Experience shows that the walls will get taller and the moats will get deeper.
The solution is communications that are demonstrably not spam and not unwanted.
There have been lots of proposals to this effect but maybe you have to put up two cents in a crypto wallet, which the other person can claim if the mail is unwanted. If someone takes your two cents, you remove them from your lists ASAP. The receiver doesn't benefit meaningfully from the 2c so they are unlikely to claim it. The sender is only damaged if a lot of different people claim the 2 cents. Maybe a few domains are default whitelisted even if they don't put up 2 cents, to protect against entities that are important but would be frequently spite-claimed (IRS, courts, and other similar). If you use a provider that doesn't whitelist, fine, but you're going to miss those emails
Seems they are the disease not the cure
Lately I've also been getting a lot from compromised MS365 accounts.
What this is called is survivorship bias. The question I would ask is how much mail are you not seeing at all because it's dropped at the edge first thing because it's IP block listed?
Next, how much spam are you seeing from them because they and Google are the largest providers on Earth? Kind of like selecting a random person from the population in the US and going "look, it's a white guy". Yea, that's how statistics works.
Lastly, because the are good at blocking spam at the edge, then that's the last bastion of attack for spammers to put their efforts in if they want any return at all.
Self-hosting allows me to use a different receiving address for each entity I contact, so I also know exactly who put me on spam lists.
Anecdotes are not a great thing to run mail servers on, broad statistics are.
These entities communicate via plain old mail, that costs more than 2 cents already.
There is and it's the same as other protocols including proprietary ones - a sender address whitelist.
There's no proprietary protocol that solved spam either.
We have dozens of different ways to send E2EE messages to each other, with realtime publish-subscribe, and yet billions of dollars are spent trying to duct tape email. Who cares if Outlook/Gmail/Icloud use IMAP or Websocket? If the interface looks the same to the end user will they really care?
Experience shows that the walls will get taller and the moats will get deeper.
Protocols aren't proprietary by definition. It's a protocol. Anyone can implement it.
User signs up, uses @outlook. Your app declines it and explains that they block with no way to remedy, and explain they are a bad vendor.
Emails would be accepted by Outlook.com, but would never deliver. We had SPF/DKIM/DMARC and full reporting. They RBL'ed us with no remedy.
We told the customer to not use outlook.com BECAUSE we told them we could not guarantee any delivery of messages.
At the most you need to use an external service for delivery (usually because you have problems with MS) but you can still run your own server with no difficulties once you do that.
That said, DMARC is required by a lot of people now, so I do not think this particular issue is a problem.
I have been self hosting my my personal email (and for family). Few problems so far other than delivery to MS and I have recently moved a domain I use for work email over.
Oddly enough the MS problems come from hotmail, but not other services. If that is a problem, then pay a bit to have email delivered.
Means you're not using your email seriously. For example, to send CVs in response to job postings.
I send up to 20 email per day to people who have issues with their package build scripts, and I have no idea whether they ignore me because they stopped using the distro or because mail got dropped.
You should be able to see this on your DMARC dashboard
The people working on outlook.com are just talentless amateurs - the rest knows how to do it right. It's a shame it's so widely used.
Most of them wouldn't even care probably...
What about tencent.com, foxmail.com, or qq.com?
Fortunate for those running their own servers is that they actually still get all the cool emails from people not complying.
I haven’t productionized this setup (I send maybe a dozen emails a year) but it worked for me a couple years back, when I had to send a mail to an Outlook-hosted address and they blackholed everything I tried to send while 250 OKing me.
It's always people self-hosting mail on a shared server in Moldova (because they think it makes them cool) that are complaining.
https://www.mimar.rs/blog/a-journey-of-my-mx-server-to-new-r...
And yes, it's cool not to have to let scum read your private communications :D
Which with cheap models like Jev as spam classifiers, this can now become a reality.
The problem is, Google and Microsoft have monopolized the entire email market, so their esoteric deliverability mysticism from 2007 still persists.
Email naturally followed this evolution.
I've never even had the key to mine. I've lived here over a decade.
You shouldn't own your car or your house, give them to all the corporations as well.
As soon as you want to do business with Outlook's customers, you play by their rules.
"They're allowed to do it" is one of those things that doesn't really bear saying so much because that's already been implicitly established. Nobody is claiming what they're doing is illegal, so how does this add anything?
That seems to be turning into "you spend money to another corporation that we trust".
This is also true for like 99% of the landmass of America.
Switch Moldova to almost any country (or even a state that isn't California or Washington), and it's the same story everywhere
With LLMs on the other side trying to make spam less detectable by cheap models like Jev?
It's funny when people assume benefits from some tech go one way and baddies will surely never use it...
I ran a SaaS up until recently. Emailing users notifications for events was just a normal part of the app. Users got upset when the emails didn't come through. So then I had to be email tech support for something I had no control over. Lovely.
It turns out that whoever has the most power is the most powerful. This is why distributed/decentralized systems cannot singlehandedly free us from tyranny, and why I find people who spend all their time preaching decentralized systems to be quite silly. We don't need better systems (well maybe we do but,,,), we need better education and awareness of how billionaires manipulate us; this goes beyond software.
Mail, then emails, then home phones, then cell phones, then texts, then social media have been gradually rendered less and less usable by bad actors systematically abusing every single tool we try to use to communicate with one another to steal from us, lie to us, and manipulate our beliefs, and we'll just keep inventing and discarding new ways of communicating until we reckon with this.
The only question is how many years the lazy big tech network-effects monopolies (like Google and Microsoft) will hold this back from happening.
The optimist in me says this will unlock pathways to true decentralization of push communication protocols (like SMTP) instead of only have decentralization of pull-oriented protocols (like HTTP).
AI becoming faster empowers attackers far more than it empowers defenders. We're seeing this in every discipline and every corner of the software industry.
I'll never pay for email so your options are either outlook or Gmail and I don't trust Google.
But we won't.
So that people would vote for the government to manipulate them instead?
Honestly, I hate outlook as much as you do, but I'd still prefer it to Max
Selfhosted email is likely easier now than it ever was before.
Oh man, please tag me if you're ever the lead on any project so I know to stay far away from it.
This is not Microsoft's fault. The building's on fire and they're locking out the arsonists.
I was working for Microsoft when outlook.com launched and got a good email address that was my primary for more than a decade.
I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites that I finally gave up, reversed the stream, and had Outlook forward to GMail instead of vice versa. A few months after that, I realized that all my Outlook got was an enormous volume (hundreds of day) a spam and that all legitimate mail was going to my other accounts, so I turned it off entirely and haven't read that mailbox in over a year.
This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.
Add in the fact that you're almost certainly not the only one impacted, and that they have no interest in fixing it, it screams incompetence on the source's part.
> and had Outlook forward to GMail
Till the day GMail hits you with the "We couldn't verify it's you" bullshit and locks you out of your account forever. Good luck getting support from Google, the word is not in their lexicon.
I've never encountered this issue with GMail. Delivery just works.
This is also true of Microsoft though.
Wait until this guy realizes that all spam these days comes from Azure ASNs, and abuses cross-tenant issues as well as a simple "Fwd: ..." and "Re: ..." tricks to bypass Microsoft Outlook spam filters.
Stop being so ignorant
Four hours later, I got the same message by email. I thought he was back - nope. An email sent at 10am that was delivered at 4pm showed it was from 2pm until I looked at the header and saw sent at 10am and just... chilling out for 4 hours. DMARC was set up for them just fine.
I've had the same issue with my own custom domain, with DMARC set up. A year later, it finally got bumped up to some sort of "trusted" domain for that one place and my emails get delivered the same day now.
Mildly infuriating for emails containing OTP codes "valid for 10 minutes".
Yes, no one should not have DKIM or DMARC but holy yikes when neither side wants to actually give in to help the customer.
Based on my broad experience, I’d comfortably rank Microsoft as the worst of the major email providers. (I am owner poste.io)
Yes, that may turn some users away, but they would complain and leave anyway, because they don't receive emails from your server. On the other hand, that's how one can contribute to unwinding ms's share of email accounts.
I bet Microsoft is single-handedly responsible for 80+% of complaints about email being impossible to host.
In a federated / pseudo-decentralized network, any provider with 10+% of captive users has an outsized leverage on the entire ecosystem. You don't need a monopoly; as long as you have a monopoly on just a few users that others absolutely need to be able to interact with, you can dictate terms to everybody.
They are the reason I dropped self-hosting my mails. They were silently dropping some of my mails depending on the day I sent them. If they were at least sent to the spam folder, it would be easier to communicate with their users. And since a lot of their users are not technical at all, it's complicated to explain them the issue.
I wish I could just wholesale block gmail.com like people used to do with the early webmail providers.
I think that implies having an actual google account to do that, which is absurd.
It's absurd in every way. I was trying to get it to stop spamming maillist traffic. It's impossible. Global level filters enacted as admin to not spam check are ignored.
It should be the other way around though.. More people should run their own mail servers so that centralized players cannot control what should be a decentralized communication protocol.
This plan relies on a meaningful number of people voluntarily switching to a setup that requires more expertise and effort for a worse experience in the hopes that eventually large corporations will take notice. That seems like it is unlikely to be successful.
I suspect that if the Europeans or Californians don't force email interop via regulations, it will eventually be an open standard in name only.
Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
On the other hand rejecting domains without dmarc is fine. Just not happy it is silent.