as they or me wish.

At this point, this argument always sidetracks to discussions of
interoperability, various user and customer service issues, and other
similar worthy goals; or once in a blue moon I get accused of somehow
working to undermine E-mail interoperability, in some unclear way,
assigning to me some Dr. Evil-like powers to do so. I haven't heard
anything new, to those points, in many years, though. So let's just
consider all those arguments as simply repeated, once more.

---

From: Claus Assmann <[email-masked]>
Date: Tue, 13 Oct 2020 06:37:15 +0200

On Mon, Oct 12, 2020, Sam Varshavchik wrote:

> [[...]] They pay for its electricity,
> whose mail they must accept or reject, and why.

I am paying fees to my bank and they state they want to be contacted
by e-mail. So I expect them to accept my e-mail (and answer if needed).

-- 
Address is valid for this mailing list only, please do not reply
to it direcly, but to the list.

---

From: Laura Atkins <[email-masked]>
Date: Tue, 13 Oct 2020 08:29:12 +0100

> On 13 Oct 2020, at 05:37, Claus Assmann <[email-masked]> wrote:
> 

The choice to run your own server means you’re choosing to handle your own deliverability. In some cases, that means sending to specific places isn’t viable. We ran into a similar problem trying to send attachments (that were asked for and necessary) to a government department. Our tiny little mailserver couldn’t. We fell back to a gmail address and got the process handled. Was it frustrating? Eh. It was kinda annoying. But it wasn’t a huge barrier. 

In another recent case one of the major filtering provider started bouncing mail from us. Not because our MTA IP was blocked, but because they were doing some 2nd received line filtering and the IPv4 NAT our cable modem goes out was blocked. We followed the instructions in the bounce message and it was resolved in < 24 hours. Now, was it a mistake or was one of our neighbors spewing a bunch of spam / virus out through the NAT? I don’t know. In any case, it was resolved. 

I’ve actually found that filters are getting more friendly to small servers. 

The reality right now is: if you make the choice to run a mail server of any size you’re going to have to deal with deliverability issues. That’s part of what you’re opting into when you decide to run your own server. There are people out there who have spend over a decade providing deliverability advice, tools, and resources all for free. 

Filtering isn’t going away. If spam went away tomorrow, filters would still exist. This is just the reality any mail server operator needs to deal with. Don’t like it? You can outsource it to a 3rd party who will handle that for you. 

laura 

-- 
Having an Email Crisis?  We can help! 800 823-9674 

Laura Atkins
Word to the Wise
[email-masked]
(650) 437-0741		

Email Delivery Blog: https://wordtothewise.com/blog

---

From: Sam Varshavchik <[email-masked]>
Date: Tue, 13 Oct 2020 06:59:25 -0400

> by e-mail. So I expect them to accept my e-mail (and answer if needed).

And they will. If they don't you can choose to notify them of the
problem. They may or may not resolve it. In either case you always
have the option to use another bank.

But that's not really a good analogy for two parties that don't have
any existing relationship between them, with one party demanding the
other one to accept its email.