poolpOrg / poolp.org

poolp.org website
https://poolp.org
22 stars 8 forks source link

You should not run your mail server because mail is hard. #61

Closed poolpOrg closed 3 years ago

christhomas commented 4 years ago

I've got a setup on a VPS working for years. The problem is whether you have ticked all the boxes related to DMARC, DKIM, got the correct DNS entries, etc, etc. Then you'll have no problem. But if you're missing any of these, you'll easily fall into a grey zone where things work for a while then stop. I'm even able to send to hotmail addresses from my setup. So I think it's important to have all the correct security information setup and configured for your server so other email servers can properly validate your email server is legit and not used for spamming

dm17 commented 4 years ago

I've got a setup on a VPS working for years. The problem is whether you have ticked all the boxes related to DMARC, DKIM, got the correct DNS entries, etc, etc. Then you'll have no problem. But if you're missing any of these, you'll easily fall into a grey zone where things work for a while then stop. I'm even able to send to hotmail addresses from my setup. So I think it's important to have all the correct security information setup and configured for your server so other email servers can properly validate your email server is legit and not used for spamming

Which tools/sources do you trust to verify the correctness of your DMARC, DKIM, "etc" setups?

christhomas commented 4 years ago

I used this to validate some information: https://dkimvalidator.com/ Then I used the tools on https://mxtoolbox.com/ to check some things too

Another great tool is: https://www.mail-tester.com/

But you can only use it so many times a day before they tell you that you must pay ;) but perhaps you can find a way around that, I didn't, but then again I didn't need to check myself so many times a day, I just waited until tomorrow to try some other things and used it for free, I previously got 10/10 score with my setup, which I have here if you're interested: https://github.com/kubernetes-mail-server

The problem is that there is no standard way to check down the list. You just gotta go through the tools and play things by ear. That's why I was complaining about email so much in my previous messages. Cause there is no standard way to setup things in the right way, there are just 1000 websites with varying ideas of how to do things and nobody agrees on the proper way to do it

streaps commented 4 years ago

I've got a setup on a VPS working for years. The problem is whether you have ticked all the boxes related to DMARC, DKIM, got the correct DNS entries, etc, etc. Then you'll have no problem.

This doesn't help at all, if the IP address is blocked.

christhomas commented 4 years ago

Unfortunately not, some hosting companies are safe though. I've used Hetzner and Contabo without issue, but other hosting services which are cheap, no-frills, and borderline sketchy have the problem you've mentioned with their IP Addresses being blocked.

The biggest problem is that email is just fundamentally broken. It's too complex and too difficult to properly set-up, configure, and maintain. It's not easily scalable, many people don't know how it works and there isn't really a lot of accessible information that newbies can read and learn about. Instead of fixing problems and simplifying things, the mail server authors of various types just layered solution upon solution until it's all a quite shaky house of cards, with so many things that could and often do go wrong.

But there isn't an alternative, one that you could drop it and replace. So it lingers around when in reality, somebody should try to replace it with a more modern solution using modern techniques and technology.

dm17 commented 3 years ago

Finally taking the plunge. I wanted to get some final input from those of you who have analysed the quality of the full systems out there. From my analysis so far, the best is this: https://github.com/mailcow/mailcow-dockerized

Is it missing anything? I suppose future lock-in isn't much of an issue, but switching to a different system would be a pain.

Some honorable mentions go to: https://github.com/mail-in-a-box/mailinabox https://github.com/tomav/docker-mailserver https://github.com/Mailu/Mailu

https://www.proxmox.com/en/proxmox-mail-gateway -- also may be of interest, and curious to hear your alternatives to it. Thoughts???

toraritte commented 3 years ago

@poolpOrg Thank you so much for this post and emphasizing that "hard" is not the same as "putting in the work". (I believe this is similar to confusing motivation with discipline.)

Quantum mechanics is objectively hard (even according to Feynman), but an open source software with extensive documentation, even if it does not spell out every common scenario, is "just" work. I would argue that open source projects without (or bad, spotty, etc.) documentation would fall into the same category - it's another matter entirely of how long it would take to become productive. Yes, it is daunting, especially if one is not versed in ancillary topics such as system administration, networking protocols (of all colours of the rainbow), programming, and so on, but the information is out there somewhere (and are mostly free): books, blog posts, standards, forums, videos, online courses, and more.

On the other hand, it looks as the argument is mostly about semantics (religious wars over a letter come into mind), but the point of your post stands: to set up a mail server is complex/time-consuming/hard/etc. but it is a solved problem and can be replicated by others just the same, and it is not an insurmountable obstacle that would render one's life's work obsolete, irreparably demolish one's reputation (... blabla) and so it should be left to "higher powers" (oh yeah, thanks also for advocating for decentralizing the web and for open source:).