"Run Your Own Mail Server" by M.W.Lucas

I started sending through Amazon SES around a year ago. That got the blocklisting down to practically zero and my volume is low enough to be free. Running a mail server itself is not *THAT* hard really, I consider that a pernicious myth. It's the babysitting of users and the rest of the outside world misbehaving that takes most of the time. My stack: FreeBSD obviously, Postfix, Dovecot, OpenDKIM, OpenDMARC, SpamAssassin (I know, old but works), clamav-milter, and a few plugins for Dovecot like Sieve.

Running through SES botched the test above quite a bit. It takes it down from 9 to 6 for me, which is worth a complaint against AWS (which is interesting and I'm going to route through the big fat enterprise support agreement at $work for added effect) . The test at internet.nl is less comprehensive but good enough for my purposes. Mail works and has worked for me for years with my current setup, which is practically maintenance-free. I can't help the DANE situation unfortunately as AWS Route53 doesn't let me add that. which is another open case with AWS posted with my work hat on.
 
What the heck is the point of MTA STS when the server can just do SMTP over TLS? "I put something in my DNS records" YES THAT IS WHAT THE MX IS FOR.
 
Install a mail server, follow the documentation. Learn the basic protocol – it helps a lot when debugging and looking for vulnerabilities. It also clarifies a number of idiotic myths that have accumulated over the years.

Spamhaus is tolerable among free blacklists while all others are complete junk. You shouldn't expect miracles though: I checked my today's spam feed at Spamhaus: 3 IPs were indeed listed, 1 was clean, and 1 IPv6 was also clean.

Much of spam used to come from big tech free mail, and vast majority of that was GMail. This has been rapidly improving in recent years. However I haven't administered a busy mail server for some time now, so I might not have the full picture.

Graylisting and fake MX records with higher priority work just fine on stupid botnets. SPF does not because it's trivial to circumvent. The idea was good, but the actual protocol that they cooked was a conceptual disaster.

DKIM, DMARC, DNSSEC, S/MIME, and some other fancy abbreviations are waste of your time.

PGP is vastly underutilized.
 
You must log in or register to reply here.
Back
Top