Why are we so willingly ceding one of the few widely used free and open protocols to a handful of $mega-billion providers?

Experience shows that the walls will get taller and the moats will get deeper.

Because the noise is so loud now that people are basically just coping with the stresses of work life by taking the easy path in the home life.

Because the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and someone you'd want to interact with. If the big providers weren't doing this stuff, we'd whine about the enormous amount of spam.

The solution is communications that are demonstrably not spam and not unwanted.

There have been lots of proposals to this effect but maybe you have to put up two cents in a crypto wallet, which the other person can claim if the mail is unwanted. If someone takes your two cents, you remove them from your lists ASAP. The receiver doesn't benefit meaningfully from the 2c so they are unlikely to claim it. The sender is only damaged if a lot of different people claim the 2 cents. Maybe a few domains are default whitelisted even if they don't put up 2 cents, to protect against entities that are important but would be frequently spite-claimed (IRS, courts, and other similar). If you use a provider that doesn't whitelist, fine, but you're going to miss those emails

Nearly all the spam I get has an email address from those providers.

Seems they are the disease not the cure

Mine isn't from those email hosts, but it from google cloud or Azure typically (not AWS for whatever reason). Related, the gmail spam filter is terrible.

>Related, the gmail spam filter is terrible. It seems insane that gmail doesnt provide a way to automatically send a mail (eg based on domain, keywords, etc) to spam. I know theres block sender but for example aliexpress uses a different name for every email so that's useless.

Most of my spam is from gmail addresses. Why Google hasn't figured out how to stop the fake Norton renewal notices is just mind-boggling.

Lately I've also been getting a lot from compromised MS365 accounts.

I think you misunderstand the disease.

What this is called is survivorship bias. The question I would ask is how much mail are you not seeing at all because it's dropped at the edge first thing because it's IP block listed?

Next, how much spam are you seeing from them because they and Google are the largest providers on Earth? Kind of like selecting a random person from the population in the US and going "look, it's a white guy". Yea, that's how statistics works.

Lastly, because the are good at blocking spam at the edge, then that's the last bastion of attack for spammers to put their efforts in if they want any return at all.

Sorry but bastions are defensive.

I self-host and don't have a spam filter. Spam makes up about 1 in 5 messages I receive. It's always the same spam campaigns that would be easily filtered with a few regexes.

Self-hosting allows me to use a different receiving address for each entity I contact, so I also know exactly who put me on spam lists.

It's been a while since I've been an SMTP server admin but when I was I managed a few hundred thousand mailboxes under different domains. Most likely know one knows about your domain and it has little traffic. On average I saw users domains get around 5 spam to 1 ham. Of course you have outliers. I had one domain that received around 1000 spam to 1 ham. That was a domain that looked like it could belong to a university and it got absolutely flooded.

Anecdotes are not a great thing to run mail servers on, broad statistics are.

I'm the sysadmin at my company and we regularly get emails spoofing our own addresses! It's wild that Microsoft can't even protect customers when they have all the info to do so.

> frequently spite-claimed (IRS, courts, and other similar)

These entities communicate via plain old mail, that costs more than 2 cents already.

Spam is a super solved problem though and I'd rather have false negative spam than email oligarchy.

> the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with.

There is and it's the same as other protocols including proprietary ones - a sender address whitelist.

There's no proprietary protocol that solved spam either.

A web forum's users, who love nothing more than using the "flag" button to stomp out comments they don't like, are indignant upon discovering the world's third largest email provider has a "flag" button of their own.

Third? What's second, Yahoo? I know Gmail is first.

The irony is that if more people started to self host again, especially jogger companies, the problem like one exemplified by this post would be solved quickly.

why do we cling on to the email protocol at all?

We have dozens of different ways to send E2EE messages to each other, with realtime publish-subscribe, and yet billions of dollars are spent trying to duct tape email. Who cares if Outlook/Gmail/Icloud use IMAP or Websocket? If the interface looks the same to the end user will they really care?

Why are we so willingly ceding one of the few widely used free and open protocols to replace it with incompatible proprietary ones that don't interoperate?

Experience shows that the walls will get taller and the moats will get deeper.

So free and open that open source email clients/servers are the most popular and widely used /s.

Protocols aren't proprietary by definition. It's a protocol. Anyone can implement it.

I'm not! Hosted my email since the 1990's, don't plan too stop. I do use the big services too but not giving my ability to use my own server.

Alt take: Using a Microsoft-hosted email service is a big mistake in 2026...

That may be so, but you can't control what mail service your recipients use. So whether or not it's a bad idea, it can be your problem. That said I don't agree with OP that self-hosting mail is a bad idea.

Yes you can.

User signs up, uses @outlook. Your app declines it and explains that they block with no way to remedy, and explain they are a bad vendor.

Deeply unserious take.

As unserious as you claim, we had this exact problem.

Emails would be accepted by Outlook.com, but would never deliver. We had SPF/DKIM/DMARC and full reporting. They RBL'ed us with no remedy.

We told the customer to not use outlook.com BECAUSE we told them we could not guarantee any delivery of messages.

Seems to work for many websites. But only if your users aren't giving you money, because it's 50/50 whether they'll use a different email address or give up entirely.

Lol if you do that, your service is just going to have a small minority of people and most people will just not bother using your app/service entirely

Most people aren't using Outlook. If your users mostly are, then this solution doesn't work for you. But it does work for many people.

Sure, and the same is true from the recipient point of view: If you miss important emails because you are using a MS hosted server, it becomes your problem.

Why?

At the most you need to use an external service for delivery (usually because you have problems with MS) but you can still run your own server with no difficulties once you do that.

That said, DMARC is required by a lot of people now, so I do not think this particular issue is a problem.

I have been self hosting my my personal email (and for family). Few problems so far other than delivery to MS and I have recently moved a domain I use for work email over.

Oddly enough the MS problems come from hotmail, but not other services. If that is a problem, then pay a bit to have email delivered.

It's not enough. I have a domain that I had a very long time but it is on an undesirable tld. I got it long before it was problematic. Outlook always puts my mail in the SPAM folder even though I have done everything I could. I even deliver through a trusted provider. Not on any spam list. DMARC, DKIM, SPF all set up. No dice.

I've never had a problem not having dmarc. DMARC doesn't really mean anything. The security comes from DKIM (or SPF, but that's garbage)

Proudly self-hosting since 2001. My mail server is in my basement. Do not know what you are talking about.

How often would you be able to detect acceptance-but-non-delivery of your emails to office.com-hosted emails?

Always? If emails are not answered you'll usually notice unless you're a Spammer

MS live/hotmail/outlook would silently drop - although not for this DMARC, that gets a straight bounce.

>Always? If emails are not answered you'll usually notice unless you're a Spammer

Means you're not using your email seriously. For example, to send CVs in response to job postings.

I send up to 20 email per day to people who have issues with their package build scripts, and I have no idea whether they ignore me because they stopped using the distro or because mail got dropped.

Does it ever get silently dropped or just filed straight in their spam folder?

Silently dropped in my case.. that’s why I stopped self-hosting. Email hosting is sadly now a cartel

And that happens even with DKIM and SPF correctly set-up?

> How often would you be able to detect acceptance-but-non-delivery of your emails to office.com-hosted emails?

You should be able to see this on your DMARC dashboard

Now watch the goal post moving at light speed. This site is by business for business. They can't stand self hosting. Saas or bust. No matter how much time you spend demonstrating the opposite the next time someone mentions email they'll get a backlash. It's mind boggling how it plays out the same every single time. But give them a saas that returns the next integer for $19.99/month and that "creator" will be praised for their hard work. :)

No, it isn't. You're just a coward.

Sounds more like using outlook.com is a mistake. I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with, and this is the only reason that I now send via Scaleway's free transactional email service.

The people working on outlook.com are just talentless amateurs - the rest knows how to do it right. It's a shame it's so widely used.

I don't disagree, but what are your options when a giant portion of the population uses O365 and outlook.com? How are you going to get them to stop using it, so that legit emails from user-owned servers are not silently rejected?

Most of them wouldn't even care probably...

I use a sending service. I would prefer not having to, but at least all inbound email goes directly to my server.

I've also been running my own server for over 20 years, but do note that the big players may block their senders from delivering mail to your server. This happened to me with GMail around 6-7 years ago, until I configured DMARC and/or DKIM and/or SPF to their liking. As far as I know, they don't do a press release when they update their rules.

I have a perfect score in google postmaster tools on dkim, spf and 0 spam reports. They still send all emails to spam. Same experience for my friend running an indie festival. These days you pretty much have to alert gmail users by some other means (like if signing up on a website) that they have to check spam and whitelist you since it appears gmail would rather block legit emails than allow a single possible spam through.

It depends on the nature of the transaction. If the user needs the email more than you do, you just remind them Outlook deletes your messages, and they'll find a way, and in the long term usage of Outlook will decrease.

>I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with

What about tencent.com, foxmail.com, or qq.com?

I still run my own server and do not use a relay service and do host on a cheap (free actually, OCI) VPS and other cheap VPS's before that since the 1990's. In that time only one big email service blocked my IP by a large block range, twice...Microsoft but by filing a support request here https://olcsupport.office.com/ both times, they resolved in in less than 2 days. The second incident was just in the last several days so the request does work.

This is what google and microsoft want the make you think for obvious reasons.

Fortunate for those running their own servers is that they actually still get all the cool emails from people not complying.

You can take my email server from my cold, dead hands.