But Carlos did not do "all that". He said he tried VPS servers, not dedicated servers. Maybe that's his problem. VPS servers tend to have IP addresses with low reputation, whereas dedicated servers tend to have higher reputation IPs.

Deliverability really depend on solid reputation of IP address blocks, including reputation of your neighbors. Ideally you want an IP near other IPs who also send high volume of non-spam.

I used to self-host, on my home internet connection, for 20 years. I used ISPs that were email-friendly, and gave me clean IPs. I started out with Sendmail, but switched to Postfic/Dovecot after a few years.

I stopped a couple of years ago, and moved my mail to my ISPs servers (they let me use my own domain). I switched because of the hassle of keeping the thing up, backing-up the mailstore and so on; and because I was moving home, so I wanted a service that couldn't be knocked-out by the move. Not because of any deliverability issues. I haven't had deliverability issues since about 2010, and those were probably because I couldn't be bothered with DMARC.

My ISP is a niche outfit, targeted at nerds; their mailservers are Postfix/Dovecot, which suits me. They support Sieve, and they have a control panel with various knobs and buttons. As an ISP they're a bit pricey, but for email hosting they're cheap.

One thing that was really buried in that article was this bit:

> At some point your IP range is bound to be banned, either by one asshole IP neighbor sending spam, one of your users being pwned [emphasis mine], due to arbitrary reasons, by mistake, it doesn't matter. It's not if, it's when.

In other words, at least some of the time, the one of his users' accounts had been compromised, and as a result, his servers were actually sending out spam. But rather than take responsibility for detecting and blocking outgoing spam on his own servers, he's blaming The System for doing exactly what it was meant to do.

This exact thing happened to me. A test account I created with a weak password that I should have deleted but forgot about got pwned. I have spam detection in place and within an hour I disabled that account. But that was enough to send over 30,000 spam emails, and then your IP reputation is gone for a very long time.

The point being that outgoing spam detection won't save you, by the time you are pwned it's too late.

My solution is to have a script that scans the mail server log files and aggressively block ips of failed authentication attempts that are not quickly followed by a successful authentication attempt, and get immediate notification when there is a successful authentication attempt from an unexpected country (I think it's not the same bot that scans for vulnerable accounts and sends spam so you have maybe an hour to react).

That works well for a small user base.

That sounds interesting, could you share the script?

I've encountered a few obvious login attempts like that, but since they come from a broad pool of IPs it's not something fail2ban can easily handle without collateral damage.

It’s parsing smartermail logs which have a kind of funky format and the script quite tied to my setup (I have a central IP ban list because I also momitor non mail related protocols on multiple machines), so not sure it would be very useful to someone else.

What I find so baffling is that these experiences do not match my own at all.

I've been running a non-profit ISP for about 23 years with a few friends. We've always been doing this from our own IP Space (/20) in RIPE. Even when we had problems sending spam (compromised user accounts, compromised php websites) and we ended up on a blacklist, we usually could get removed pretty fast.

For a few years our mail system would sometimes generate late-bounces, that is accept a mail on the incoming MX only to then figure out that it actually cannot be delivered later on and generate a delivery failure notification mail. Not a good situation.

That got us into some trouble here and there. But even that could easily be unblocked again.

When we finally managed to set up a new mail infrastructure (2 year project cause it's a hobby) we set up new outgoing SMTP servers which cycle through multiple IP addresses. There was exactly one ISP (Deutsche Telekom T-Online) that was not accepting mail from some of these IPs. One mail and a turnaround time of abour 12hrs later this was fixed. Gmail or Hotmail/live.com/Outlook never had any problems with deliverability. Even with a few users forwarding all their email to their gmail accounts including the spam that slips through our filters. That might mean that a single mail would not be deliverd, but other users never suffered as our outgoing IPs are not being blanket-banned.

There's one residential ADSL provider that has a blanket ban on one of our outgoing IPs. There's no way to get that resolved because their mail infrastructure is unmaintained and nobody is reading their mail. Common problem with that one ADSL provider, googling their name shows other people have the same problem. shrug We just use a different outgoing IP for them.

No DMARK or DKIM setup at all for outgoing mail.

So I wonder, what really makes the difference in experience? Is it just the fact that we have a decent sized IPv4 Network in our name as PI space?

Ipv6 to the rescue with one IPv6 per email account in a /64?

:)