Internet was meant to be decentralized. Lets leave it this way.

I am running my server for 15 years and couldn't be more happy with "artisan" infrastructure.

I don't want or use webmail (sluggish), I don't want others fingerpoking my emails, I don't want various compulsory registration systems (like requiring my phone number out of """security""" reasons like google), giving others the ability to kill my account and do me a huge amount of work and on the top of that, it breaks the sites registration schemes, I have set up a script that accepts any email with some special structure and each and every registration gets a specially customized mail address (that I can calculate in my head, no configuration needed) that can be resolved back to the registration.

Getting spam? I am sick of you, whatever? No issue, just REJECT the whole address. It is used by only one site, like smart people don't reuse passwords, I don't reuse email addresses.

And you would be surprised, how many sites sell email addresses to others, and I know it as every one gets its own email address.

Rspamd eats the spam just as good as "ai infrastructure" /s

Even if you go for 3rd party email infrastructure, registering a domain is a must, so you can switch the provider fast if it gets vampirized.

Out of my whole infrastructure (100% self hosted, as said, for 15 years, actually more but not 100%), the email server is the part that needs the least attention.

The response to the author would be: nice that large providers have webmails and some other quirks that I don't want or need. Feel free to use them, but I have freedom.

postfix. dovecot. rspamd.

The internet was meant to be used by people who knew how the internet worked. Herein lies the problem.

This might sound like gatekeeping, and maybe it is. When these systems were designed, they were not designed to be used by everyone. They were not designed to be commodities that are bought and sold, with the most valuable trinket available being the attention of the user. But this is where we are.

Few are capable of running their own _anything_ on the internet, and even fewer have the desire to do it, because if you run it well for yourself (as an individual), someone else will want you to do it for them because you are already doing it, so it's not that much more work, right? \s

Decentralization limits monetization of anything, so that is going to be a non-starter for investment of resources. Unless you are trying to have your infrastructure survive a nuclear war, no one is going to provide the means to build anything big unless you can sell it or the users of it.

The notion that anything really works on the internet with the assumptions that were made in the 70s and 80s, and the realization that what holds most of it together is the blood and sweat of ops, duck tape, and fever dreams consistently astonishes me. In the not so distant past, someone paid me to write them a custom FTP server. In the 21st century. It's like being asked to whittle an engine block out of a tree.

> Decentralization limits monetization of anything, so that is going to be a non-starter for investment of resources. Unless you are trying to have your infrastructure survive a nuclear war, no one is going to provide the means to build anything big unless you can sell it or the users of it.

I'll go further: centralised systems can emulate decentralised systems, but not vice versa. Thus, ultimately, the only USP of a decentralised system is that it is decentralised for the sake of being decentralised, and nobody cares much about that. Centralisation is inevitable, and wins out every time.

They can pretend to be decentralized, but they can't emulate the lack of centralized authority.

People certainly care enough about centralization once it's consistently abused in ways that hurt them (which always happens eventually, given enough time). Our existing anti-monopoly laws came about like that.

Signal jumps to mind.

Plus I don't see much evidence people care. This argument reminds me of Accelerationism, which doesn't seem to work either.

People start to care on the edges (e.g. social networks), but there simply isn't enough abuse wrt email yet for opposition to register.

> And you would be surprised, how many sites sell email addresses to others, and I know it as every one gets its own email address.

So much this. I've actually contacted companies to tell them they've been compromised because I started getting phishing emails. I quit after the third time of reporting it and being told "we haven't been hacked, someone in your friends group has and you just can't read email headers".. right because someone in my friends group emails "[email protected]" to schedule group activities.. then six to twelve months later I get an email from HIBP telling me said website was hacked and my email was compromised.

It's funny to hear this experience. I've been doing this consistently for about 5 years now and have noticed 2 instances where this occurred, and in both there were prior disclosures about a security failure.

I tend to sign up for a lot of things (I'm seeing over 150 unique email addresses I receive emails from using this scheme), but I guess I'm just getting lucky.

Also, just out of curiosity, where does one sell email addresses, and how much are they worth? I take signups on a few websites, and I'd never sell my users' email, but I'm just curious to learn more.

I used to trade e-mail addresses with various banks, some 15 years ago. I'd just call up their marketing departments and offer those as 'financial leads'. I had a network of people who had various ad campaigns running where a customer could win something if the'd leave their personal (financial) data.

I did it in the early 2000s with a domain I picked up just for that purpose, which I'm almost positive was "myspamstopper.com", but I let the registration lapse and it was snapped up. It's amazing what was still available back then to easily register.

Not the GP, but I’m experiencing this mostly with small to mid-sized online retailers.

Side note: I've seen some MTA systems having weird filters for receiver's domain name or company name being part of sender's local-part.

When I'm opening an account at Example Bank which uses example.com domain, I avoid creating dedicated mailbox or alias with words "example" and "bank". exmplbnk@, xmplbnk1234@ or similar seems to have better deliverability when I'm attempting to contact the other side.

> weird filters for receiver's domain name or company name being part of sender's local-part

Likely to help cut down on phishing.

Perhaps there should be a system that lets [1] ordinary people record that they notified a company that said company had been hacked together with timestamped evidence of said notification. [2] people/organizations who sue/regulate said companies wrt said hackage have access to said timestamped evidence.

I don't know how to monetize said system but it would produce both social and economic value.

I've discovered two previously unknown data breaches this way. I was gratified when the operators of the sites thanked me for reporting it. Most times, though, I get the treatment you're describing.

Honest and non-rhetorical question here: Have any of your customers had an e-mail they've tried to send not arrive because the recipient's system was using a black-hole list that, for some erroneous reason, had you blocked? If so, were you able to successfully communicate with and/or reasonably work through whatever issue got you black-holed?

I haven't administered e-mail servers for 20 years, but back when I did, this started to be a problem that eventually became insurmountable. I used to manage a small business oriented ISP. We were multi-homed with a /18 that we used for everything. I had a customer that was a reasonably sized organization that dealt with tourism and conventions for a major city. On one of their websites, (which we hosted with IPs that came out of the same /18 as their mail server,) they had a directory of vendors who were associated with them. ONE of those members had a website that had been hacked/defaced. This got our entire /18 on a blac-khole list. They had an employee that was trying to send e-mail to someone on a system that was using this black-hole server to filter spam.

When we explained to them what the problem was, we got glassy-eyed stares back at us and a, "just fix it." I told them that, they would need to remove the link to their partner's site from their website in order to get them AND all of our other customers using numbers inside our /18 de-listed from this particular black-hole. They asked, "We have hundreds of partners who pay for membership in our organization and being listed on our website is one of the benefits. How can we possibly police every one of those websites every day to make sure there's no defacement or serving of any problematic material from any URL in any of those domains?" That's a decent argument in my opinion. And I tried to explain that different black-holes have different policies and no black-hole is demanding that anyone use their system for filtering. I tired contacting the organization that was using that black-hole to explain the situation to them, but they weren't interested in discussing it. As far as they were concerned it was our problem to deal with.

This kind of problem happened dozens of times with varying degrees of severity but with increasing regularity and it was one of the primary reasons we quit hosting e-mail and started re-selling another vendor's solution. That was a long time ago, and maybe black-hole lists aren't a thing anymore.

(Running a email system for a few thousand users)

> If so, were you able to successfully communicate with and/or reasonably work through whatever issue got you black-holed?

Yes. Practically all black-lists have a de-list form that one can use, and most seem to auto-delist fairly fast as soon they don't get any more reports from honey-trap and other sources.

We do have a few custom written ways to detect hacked accounts, and we don't allow users to set their own passwords. We also tend to discourage/deny users who do newsletters and other "higher risk" form of email. All emails sent by websites is sent through different servers, which also mean that a hacked website does not impact the reputation of the email servers.

Events with black lists maybe occur once a year and as I mentioned above, fixed fairly fast. One good tip is to keep an automated eye on the mail queue and react quickly when things start to look wrong.

It's better now, but in the early days of organized blacklists (more than 20 years ago) it was somewhat chaotic. Many large ISPs ran their own blacklists and some were poorly managed. AOL was the worst of them all. Their admin staff was unprofessional and unresponsive when I provided a PoC for their defective spam control system.

There are a few sites where you can plug in an IP address to see if it's on any blacklists. A handy thing to do before setting up a new server is to work with your provider to find a clean IP address beforehand. Here's one that I have used: https://mxtoolbox.com/blacklists.aspx

Thanks for the link, I see my email server is on a few lists. I’ve heard that DigitalOcean isn’t good for email servers but I’ve been lax on investigating.

Now I have incentive, this is annoying. Maybe I need a static IP as well.

For what it's worth I've run into the same set of issues at corporations using Google and Microsoft's hosted offerings. Hell, sometimes you can't even send it mail between customers!

> Have any of your customers had an e-mail they've tried to send not arrive because the recipient's system was using a black-hole list [...] ?

Yes. Twice.

In the first case, the mail provider was our ISP; and they got themselves in some mainstream blacklists. The problems getting that sorted out were part of the motivation for bringing mail in-house.

In the second case, there was some academic departmental mailserver and they were using some list incorrectly; using an extremely-opinionated list to block when it should at best be used to score.

This wasn't in itself a big deal, but one of my boss's correspondents was a senior professor in this department and they had some important business; and the postmaster was a dick, and wouldn't help. Boss didn't want to use some secondary email address; I had to show him how to set up an alias on some commercial server, which was second-best, but he was in a hurry.

Boss was angry with me and barked at me. If you run a mailserver for some group, one you assembled yourself, then people expect you to take responsibility for sorting out any mail problems. Well, they're right: you have taken on that responsibility. You made it, and you're running it: who else can they complain to?

[Edit] My point is that it's not hard to set up an artisan mail system; what's hard is that you create a job for yourself that is at the same time networking, user-facing, and technical. It's an interesting learning point, and I recommend it. But don't underestimate what you are taking on.

> [Edit] My point is that it's not hard to set up an artisan mail system; what's hard is that you create a job for yourself that is at the same time networking, user-facing, and technical. It's an interesting learning point, and I recommend it. But don't underestimate what you are taking on.

This. So much this.

I will happily run my "artisinal" mail system for myself. Would I put customers on it? Oh, hell, no.

I, sadly, always recommend that companies pay money to Microsoft for email. You are really paying for the customer support service rather than the email service.

Microsoft's email behaviour seems like anticompetitive abuse - you can whitelist an address and they overrule you and block incoming email for obscured reasons.

Customers still have problems occasionally _sending_ email to one domain, which is over 15 years old and sends <1 email per day. If they initiate and email us we can't send them a reply (if they're on MS email, sometimes). We use an outlook.com email nowadays as a relay and have to treat MS using customers differently still despite using a relatively large supplier.

Some years ago, I was lead to believe, you could pay a third-party to add you to what was effectively MS's whitelist.

Aside: back then I was doing some webdev and supporting IE5+ so I already hated MS about as much as one could.

Never paying to enable interoperability that is part of being a reasonable web citizen/company. Paying them just reinforces the negative behaviour.

Please don't recommend to people to pay money to have all their email communications read and stored by Microsoft, the US government and possibly other parties.

There are plenty of other email providers which are worth considering, and I'm sure some of them have half-decent customer support.

> I'm sure some of them have half-decent customer support.

You would, sadly, be wrong.

Microsoft customer support is "least bad" among the email providers.

That is a massive indictment of email providers, but it is what it is.

> Well, they're right: you have taken on that responsibility. You made it, and you're running it: who else can they complain to?

Assuming logic applies to humans is painfully wrong. I wish it wasn’t.

That question seems completely unrelated to running a personal mail server?

> Getting spam? I am sick of you, whatever? No issue, just REJECT the whole address

I started using that with Fast mail, they call that Masked address. Best spam filter ever.

It’s not so much that I want to go all the way and do it myself, but I’m interested to see the gold standard way and as per the OP, perhaps go part the way (ie not send) - do you have a resource you could point me at that you recommend or rate? Not trying to get you to do my dirty work, just wondering if you have a resource you use.

Exactly this. You make the wrong comment on Youtube and they take down your entire company's infra. Is this an acceptable risk to anybody?

While that’s true, and crazy…

Everybody know you show never even read YouTube comments. Posting them is just insane…

Using the same stack and have to agree. Once it’s up, it’s rather low maintenance. I wouldn’t start again from scratch, though today.

There is also a guy, Jar, who runs a rather his own email service, mxroute, quite successfully. Users love it and he seems to know his stuff.

> I don't want or use webmail (sluggish)

Serious question: what if you're on a network that blocks non-HTTP[S] traffic? How would you read your mail? This is a problem I hear of quite regularly.

That’d alert me to the fact I didn’t have my vpn running.

Im happy to pay for my own cellular data and vpn to avoid networks like that. Including tethering my laptop if needed.

Are there any guide or books available on how to setup something like this?

I assume you have a fixed IP. That's a non trivial part of the process.

What are the memory requirements for postfix, dovecot, and rspamd these days?

> What are the memory requirements for postfix, dovecot, and rspamd these days?

Approximately nothing. I run all my email infrastructure on the smallest available $5/mo Linode and it's way overprovisioned even so. I'd take a smaller VM if they offered one.

Hmm. Admittedly, I didn't use postfix, but dovecot was the largest process running on my 1G server and adding rspamd resulted in it doing the Out-of-memory mambo a couple of times a week. This was just for my domain, but I do get a crap ton of spam.

Very low for one person with a few emails per day. They almost never appear in top on a 3€/month VPS server (2 vCPU, 2G RAM).

They probably work well on quite limited hardware. But I guess it largely depends on traffic / on the number of hosted users.

Doesn’t even need that. I’ve run pretty much that stack on an original Raspberry Pi. You wouldn’t want to be trying to do a lot else, and GB sized attachments are gonna be limited by the usb Ethernet speed, but it’ll run just fine.

FWIW, someone is still reading your email. The owner of the infrastructure of your message recipients. If you've gone through the trouble of hosting your own email to avoid Google harvesting your messages, but you're exchanging emails with someone whose email is hosted by Google, then your emails are still being harvested and/or are harvestable.

Good point. But it is still one person/company less that reads your e-mail, if you and your correspondent used different e-mail providers previously.

There are also correspondences where you are only the receiver. For example, when you order things online. Gmail doesn't need to know what you are shopping for.

Unfortunately, they can still close the loop on purchase history and ad impressions through indirect, lazy association.

It's a very, very impressive edifice that's been created for identifying and tracking pretty much everybody irrespective of their direct, immediate interaction with the entity doing the tracking. I honestly think it's kind of funny that such a potentially insidious system was manifest for something as principally vapid as ad targeting.

Yes, quite the trojan horse.

True. But at least, you went out of your way to not inflict this to your recipients, should they wish to avoid this harvest. You made your part of trying to avoid this. You did your part to weaken this argument. Someone has to break the vicious circle.

There’s a midpoint at #1.5 where you control the domain and rely on an external host, but also have a continuous archive of your historical mails on your own server. Otherwise with a standard IMAP setup, if your provider locks you out, you’re limited to only the most recent N messages on connected devices.

Buy a domain for $20, get a GSuite account with it for $6 a month or similar, then archive all your mail via Outlook or your desktop email app of choice. You also get a lot of other tools and storage space for very low cost which I find useful.

It's still using Google but it allows plenty of control and management, and I can take my domain anywhere with minimal stress. It's a decent compromise.

Just make sure that you use a different domain registrar than Google Domains, and make sure your admin email address is not gmail. Because if Google bans your account, you will be totally screwed.

I used to do this but switched to iCloud Beta for custom domain this year. It’s $1/month (free with any paid iCloud plan) and integrates with iPhones/Mac, supports push email for iPhone, and is free of Google spying.

> $6 a month

Zoho has a $1/yr plan.

And Yandex has a $0/yr plan (unless they got rid of it and I’m just grandfathered, not sure..)

Can't find anything below ~1/month at zoho for just mails; care to share a link?

Yeah it's $1 a month, got confused, still a good deal!

Is zoho email any good? I've never heard anything about it.

you could argue dmarc, dkim, and SPF were all invented as barriers to entry for small mail servers as the majority of internet SPF is permissive and the majority of DKIM is misconfigured. imo, senderbase and other reputation/policy proprietary shit-lists used by anyone with a Symantec or Cisco email product only served to convert the unwashed to a corporate license as most of these mechanical turks just paid the same spammers by night to show up in a delhi office complex day job to identify their own campaigns. DMARC and DKIM/SPF just wrapped email in a mandatory layer of arbitrary complexity to "solve" a problem that RBL's had largely managed to tackle as an independent entity.

that they exist in part to force the hand of small companies and users to simply submit to a big player for their email is something i have long considered.

DISCLOSURE: I proudly run my own email server.

SPF/DKIM aren't meant to solve spam directly. They are aimed at sender forgery.

The real benefit of SPF is for outgoing mail. People no longer forge my domains. It stops backscatter. It has almost eliminated the mistaken spam reports to my ISP by people who don't understand mail headers.

How hard is it to actually get mail delivered?

I have the dumb idea of trying to make SMTP as cheap as http. Make spam expensive using proof of stake.

I find it frustrating I have to pay Amazon to send text for me. I was going to setup my own SMTP server but it seemed like too much work.

Check out the following pieces of software — it’s never been easier!

Maddy (https://maddy.email/)

Postal (https://docs.postalserver.io/)

Chasquid (https://blitiri.com.ar/p/chasquid/)

> Make spam expensive using proof of stake

That's already a thing. Hashcash [1], the PoW algorithm underpinning Bitcoin, was originally conceived as a method to prevent email spam.

[1] https://en.wikipedia.org/wiki/Hashcash

Huh? SPF, DKIM, and DMARC along with mta-sts/DANE require running some scripts and entering DNS records. If you are already capable of hosting a mail server at your own domain, then this should be rather straightforward.

How is this a "barrier to entry"?

It is surprisingly hard to get the cryptography right, and the cost of misconfigured DKIM in particular is nothing gets delivered to most providers.

It is a pretty solid example of market power at play - nobody but a big player would have the scale to force a change like that.

I'd like to see something to make it easy to address the case where you are doing #1, but your provider does unilaterally kick you off with short notice for some reason. The email equivalent of a bug out bag [1].

This would be something that provides in a single package an SMTP server, an IMAP and POP server, pre-trained spam filtering, and maybe a web server with a web-based email client, and a simple setup program that asks a few basic questions such as your domain name and configures everything on your end and provides help for configuring things elsewhere (such as with DNS, such as telling you what to put in your SPF and DKIM and DMARC records).

This is meant as something to handle your mail during the time it takes you to find another provider. It is meant to be something you can quickly install on a VM somewhere, point your MX record at it, get a Let's Encrypt or similar certificate for it, and not be losing mail while you are between providers.

It should have a quick start guide that includes details on signing up and getting a Linux VM up at major inexpensive VM hosting places. Amazon Lightsail, Hetzner, and such.

It should make minimal assumptions about your Linux environment. Probably it should not use the SMTP, POP, and IMAP servers that are packaged by your Linux distributor. It should use minimal servers that are written specifically for the emergency mail kit.

[1] https://en.wikipedia.org/wiki/Survival_kit

https://mailinabox.email/ does most of that.

I have my own domain since when I was about 15 years old and used that for a while on a digital ocean droplets. It's incredibly easy to set-up.

The only issue I had was that other people were not getting my mail and I sometimes it was not even reaching their spam folders. Probably because Google/Microsoft were blocking that IP range of Digital Oceans.

Nowadays I just pay for a personal Gsuite license and use Google Infrastructure.

Much simpler that way and I'm almost guaranteed that my mail will reach the recipients. You only need to set-up your DMARC / SPF records and point your MX records to the ones that Google provides.

We've been running a small mail host for ~10 years (less than 100 accounts, but outgoing monthly newsletter to a few thousand addresses) ... we had basically zero problem with delivering to Gmail. Their spam filter, while strict and applies throttling (and a bit of greylisting) is completely livable, compared to the balls-to-the-wall insane Outlook/Microsoft "protection" ( https://news.ycombinator.com/item?id=28982434 )

Don’t even get me started on outlook.co/o365.

If you put an address or domain in the safesenders list; they do literally nothing. Like you can just totally spoof the domain entirely.

However if you use transport rules as per their rec, there’s all sorts of stuff that will still get flagged, and you have to to reference ATP, anti-phishing, anti-spam policies. Much of which aren’t even in the Exchange admin panel, rather they are in “security” and buried in hamburger menus galore.

And what’s best. They don’t even have any documentation for how these modules interact or what order mail is processed in. I had a case open for months thst finally got escalated to someone that was able to explain the issues we had with specific list serves/domains getting flagged.

In the end my only option was to whitelist emails classes as phishing and route them to junk rather than keeping them in quarantine. Even though it was a 99% accuracy rate sans this single domain.

The guy was really only able to commiserate with me. We are but a number and not a big enough one to get Ms to change a thing. Their best recommendation was to deploy an edge device like proofpoint/proofpoint hosted and just handle it from there.

I get what they want to do. They are trying to make the crazy email RFCs easy for devops guys thst don’t give a damn about how e-mail works. But it’s still hard to keep up with as they constantly just move stuff around and change their own standards on a near monthly basis.

That safesenders list thing sounds insane. How many companies add their own domain to that?

Well....that's how I found out about it when I took on my current role. We had pretty solid phishing attempt slip through. I was able to spin up a VPS as test it on mine and some other known tenants as well (with their permission). And since o365 uses a predictable name for their SMTP receivers for a tenant (domain-com-net-whatever.mail.protection.outlook.com)its easy to kind of....select targets and test it out.

So even if its not listed on the domains MX record but you can suss out they are an office365 tenant receiving mail, you may be able to relay off it and spoof to high heavens (especially if the edge device reccomends you....ahem...whitelist your own domain and not use transport rules). In fact especially if you can do this.

For example i think MS forced proofpoint to change their config recommendations as an outcome.[1]

from the page on [1]:

"Due to major complaints, Proofpoint has opted to change change to the format of ensuring Proofpoint mail is not scored via the O365 system. This rule will allow external email to come in still, but will follow O365 scoring. This is to ensure no mail is lost."

[1] https://web.archive.org/web/20200807173336/https://help.proo...

I've been running my own (and other) email servers for over 25 years. About four years ago I switched mine over from sendmail (with a bunch of add-ons like spamd/spamassassin, rbl, etc.) to mailinabox. Mailinabox is full-featured, secure, and reliable. It doesn't take anywhere near the level of effort required to maintain vs. other solutions.

Microsoft has blacklists the entirety of Digital Ocean and won't whitelist any IPs, even if it's a legit mail server. If I didn't know better, I would say that's anticompetitive behavior.

If true, that is probably the last excuse I needed to migrate my own email server off Digital Ocean to another provider. Oh well, it's been a very good run, DO.

I use a domain, registered at Namecheap, and I forward to my gmail account. If gmail “goes away” I simply configure my email to forward elsewhere. If I’m unhappy with Namecheap forwarding, I point my DNS at another forwarding provider. If I’m unhappy with Namecheap, I transfer my domain to another provider.

It gives me all the flexibility I need with almost no work or maintenance.

There are enough mail providers that I could easily switch to that I don’t need a piece of software. Switching from gmail to yahoo, proton, apple, outlook, or juno is a simple domain adjustment and has me back receiving mail within the TTL period.

Does gmail actually trust the incoming forwarded email? Or mark a lot of it as spam.

My understanding is that SPF makes forwarding like this no longer possible if the original sender's address is to be preserved.

If they are using GMail for work, the DNS just points to GMails actual server and authenticates using DKIM as well. Google for Work will provide you with the necessary DNS entries to set. Obviously this will not work with their free offering, you'll need to fork over $6/month for this.

Yes, though this isn't forwarding. The mail is actively being delivered into gmail, who must be programmed to accept mail for that domain.

Forwarding, on the other hand, made it possible to do a simple redirect of one address to another (eg. ~/.forward) but strict SPF rules will deny the forwarder as a valid source for the mails.

I used to do this but found every now and again I'd get multi-minute long delays before gmail picked it up. I've since moved to paying for Google Workspace to host my email (eventually hoping I'll move to something cheaper).

The goal is to get my personal domain to be my email domain for exactly this reason.

For my soon-to-be-born son, I'm registering him a personal domain immediately, and I'll turn it over to him when he's old enough to have email - save him some trouble.

But what if... the TLD owner decides to 10x the domain price?

As someone who de-googled about 5 years ago by buying a nice three letter .io address this hits right in the feels.

I could go through the process again (not fun) with some ridiculously long .com/.net or other OG tld which are probably somewhat more resistant to rent seeking practices like this or I just suck it up and hope it remains pricey but not egregious.

Are there any truly "community-owned" TLDs for the tech community? Would such a thing be possible and/or useful?

For Canadians, .ca seems a generally well behaved and managed TLD under community control.

EDIT: .ca is not particularly tech community related, but that doesn’t matter to me.

For personal domains, I bite the initial cost and buy the domain for 10 years, then every year top it up to 10 again. For a $20/yr domain that’s only $200 up front, and if the cost suddenly goes up or some other TLD policy changes that I hate, I have plenty of time to gradually move to a cheaper/better domain.

One thing I’m not sure of is what happens if I want to switch registrars in that time—will the full 10 years of ownership transfer to the new registrar?

Like you, I have domains registered for 10 years and extend it every year so that it always remains at 10 years.

If you switch registrars, your domain validity continues as before. Your registration information is with the registry for your TLD, not with the registrar alone. So your 10 years of (future) ownership will carry over. Two caveats to note. The first is that you can’t transfer a domain within 60 days of purchase or renewal. The second that I’ve seen is that a transfer to another registrar requires a one year renewal for the domain. So I’m guessing you may not be able to transfer a domain that’s already at 10 years (even taking into account 60 days after the renewal to keep it at 10 years). But if your domain is at nine years, you’d surely be able to transfer, and it would become 10 years at the time of transfer.

The expiry date never changes through all these actions.

Epik lets you buy domains more or less permanently for a large upfront cost (~$600 for a typical otherwise $10/year domain IIRC). Anyone know any other registrars that do?

Transfer the domain. You can generally find a deal for transferred domains.

When you reply to emails, does google let you put your custom domain address as the sender so folks don't see the underlying gmail address?

In fact Gmail requires you to add your SMTP if you want to send from a non-gmail address.

Yes.

Do you use Namecheap's email inbox or is that accomplished just with DNS records?

Cream does cloud backups for office 365. Most other business focused backup software will do mail server backups in some form

iredmail does this pretty well

https://www.iredmail.org/

Indeed. I set up my personal email server on a Hetzner VPS using iredmail. It just took a couple of hours and everything actually works pretty well with very little maintenance. Even Hotmail/Outlook.com accepts my emails.

I think #1 is a super solid idea. I'd love to go beyond that— I'm familiar with the tech and love the satisfaction of a more DIY approach— but other end users preclude my doing so.

The author mentions quality in big email service but only passingly mentions what that encompasses. Smooth, responsive, well-worn, ceaselessly preened, and smoothed-over end-user UIs are important. Unfortunately, the open-source alternatives are comparatively rough.

(As a long-time developer and more recent designer, I write a lot of open-source code myself. I understand that these are complex and tedious problems to solve. However, without frank critique, "Open-Source Alternatives" will always be "Alternatives.")

Every interface I saw needed fundamental design work. My recent research showed 2+ decade old interface layouts w/new features just bolted on, visually complex toolbars, menus, and lists, little editing for views and controls, and comparatively unattractive designs(, which even if it doesn't matter to you, that doesn't invalidate its importance to others.) Even this crowd— people accustomed to configuring complex applications— lament the clunky interfaces.

To me, most open-source interfaces are like eating on a diet. Your sense of accomplishment offsets the discomfort... at least for a while. End-users, however, don't have or need, that holistic view of the service. To them, the interface IS the service. DIY/tech accomplishments are abstract and indirect factors, at most. For most, it's like eating on-diet, but someone else loses weight. Attractive alternatives make that unsustainable.

So the real hard part isn't technical— it's assembling an email stack where users don't feel deprived for having chosen it.

The solution is more collaboration between design and development expertise within the FOSS. If you have a position of authority in any FOSS projects, I implore you to be open-minded when presented with interface design ideas.

Happy to talk about productive ways to engage with designers and design feedback.

> most open-source interfaces are like eating on a diet.

Because there aren't open-source contributing UX/UI designers. Almost all open source interfaces are quick work done by mostly backend developers.

Firstly, I am one. I have ten years of full time back-end web dev experience and other types of coding for over a decade before that. I also know others— UX designers generally start in another field and dev work is a pretty common start.

Secondly, that few contribute as designers rather than developers is definitely a chicken and egg situation. Designers time and effort is universally seen as less valuable than developers’ and therefore more readily dismissed or minimized. People are worse at taking critique for things they’re not confident in, and as you note, most open source projects are maintained by developers. Ever give a brand new developer a code review? Yeah. That’s about what it’s like critiquing an open source project’s beloved “quirky” interface.

I’ve seen eager designers post issues in repos— some with complete wireframes and rationale having done a good amount of work already, asking for specific types of feedback— only for their system to be instantly bikeshedded into oblivion rather than productively discussed. Unsolicited contributions are often viewed as superfluous expenditures of dev time, or even viewed with outright suspicion or hostility. If it’s not submitted in the form of bite-sized PRs ready for production with the understanding that existing devs can veto any changes without any real justification. Going from a haphazardly assembled UI to a properly designed UI requires fundamental change, and that’s a lot of work. Would you contribute code in a project with those competing requirements?

Before any of that, any designer interested in open source software has almost certainly made the mistake of griping about the interface for gimp, or git. It’s a good preview for what lies ahead.

Security of your own domain depends a great deal on the security of your domain registar and dns provider.

If you are going this route for security purposes make sure they have proper policies and are not a susceptible to social engineering.

At least Cloudflare is offering such thing, but it’s enterprise option [1]. I would assume many others have similar offerings as well.

[1] https://www.cloudflare.com/en-gb/products/registrar/custom-d...

> Sending your mail yourself is the real hard part

It's possible to punt on this by using SES for outbound, while continuing to handle inbound a different way. Obviously SES doesn't count as fully self-hosted, but it does solve (or at least significantly ameliorate -- zero issues here) the reputation problem

I think that's what they're talking about in terms of 'you don't send your own mail', but it is a good solution and SPF+DKIM means you should have very few issues with deliverability and reputation.

spammers tend to set up SPF/DKIM

I mean that SES gives you SES IP reputation, and they force you to have a low bounce rate & complaint rate, thus SES specifically is usually not blocked by big providers nor small enterprise networks.

>It's possible to punt on this by using SES for outbound

How does this work? Do you just sign up for aws, then set your outbound SMTP to whatever SES provides?

Yep, you just configure your outbound SMTP server to be the SES credentials and adjust your SPF/DKIM records.

I was determined to make #3 work for years. But despite a golden reputation for my IP, perfect dkim, dmarc, dns, and everything else, plus exclusively personal mail (no bulk mail ever) I could never get out of the spam box at several major providers. Never could figure it out, even with all the tools. Finally gave up.

I have come to suspect new MX servers are spam-holed by default until enough people click “Not Spam”, which is an absurd hurdle for a single user hobby server.

> I have come to suspect new MX servers are spam-holed by default until enough people click “Not Spam”, which is an absurd hurdle for a single user hobby server.

Yes, a fresh (or: previously sending spam) IP requires some warmup time until providers like GMail will let you anywhere near the inbox.

And if you're not sending out a high enough volume of emails, no chance.

I had the IP for probably five to seven years- but my outbound mail volume was less than ten emails a week. Which, of course, was tough to increase when delivery was poor - chicken and egg.

I monitored all the blacklists, filed ownership attestations with receiving domains, the whole nine yards. It’s sad that a microscopic MX server can’t be default trust instead of default spam for the first two messages a week.

(I want to repeat, this was a single user exclusively personal domain. Writing to a friend, to grandma, to a colleague)

I was probably in a bad ASN, but at that level trying to find a good block you’re just rolling dice. I wasn’t willing to play anymore.

> Sending your mail yourself is the real hard part

No, having quality spam and fraud filtering, and quality security, that you host yourself, is by far the much harder problem. I would argue that outsourcing your email to Proton or Tutanota is not running your own "artisanal" email server. By the way, even with those email providers, I still have terrible spam and fraud emails getting through filters that I never would have seen with my GMail.

Well, on the flip side unless you constantly check your spam folder (which pretty much completely defeats the purpose of a spam filter) you most definitely have lost important mails thanks to gmail.

I just don't see what people see in gmail part from the google brand - which surely isn't a good thing anymore.

I'm not here to be a Google apologist, but in the 10 or more years that I've used gmail, I don't think I've ever had an important email go to spam.

Incredible.

Most people I know? It is almost a daily occurrence. Including if senders are in address books, and "not spam" is clicked when found in the spam folder.

Most people I know see legit emails in the spam folder, all the time.

Google workspace sends yes/no meeting confirmations that you make in workspace, to people within your own organization, to spam unless you specifically make a rule to allow them.

For me, this was the main reason to move away from MSFT/GMail to Mailbox.org where I could set the Spam filter to as low as they'd allow.

So far I've been lucky to rarely receive actual spam, but I've often missed out on important emails too often.

I still have a @gmail.com account and every time I check it there's a whole lot of spam sitting in the inbox waiting to be classified as spam. Very strange as my main address (which I've had as my main address for almost 20 years) is on FastMail and hardly gets any spam despite the address being much more exposed e.g. it's found on many public mailing lists and it's been part of more data breaches than I can count. Yet it's Gmail that gets the torrent of spam including many obvious ones ending up in the inbox. YMMV of course but I don't rate Gmail highly compared to FastMail and even Office365.

At this point, I suspect the pattern [email protected] is so common that spammers just blindly target it.

My experience is similar, I receive much less spam on my actual mail than I do on gmail.

That is possible, my Gmail is indeed [email protected].

> I would argue that outsourcing your email to Proton or Tutanota is not running your own "artisanal" email server.

That's not a claim I'm making. The goal of my message was merely to help people see that there are several steps you can take from using a gmail account to relying on no third party. When I talk to people, they often don't realize this, and especially, how easy it is to set up #1.

> No, having quality spam and fraud filtering, and quality security, that you host yourself, is by far the much harder problem.

Handling spam is not an easy problem, but it's one where you have all the cards to take actions. On the other hand, having your mail properly delivered is something where people have wildly different outcomes, and for people with bad outcomes it's "impossibly hard, and there's no action you can take about it, unless you personally know the right people at the right places".

I've done #1, it didn't occur to me that you could split up #2 and #3. That sounds like a really interesting project. Thanks for the idea!

Might be a silly question, I own a domain that is my first initial + last name dot dev for my portfolio. What's a decent, or usual, prefix to use with such a domain as a personal email for job applications? Bonus point if it is English-French bilingual.

contact@ sounds off, like I'm a corporation. email@ or mail@ I kind of like, but I'm afraid it sounds "confusing" (is that in my head?). application@ or job@ is not bad, but a bit specific and not one I could use all around.

I use [email protected], and I am playing with the idea of different versions per language, Ja, watashi, moi, mig, and so on.

I always give out 'hello@' or 'hi@' on for general contacting

hello@ is pretty popular.

But when I give the mail directly to a given company, I use [email protected]. That lets me track how I'm contacted, and sometimes it starts interesting conversations.

Your post is super insightful.

Option 2 in particular is super appealing.

I’ve tried a bunch of pricacy-focused email services and have been let down by one or more aspects of their service. Pretty much all of them managed to handle sending Ronny satisfaction, though.

So setting up inbound to run on my own gear and paying a couple bucks a month for others to deal with dkim and and domain keys and all that other crap… that’s brilliant.

Thanks for the idea!

This is great advise. I do #1 and #2 but not #3. I use sendgrid.com for #3. They have one of the highest (if not the highest) deliverability rates in the world and mails arrive really fast (faster than gmail).

As a bonus: I get to see report which of my emails were classified as spam or not opened.

Also, first 100 mails per day are free (which has been enough for me so far).

You put tracking pixels into private emails? That’s pretty upsetting, luckily I’ve had images disabled for years.

Using sendgrid would seem to have similar or worse privacy implications to using gmail, outlook and their ilk.

#2 has practical reasons as well, such as security and privacy (yes, other mail servers on the internet can catch your mails in flight; that’s quite different from a mail provider having full retention of your email at any point in time)

I’d add another thing:

- Hosting your own mail client. You can self-host roundcube/mutt/thunderbird/or even an imap server that just fetches (and possibly deletes) email from the remote server using something like mbsync. This mail client/server doesn’t need to interact with any other mail server apart from the mail provider that receives the incoming email, be that gmail or fastmail. While paid ProtonMail can be used for this, it’s a bit of a hassle with their lack of native imap support.

> other mail servers on the internet can catch your mails in flight

This also shouldn't be a problem most of the time if your email server supports TLS; Google currently sees 81% outbound email encryption[0], so you can imagine roughly 4/5ths of email servers support it.

0: https://transparencyreport.google.com/safer-email/overview?h...

Indeed. It was more of an inb4 of the common reply of “there is 0 privacy gains of self-hosting email since most of the people you’re mailing with will be on one of the big providers anyway”, which is tired and defeatist.

Tired, defeatist, and giving way too much credit to the big guys. No matter how good they are at assembling a profile on me from indirect data, it's still going to be more effort and likely lower quality than if they had a giant store of data labelled as mine.

Great write up!

I’ve long been interested in self hosting, but constantly tweaking and never got #3 stable. After iCloud made it easy to do #1, I pushed my parents into using it and gave them my domain (@lastname). Now I just share it too, since it’s just too easy.

I encourage everyone who wants to change to something they control, or uses a paid iCloud tier to set up their own vanity domain for iCloud. It’s so easy and lets you own the identity, which is a critical part and portable. Not trying to shill anything, but it took 10 minutes and is offered by apple, so every not tech-savy person has heard of and trusts them, so it’s easier to convince others.

Yep! I do #1 despite researching controlling the whole stack. I still like the idea of doing it someday, if only with a development domain.

I pay $12 a year for email hosting, $10 a year for the domain. I use name.com and I presume (though I have not tested) that if I needed a human to talk to, I would have much better luck than with Google. I also don't have to worry about a snarky Youtube comment getting me locked out of Youtube, Youtube TV, Gmail, GDrive and everything else.

Qualifier to add to #3. Sending mail to other recipients who are running their own mail server (for themselves not for others) is not "real hard".

Unfortunately, most outbound mail I send these days end up at Google or MS.

You can have the best of both worlds with self-hosting received mail and achieving good deliverability by using a service such as Amazon SES. SES will probably cost you less than $10 a year for personal email sending volumes. I use it for my business and it is less than $15/yr. Rarely get a bill for more than $1. They hold you accountable for any abuse/complaints, which is a good thing.

I use it for personal use, would also recommend. It's not 'self-hosting' of course, but that's not what I actually care about personally, more interested in 'running my own' regardless of whether it's physically my hardware or not.

(Or rather given everything I've read about self-hosting email, not regardless, this is my preference...)

For a private mail server operator, Amazon SES is somewhat annoying because if your mail server is down, they're only keeping mails in the delivery queue for something like eight hours or so, which is way too short if you're not a big provider who can commit to round-the-clock support for the mail server.

I keep a backup postfix server in a different location from the primary. It all kicked in once about 3 months ago and worked beautifully.

How do you use SES for this? It seems to only allow receipt of email conveniently. Sending seems to require using an api which is not something most people want to do to email others.

You can create smtp credentials for use in any email client. The api is optional.

Yeah, I've gone with the compromise of my own domain and a rented managed server for the last twenty years or so. Works well enough for me. I like to be able to give different email addresses every time I need to register somewhere. Keeps my personal address free of spam.