Hacker News new | ask | show | jobs
by outsomnia 1509 days ago
Incoming email is simple, MTAs have no problem at all delivering to residential IPs if that's what your MX says. So ideally you should run your own postfix + dovecot at your premises and point your MX to that. You have to take additional steps for sending email.

> would my custom domain be free from being marked by spam?

The receipient's mail service gets to choose if it thinks your email is spam, this will happen whatever your sending arrangements, outlook is not immune from sending spam and is no magic guarantee others will give it a free pass somehow.

Recipients score your email on a variety of characteristics, many of which are under your control. A major consideration is the sending netblock, eg, residential ADSL blocks are likely to be rejected or scored to hell. Garbage netblocks like linode with a terrible reputation likewise. A clean (no history of spamming) IP in a clean (reputable) netblock will be scored higher. You can look up sender reputations here, which is the service the big email providers use.

https://senderscore.org/

So to send your own mail, you should rent a dedicated server on your own IP, you can do this for $30/mo or so. All you need to run there is postfix + SASL auth to forward your (and only your) emails.

Then you must configure DKIM etc correctly and check your emails are validly signed, DKIM requires being able to add TXT fields to your DNS.

It's very possible to do this yourself securely after a bit of a learning curve and have it require minimal ongoing maintenance.

1 comments

I think $30 a month is high just for email. I do $5/month now and have been doing this for over 20 years on my domain. (It was more expensive in the past.)
Yes, you can do it on a VPS much cheaper.

But this is your outgoing email authorized by DKIM... an attacker can use it to take over most of your accounts via Forgot Password flow. I think it is a false economy to have that depend on a shared VM.

You don’t have to store your DKIM keys on the VPS. I keep my signing infrastructure local, and send outgoing mail over a WireGuard tunnel so it looks like it was sent from the VPS.