I don't know if ATT even provides email with my service, much less for a custom domain.

How did the de-facto solution become "Just use Gmail" or pay a third party to do it? It's a little sad for those of us who like running our own servers, total uphill battle. All that work in the early days of the internet to ensure such a feat was possible, only for it to become near impossible for most, regardless of technical prowess.

Just give all your data to a huge company, it's fine. Pft.

Sorry for the rant. Am I really becoming those old hags I used to make fun of on slashdot? Shoot...

p.s. It's easier than ever to do, too, because high-quality docker images are abundant. Tragic for nerds like us!

You can always rent a subnet or a server including network and host mail yourself.

I never need to reply from that email. I just need to be able to read emails I get. Should be much easier, right?

Receiving email is pretty straight and forward, filtering it can be a little tougher but should be fine.

It's not that I can't set those other ones up, I just don't want to, nor should I have to for a small service...

It's a bit chunky and when it doesn't fall apart it has a nice friendly client with support for mobile. Includes all the bells and whistles of spam assassin, dkim, briefcase etc. Mobile view is a bit dated but it works for elementary sending / receiving.

The free version has no backups which is a pain and makes me scared to reinstall/move away from. But for a all-in-one email server client it does have a charm.

Zimbra 9 looks nice but licensing.

> The free version has no backups which is a pain and …

I “simply” rsync the key parts off to my usual backup locations (where snapshots are made etc.)⁰. There are a few articles on how to do this floating around. The restore procedure is basically the same as transplanting a Zimbra instance from one install to another¹. For paranoia's sake I have a small extra VM that automatically restores itself from the latest backup daily, and I check occasionally to make sure it is running fine and has recent mail. That VM is not publicly addressable, but if my main instance dies irreparably I could make it so easily and flip DNS over to point its way, probably bumping up its RAM allocation too, losing at most what happened since the last backup. The VM actually thinks it is the “real” primary instance, even with the same local network addresses, as they live behind a split DNS arrangement. A copy of this VM can be used to test upgrades and other major admin to an extent too.

> makes me scared to reinstall...

I've found upgrades work smoothly, if you wait a bit after major versions to let the quick adopters iron out the issues first, so I've not had to completely fresh install. Just don't upgrade the base OS at the same time as Zimbra. For OS upgrade when an Ubuntu TLS release nears its own EOL or Zimbra's support for it does. I do by reinstall rather than upgrade but for Zimbra in the process things are the same as the backup restore operation. There has always been sufficient overlap between Ubuntu LTS lifetimes and what versions Zimbra supports that this has worked for me.

> makes me scared to … move away from

I've successfully used imapsync³ to move mail between various servers in the past, including into, out of, and between, Zimbra instances. Obviously that doesn't cover calendar data, config, and other features, if you use them, but for mail it is a good option. Regular syncing to something else could be an extra fall-back backup option too though I've only used imapsync for one-off bulk transfers.

> Zimbra 9 looks nice but licensing.

Same. Given how many times Zimbra has changed hands I'm surprised similar hasn't already happened sooner and I've had a good run with it! Maybe closer to 8's EOL others will start maintaining reliable builds of the OS parts, though I'm thinking I'll shift to something else next year. I've mainly stuck with Zimbra because it just works, given my needs have changed considerably over the years something lighter will probably be better and if I'm going to have to do more work (or pay, of course) to keep using Zimbra it is definitely time to properly reconsider the state of the many alternatives. At least we've got a decent amount of time to transition.⁴

[0] Hot rsync to local LAN backup first to speed up the part where the instance needs to be down, stop Zimbra, rsync to local LAN again to get a consistent backup there, restart, then soon after that the local backup is rsynced off to the offsites.

[1] Install same OS+Zimrba versions, stop, restore data from backup over the top, some steps to check/fix perms, off you go. Again, there are examples in the docs & forums.

[2] As [1] just with the new OS.

[3] https://github.com/imapsync/imapsync

[4] IIRC 8.x is due to EOL and stop getting security updates at the end of 2023, I'm intending to have something else in place by the end of 2022. If I have time to look around properly and make a decision by then, maybe I'll get around to it over the extended bank holiday weekend at the start of June.

I've been using nodemailin to receive all emails as POST requests. Set the DNS ip address to a vps on hostwinds (they don't seem to block incoming port 25) so it worked for me right away.

https://www.npmjs.com/package/node-mailin

https://www.hostwinds.com/

It's a single go binary that supports IMAP and SMTP, with a CLI (maddyctl) to help you set it up. TLS can be added with acme.sh.

Would it be more cost effective to do a DO droplet? (haven't tried it personally yet).

In my experience, a business connection is usually twice the price and half the bandwidth.

Disclaimer: Currently I work there, and it's true anyone can get a free VM "forever" (I've had one for 4 years).

also, newer accounts (from June I think) have port 25 closed by default, you need to open a ticket for that too

:(

Quite often blocked, too.

But, also, havn't you read all the cry babies on hackernews talking about how complicated it is to run a mail server? Why would you even try??? And, don't take calculus when you're in high school. That's hard too, I heard.

Complexity isn't the issue. It's about the utility of doing it. What you gain from running your own mail server is so minute that it's not worth the effort even if you think it's simple and easy. I could run my own MTA from my house, but I pay someone else to because being a sysadmin is so boring.

Orange DSL would change the IPv4 fairly often, sometimes while using it during the day. Huge PITA. You could pay for a fixed IP. No IPv6 on DSL. I have no experience with their fiber offer.

SFR used to have a fixed IPv4 on FTTH, but now they're rolling out CG-NAT. Which is even worse, because not even DynDNS can save you. Not sure if there's the option of paying for your own fixed IP. You do get a fixed routable IPv6 prefix (/56 I think). Older installs based on FTTC + Docsis get a new IPv4 on reconnection; no IPv6.

Bouygues still seems to have a fixed IPv4 on FTTH. They're rolling out IPv6 with a fixed /60.

There are "pro" offers, but they usually require you to have an actual registered business, which does incur some other costs.

--

Edit: Added IPv6 info.

also, the author makes the point that you quote,

>> You may not have a public IP, and if you do, it likely changes from time to time.

you then go and deny this claim and contradict yourself,

> generally do not change IPs frequently (unless your router/modem is restarted)

That's the point the author is making. How frequent and what may cause it doesn't matter, the point is, your IP address will change. When it does and if you ignored that in your infrastructure, you'll have problems. Regardless of how frequently it happens, you have to deal with dynamic IPs.

Yes, mobile internet has AFAIK always been behind a NAT --- I'm not sure if you can even get such a service with a publicly routable IP, since there's not much interest in e.g. hosting a server on your phone while you carry it everywhere, as useful as that could be.

https://www.att.com/support/article/smb-internet/KM1181996/

This started in the last year and affects millions of people.

Not everyone wants to give monthly Danegeld to Bezos.

I moved to a new location a few miles away, and Xfinity doesn't cover this area. The new ISP blocks the following:

"TCP 25, TCP 80, TCP 443, TCP 445, TCP 1080, TCP 6667-6669, TCP 1433-1434, TCP&UDP 135-139, TCP&UDP 67 are blocked for security and network management reasons"

The only way I can get high speed service that doesn't block these is to purchase a business plan from PennTeleData, but they won't even talk to you unless you have a federal tax ID for an actual business.

I ended up putting haproxy on a free Oracle instance and changing what port I listen at here at home.

While outbound connections to port 25 may be blocked, the ISP we are with still allows inbound connections to port 25.

I have a few accounts on the net tied to an old domain, and what I've done with that domain is that I now have the MX record for that domain set to my home IP address, but I reject connections to port 25. Then, when I need to reset a password for an account tied to an email address on the old domain, I start a simple mail server on my computer that accepts incoming mail, and I open for incoming connections on port 25.

I receive the password reset mail, and then I block port 25 again and shut down the mail server program.

For services that are actually important, I’ve changed the email address associated with the account to a hosted one, so that I receive mails about billing and such related to those services.

For less important accounts where I only need to be able to receive password reset mails but otherwise don't want mail related to the service, I keep them associated with the mail address of the old domain that has its MX record set to my home internet IP address, and where I only accept incoming connections when I am doing a password reset.

This way I can receive those password reset emails while avoiding most spam since I only keep port 25 open for incoming connections for short and infrequent periods of time.

It’s certainly too peculiar of a setup for most people. But I figure some others here on HN may find that they might want to do something similar.

So if your ISP allows incoming connections on port 25, you could set up MX records on a new domain or on a subdomain of an existing domain, and run your own server for the sole purpose of registering accounts or receiving password reset emails, and like I do only run that server when you are creating an account or resetting the password for an account.

It’s sort of a fourth option to other alternatives that I more often see other people use. The four ways that I commonly see others do it is:

- Some use “+” addressing with your Gmail account. Not ideal because spammers know of the “+” trick and can just strip the suffix.

- Some self host catch all mail. Not ideal because spammers also blast out email to commonly used names for email addresses. So if you have a domain and you accept mail to any address at that domain you will get spam for addresses like bob@ your domain, sales@ your domain and all sorts of random names @ your domain.

- Some generate a uuid as name portion of email address, unique for each service, or some other scheme with unique name portion per service. This is pretty good but has a couple of drawbacks still. One of which is that you need to explicitly create a new account in your mail system each time, which also can take time – this can be set up so that the operation is pretty simple but still.

- Some use a throwaway email from a free service like Guerrilla Mail or similar. Mostly fine if the account you are registering is really just some temporary thing, but if you do decide that you want access to it later then because the mail address was temporary you will not be able with most throwaway mail services to read mail for that address after like 1 hour or 24 hours or whatever limit they have set. So then password reset becomes difficult or impossible. Also some sites maintain lists of domains from such services and will not allow you to create an account with an email address using any of those domains.

Whereas what you might do instead, which is what I am doing now, is to run catch all but only during the moments where you know you will be receiving an account creation or password reset mail.

For this I use a very basic mail server that receives the mail and just dumps the mail in the terminal that the program is running in. Portions of some mail may be base64 encoded, but you can just copy the encoded text, run a base64 decoding program in another terminal and paste it into that. macOS, FreeBSD, most Linux distros etc all come with a base64 encoding and decoding program shipped with the default install of the system. At a glance it may seem like a bit of work, but I find this the simplest and fastest for the purpose of receiving one-off password reset mails.

First of all, forward port 25 TCP from your router to your computer.

Then, create an MX record on the domain or subdomain that you'll be using.

Install aiosmtpd:

  pip3 install aiosmtpd

  sudo aiosmtpd -l 192.168.x.x:25 -n

Then when an email is sent to any address at your domain you should see the message show up in the terminal where you have aiosmtpd running.

When you've received the mail, shut down aiosmtpd on your computer and disable the port forwarding of port 25 TCP on your router. Also, remember to update the MX record next time you want to receive an email if your global IP address has changed in the meantime.

Also, instead of running aiosmtpd as root you should find out how to bind it port 25 as a non-privileged user. See for example https://stackoverflow.com/questions/413807/is-there-a-way-fo...

See also https://aiosmtpd.readthedocs.io/en/latest/cli.html for aiosmtpd command line usage and https://aiosmtpd.readthedocs.io/en/latest/ for other details about aiosmtpd.

If you are feeling adventurous you could write some code to make this even simpler to use. Perhaps going as far as to both automatically enabling and disabling the port forwarding for your router (for example by emulating the login and other HTTP calls that your browser would send when you manually manage the router), and updating the MX record for your domain if needed, as well as to write received mail to disk in Maildir format. https://en.wikipedia.org/wiki/Maildir

But at that point, why not run your own MTA all the time and then just have your firewall cut port 25 off? When you want to start accepting mail again just turn the firewall rule off temporarily. That way you don't need to muck with setting up the MTA.

> But at that point, why not run your own MTA all the time and then just have your firewall cut port 25 off?

You could do that as well for sure. Mainly I do it the way I do simply because the mail server I am running on my desktop that I linked to is run from the terminal and I routinely close terminals which I am not using.

But for example instead of running the server from your desktop you could use the same general idea and have it always running on a Raspberry Pi and block port 25 like you say.