<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><blockquote type="cite" class=""><div class="">On Feb 19, 2018, at 1:18 PM, doug moen <<a href="mailto:doug@moens.org" class="">doug@moens.org</a>> wrote:</div><div class=""><div dir="ltr" class="">One of the things you need for an email server is a high quality IP address that won't be blacklisted by DNS black hole spam filtering. Most of my spam is rejected based on the IP address. So you need to own a static IP address, and establish a high reputation for it. That might be hard if the IP address lives in a bad neighbourhood, eg a residential IP block, or maybe even a cloud VPS block.</div></div></blockquote></div><br class=""><div class="">I’ve run my own email server since 2001 (used to be qmail, but for the last decade at least it’s been postfix). I do a very light spam filtering, but am religious about keeping my IPs squeaky clean to avoid blacklists.</div><div class=""><br class=""></div><div class="">For almost that entire time I’ve been using colocated server space from Mark Steffen (local guy, hangs out on this list too) and in the most recent incarnation as colocated space with his Indieserve networks company.</div><div class=""><br class=""></div><div class="">The only time I’ve had issues with blacklists has been when I’ve messed something up. As far as “IP neighbourhoods” goes, Mark runs a pretty tight ship. I’m happy to recommend his network for your VPS or colocation needs.</div><div class=""><br class=""></div><div class="">Other things which go a long way to preventing your domain from getting blacklisted involve basic good netizen things:</div><div class="">* have a reverse IP mapping set up correctly and matching your SMTP server banner</div><div class="">* have correct (and tight) SPF DNS entries</div><div class=""><br class=""></div><div class="">As far as how I limit my own exposure to spam in postfix:</div><div class="">Obvious things for smtpd_sender_restrictions:</div><div class="">* tighten up relay_domains and relay_networks</div><div class="">* use basic helo_checks as low-cost rejection</div><div class="">* refuse_unknown_sender_domain</div><div class=""><br class=""></div><div class="">Less obvious things for smtpd_sender_restrictions:</div><div class="">* reject_non_fqdn_sender</div><div class="">* reject_invalid_hostname</div><div class=""><br class=""></div><div class="">and for smtpd_recipient_restrictions:</div><div class="">* basic helo_checks</div><div class="">* basic client_checks</div><div class="">* reject_unauth_destination</div><div class="">* reject_invalid_hostname</div><div class="">* reject_non_fqdn_hostname</div><div class="">* reject_non_fqdn_sender</div><div class="">* reject_non_fqdn_recipient</div><div class="">* reject_unknown_sender_domain</div><div class="">* reject_unknown_recipient_domain</div><div class="">* reject_rbl_client <a href="http://zen.spamhaus.org" class="">zen.spamhaus.org</a></div><div class=""><div class="">* reject_unauth_pipelining</div></div><div class=""><br class=""></div><div class="">As you can see, I’m only using one RBL. spamhaus is pretty reliable and they don’t have a hair-trigger <span class="">anaphylactic</span><span class=""> reaction to an individual spam report from some random internet user like other lists.</span></div><div class=""><span class=""><br class=""></span></div><div class="">The basic helo_checks and sender/client checks just reject mail outright if the server contacting me claims to be <a href="http://mixdown.ca" class="">mixdown.ca</a> or localhost, or if they claim to be coming from an RFC1918 IP space.</div><div class=""><br class=""></div><div class="">Also recommended, but probably doesn’t do anything for spam is to set up SSL/TLS and tighten up the acceptable ciphers/hashes. I did the same for my web server and that took a LOT of tweaking and testing to get the A+ ratings from the various online checkers. I’d also recommend obfuscating the SMTP software banner so help prevent people from targeting specific attacks against your software, should anything subtle show up before you read about it and fix it.</div><div class=""><br class=""></div><div class="">For email, <a href="http://mxtoolbox.com" class="">mxtoolbox.com</a> is pretty good. They’ll also do blacklist checks.</div><div class=""><br class=""></div><div class="">-A.</div><div class=""><br class=""></div></body></html>