[mrmekon]

In my experience, spam blacklists have significantly decreased in efficiency over the last 10 years. I think the biggest e-mail providers stopped contributing to them, so the user-reported lists are almost unused. The honeypot lists lag behind the spammers by a few days, so plenty slip through. They do trim out 85% of my incoming spam, but that last 15% is still a lot. Back in ~2013 they cut out more like 99%.

Today, the single most effective thing you can do if you run your own mail server is to completely block all gTLDs. Screw 'em, they are 99.9999% spam.

Plenty of spam has valid SPF and DKIM records. They are sent through legit services, either through cracked credentials of real users or rotating through new accounts.

It also doesn't seem like anybody cares about abuse@/spam@ reports anymore...

[interfixus]

> completely block all gTLDs. Screw 'em, they are 99.9999% spam

[citation urgently needed]

Anyway, in my own experience with many years of self-hosting mail - until giving up and going Fastmail a couple of years ago - the real problems were in sending. No matter what rigorous level of DKIM'ing and ip-hygiene and whatnot, Google and Microsoft - Microsoft to a grotesque degree - would randomly ditch incoming mails from my server. Would sometimes happen in the middle of a conversation thread, and for the most part without warning. The kind of person using Hotmail is typically not someone you can convince that the error lies in his end.

[mrmekon]

> completely block all gTLDs. Screw 'em, they are 99.9999% spam

That's for _my_ e-mail. Your experience may differ. Perhaps you communicate often with people on .loan domains.

E-mailing Microsoft accounts is just not an option. They have no process for fixing incorrectly blocked IPs. I take the same approach with Microsoft as with gTLDs...

Never had a problem with any other mail provider. Google has never blocked or spam-holed me.

[spc476]

Three years ago I investigated the effectiveness of some realtime black lists (RBL) [1]. I didn't find it worth implementing.

I also looked into the result of SPF [2] and again, found it not worth implementing. I rechecked the results for SPF earlier this year [3] and the results were the same.

[1] http://boston.conman.org/2015/05/11.1

[2] http://boston.conman.org/2015/04/12.1

[3] http://boston.conman.org/2018/01/10.1

[detaro]

I assume you mean "new gTLDs", or are you seriously blocking .com/.org/.net?

[megous]

You can get far by blocking national domains like mx, ua, br, etc. If you're not expecting email from residents of said countries.

[bluedino]

Spam filtering is no better than it was 10 years ago.