I think they mean 300 mil isn&#x27;t a lot in the scope of an entire market. The entire spam market isn&#x27;t centralized in one poor country

For Poor country 300 million is a huge sum of money.

I think it is different. With Piracy people want something (product&#x2F;service&#x2F;media). The quote from Gabe is about the fact that they are willing to pay for it, if it is convenient and affordable.Nobody wants spam or the things promoted in the spam. The companies want attention from the users. I think the better version is targeted ads on Facebook, etc. Maybe that’s the closest analogy to Gabe’s quote.

I think you can exclude Netflix from that list. Streaming services have fractured into a dozen different ones so piracy has come back.Still applies to games&#x2F;music and probably audio books.

Steam and Netflix made it possible for people to play&#x2F;watch media more easily than going to the pirate bay.What are spammers trying to accomplish, that a better product would prevent them from using email (that isn&#x27;t just them shitting up the other service the way they shit up email)?

&gt; I wonder what the underlying problem is.The underlying problem is that a sufficiently motivated spammer can target tens or hundreds of millions of people with their spam without too much effort.As a result, every possible scam and spam with even the slightest possibility of converting 0.00001% of recipients can now be a viable spam campaign.The underlying problem is that it’s so easy to scale spam to a lot of targets.

I think the deeper problem is sending an email (or a billion emails) triggers someone else&#x27;s servers to do most of the work. Email is beautifully cooperative computing, but that means it can easily be taken advantage of.

Spam is just the opposite, it is actually a pricing issue and not a service issue.As long as the expected value per message of spam sent is positive, someone in the world will send as many messages as they are able to. You either fix this by raising their costs so that spam no longer has a positive expected value, remove their ability to send an unlimited number of messages, or both.This is not exclusive to the e-mail system, robocalls are still a major annoyance, and the global telephone system is much more regulated. Mobile phones now automatically filter calls, even! It&#x27;s wild.

I wonder what the underlying problem is.Gabe Newell once said that &quot;Piracy is not a pricing issue. It&#x27;s a service issue&quot;. I believe this has been proven by netflix&#x2F;spotify as well.Is spam just a symptom of a much deeper problem? If so what is it? Or is it naive to think of spam this way?

&gt; Somebody joked that it would be better if we just paid them that much to do nothing.I know this is in jest, but in economics there&#x27;s this concept called &quot;induced demand&quot; that comes to mind.&quot;Public extortion&quot; would be an interesting challenge, as it would be difficult to solve the problem of &quot;Hey why don&#x27;t you also pay ME to do nothing too?&quot;

Transaction costs! <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Coase_theorem" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Coase_theorem</a>

All that &quot;security&quot; just to fight spam. IIRC it was estimated that globally spammers make $300M per year from their spam. It doesn&#x27;t seem like much. Somebody joked that it would be better if we just paid them that much to do nothing.

This was a great read. Thanks for posting it here!I found this line to be especially intriguing:&gt; Hellbanning everybody except for other big email providers is lazy and conveniently dishonest. It uses spam as a scapegoat to nerf deliverability and stifle competition.The big tech firms criticized in this article are guilty of these sorts of transgressions in other arenas, as well. It&#x27;s always been my contention that the &quot;hellbanning&quot; of user-generated content by big media and big tech alike comes from the same motivations. YouTube and CBS alike want to make niche content difficult to consume in order to stifle any competition that might get vaulted up as a result of that niche audience finding the new distribution endpoints. This comes with the added bonus of reducing cost of goods sold, by reducing the firehose of new content to process. Or, as the article puts it:&gt; Unfortunately, the computing power required to filter millions of emails per minute is huge. That&#x27;s why the email industry has chosen a shortcut to reduce that cost. The shortcut is to avoid processing some email altogether. Selected email does not either get bounced nor go to spam. That would need processing, which costs money.I would be very curious to learn if there are any proposed explanation as to why this phenomenon is so commonly spread throughout the big tech space. Do we get the same kind of behavior out of other enormous multi-national firms like oil producers, ocean freight companies, defense contractors, and chemical suppliers?

Microsoft and maybe sometimes very rarely Google does it.&gt; But as far as my own personal experience goes, this author has no idea what they are talking about.He&#x27;s not very informed about being on the receiving end.

&gt; Is there actually a &quot;big tech&quot; email provider that accepts a message with a 2xx SMTP code and then deletes it?Agreed, that is really broken behavior. Once you accept mail for delivery, it should be treated as a contract to deliver that mail. Rejects during SMTP conversation are fine as they notify the sender and do not generate backscatter.I have heard complaints that Microsoft&#x27;s hosted mail offerings accept then silently delete mail. It is somewhat believable, as MS Exchange server would respond 2xx for any message to any (including non-existent) destination address and later spam the possibly spoofed sender with bounce messages. Maybe MS has broken behavior like this in their hosted offerings too? And, rather than fix their software, they silently delete mail since they have finally learned that backscatter is a bad thing?And, MS o365 allows &#x27;delete&#x27; as an option for the centralized spam rules maintained by the admin. These mails are accepted 2xx then silently deleted.MS does other questionable things on their &#x27;free&#x27; hosted offerings to mitigate their abysmal spam filtering. I have a couple burner @outlook.com addresses, and they no longer receive any mail reliably from any sender. MS provides the user a place to whitelist senders and domains, but after wasting a bunch of time whitelisting domains, mail still is marked spam. &quot;Junk&quot; is effectively the inbox on those accounts.Disclaimer: experience is dated, from a past job, running Postfix MTAs for a large organization and dealing with &#x2F; mitigating MS issues, but never directly involved with any MS stuff.

Yes, it&#x27;s Microsoft (the author confirmed in a thread on Twitter).

Is there actually a &quot;big tech&quot; email provider that accepts a message with a 2xx SMTP code and then deletes it? The only one I personally know of never does that. That one also does not use anything like an IP address blacklist. This article doesn&#x27;t name names, it just waves its hands and throws around some innuendo. But as far as my own personal experience goes, this author has no idea what they are talking about.

&gt; In every scenario, deliverability problems can be solved by smarthosting through a reputable email provider. Period.Could you provide an example of such a smarthost email provider that has the benefits you mentioned?Not challenging you, just genuinely curious.

If you&#x27;re sending through someone else then you&#x27;re not self hosting!

You start with the premise that you can&#x27;t host your own email, which is problematic. I don&#x27;t know why the people who fail at self-hosting email are so adamant about telling others that nobody should self-host, but it seems more like a squeaky wheel problem than a real one.In every scenario, deliverability problems can be solved by smarthosting through a reputable email provider. Period.You get all the benefits of your own filtering, your own logs showing every delivery attempt, you get to store your data on your own systems, access it however you prefer, et cetera - all the reasons to self-host are there except for delivery logs, and those can be arranged through your smarthost provider.Simple, huh? So why are so many people emphatically telling us to NOT self-host email?

For those interested, I made a post related to this topic a few months ago: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=31180379" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=31180379</a>

I love the idea of self-hosting my email, but there&#x27;s no way I&#x27;m going through all that work if getting my mail delivered will be a toss-up. Complete motivation-killer.

Wanted to get my own email specifically for this. Is it possible on one of the serviced emails?

I am somewhere in the middle. Have been running my personal mail server for 15y, it mostly works but my emails do get often flagged as spam by the major providers (but not deleted). Though those very same providers are themselves a major source of the spam I receive. Do as I say, not as I do.The nice thing if you control your domain is to be able to create unique email aliases, which is a way to cut spam to zero. A company starts spamming or leaks your email address, just delete the alias.

&gt;You can send to someone @gmail.com that you&#x27;ve never messaged before and it won&#x27;t get rejected. It will probably end up in their Junk folder.That happens even if you send from @gmail to @gmail. Well, it happened to me not long ago.But I&#x27;ve mostly been using lesser known email providers and I haven&#x27;t noticed any problems.

Part of the problem is silent deliverability issues.  You can send to someone @gmail.com that you&#x27;ve never messaged before and it won&#x27;t get rejected.  It will probably end up in their Junk folder.  You don&#x27;t know it, they don&#x27;t know it, and unless they check, which many people don&#x27;t, it will be as if you never sent it.

I have had the exact opposite experience, I used mail in a box and set it up on digital ocean on a 5$ droplet.Have not had any spam or blacklisting issues and it was super easy to setup.

After 30 years running my own MTA I also gave up and moved to fastmail.

I’ve noticed since switching to Fastmail from gmail my spam filtering is very problematic. I always end up with legit emails in spam, and I just can change if I want even more legit in spam or more spam in inbox, which still gets through.I think it’s both a tough problem, as well as something that only becomes easier when you have both talent and scale to have a wide perspective.

I started self hosting in 2017. (With a fresh domain. I&#x27;m the only user.) My sever closes the incoming connection if it doesn&#x27;t has a rDNS or the HELO doesn&#x27;t match the rDNS. Apart from that I have no anti spam measures! Friends and family have my firstname.lastname@domain address. Websites and companies get a &lt;random&gt;@domain address. So far I have only reserved 3 spam mails. Two times they got the address from a public mailing list I participated. One time it was from a webshop that sold or leaked my address.

I started hosting my own email in 2004 before finally giving up and migrating my email to Fastmail last year.Besides the problems mentioned in this post the real problem I had was dealing with spam. The open source community around spam has really degraded over time, to the point where most solutions are extremely high maintenance and require regular tweaking. Methods that used to work, like greylisting, cause problems when dealing with GMail because google doesn&#x27;t play nicely with it. The big spam blacklists have also gotten a bit less trustworthy over the years.

Nah, he should have some staff. I just know the founder (&quot;Jar&quot;) from forum posts.

The owner is from the lowendtalk.com hosting forums.It was a side project for a few years and has been full time for last couple of years now.He&#x27;s very hands on. Has very strict rules about spam - both from sending and receiving perspective.When he brings in new ip ranges, he babysits them by slowly warming them up until they have a good enough reputation to be accepted by major providers.

He? Is it a one-man-band? If so, that&#x27;s a scary single point of failure for something as critical as your email.

Have around 100 users on my self-hosted mailserver. Works alright for the most part. Once or twice a year, there are connection issues to small companies with weird settings. I just route those over an external ESP.Then there is also mxroute.com, which is an indie email provider. He seems to do fine too. Didn&#x27;t use them yet.So I think having at least some sending volume is key to running an indie server. You can&#x27;t do it just for a few mailboxes&#x2F;users.I still wouldn&#x27;t recommend to learn or start with email in 2022. There are better uses of your time.

RBLs and other blacklists have been annoying for decades, even more so when they were maintained by annoyed individuals rather than corporations like today. You had to beg a single person to remove you off a list that an ISP somewhere used without thinking twice about it.

I actually would rephrase it as there weren’t enough users with money to make using email a worthwhile scam medium.Email is low trust and almost any user is susceptible to being scammed, because there aren’t good trust markers in emails, and companies use it in ways that make it indistinguishable from spam.

The paradox here is the same one patio11 discussed in &quot;The optimal amount of fraud is non-zero&quot;, on the front page yesterday [0]. The more non-tech people have an email address, the more we have to prevent fraudulent email, and the harder it becomes to run your own email address.The original email users were much more savvy and needed less protecting against fraud. Now my grandma has an email, and if we&#x27;re not careful she ends up on the phone with &quot;Microsoft customer support&quot; giving them full access to her computer. Spam filters aren&#x27;t just a question of irritation anymore, people&#x27;s life savings are at risk.[0] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=32701913" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=32701913</a>

I relate to this. I also stopped hosting my own mail server for this exact reason.However I do think it’s a case of damned if you do damned if you don’t. As a consumer of big tech email I become equally frustrated when spam makes it past the filter and I expect them to do more.If it’s easy for the average person to setup a mail sever with high reputation then it’s easy for spammers to do the same. I can’t think of a great way to manage this at scale for the average person using a $5 a month Digital Ocean VPS sending &lt; 10 emails a month.One thing I have noticed is that there’s still a load of large organisations failing to implement basic deliverability best practices like SPF records. These organisations have themselves to blame.

Matrix protocol. Can be bridged with existing platforms and protocols, including Facebook Messenger, WhatsApp, and email. 60m+ publicly addressable users, not including EU military, gov, healthcare, emergency services et al.

We need kubernetes level of distributed messaging system to beat email. What’s most popular next option?

Would that be Hashcash you&#x27;re thinking of?<a href="http:&#x2F;&#x2F;www.hashcash.org&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.hashcash.org&#x2F;</a>

The name evades me, but this was a thing a few years back. IIRC, it was the equivalent of what a stamp for an envelope would cost, and the recipient got a chunk, as did the service provider. Will try and find the name for you, but AFAIK, it&#x27;s no longer doing business.

Honestly wish there were a mode where you pay me $x to send me email and I can sort by spend.

Totally agree with the tone &amp; premise, but&gt; At some point your IP range is bound to be banned, either by one asshole IP neighbor sending spam, *one of your users being pwned*,feels like a hint that&gt; My current email server IP has been managed by me and used exclusively for personal email with zero spam, zero, for the last ten years.Might not be entirely accurate.

I&#x27;m pretty happy using protonmail bridge with local clients. It does take some effort to setup though.

This is what I do. The downside is that a lot of email providers make it really difficult to set up 3rd party clients outside of their own clients. I&#x27;ve struggled to get mutt to work with a lot of email providers because they use their own auth mechanisms.

I agree with this assessment, and it&#x27;s what I do. There is still the single point of failure of losing your domain due to a hostile registrar or mismanagement e.g. allowing registration to lapse.Ideally there would be some a decentralized permanent domain registry keyed on certs (I know these exist but have not been adopted), or at least a fallback domain you could configure somehow in case you lost control of your main domain.

Where is it hosted? Isn’t the primary issue being blocked by the major providers due to spam filters?

How do you make sure your emails don&#x27;t end up in spam?

For me, the issue wasn&#x27;t that I had to fix it frequently, but that when I did it was urgent, stressful and disruptive. Eventually the VDS I was renting had a fatal HD crash and I gave up.

&gt; It&#x27;s just not something I want to babysit anymore because I have other things to focus onDont know about you, but I have setup my mailserver years ago, and outside of regular OS updates, havent had to touch it.

You can also use an MX backup service which will accept mail when your server is offline (and it will resend it when the server comes online)You can also even keep Gmail as your MX server! Just move messages off of it as soon as they arrive. It&#x27;s just a mailbox, after all

Adding to the happy medium is to teach your friends and family to use Thunderbird so they can easily GPG encrypt [1] their emails keeping the nosey email providers off the email body. Also teach them to use the IMAPS (TLS) endpoint for their mail provider, usually port 993. There are probably simpler how-to&#x27;s with pictures, I just do not have any of them handy.[1] - <a href="https:&#x2F;&#x2F;support.mozilla.org&#x2F;en-US&#x2F;kb&#x2F;openpgp-thunderbird-howto-and-faq" rel="nofollow">https:&#x2F;&#x2F;support.mozilla.org&#x2F;en-US&#x2F;kb&#x2F;openpgp-thunderbird-how...</a>

&gt; Host your own MX servers but use someone else&#x27;s SMTP servers.Yes. My outgoing email goes out via Sonic&#x27;s SMTP server, with the SPF records to allow it to have a source address of my own domain. Incoming email goes to my own domains and gets forwarded.This seems to be trouble-free. The domain is on a cheap shared hosting account. I&#x27;m not running a server. I own the domain, and not though the hosting company, so I can switch to another provider if necessary. In 27 years, I&#x27;ve had to do that twice, because the hosting provider went out of business.This is easy to do, and I don&#x27;t have to deal with Google. I don&#x27;t even get much spam. All the spammers seem to be targeting the big services now.I just looked at my spam folder. I&#x27;m regularly being offered dental supplies, large hydraulic sheet metal bending presses, and ammonium sulfate fertilizer. 
It seems that having your own domain now means you get mostly business-to-business spam. I subscribe to Machine Design, which gets me some heavy industrial marketing, but I have no idea why I get dental supply ads.
The fertilizer spams, from China, look like a scam - there&#x27;s a fertilizer shortage, so that&#x27;s a spam which might get replies.

Yep SMTP relay is the only sane choice nowadays sadly. Sending your own mail is a losing battle against the email blacklist cartel.

This should be made a standard practice.Third party email providers, the so-called &quot;established businesses&quot;, get a free pass as sending SMTP servers that are accepted by almost all receiving STMP servers. Everyone just assumes everything coming from those SMTPs is legit.
Establishing this &quot;legitimacy&quot; and getting the &quot;free pass&quot; is difficult and some have suggested, the third parties may employ anticompetive tactics.However, IMHO the receiving SMTPs is a different issue. Why do we let these third parties receive and store our email. (Why do our homes have their own mailboxes. Why not use a &quot;P.O. Boxes&quot; instead.) Eventually we could move away from letting third parties control the receipt of our mail. Neither &quot;POP3&quot; nor &quot;webmail&quot; was part of the original concept of email.Today, it is easier than ever to set up overlay networks where we can assign our own IP addresses and run our own SMTP servers that can communicate directly with other SMTP servers on the overlay network. These networks are not open to the world, they may only be open to people we know. Much of our mail is between people who know each other, e.g., friends, family, colleagues. Or businesses that we contact first. We can separate different social and business networks on different overlay networks.Anyway, the sending and receiving of mail can be separated. We do not need to let a third party control both.

There is also a happy medium. Host your own MX servers but use someone else&#x27;s SMTP servers. You have complete control over the incoming mail but dodge the filters by using the established business for sending mail.

The MX servers cert in my experience does not need to include your email domain name .

Certs for MX servers are supposed to have the MX as subject or SAN, not your email domain. It&#x27;s important when the sender enforces encryption with a valid cert (e.g. MTA-STS, or config in the mail server, or many hosted solutions like Google Workspace also support enforcing this for selected or all domains).Example:example.com. MX aspmx.l.google.com.Cert should have aspmx.l.google.com as subject or SAN.

Yeah, I&#x27;ve been doing exactly this for over 20 years. The only problem I can recall is related to the fact that the hosting provider uses a single SSL cert for the machine that hosts my domain (and many others, presumably), so of course the cert doesn&#x27;t match my domain name. It&#x27;s pretty easy to work around, and I only have to deal with it every few years when they do a hardware upgrade, which sometimes means moving my domain to a different machine.

&gt; The issue no one seems to think about is that you need to make sure to pay for the domain for the duration of your lifeBut that&#x27;s true for any delivery endpoint in any medium, including physical mail and phone numbers.It&#x27;s pretty easy to set up auto-pay for domain names so that all you really need to do is keep the billing info up to date. After that it all runs on autopilot.

You can always use a different email address to manage the domain if that&#x27;s the issue?

&gt; The issue no one seems to think about is that you need to make sure to pay for the domain for the duration of your lifeIs there a registrar that will allow you to do this? Most of the ones I’ve looked at have an upper limit of around 15 years or so

While this is true I don&#x27;t see it as a huge deal. Treat it like any other annual bill (e.g Insurance, property taxes) and you will be fine.

&quot;The sweet spot for having control over your email while simultaneously minimizing unforseen headaches is to simply own your domain name&quot;You would think. The issue no one seems to think about is that you need to make sure to pay for the domain for the duration of your life(at least). Otherwise, as soon as you lose your domain you lose ownership of your email. Any one that has control of the domain has control of your e-mail.This dawned on me after a place I worked at reactivated the email I used for work when I worked there. It has my name but I have 0 control over it. Lucky for me I never used the email for things other than work so it&#x27;s not a big deal. It is still bothersome that they can do that and I have no say so on its use.

&gt; point the MX record to whatever hosting provider you wantYou can even have a hybrid solution where incoming mail goes directly to your self-hosted server and (some) outgoing mail is relayed through a third party.

Some of us use Wireguard or OpenVPN to host where we want and use a static cheap or free (like Cloudflare) public point of presence IP.

&gt; simply own your domain name and point the MX record to whatever hosting provider you wantThat&#x27;s not necessarily a sure cure, depending on the hosting provider. RoadRunner (Spectrum &#x2F; Charter) in the US and Shaw in Canada won&#x27;t deliver emails from my domain hosted at Runbox.com (or sent directly from the runbox.com domain.) Spectrum&#x27;s bounce message references an error code that translates to &quot;Spectrum limits the number of concurrent connections from a sender, as well as the total number of connections allowed. Limits vary based on the reputation of the IP address. Reduce your number of connections and try again later.&quot;

You send your email through a client. That client then sends (transfers &#x2F; SMTPs) that email through an MTA either bundled with it or provided by your mail server.The MTA parses the message, figures out who it needs to go to (To, CC, BCC headers), figures out what servers receives mail for those recipients, and then transfers (SMTPs) it to the server.What OP is referring to is that the MTA essentially does a DNS lookup for the recipients domain for a record of type MX (Mail eXchanger).If you own the domain you have complete control over where that mail goes: you own the MX record.

Typically, if you sign up for an email account, you get an email address like skywal@gmail.com or skywal@yahoo.com. Alternatively, if you own&#x2F;host skywal.com, you can have an email address like skywal@skywal.com served from a computer in your home.The &quot;sweet spot&quot; is combining the two, where you own skywal.com, and have your email send&#x2F;receive through Google or whoever. Then, if Google decides to ban you, you just register skywal.com with another company who provides that same service, and you keep your same email address.That&#x27;s the broad strokes anyway.

I can type out an explanation relatively easily.Let&#x27;s imagine I&#x27;m sending from user@zahllos.example to user@skywall.example. I&#x27;m doing it from say Thunderbird or Outlook, and you&#x27;re using the same.I need to send, and to do this I typically use an SMTP server. This is something configured, probably on zahllos.example, maybe with the domain smtp.zahllos.example. My mail client contacts this and &#x27;logs in&#x27; with my details, then transmits the email message I want to send to this server. The server says &#x27;right fine&#x27; and closes the connection.At this point, the message is in a mail queue ready to go. The SMTP server then does a DNS request for the MX record of skywall.example. Let&#x27;s say this is &#x27;mail.skywall.example&#x27;. My server, smtp.zahllos.example, then connects to `mail.skywall.example&#x27;, also speaking SMTP, and says &quot;hey, I have this message to deliver&quot;.It is at this point that mail.skywall.example can decide to do some things. It might check SPF, so it will query the SPF record of zahllos.example to find the list of servers that may send email for that domain. In this example, let&#x27;s assume smtp.zahllos.example is in the list. Great.It may then also check the mail headers for a signature, called a dkim signature. My server signed the message before sending; mail.skywall.example can query &lt;uid&gt;._domainkey.zahllos.example and find a public key (or not) and check that this signature matches (or not). Again, let&#x27;s assume it matches.It might also check something like TXT _dmarc.zahllos.example to see what my DMARC policies are. If I have something like v=DMARC1;p=reject;sp=reject;pct=100;ri=86400;fo=1;aspf=s;adkim=s;rua=mailto:postmaster@zahllos.example;ruf=mailto:postmaster@zahllos.example;&quot; this tells you I&#x27;d like you to outright reject anything not matching policy, that I expect everything to match SPF and have DNS signatures, and you can send reports if you support that to postmaster@zahllos.example. Your server can then enforce these checks as it likes.One of the first things that will happen is that my server will announce itself via an EHLO statement. An obvious check to do is to check that the sending IP actually matches smtp.zahllos.example. by querying &#x27;reverse ptr&#x27; records.Your receiving server will also likely hand the message over to various spam-checking tools for analysis, such as against DNS blocklists and so on. Larger providers likely have much more sophisticated infrastructure here. Ultimately, you&#x27;re going to do one of a few things: 1) deliver to inbox or apply user-specified rules and deliver to a folder; 2) deliver to junk (which is typically just another folder, but treated specially by clients), 3) reject, and tell smtp.zahllos.example you don&#x27;t want the email.Once the email passes through the smtp dameon, assuming either 1 or 2, it then gets stored somehow and in some way. I&#x27;m being a little bit vague here, because &#x27;it depends&#x27;, but in the simplest scenario, the smtp daemon will write the message to an mbox or maildir-style format. More complex setups definitely exist, indeed, there can be multiple layers of servers doing analysis on separate machines, but for simplicity, mail.skywall.example is one VM that makes its decisions and the result ends up in &#x2F;var&#x2F;mail&#x2F;user@domain&#x2F; or some such.A key aspect of this step that makes email very nice is that if smtp.zahllos.example cannot, for some reason, reach your server now it will queue the message and try again at set intervals. You can reasonably safely turn off mail.skywall.example for a couple of hours.Another aspect is that you can have multiple MX records where you are prepared to accept email, with priorities. So if you can&#x27;t accept at one address because the server is down for maintenance, another will accept.So, now you&#x27;ve technically got an email, but you don&#x27;t know it. So you open thunderoutlook, and you connect to an IMAP server imap.skywall.example - in our example let us assume this is really the same thing as mail.skywall.example. The server checks you are really you with your credentials. At the backend, this is just another daemon that knows to read &#x2F;var&#x2F;mail&#x2F;... and find new messages; it finds one, downloads its headers and displays it on your screen.Since we&#x27;re in a slightly more modern world now, in the case your client was already open you might have an &quot;idle&quot; connection with the server at all times, in which case it can push the message down to you.In the case of webmail, it is really all the same thing, except you point your browser at a webpage, and that webpage communicates with the servers instead of your client communicating directly. Open source webmail might even use IMAP underneath; things like Zimbra use their own java mail agent, while Google is entirely custom.That might seem complicated, but in the end it isn&#x27;t: between two domains at the &#x27;edge&#x27;, in the end, there&#x27;s an SMTP conversation. One sending server tells a receiving server it has mail for delivery, and it finds that server by asking DNS where it is. The receiving server may do a bunch of checks against DNS also before making a decision on what to do with the email.

Email is complicated but the jist is there are relays and mailbox&#x2F;mail-exchanger servers (and email clients). And a million different anti-spam measures that make making sure people actually get you email difficult.When you send an email you mail client contacts you mail-exchanger (MX) and drops the mail in your outbox. Then the MX will look up the MX record for the domains in the TO field and attempt to send the email to it using SMTP.The first thing receiving server ussally does and look up the IP of the sending server and see if it&#x27;s on a spam black list. If it is it will probably just drop the connection. Then it will look up the SPF record for the domain in the FROM address and see if the sending server is allowed to send that mail.Larger email services will have an internal &#x27;reputation&#x27; scoring system that will use data from reported spam to figure out what IP&#x27;s and domains are sending spam emails and filter them out. They&#x27;ll also look at if it&#x27;s a residential IP, in an IP pool for a major cloud provider etc. Each provider has a different system and it can be really difficult to get a provider to trust your IP or whitelist your IP so you can make sure that your mail actually gets to who you&#x27;re trying to send it to.Relays are pretty simple they&#x27;ll take email from one place and send it to the recipient. The mail exchanger usually has a built-in relay. A lot of people will use a third party relay service so they don&#x27;t have to worry about managing the reputation of the IP of their sending mail server. They&#x27;ll just add an SPF record for the relays service to their domain. And then configure their mail exchanger to send all outbound mail to the relay and then the relay will do the MX lookup.A lot of mail services will also have their MX records pointed at relays. These inbound relays will often have a lot of those anti-spam services bolted onto them and they can also be used for load balancing to make sure that the service is always able to accept mail even if it doesn&#x27;t make it in the mailbox immediately.

I am ashamed to admit that I have no idea how email works. Is there a dumb down explanation of what are the moving parts and how you can achieve that sweet spot?

Indeed. I host my domains with dreamhost and it turns out that outgoing mail from their servers will get marked as spam by Google. The exact same mail sent through a gmail address (whether under gmail.com or a custom domain) will be delivered no problem (although after the sudden closing of legacy free email, I found that emails that I had been sending via gmail with my own domain that had been getting blocked by spam filters were being delivered when they came from a gmail.com address).

It’s just because of spam. All open systems that do not impose a cost to participate are destroyed by spam.

&gt; It&#x27;s definitely an anticompetitive practice.Or maybe it&#x27;s an overly competitive protocol? Like playing Monopoly. Even a neophyte can end sweeping the game despite not understanding any of the underlying mechanics that drive the game&#x27;s outcome. Those remaining mail providers are also fighting back the insanity. They &#x27;just&#x27; won.Don&#x27;t hate the player, hate the game.

&gt;It&#x27;s definitely an anticompetitive practice.yeah, but in this climate what are you gonna do? It&#x27;s not like there&#x27;s any kinda recourse for monopolistic behavior that has any teeth to it.

I just randomly looked at 8 different emails in my inbox. All of them were from different email providers (except google which was there twice). There&#x27;s hundreds or thousands of email providers you can chose from.iphmx 1
google 2
kornet 1
linkedin 1
secureserver 1
amazonses 1
self hosted university email 1

&gt; You are totally missing the simple fact thatPlease make your substantive points without swipes. Your comment would be fine without that bit.<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;newsguidelines.html" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;newsguidelines.html</a>

You are totally missing the simple fact that the number of blessed email providers to choose from is slowly going down. I&#x27;ve seen ISPs with thousands of clients to give up and move the mailboxes to large players simply because their clients&#x27; email was ending up in the spam so often that running the support has gotten too expensive.It&#x27;s definitely an anticompetitive practice.

Most emails are still going through servers owned by Microsoft or Google, so what does self-hosting email accomplish in reality? Some government entity likely has warrant-less access to most of your emails regardless. I like email as a way to communicate, but speaking pragmatically, it’s just not a secure means of communication in 2022.

&gt; The sweet spot for havingno forth amendment protection for your email because its stored by a third party.

It isn’t about what’s convenient for you. It’s an individual cost benefit analysis. Your needs are different than mine.

This is what I do, though I do think helm is also pretty cool: <a href="https:&#x2F;&#x2F;thehelm.com&#x2F;products&#x2F;helm-personal-server-v2?variant=39250026790981" rel="nofollow">https:&#x2F;&#x2F;thehelm.com&#x2F;products&#x2F;helm-personal-server-v2?variant...</a>I like the idea of having a node I can just plug into my network. I run my Urbit on a Mac mini with tailscale (which works great).The core of what he writes about is correct though, email failed to be truly peer to peer (as imo all non-urbit-like federated systems will) because of the incentives that lead to centralization (spam, difficulty of running nodes, etc.)We’re suffering the consequences of the local max we’re trapped in currently because of this. The promise of the 90s internet was a bunch of people using decentralized services they controlled - instead we&#x27;re primarily thin clients connecting to a small handful of powerful ad companies. We&#x27;re mostly serfs [0] allowed access if we give up our data for ad targeting, follow EULAs nobody reads, and don&#x27;t say anything the company earls disagrees with.[0]: <a href="https:&#x2F;&#x2F;zalberico.com&#x2F;essay&#x2F;2020&#x2F;07&#x2F;14&#x2F;the-serfs-of-facebook.html" rel="nofollow">https:&#x2F;&#x2F;zalberico.com&#x2F;essay&#x2F;2020&#x2F;07&#x2F;14&#x2F;the-serfs-of-facebook...</a>

How does this get me unlimited accounts for my shady biz? Every provider I know of wants money to make new ones, those bastards.

&gt; The sweet spot for having control over your email while simultaneously minimizing unforseen headaches is to simply own your domain name and point the MX record to whatever hosting provider you want instead of self-hosting a server at home.So, mandatory third-party doctrine&#x2F;warrantless surveillance.

Controlling your domain&#x2F;mx is the most valuable thing.Email reception has not been a problem for me so I enjoy having my mx pointing to my own mail server. It gives me more control and it requires very little maintenance.If I was going to outsource anything the first choice would be outbound. My email system does everything right for reputation protection. All senders are authenticated on secure connections and the senders are people I trust. Nothing bad gets sent and my static IP is on a reputable server host and is not on any public black lists. I maintain SPF, DKIM etc. If someone decides to block my IP for no reason by accident or on purpose there is very little I can do or care to do anymore.I have an alternate path for emails setup via a server I host elsewhere ready to go. If I run into a widespread delivery issue due to massive indiscriminate ip blacklisting of my provider I can enable it. That has happened once in 20 years. If delivery gets too hard I will change that policy to send all outgoing emails through a commercial smtp delivery service and let them deal with the problems.

I think everyone knows this who owns a domain. Probably people say this because (like I do too) they have all the control over the name. If I rent an apartment, I do have to consult the owner to make major changes.

It’s a misnomer to say you can “own” a domain name. You cannot. The better word would be “rent”. Because of that you should think about what could happen if your domain name registration lapses and someone else registers it.

The sweet spot for having control over your email while simultaneously minimizing unforseen headaches is to simply own your domain name and point the MX record to whatever hosting provider you want instead of self-hosting a server at home.Same philosophy for exposing a your personal blog of html files or content like mp4 videos. The sweet spot is to focus on buying a domain name you control. Then let Amazon S3, or Cloudflare, Hezner etc, host your html or mp4 files.I quit self-hosting email at home over 15 years ago. It&#x27;s just not something I want to babysit anymore because I have other things to focus on. As long as I control the MX record on my own domain, that&#x27;s really all that&#x27;s necessary.

The metaphor is kinda good. It&#x27;s okay for people to refuse your home-cooked burgers because they don&#x27;t trust them to be safe. There are actual small food vendors that comply with sanitation rules and you can have them provide catering services, professionally. And that is okay.

No. To beat up the metaphor, I&#x27;m saying if we support the restaurants that aren&#x27;t McDonalds and that are more &quot;mom and pop&quot; (and get others on board) then we can beat McDonalds or at least live in harmony with them.

&gt; like saying &quot;You can only have hamburgers two ways, cook them yourself or McDonalds.&quot;and your comment seems to be saying it’s OK if we lose the ability to cook hamburgers at home, because there are other (more ethical) restaurants that aren’t McDonalds. am i misunderstanding?

This isn&#x27;t actually that hard to fix, it&#x27;s just that for whatever reason, we seem to frequently have this blindspot that we don&#x27;t seem to have in other industries.Namely that &quot;do it yourself at home&quot; and &quot;massive oligopolist&quot; aren&#x27;t the only two options. It&#x27;s like saying &quot;You can only have hamburgers two ways, cook them yourself or McDonalds.&quot;I do the third and it&#x27;s been great. I let my paid webhost handle it. (hostdime if you&#x27;re interested, but I&#x27;m sure others do it well also)

What the author doesn’t mention is he uses his email to discuss his penis enlargement company with his friend, a Nigerian prince.

For my personal mail server I ended up using the free tier of SMTP2GO as outbound smtp relay. You can just register your domain as a whole, and the setup was pretty painless. They let you send up to 1000 mails&#x2F;month for free, which is plenty for my own personal use, but if you need any more than that, these relay services can get quite expensive. You usually end up paying the same price as the fully hosted solution that most of those providers offer alongside the relay service.

what do you use for outbound SMTP? do you need to add&#x2F;authenticate each domain or from address with it? (I host several domains and mailboxes)

Actually, smarthosting is precisely ideal for deliverability problems, particularly with IP reputation that can&#x27;t be fixed.

The fix here is use a commercial provider for outbound smtp but continue to self-host inbound.Not ideal, but it works.

Sending emails with dkim + sfp and I never had big problems with reachability and a postfix server on Digital Ocean.I haven&#x27;t done it since last year though.
Has something gone terribly wrong?I remember debugging issues with email sent via aws ses to Hotmail addresses at $dailyJob but I can&#x27;t think of a single Microsoft product that works well (windows, teams, azure, now even GitHub is starting to work every other day) so it doesn&#x27;t surprise me.

Proper, artisanal self-hosting of email can still be viable depending on your expectations and tolerance levels for random issues.These days, I operate with the medium-temperature bowl of porridge: AWS WorkMail with custom domains &amp; users. My use case is basically &quot;Replace gmail for personal email&quot;. I don&#x27;t have a lot of patience for running an actual email server, so this is about as custom as I can get.Running a custom email domain can have other practical implications, such as having to carefully re-iterate spelling when mentioning your email address over the phone to a customer support agent. With a gmail or hotmail account, virtually everyone can type that hostname in without thinking about it. This concern is moderated by being able to select a username with fewer than 5 characters, rather than your full legal name appended with your date of birth.

Reminds me of this fun story:A person at a company mistakenly created an email list segment (or lack thereof) resulting in an email to the entire email list of hundred of thousands of emails. This combined with inexistent (we were a naive startup without an email specialist role) list hygiene practices meant we were blacklisted by Gmail after some time.Took a year to get a hold of someone on Gmail&#x27;s spam team. We found out were on 4+ Gmail blocklists, some of which were ML-based. We couldn&#x27;t do anything to remove ourselves after we fixed the issues. A $1-2 million revenue channel dried up because we couldn&#x27;t get out of the Gmail blackhole (short of rebranding completely, rewriting content, and using a different ESP). Fun times.

Totally unrelated. But this guy has an amazing OS-from-scratch tutorial [0].[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;cfenollosa&#x2F;os-tutorial" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;cfenollosa&#x2F;os-tutorial</a>

A previous thread (5m old) here showed it is not that cut and dry, a good read: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=30788681" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=30788681</a>

&gt; This is the same Big tech story. They want to cut cost, you want a human touch. You can see a similar story here in HN every week.Dang, sounds like our monopolized tech dystopia is probably inevitable. If only there was some state level mechanism to help balance the interests of industries maximizing profits and those of users who need a robust system which doesn&#x27;t harm them.

&gt; ... [They use] spam as a scapegoat to nerf deliverability and stifle competition.Disagree. It was a way too open protocol to begin with. From a time of innocence best suited for places with inherit trust like inside a business. And it&#x27;s not just spam. Phishing is also a huge issue.As much as I want to sympathise, Email for the big WWW is unsalvageable IMO. Too many bad actors are out there.&gt; [Solution:...] * There should be a recourse for legitimate serversThis is the same Big tech story. They want to cut cost, you want a human touch. You can see similar stories here in HN every week. Which is why I think it will never happen.

You can know from getting responses and sending test mails to different mailboxes.Doesn&#x27;t give full certainty, but can be well enough. (If all my recipients respond I don&#x27;t care about the ones I don&#x27;t send to anyways)

If you&#x27;re not getting bounces, then the receiving email servers are not RFC-compliant.If you&#x27;re really that worried about it, smarthost.

Statistically. I communicate with a lot of people via email, and if I don&#x27;t get an expected response to something of consequence I follow up - it&#x27;s far more common the recipient simply missed it&#x2F;didn&#x27;t get around to it than it is to get &quot;I never got it&#x2F;I found it in my spam folder&quot;.

How do you know? SMTP wasn&#x27;t designed for reliable delivery. You don&#x27;t know if your emails are being received, and even i they are, you don&#x27;t know if they&#x27;ll be received tomorrow.

Hosting an email server on a consumer IP does seem to a losing proposition,Hosting an email server on a cheap (reputable) cloud server and doing the basics (PTR records, SPF etc) still works well.

&gt; Blacklists should not include whole IP blocks. I am not responsible for what my IP neighbor is doing with their server.This is obviously laughably naive and creates infinite sources of spam.Before doing a proposal on a core Internet technology you should be required to be on the other side for a while. Do anti-spam at a large retail e-mail service provider for a year and then you can understand the problem space.You might not be responsible for what your neighbor is doing with their server, but the ESP is responsible for filtering it. The idea that they need to treat each and every comcast IP with equal weight is nuts. IP reputation is the single most valuable tool in the industry; the largest statistical predictor of whether or not an email is abusive.

The fact that it&#x27;s too hard for you doesn&#x27;t mean it&#x27;s too hard for everyone else.

Forget about self hosting. Even a custom domain is a pain sometimes.According to a lot of web apps, my email is not valid and can’t use it.Also I have been told by a customer support person that my email is not right as it has to end with gmail.com

my point exactly. was your experience an exercise in futility as the OP wants us to believe?

MIAB user here. I pay ~$4 for a small VPS hosted here in Hungary. The company did a pretty good job of keeping it&#x27;s IP range clean apparently. I only had to request whitelisting from 2 spamlists. One being Outlook&#x27;s. I filled out their form and my mail was delivering a few days later.I wonder how the ubuntu 22.04 upgrade is progressing though. The EOL of 18.04 is getting pretty close.

how many of posters here have used mailinabox ? or something similar? how was your experience?i am almost 2 years into it now and beyond the first months hiccups, it just works

Do you have a source for this? Because I don&#x27;t think it&#x27;s true.

do you have your own asn? The entire Hetzner network has been banned by Microsoft, so you can&#x27;t send to Hotmail addresses

Very interesting, I&#x27;ve self hosted my e-mail since 1999, which incidentally is 23 years ago. My current server is at Hetzner in Germany.

Oddly enough I do not have these problems after self-hosting for close to 27 years now (i.e. from before spam became a problem). I hardly ever get any spam and my messages seem to arrive where they need to be even when that destination lies in Microsoft- or Google-land. I have the usual assortment of DKIM&#x2F;SPF configured for my domain, I send mail through a smart host operated by my IAP (at no extra charge) but for the rest I do not do anything special. Am I the exception to the rule, am I just lucky that my IAP&#x27;s smart host has not been blacklisted by the likes of Microsoft and Google or is the perception of self-hosting mail to be fraught with problems erroneous? I suspect the latter to be true, self-hosting is neither difficult nor bound to fail just as long as a) you have some good spam filters (easy), b) your MTA is set up with the correct SPF and DKIM records (also easy) and c) you send outgoing mail through a smart host (easy to configure once you&#x27;ve found one).

I see this same behaviour. It&#x27;s infuriating. At this point, I&#x27;d almost rather be able to disable all their spam filtering and simply run an App Script, or email client with its own rules that then syncs changes back to the server.

And yet I continue to get &quot;Walmart Confirmation Receipt&quot; or &quot;Verizon  Confirmation Receipt&quot; all coming from addresses like &quot;verizon_info_nlAT2Q7uf0d@zfgfdyyqsckxbvwg.linenight.com&quot; which means google are&#x27;t even trying for some.

gmail also puts mails from mailing lists into spam, despite repeated &quot;not spam&quot; tagging. Wondering whether mail getting flagged as spam is even a problem anymore as people   get used to erratic results, at which point we can get rid of spam filtering, or what&#x27;s left of it, altogether when on balance it does more harm than good, such as preventing SMTP self-hosting.

Funny thing happened to me today: Gmail sent its own Google Fi customer support email to spam. Haha, wish I noticed that before spending my morning going in circles with chat support.

&gt; I can send email all day from joboffers@google.com. But most email providers will check SPF and see that my VPS IP is not authorized by google.com to send email, and it will go to spam.Actually, it will be discarded completely.Google&#x27;s DMARC policy is for mail from unrecognized origins to be rejected:<pre><code> host -t txt _dmarc.google.com
 _dmarc.google.com descriptive text &quot;v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com&quot;
</code></pre>
p=quarantine would send it to spam.

SPF&#x2F;DKIM are not intended to prevent people from sending spam.They are intended to let a domain owner tell other email providers what servers have the right to send email from that domain (and sign email).I can send email all day from joboffers@google.com. But most email providers will check SPF and see that my VPS IP is not authorized by google.com to send email, and it will go to spam.Those standards wouldn&#x27;t keep me from registering example.com, setting up SPF correctly, and then spamming. There are other techniques to filter out that kind of behavior.

I might be reading into this a little, but you seem to be arguing that &quot;Spam is a reasonably solved problem at my scale, therefore spam is a reasonably solved problem at global scale&quot;, and those are very different things. One of the key differences is: a small domain like yours is multiple orders of magnitude less attractive of a target, vs. Gmail, and as a result Gmail&#x27;s filters are subject to constant, high-volume adversarial attacks, and you are not.SPF and DKIM are pretty explicit in their RFCs that passing authentication isn&#x27;t a sign the mail is legitimate. The presence of passing auth in a message does change how filters should handle it, but for most larger-scale production filtering systems (not spamassassin) that mostly ends up as &quot;change the weight of certain reputation identifiers in the spam filtering inputs&quot;, more or less.

I can&#x27;t send mail to mit.edu addresses. It gets rejected with a message that says I should talk to Microsoft.I frequently end up in GMail&#x27;s spam folders. No idea why.I see no more than one piece of &#x27;spam&#x27; a week; everything else is caught by a combination of a 15 minute greylist, the zen spamhaus BL, and SpamAssassin evaluating things. There are a bunch of spammers who send from accounts with valid SPF and DKIM, by the way.Spam is a reasonably solved problem, but SPF and DKIM aren&#x27;t much help.(I get lots and lots of business spam, where the sender clearly believes that they have a right to try to sell me crap. The difference is that if I respond to business spam, someone will answer, trying to sell me crap.)

A big problem with the way the big companies fight spam is that sometimes it is a bit too aggressive. Happened a couple of times where legitimate government-agency emails had trouble getting through.Personally, I prefer defining my own spam list rather having an algo decide what pops into my inbox.

Completely agree this is anticompetitive and worthly of examination under the light of antitrust laws. Of course the defense that will be offered and one which is partially true will be one of providing safety from spam, phishing, and other evils prevalent in the email system today. Maybe texting is the new email after all...

The biggest challenge is in the sending.If, for whatever reason, Gmail doesn&#x27;t like your setup, even if it&#x27;s 100% according to specs, it&#x27;s effectively broken. And there&#x27;s no one to resort to, often no previous relevant search result, because the errors are vague when not silent (you don&#x27;t get to know the email was hard rejected, i.e. has not even reached the recipient&#x27;s Spam box).Your only hope is for your complain to go viral on HN or Twitter and some Googler takes pitty on you.

The general rule of thumb for my home server is that messages to people I&#x27;ve contacted before, or to addressees that were in a thread that I&#x27;m also part of get delivered reliably.  Messages to new people I&#x27;ve never emailed before often go to spam.  I&#x27;ve learned to accept this.

I think ideally replies would have a token to bypass it (since replies are expected)

This was a bad idea when it was first proposed 30 years ago

&gt; &quot;You might be an anti-spam kook&quot; does need to be updated to also include cryptocurrency solutionsI was scanning this thread to see if someone would post that old copypasta email solution checklist form again.Here&#x27;s one version: <a href="https:&#x2F;&#x2F;craphound.com&#x2F;spamsolutions.txt" rel="nofollow">https:&#x2F;&#x2F;craphound.com&#x2F;spamsolutions.txt</a>

e-postage, knows-SMTP-4, knows-SMTP-5 -&gt; <a href="https:&#x2F;&#x2F;www.rhyolite.com&#x2F;anti-spam&#x2F;you-might-be.html" rel="nofollow">https:&#x2F;&#x2F;www.rhyolite.com&#x2F;anti-spam&#x2F;you-might-be.html</a>We have cryptographic identity in SMTP already. In fact, almost all our protocols and formats for signing and identity were first adapted from email standards. This has already failed.&quot;You might be an anti-spam kook&quot; does need to be updated to also include cryptocurrency solutions. You&#x27;re neglecting the transaction costs associated with cryptocurrency, which might be punitive both for senders and for those attempting to collect the spam bounty. Of course the big email providers could aggregate settlements... but now we&#x27;re back to having big email providers.

It would be possible to solve the spam problem once and for all with a crypto currency:<pre><code> if (Sender is whitelisted by receiver):
 All emails arrive in the inbox
 else:
 Sender has to send $1 for their email to arrive in the inbox
 The $1 will be returned if the receiver replies</code></pre>

I run my own email server for receiving, but use the ISP&#x27;s server for sending (and setting up Exim on Ubuntu provides such an option at installation time). I have no problem.

I&#x27;ll keep going with my private server (on a vps). I just moved it to another hoster, meaning new IP block. This caused blocking issues:
Some but not all gmail address delivered to the spam folder. Another big mail provider asked me to set up a web page with contact info on the same domain I use for mail. And another self hosted mail server from a public service agency had me on block list.This caused me some headaches and I was thinking this could be the end and I have to use one of the big players. But I did not give up, invested time and it works now again!

mine is maybe 10 years? I don’t recall. No issues so far, but started seeing those Microsoft blocks when I moved my brother’s domain over to my server. I hardly send email out, so it could be unrelated to his domain, just that he sends much more email out.

I have my personal e-mail on linode for probably 15 years or so and haven&#x27;t had any issues with e-mail delivery (knock on wood).  Had the same two static IPs there for years, and have always had things locked down so I couldn&#x27;t be used as a relay for spammers.

IMO, any low-cost VPS provider is going to have a poor reputation. I&#x27;ve even had trouble running websites on some of them, as some &quot;endpoint security&quot; products have their IP addresses blacklisted, causing users to get alarming warnings if they try to visit sites hosted there.You&#x27;ll run into the same issues with the &quot;free&#x2F;trial&quot; tiers of bulk email services like Mailgun.I agree with OP, you pretty much have to at least send your outgoing email via an established, widely-accepted SMTP service provider, or in some other way pay a lot for a &quot;clean&quot; reputation.

&quot;Wouldn&#x27;t surprise me if Linode were entirely blocked.&quot;I&#x27;d be very surprised. I hosted email on Linode for years without issue.

Wouldn&#x27;t surprise me if Linode were entirely blocked. Also anything in M247 Ltd&#x27;s ASN. They host a lot of VPN endpoints, including Mullvad&#x27;s.Step 1, I&#x27;d move off Linode. Find a local DC or business you can support by hosting a VPS or dedi box with them. LowEndBox might be an interesting place to search but avoid anything too famous.Step 2, join this <a href="https:&#x2F;&#x2F;sendersupport.olc.protection.outlook.com&#x2F;pm&#x2F;services.aspx" rel="nofollow">https:&#x2F;&#x2F;sendersupport.olc.protection.outlook.com&#x2F;pm&#x2F;services...</a>. They don&#x27;t actually email me when they block my IP, but at least when I contact them I can argue I&#x27;m already in their program and they didn&#x27;t actually notify me of any sending issues. I&#x27;ve got myself unblocked relatively quickly this way.

Thanks I’ll check it out.  The bounce link was to an office 365 spam delist portal. My request was auromatically rejected and my only option was to escalate it to support (one click luckily). I’m yet to hear back, but from the stories on the link I shared, I doubt it will do anything.

Wow that is a wonderful link, they really seem to be improving on interacting with the public in these matters.

&gt; Trying to deal with a Microsoft ban on my IP<a href="https:&#x2F;&#x2F;sendersupport.olc.protection.outlook.com&#x2F;snds&#x2F;index.aspx" rel="nofollow">https:&#x2F;&#x2F;sendersupport.olc.protection.outlook.com&#x2F;snds&#x2F;index....</a>

office 365 hosts a bunch of domains though. My bounce was to a .berlin domain hosted there. Yes, I could route all smtp via a ESP and pay for it, but that’s centralization.

File a complaint request, they will fix it, they did for me.

I&#x27;ve been running a private mailserver for myself and a couple of friends since 2002. I hit a similar issue with Microsoft last year.I route outgoing mail to hotmail.com, live.com, outlook.com and msn.com domains via email-smtp.us-east-2.amazonaws.com. I started doing this when I noticed a large portion of e-commerce email I was receiving originated from amazon vms and they clearly had no deliverability issues.The ability to do this is a paid-for service, and needs to be configured appropriately. I was expecting to have to pay for a VM when I set out to do this. However, it turns out you do not need that - you can just configure the SMTP forwarding without needing to purchase any other products, and the cost for this is a few cents per 10k emails, which I can see would be significant for commercial services and&#x2F;or spammers, but for a private mail server essentially means I will never have to pay. Amazon go to great pains to maintain deliverability for those servers, so you don&#x27;t have to.I don&#x27;t really see a problem with adding one extra SMTP hop to outgoing emails tbh, but as no-one other than Microsoft has (to date) a permanent IP block ban with no recourse whatsoever policy, while I&#x27;ve had transient issues with most other big providers at one time or another, those four Microsoft domains remain the only destination I have to route this way.

I had that issue with them once in the past, I found a form on their site, filled it out and they had it fixed in a week or so. No issues since then.

I vaguely recall seeing in Linode docs that Linode itself blocks outgoing mail, unless you contact them to arrange for them not to.

Sending email out is a royal pain. Trying to deal with a Microsoft ban on my IP even though it’s sparkling clean for several years. DKIM, DMARC, SPF etc all ser up, reverse dns, you name it. Looks like Linode is being blocked as a whole pretty much?Hate the level of centralization, particularly since there’s still a shit ton of spam still around. Sorry for the rant.<a href="https:&#x2F;&#x2F;docs.microsoft.com&#x2F;en-us&#x2F;answers&#x2F;questions&#x2F;674558&#x2F;550-57511-access-denied-banned-sender.html?page=1&amp;pageSize=10&amp;sort=oldest" rel="nofollow">https:&#x2F;&#x2F;docs.microsoft.com&#x2F;en-us&#x2F;answers&#x2F;questions&#x2F;674558&#x2F;55...</a>

I use a small datacentre in my country, actually not far from where I live. DKIM&#x2F;SPF are independent of the provider. The easiest way to understand is to consider how receiving works. If I&#x27;m getting an email from hnemail.example, the first thing I do is consider the IP address. Oh, 257.257.257.1? Ok. So I then ask DNS &quot;what is the SPF record for hnemail.example?&quot; and it returns<pre><code> v=spf1 mx -all
</code></pre>
This tells me only to accept emails from &#x27;MX&#x27; entries for that domain. So I query &#x27;MX&#x27; against the DNS server and I get a list of A records, which I can get IPs from. If the IP is in the list, spf passes. Otherwise it fails, mark as spam.For DKIM, when the email was sent it was signed with a key by the sending server. It is identified by a UUID in the incoming email. So the receiving server again queries DNS for TXT &lt;UUID&gt;._domainkey.hnemail.example and receives the public key as a response. Signature verification passes? Accept email. It fails? Mark as spam.This doesn&#x27;t have a lot to do with IP reputation. This is different. If you are a very large email provider, you might develop custom spam filters. IPs are allocated to &#x27;autonomous systems&#x27; i.e. who actually uses them and hands them out to users, and depending on the business you might make some decisions about reputation. For example, if the IP address is part of a consumer ISP block that is handed out to users of broadband, chances are high that if they&#x27;re sending email, it is probably a Windows PC compromised by malware.Similarly, you might decide some ASNs are better than others. Some hosters are more liberal in what they will accept, such as VPN endpoints, tor nodes and such and as a consequence of this more spam comes from these ranges.Rightly or wrongly, larger email providers try to add these extra filters to the process to protect their users from spam. This obviously sucks if you are genuinely trying to run an email server on your symmetric home fibre connection with a dedicated IP, but that&#x27;s the world we live in.I can&#x27;t make any general statement on which providers might be best, and some people will have no issue whereas others will find themselves unable to send anything. I don&#x27;t work for Outlook&#x2F;Microsoft or Google and never have, so I don&#x27;t know exactly what rules they use, and in all likeliness they shift constantly depending on spammer patterns. I can only say I&#x27;ve found running from a small DC to work pretty well.

Find a clueful small provider, local to you if possible. On huge providers like Hetzner and DO, you are guaranteed to have spammers as neighbours some of the time, even if the provider rapidly shuts them down. On the other hand, a good-quality small provider may rarely if ever host spammers.

was just gonna ask how you would handle DKIM and SPF stuff. Hetzner? Digitalocean?

EU&#x27;s MECSA is nice as well <a href="https:&#x2F;&#x2F;mecsa.jrc.ec.europa.eu&#x2F;en&#x2F;" rel="nofollow">https:&#x2F;&#x2F;mecsa.jrc.ec.europa.eu&#x2F;en&#x2F;</a>

I used this one: <a href="https:&#x2F;&#x2F;www.mail-tester.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.mail-tester.com&#x2F;</a>I will check out your recommendations. Thanks

Agree completely.To those that still persist, there is a page I found recently that helps you make sure that your outgoing mail is configured correctly: <a href="https:&#x2F;&#x2F;appmaildev.com&#x2F;en&#x2F;dkim" rel="nofollow">https:&#x2F;&#x2F;appmaildev.com&#x2F;en&#x2F;dkim</a>. They generate an e-mail address, you send a mail to them, they do the check and display results (not affiliated, just a happy user).

At least you get notified. Microsoft&#x2F;Outlook on the other hand silently drops emails leaving you and the recipient in the dark.

I&#x27;ve also been self-hosting email for years, and the only deliverability problem I&#x27;ve ever had has been with AT&amp;T. If I try to send something to an AT&amp;T customer, I get an automated &quot;your message has been eaten&quot; notice, and following its directions accomplishes precisely nothing. At this point, I can only guess they&#x27;re hellbanning the IP block in which my VPS resides, because it does not show up on any public DNSBLs.Google? No problem. Comcast? No problem. Charter? No problem. AT&amp;T? Problem.

&gt; Even as I don&#x27;t use DKIM or DMARC.I wouldn’t expect sending email to be the problem. But I’d be surprised if it’s delivered.

If you are using external blocklists, you are perpetuating the problem here. Small mail operators end up on blocklists through no fault of their own, and it sounds like your server would reject them just like the big servers do.

I completly agree with you. While Hetzner is my actual neighbor as their headquarters is right in the neighboring town, I still use a server at very small scale provider. I have no problem with my email server. I receive some spam here and there, mostly from Russia. But I immediatly block the according IP addresses for some time.For years I avoided to use any external service to decide whether its Spam or not. But about 2 years ago I started to rely on some of the external Blocklists.Till today I have no problem sending Email. Even as I don&#x27;t use DKIM or DMARC.

Yes, as long as the IP doesn&#x27;t already have some reputation attached to it. Here&#x27;s a list of resources: <a href="https:&#x2F;&#x2F;sendgrid.com&#x2F;blog&#x2F;5-ways-check-sending-reputation&#x2F;" rel="nofollow">https:&#x2F;&#x2F;sendgrid.com&#x2F;blog&#x2F;5-ways-check-sending-reputation&#x2F;</a>

Would using a VPS with a static IP not work?Also does it help to use Google&#x2F;Azure to host with regard to IP reputation with Gmail or Outlook?

It can be enforced when complaints come in.

&gt;VPS provider that disallows things like VPN endpointsthis can&#x27;t exactly be policed

I think we are currently in a phase because of phishing problems. Corporate filters are currently turned up to eleven, but hosting your own server is still very well possible. SPF&#x2F;DKIM&#x2F;DMARC helps, but isn&#x27;t required. You really think the corps that do host their own servers have set that up? It is far more widely spread by enthusiasts that host their own servers.We also should keep mail for pseudonymous and anonymous user authentication. There are a lot of threats to the free internet right now and user account consolidation is one of it. I agree that people should keep hosting themselves. Someone blocked you? Their loss, let them rant to their internal IT about it. Corporations or institutions that use Google as a provider should be seen with scepticism.

Everyone that can should host their own HTTP&#x2F;1.1, DNS and SMTP at home on a battery backed Raspberry 1, 2 or Zero if they have an external IP.To host anything beyond those protocols and&#x2F;or on more powerful hardware is often counter productive.The problem is getting the ports opened, you need to fight for that right even if it makes spam worse in the short term.Fight for external IP, ports and static IP in that order.

I&#x27;m on 12 years of self hosting email and counting. Once every so often, I do end up being blocked, usually by Outlook and once by Yahoo. I&#x27;m in their &#x27;sender program&#x27; and they still don&#x27;t actually bother to contact postmaster@, but a few emails is usually enough to unblock the block within 24h.Agree with a sibling comment that many major providers fail to operate the SPF&#x2F;DKIM&#x2F;DMARC tools they insist you do.Each to their own, but ultimately if we don&#x27;t hold on to the freedom to operate our own mailservers, it will be taken away through inaction. This means doing some things right: DMARC, DKIM, SPF of course, server maintenance, good password policies and of course IP reputation. The best way I can recommend for IP reputation is to use a dedicated provider or VPS provider that disallows things like VPN endpoints, where it is less likely they&#x27;ll assign an address with a poor reputation. A good provider might also ask you what you intend to host, and you might be able to discuss IP addresses with them.

This was the first thing in Google so caveat emptor: <a href="https:&#x2F;&#x2F;www.templafy.com&#x2F;blog&#x2F;how-many-emails-are-sent-every-day-top-email-statistics-your-business-needs-to-know&#x2F;#:~:text=Globally%2C%20as%20of%202019%2C%20a,4%20billion%20email%20users%20worldwide" rel="nofollow">https:&#x2F;&#x2F;www.templafy.com&#x2F;blog&#x2F;how-many-emails-are-sent-every...</a>.Now for the quote:&quot;Globally, as of 2019, a staggering 293. 6 billion emails were sent each day and there are currently now over 4 billion email users worldwide.&quot;If we suppose that 95% of that traffic is SPAM, 14,650,000,000 or 14 Billion legitimate emails are sent around the world every day on a planet with 8 billion people and not sure how many of those are connected to email.Even at 14 billion, email is staggeringly successful, this is why FAANG wants us small time operators who do this as a hobby, for free for ourselves and family ... out of their pool.

Email is broken. Fix that first so that hosting it isn’t such a terrible chore.

I did training provided by a large email security firm, and one thing the presenter said was along the lines of &quot;this spam filter defaults to block the senders domain &amp; IP, you can set an expiration on that block butI don&#x27;t see a reason why you would&quot;. One misconfigured server sending out a single email and I assume by extension  someone impersonating your domain could get you perma-blocked from sending emails to that company, and I assume it&#x27;d reduce your trust rating for other orgs using that provider.

IP addresses and whole address blocks may have a bad karma: if somebody ever sent spam from them, they may be marked as untrusted in various databases, and unblocking them is pretty hard. The filters prefer to err on the side of mis-marking a few legitimate self-hosted emails, instead of passing a spam salvo.Decentralized trust is still hard.

You can deliver email to gmail and outlook until you ... can&#x27;t. Whether the IP block your mail server is on gets blacklisted, some heuristic shifts against you (domain name becomes &quot;bad&quot; and shifts a point score over a threshold for being spam), or some other external factor happens, your perfectly configured mail server will suddenly and possibly with no warning or sign that it&#x27;s failed, fail.For even personal mail this is pretty annoying, but if you&#x27;re relying on mail for business reasons, this is completely unacceptable. You need to be able to assume that mail you send reaches your clients&#x2F;customers. The chance of your private mail server getting banned might be low, but it&#x27;s not low enough, and over time that chance only increases (especially if you&#x27;re hosting from a server on big shared IP blocks with naughty tenets like on most major cloud providers).

Maybe it&#x27;s a joke, but a problem I see in every &quot;open source self hosted alternative&quot; is that people tend to underestimate how much work is to self-host everything.It&#x27;s either paid hosting like AWS, some intermediate docker-compose solution or your own personal server machine. In every case someone has to do the gritty work. It&#x27;s either a paid service, a volunteering open-source contributor, or you.

I guess try to use it as your main e-mail for a few years and you may see...

&gt;I implemented all the acronyms, secured antispam measures, verified my domain, made sure my server is neither breached nor used to relay actual spam, added new servers with supposedly clean IPs from reputable providers, tried all the silver bullets recommended by Hacker News, used kafkaesque request forms to prove legitimity, contacted the admins of some blacklists.I cloned a repo, edited two lines in a yaml file, ran docker-compose, logged into a web ui, added my domain, added a couple of dns records (MX, spf, dkim, dmarc) and everything worked (yes, I can deliver emails to gmail and outlook).I honestly have no idea why so many people say that self hosting emails is hard.

This is sad, but it&#x27;s a gross and inaccurate oversimplification. Let&#x27;s look at the summary of &quot;What are we left with?&quot;:&gt; You cannot set up a home email server.This is true enough to not care about edge cases.&gt; You cannot set it up on a VPS.This is definitely not true.&gt; You cannot set it up on your own datacenter.This is absolutely, unambiguously untrue.I get that there are many people out there who don&#x27;t want to administer an email server, or who administer one (or more) and are tired of trying to train users to DTRT and care about security. The truth is that if you have lots of users, it&#x27;s likely that one will get compromised, and their account will be used to send spam.Is it the end of the world? Heck, no, unless you let it go on for days. &quot;It&#x27;s not if, it&#x27;s when. Say goodbye to your email. Game over. No recourse.&quot; That&#x27;s just plain not the case at all, unless, again, you don&#x27;t have monitors in place.A super simple example: a script which counts the number of email sent by any given user in a certain timeframe is really not complicated. I&#x27;ve used something like this and it has caught a mail loop which wouldn&#x27;t end because the entity causing the looping was rewriting so much that typical anti-loop checks failed.So a user gets compromised. If this is a real concern (say, for instance, you have a lot of Windows users), your script should send an alert to you when this user&#x27;s account has sent several hundred messages over the past hour. You disable the user&#x27;s account, you clean the mail queue, and you deal with the fallout. Sure, that may mean watching your logs for a few days for rejections and visiting other networks&#x27; delisting pages, but it happens.So there&#x27;s the largest problem with running your own email server handled. Boom. Done. If you&#x27;ve hosted email for years yet can&#x27;t &#x2F; won&#x27;t do this little bit of work, then that&#x27;s you. The rest of us understand this.What about deliverability in general? Isn&#x27;t that the largest problem, you ask? No. No, it isn&#x27;t at all. You can even run an email server on your home Internet connection, if your ISP allows incoming connections, the same way you can handle any other general deliverability issue: smarthosting.If you want to claim that there are NO ISPs out there that can reliably send email outside of Yahoo &#x2F; Outlook &#x2F; Google &#x2F; Amazon, then you might say smarthosting isn&#x27;t a solution. However, you&#x27;d be flatly wrong, so wrong you shouldn&#x27;t be hosting email.If your home network can&#x27;t send email (it almost certainly can&#x27;t), and your VPS can&#x27;t send email (it&#x27;d probably have issues), and your datacenter can&#x27;t send email (you&#x27;re clearly doing something wrong, but let&#x27;s pretend), then you can smarthost through an email provider that has a good reputation. Period.Anyone who wants to argue that hosting your own server can&#x27;t be done today because of deliverability ignores this super obvious solution, which negates this entire article.Let&#x27;s move past that and look at the suggestions this article makes:Should we throw in the towel, proverbially speaking? Certainly not. I disagree with this emphatically.&quot;This doesn&#x27;t only affect contrarian nerds.&quot; No, it doesn&#x27;t, but discouraging others isn&#x27;t the solution. Your lack of solutions isn&#x27;t a good reason for others to throw in the towel. But why are so many &quot;contrarian nerds&quot; so quick to tell others to NOT do something? Do you tell people to not paint or draw, because it&#x27;s too hard for you? Or to carve, or write fiction, because you&#x27;re not good at those things?&quot;You can no longer set up postfix to manage transactional emails for your business. The emails just go to spam or disappear.&quot; Nope. You&#x27;re accepting that as normal and equal. It isn&#x27;t. This is the same basic idea as &quot;I can&#x27;t afford to not run Windows, because everyone else runs Windows&quot; - it&#x27;s a fundamental misunderstanding on your part that leads you to assume you&#x27;re the victim, and you&#x27;re powerless. If your email is being silently dropped, then you need to tell the recipients that they need to 1) complain to their provider, and &#x2F; or 2) find real, deterministic email services. I&#x27;ve told many people that I&#x27;m not responsible for overzealous spam filtering, and I provide proof that the email was delivered. It&#x27;s on them after that. &quot;But I can&#x27;t afford to do that!&quot; Then smarthost. This isn&#x27;t difficult.&quot;One strike and you&#x27;re out. For the rest of your life.&quot; Nope. Demonstrably, nope, unless you&#x27;re letting spam flow from your servers for days at a time.Your recommendations:&quot;Let&#x27;s keep antispam measures.&quot; Sure, but consider the fact that they&#x27;re part of the problem. Spam filtering shouldn&#x27;t be arbitrary - for instance, I do ZERO content filtering, unless or until I can prove to myself that there are no false positives. Email with &quot;storage.googleapis.com&quot; URLs? 100% spam. Email from random addresses &#x2F; networks with Gmail Reply-To? Absolutely 100% spam. Email from servers with a HELO &#x2F; EHLO name that doesn&#x27;t exist? Rejected. But keywords? No. That&#x27;s stupid. I&#x27;ve seen, for instance, too many abuse email addresses that don&#x27;t accept spam complaints because of content-based, rather than behavior-based, spam filtering. The problem with Gmail is that they do too much content based filtering, with no rules and no logs that we can see.&quot;Change blacklisting protocols so they are not permanent and use an exponential cooldown penalty.&quot; Fair.&quot;Blacklists should not include whole IP blocks.&quot; I disagree. If your network neighbors are shitty, then you should 1) ask for your IPs to be SWIP&#x27;d to you, 2) find a better company that punishes spammers &#x2F; scammers, and&#x2F;or 3) smarthost.&quot;Stop blackholing.&quot; Yep. But, &quot;No need to bounce every email&quot; - 100% disagree. If you&#x27;re sending so many messages that you&#x27;re overwhelmed by returns, then you&#x27;re doing something horribly wrong. Every email needs a bounce. This is how email works.&quot;There should be a recourse for legitimate servers.&quot; 100% agree. I think someone who has the time and resources should take all the large providers to court to compel them to have methods for correcting interoperability. If Google, for instance, wants to be like a utility, then they should be forced to act like one and they should have real ways to interoperate. As it is right now, it it not possible to reach an actual human at Google about anything via email. Every single message goes nowhere. They shouldn&#x27;t be allowed to operate like that, or if they want to be arbitrary, they should lose the right to be called RFC compliant email and the use of Gmail accounts shouldn&#x27;t be usable for anything public. That&#x27;s another whole battle, though - why should a company get to call themselves an email provider when they don&#x27;t provide reliable, repeatable service? Sigh.&quot;Email discrimination is not only unethical; it&#x27;s a risk for the industry.&quot; Agreed. I think there&#x27;s already legislation proposed, if not already passed, making certain types of communication unblockable. It&#x27;s shitty legislation, but it&#x27;s a first step at a precedent we all need - we need to be able to dictate to large corporations the parameters of what they can do and can&#x27;t do if they want to be considered email.

Know what will kill self-hosted email? Giving up and hosting your email with the big guys, the less self hosted email servers there are the less the big guys feel any requirement to support it

There were proposals for this sort of thing a while back, but they never caught on:<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Hashcash" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Hashcash</a>

Not good from an energy-wasting perspective.

Like cryptocurrency this will be a moving target. You would need a difficulty setting - but where as cryptocurrency only has to track one thing &quot;total hash rate&quot; this would need to track two things &quot;minimum supported hardware for legit sender&quot; and &quot;hardware threshold for attacker to be successful with a mining rig they can afford, based on the income from the spam&quot;.Each email provider might come up with different difficulty levels based on what they thing this is. So some handshaking might be required. And less computer literate people would be stressed why their email is taking 6 minutes to send. I think it would be hard to implement.

Something different: a hash which is expensive to calculate but cheap to verify. E.g. calculating a string of bytes to append to a hash stream on order to produce a hash with a certain number of leading zeros; you provide the hash and the bytes, and it&#x27;s trivial to verify.

HashCash is actually referenced as part of the inspiration for Bitcoin by Satoshi themself. It&#x27;s the birthplace of proof of work.

Right, I can´t believe people are re-discovering HashCash. It was a brilliant idea way ahead of its time. Sadly it was not adopted for email.

yeah, I believe it is called &quot;HashCash&quot; and works similarly to &quot;proof of work&quot; in cryptocurrencies

It definitely does not - you can allow different work loads for different senders. Mailing lists you actually want can be dropped to zero for instance.Most spam comes from new address pairs, not existing ones. Requiring high cost to get past a first-contact filter, then near zero forever after, is completely reasonable and would practically eliminate unsolicited spam.

Most spam is sent by hijacked machines and botnets is it not? They don&#x27;t care about wasting CPU power; they aren&#x27;t paying for it.

The problem to adding a cost to email is that it affects everyone. The amount of CPU power you need to waste to make most spam not viable is so much that it isn&#x27;t worth it.

&gt; If it were a back-and-forth protocol, more like TCP, then you have way more options for congestion control, error reporting, load balancing, and the like. The server can choose to accept the incoming request, ask for more verification, or interrogate the client in various ways.That&#x27;s basically what graylisting aims to achieve.

That is a clever idea but I think it&#x27;ll still fail so long as email (SMTP) is a fire-and-forget architecture. As long as you have that asymmetry, your SNR is going to suck.If it were a back-and-forth protocol, more like TCP, then you have way more options for congestion control, error reporting, load balancing, and the like. The server can choose to accept the incoming request, ask for more verification, or interrogate the client in various ways. This could be something just like DKIM &#x2F; DMARC &#x2F; SPF, or even something more exotic, like making the client do proof-of-work with difficulty tied to how suspicious that client is to the server, and also the delivery scope&#x2F;scale. Or forcing the client to wait for ACK for valid delivery while slow-walking it.This gets around some of the issues in cousin comments, with respect to punishing botnets and rewarding lawful players. Established, high-trust players pay no cost. Suspicious players can still get through, albeit with a tax (that should be trivial for low-volume personal MX, but expensive for high-volume spam). Furthermore, it&#x27;s adaptable.

Wow that&#x27;s ingenious - and obvious when you think about it. I guess evolving the email standard is a much bigger obstacle though, no matter how clever the proposal.

This indeed looks like a good direction. A decade ago Freenet (not sure if it still exists?) had a problem with spam on its equivalent of USENET. It was pretty bad, until they changed the protocol so that it&#x27;s the sending node that keeps the message, which is then pulled (or not) by the recipients. It made a lot of sense to me: I&#x27;m the one sending you the message, I want you to see it, while you don&#x27;t even know whether you want to get that message. So it&#x27;s me that should pay for storage and propagation of the message in terms of bandwidth and disk space. Not sure how it turned out in the end, but the approach seems right to me. It&#x27;s like phone calls: it&#x27;s the caller that pays the cost, not the one receiving the call.

It was a huge mistake for email receivers to take on the cost of filtering spam. Of course given the evolution of the internet and email it is easy to see how that mistake happened. Nobody had a crystal ball. But the only solution here is to raise the cost of sending email to the point where spam is no longer profitable.It seems like one solution is to bcrypt hash (or some similarly expensive algorithm) the email and include the hash in a header. Of course you need to hash per receiver or a spammer can just hash it once and spam away.The receiving client hashes the email and compares the result with the value in the header and discards emails that don&#x27;t match.You&#x27;ll never get industry buy in though - the FAANG companies don&#x27;t want to pay that cost for their semi-legitimate email. They prefer to keep that cost externalized.I believe there have been attempts at something like this, but it clearly never went anywhere.

No, we don&#x27;t need to do this because more laws will be piled on top and only FAANG will have the lawyers and people required to comply with those laws, forcing more control of the Internet out of our hands, the people, and resting control with the last people on Earth who should have any power whatsoever...politicians.

Seems like we need to write a law (draft a bill).

Yeah, I ran my own e-mail server from 1995 until about 10 years ago. It used to be fairly simple, but between incoming spam and attacks, the various standards that were developed, and my e-mail not getting through... this became a problem that was worth paying someone a few dollars a month to solve for me.I still use my own domain, but I&#x27;ll let actual delivery and security experts deal with the day-to-day running of things, while I run my business (which definitely isn&#x27;t that).It was a bit sad to give up, but the time and frustration it saved have been more than worthwhile.

After self-hosting my email for twenty-three years I have thrown in the towel