D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

[LUG]Re: UCEPROTECT, blacklists and hosting servers

 

On Sun, 18 Dec 2022 at 22:39, Michael Everitt <michael@xxxxxxxxxx> wrote:
 
TL;DR whilst its very convenient to use eg. gmail, Micro$soft, Apple, et al, it has
always been possible to run your own mail system. Also, you have greater control and
flexibility how it runs and accepts/rejects mail(!). It's not hard to deal with spam,
there are a few tools/techniques you need to use to make it work, and keep the Other
mail servers "happy".

Thanks for linking an interesting article, but I'm afraid I'm not as enthusiastic as yourself, having done this a few times over the years. The article's perspective is one that surfaces quite often and is usually quite strongly presented. "Mail is not hard" is indeed a true statement, and it's an excellent project to learn and have fun with, and anyone thinking of doing this absolutely should - because it teaches you so much about the problems of running an internet facing mail server. I've been running mail systems (Fidonet, UUCP before email) privately and professionally for well over three decades, so I've got some experience of how not to do it.

So - why do I use Gmail for my personal email? 

Because it works. Because its spam controls are extremely effective. Because my account is reasonably secure. Because I don't need to spend a lot of time keeping it working. 

That article is unsurprisingly biased. My experience is that doing email well is difficult, and on a private/residential class IP, almost impossible to ensure reliable delivery. Email today is layer after layer of kludge after kludge designed to try and block abusers of email. It's a teetering tower of pancakes, each representing something like spf, dkim, dmarc, greylisting, spam filters, keyword filtering,  RBL lists, other filters, impersonation protection, link scanning, and domain checks, domain age checks, malware scanning, anti-phishing layers and so on. It's horrendously complicated to try and provide reliable and safe email delivery at any kind of scale. Blame the abusers of email and the impossibility of replacing it.

But despite that, by all means do play with email. If you've got an address that's been published anywhere on the web, or has been used on a site that's been compromised, you'll get spam, which is really the least dangerous aspect of email. Expose any port and you'll get probes for open relays constantly, so just ensure your security is good.

Of course, you sacrifice privacy by using someone like Gmail, MS or whatever, and that's a decision you need to make. But personally, I consider that risk worthwhile, as I do with using any "free" or even paid and curated service I choose to use. YMMV. 

S
--
The Mailing List for the Devon & Cornwall LUG
FAQ: https://www.dcglug.org.uk/faq/