To build a plug and play solution, we knew that our server could not require listening for inbound connections on a residential internet connection. So we set about looking into how we could route traffic to and from a home server but we needed to do this in a way that prevented us from being able to spy on traffic. We investigated solutions like sshuttle and eventually settled on the combination of a simple iptables configuration combined with a VPN connection. Helm establishes an outbound VPN connection to a dedicated EC2 instance with an iptables configuration that routes packets to and from the connected Helm server. The EC2 instance also has a static IP address associated with it.

It's important to stop here and explain that the only way this architecture is viable while adhering to our design tenet of knowing as little about our customers as possible is because of the Let's Encrypt project. Every Helm server has a unique domain associated with it and trusted certificates for that domain are fetched from Let's Encrypt. We strive to ensure that all inbound and outbound traffic routed through the EC2 instance is using TLS with these certificates from Let's Encrypt. This way, our EC2 instance is effectively just an extra hop on the Internet.

I hope that answers your question, let me know!

I am glad you are doing this because running a mail server is non trivial. I have done it for a long time now and love the fact that I own my email identity. It is one of the few things left you can own online.

A hard problem, and I don't envy anyone trying to solve it.

Secondly, I think you underestimate the time intensive work that goes into clearing up an IP. I've run mail servers with users in the thousands. It's basically a full time job to keep a single ip clean. And that's with a half or less percentage of clueless users. I'm unsure how this will scale to hundreds of IPs let alone the thousands(x100) that would probably be needed to make creating your own hardware profitable.

Third, you're going to need to reach incompetent customers to make this profitable.

EDIT: Just realized I responded to the wrong person :(

Or, maybe I just misunderstand smtp idk

Thanks for the question and your support!

I understand that it's just an encrypted VPN connection, and are not actually storing email on the EC2 instances. But is there any way for your customers to ensure that? Can your customers shell into the Helm and/or EC2 instance(s)?

I'd suggest allowing customers who're concerned to run their own instances with your code on it (perhaps a Docker image?) - but giving random customers shell access to gateways you're responsible for (at least to Amazon) - would be insane...

Signal/WhisperSystems are doing some interesting work on how to prove the code running on their servers is identical to their published and auditable code - might be worth checking that out (for a post MVP roadmap idea).

Then you create an infrastructure for relaying the mail from your boxes to the Internet. Then you work with the various spam agencies to create both a way to respond to spam complaints and to detect and throttle or cut off spam senders. You'll find that spammers will offer to pay you a premium to "look the other way" but don't take it, many good companies died going down that road. Without the spammers it will be harder to make your numbers but concentrate on keeping your efficiency high and ultimately you will be better off.

You don't talk a lot about data protection on site for things like disk failure. What do you do in that regard to keep people from losing all of their mail if the disk goes tits up?

Isn't throttling outbound email count/day from the start the only real solution?

People have lives which can sometimes look spammy, like you are made the coordinator of the school potluck and suddenly you're sending email to 150 parents asking them to volunteer to bring food. But after that event you go back to your regular rate.

Because this isn't a "PC" in the sense that it is more difficult to be overtaken by a virus and start sending spam without your knowledge, and as a mail service provider you know that email originating from the device has to come from a specific domain, you have a lot more tools to detect that someone is being a bad actor or not.

> To build a plug and play solution, we knew that our server could not require listening for inbound connections on a residential internet connection. So we set about looking into how we could route traffic to and from a home server but we needed to do this in a way that prevented us from being able to spy on traffic. We investigated solutions like sshuttle and eventually settled on the combination of a simple iptables configuration combined with a VPN connection. Helm establishes an outbound VPN connection to a dedicated EC2 instance with an iptables configuration that routes packets to and from the connected Helm server. The EC2 instance also has a static IP address associated with it.

> It's important to stop here and explain that the only way this architecture is viable while adhering to our design tenet of knowing as little about our customers as possible is because of the Let's Encrypt project. Every Helm server has a unique domain associated with it and trusted certificates for that domain are fetched from Let's Encrypt. We strive to ensure that all inbound and outbound traffic routed through the EC2 instance is using TLS with these certificates from Let's Encrypt. This way, our EC2 instance is effectively just an extra hop on the Internet.

> I hope that answers your question, let me know!

This doesn't seme to address the question of whether this violates the ToS, regardless of whether this is technically feasible.

(Note: I've been doing a similar home-rolled version of this, where I have a mail server under my couch that opens a reverse ssh tunnel and forwards port 25 and 465 from whichever transient EC2/Azure/DigitalOcean/Hertzner/CloudAtCost VPS Ive got listed as my MX records. A little bit of Route53 API automation, some Ansible to set up the ssh tunnelling, and some "canary" gmail and live.com email addresses to check outbound deliverability when I go to switch VPSs... It's been running pretty much untouched since 2014 or so...)

It can be argued that using a browser or any other client violates that language by sending responses to requests.

The ISP won’t do squat if it’s encrypted; they have no idea who is being connected to and what’s being sent.

A TOS is as broad and vague as they can make it. A good lawyer could undermine such language if it went to court.

Still wouldn't solve "how do I know my emails won't end up in spam" but at least we're getting closer (to at least what I would want to pay for.)

The 2015 Order said this, "A person engaged in the provision of broadband Internet access service, insofar as such person is so engaged, shall not block lawful content, applications, services, or nonharmful devices, subject to reasonable network management."

I would argue that banning personal email servers or personal servers at all is not reasonable network management (e.g. a nest thermometer or a smart microwave or an Alexa/Siri thing is a server), and if we're looking to explore home appliances that decentralize the web, we need to ensure that broadband providers' policies don't block them. Google Fiber screwed this up too.

Honest question: What stops a malicious employee on your end sshing to this server and dumping plaintext messages from memory? What stops a court from ordering you to do that?

Even if you disable remote access, what stops someone from adding a new LaunchConfiguation that enables it silently on the next instance rotation in spite of whatever configuration is in place today?

At the end of the day it seems like you -can- spy on the traffic just as easily as you could if you were running the smtp services on an ec2 instance directly.

Given that, what is the value proposition here?

(Or if I am totally wrong, by all means call me out accordingly)

A lot of mail servers don't support this though, so it would be on the client to also be able to ensure it will not relay mail except to TLS endpoints verified by a well known CA.

In my experience this is rarely the case, but if it is and Helm is willing to tell end users "sorry I can't safely send mail to this endpoint" then I could see some value to this approach.

You could still record every incoming and outgoing email as it goes through your server, couldn't you?

I really don't see the advantage of Helm.

https://transparencyreport.google.com/safer-email/overview?h...

Further, "the provider could intercept email" and "the provider stores all email" are very very different.

Overwhelmingly at 0% in most regions which they say are:

> domains in terms of volume of email to and from Gmail, in alphabetical order

Something doesn't add up there.

I've seen amazon ec2 ips being used for ddos attacks and I blacklist the entire range for many of my websites/projects. The vast majority of visitors we get from there are abusive.

edit: I guess I should be clear that I have an elastic IP (which is free) and setup reverse DNS and DKIM and SPF, but I think those are fairly standard now a days (I don't know honestly I've only run an email server for a few months).

Why? The SPAM Scoring Industry is a kind of monoculture that will impede or cancel delivery of messages. Most big email providers outsource SPAM scoring to a third party like Symantec or Brightworks. And when your email is found offensive by Brightworks with one of their clients, you’re banned on all of their clients. Part of how SPAM scorers gather intel us by hooking into the CFL system so they get a notification when a user hits the junk button to delete an email. Another way is by checking for mass duplication in your emails. Another way is tracking open rates via the email provider’s UI sending metrics to the scorer’s APIs.

And then there’s the CIDR block lists they coordinate and distribute as a courtesy for their customers. So you might be able to deliver to @gmail.com and then @yahoo.com won’t even take a connection from your server’s IP.

Why does all this happen? According to my friend who works for a midrange ISP on their email service, they have about 120PB to store real email. And the amount of SPAM they reject outright (never reaches any box, not even the junk box) is 93% of all their email traffic. They simply can’t afford to store all the SPAM.

GMail is more reasonable with perhaps being spam filtered but never blocked outright. I have also been blocked by government labs and academic institutions. I also have complied with RDNS, DKIM, SPF and got a top score on mx toolbox. Now that I have been up for a while I have had less issues besides with the ones that block cloud provider spaces.

Some things that should be delivered are not. I'd have to dig back into this to see what the exact issue is.

Free when in use, you pay for it when it is not in use.

However, there are a few things to do, more specifically, you must contact AWS to get "clean" IP ranges (fresh IPs, never allocated to instances), sign some agreements and pay additional fees.

It's not exactly as simple as an API call to create an ec2 instance, but it's doable.

With random IPs, there is a good chance indeed that it is already burnt by a previous allocation.

Amazon EC2 throttles traffic on port 25 of all EC2 instances by default, but you can request that this throttle be removed: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-p...

Doubt that AWS would allow anyone to send on behalf of 3 parties like Helm appears to do though.

Do you have a plan to help make email security features easy to consume: SPF, DMARC, MTA-STS etc.?

Is there a way to opt out on the information that is collected?

I looked on your site but it does not show a logical architecture which might be useful for some of us.

We automatically configure SPF, DKIM and DMARC for our customers. We are also investigating MTA-STS.

Device diagnostics are opt-in by default so they are not collected. Customer data like shipping and billing information is not opt-out unfortunately as we need to be able to process payments, ship the unit and track warranty coverage.

Appreciate the feedback on wanting more architectural details. This will be coming in a series of technical posts explaining how we designed and built the product. Stay tuned and thanks for your questions!

SMTP is more problematic because of spam: outbound traffic on port 25 is blocked, so a true home mail server won't work without a reachable gateway mail server somewhere else. That's basically what the linked product is: they manage the protocol side of the service on your behalf, and forward all the content to your local device which connects to them via some internal protocol.

They’re still clueless. I tried to explain that it’s being blocked by AT&T and not my router but eventually I just gave up. Their process involves a logmein session where they take control and mess with your router. Gahd it’s awful.

They also randomly added my “device” (home server) to the DMZ so all of its ports were exposed. Be very careful.

NTP was part of a massive DRDoS not too long ago. It's possible they pruned it somewhere much further up the network under the (not insane) assumption that most customers don't need to run their own time servers that answer public queries.

Considering how easily it is to setup authenticated SMTP and how effective it is at reducng spam for the ISP, I'm Surprised it took AT&T this long.

I use a VPS as a proxy. SSH with AutoSSH. I use a VPS ($15/yr), map the ports from the VPS to the server at home.

For example, when you hit 80/443 on the VPS, it's routed to a reverse proxy in the apartment, then to the correct service.

Not a bad setup.

https://www.shaw.ca/uploadedFiles/Terms_of_Use/Acceptable_Us...

When it comes to consumer internet services, the US is a 3rd world country, which is kinda odd considering most of the western world does their business there.

I just checked the terms on my 300/300 fiber connection, as well as my (backup, company paid) 25/5 ADSL.

They're almost identical:

* no spamming. * no racism/unethical behavior. * no portscanning. * no illegal downloads/uploads.

Besides that i can use it for whatever i like. They block port 25 though, and you can only get it opened by purchasing a commercial connection. It has a dynamic IP address that only changes when i reboot my modem, which happens once every 2 years or so, so practically static IP :)

The ADSL has all ports open and a staic IP.

Generally they don’t care if it’s for personal use. I’ve heard of them shutting people down for something they saw as business related. They didn’t really get shut down, it was more like a friendly “We see what you’re doing and a business plan would allow you to do it for $30 more a month”.

That seems to have potential for abuse.

I guess the terms of service allows them to shut someone down if they felt like it, but I wouldn't really worry about it. If you have a site that generates so much traffic they even took notice, I presume you'd want to be on a real hosted environment anyway.

Germany's third biggest city, I can only get 50/10 Mbit, maybe 100/20 - no fiber in sight. No static IP and no guarantees anyone will accept mail from this dialup subnet.

/s

From my experience, at least in Munich it's hit or miss which of the 2 cable company services your building - it's not even on the street level.

Also I'm not really complaining. Say what you will about Deutsche Telekom, but I've been a happy customer since 1998. Everytime I had a different ISP (mainly M-Net) I had more problems than uptime. This is more expensive, but I'm having less than one noticeable downtime every 2 years...

If you are in a major city, it might be time to check the other ISP in town. I'm glad I did.

Static IP might cost extra.

I pay AT&T $80 a month for symmetrical 1Gb FTTP with no data cap.

They don't explicitly disallow it in their TOS, they just make it impossible by disabling the underlying tech.

And this > no racism/unethical behavior. * no portscanning. * no illegal downloads/uploads

"unethical" behavior is the most arbitrary, un-objective clause one can ever have. Your ISP may find your hosting an email server "unethical", and this clause allows them to ban you.

Europe is NOT superior in any way

They also specifically disallow distribution/downloading of child pornography and leaks like "fappening", which i translated to "illegal downloads/uploads".

The list of things that are disallowed is very specifically worded in Danish, as legalese usually is. Furthermore it is also customary in Denmark to allow all traffic. in or outbound.

All "metadata" is logged for 5 years, mandated by law, so every IP i connect to is there along with port, duration, protocol (if available).

> provide network content or any other services to anyone outside of your Premises local area network

I'm not sure if Verizon has the same intention, but if they take their own wording exceptionally strict, you would be in the wrong whenever you play a multiplayer game and end up being the host.

Generally in my own experience they don't want you hosting a service opened to the general public running all the time. I think running an open mail relay would get you banned very quick. It seems like this product is intended to be used purely for yourself.

Now the terms still would give them an out if they decided they didn’t want you, but honestly as long as you’re not hurting the network they’d rather take your money.

AT&T terms: >• with respect to dial-up accounts, using any software or device designed to defeat system time-out limits or to allow Customer's account to stay logged on while Customer is not actively using the IP Services or using such account for the purpose of operating a server of any type;

I have many servers on att internet, including email.

And yes, the no servers clause is an issue, it was raised initially by people doing peer to peer torrenting, and some folks running servers.

Enforcement is a bit tricky though because folks like Comcast and Verizon get so much value from being able to see all of your Internet traffic that they won't actually cut you off for running a local server but they will be passive aggressive about it. For example, they will start changing your IP every couple of hours (they set the DHCP lease time to be low and force the DHCP server to always give you a different IP).

The common solution is a VPN tunnel which is what Helm is doing, but that tunnel has to end up somewhere so that can be a problem if that 'somewhere' is commonly used by bad actors. (Like say in Ukrainian data centers)

I expect that this restriction will go the way of paid SMS messages eventually but for now it is going to be troublesome.

Also IANAL but "services to anyone outside" does not sound like it includes un-firewalled, password-protected, services for personal use. The word used is "anyone outside" not "any machine outside". The resident themself would presumably be an insider regardless of their physical or network location.

Also I think a reverse proxy with end-to-end encryption could solve the problem with no public-facing open ports. That doesn't count as a server in my book.

1: http://www.centurylink.com/legal/en/highspeedinternetsubscri...

(Combined with fiber, it's ideal for a small home server.)

I don't think there is a good enough definition of "server" or "serving" for such restrictions to be enforceable except is an arbitrary way.

I have an MUA that retrieves email from a server and sends email to a server. It might run in a browser and interact with GMail. It might be a mobile app or Thunderbird or Outlook. It might be sendmail or postfix or Exchange. Which of these are "servers"? Which are banned and which are ok?

> with respect to dial-up accounts, using any software or device designed to defeat system time-out limits or to allow Customer's account to stay logged on while Customer is not actively using the IP Services or using such account for the purpose of operating a server of any type;

AFAIK, AT&T does not prohibit running a server on broadband accounts.

What's being done by Helm is not much different than using Back to my Mac or Plex or SlingTV.

In any case, these ToS are over-broad and most customers probably violate them every day, especially the copyright provisions. The ToS are not enforced to the letter but allow the ISP to terminate an account if the violations are egregious. I don't think running a Helm server would get you booted.

This serves to protect them technically (residential systems are not designed to withstand a large number of inbound requests), legally (you can't sue them for failing to serve your site) and of course to promote their more expensive business lines.

If you're going to tin your own mail server, it's paying for a good VPS. Beside the guaranteed static IP, being on an IP block with a good reputation, good VPS provider have redundant power sources and console access over the web, which you are unlikely to have either from home.

"Helm connects securely to a unique gateway, which is assigned a static IP address so Helm is reachable by other mail servers and secure TLS sessions can be established."

Which I dont see the point of then. That way they are your gatekeeper of your mail/files etc. Not much of an improvement.

I wonder what happens if nextcloud does a full sync to a new device.

As far as what happens with a full sync: it's not really doable outside of the LAN for several reasons. One is I have a data cap from Comcast of 1 TB/month. Another is the upload speed is only 10 Mbps. That's actually one of the reasons I went to self hosting.

Lawyers, really? Why wouldn't they just cancel your account?