<div>This is attempt number two to send this. The Google Inbox mail interface isn't as mailing list friendly as Gmail.</div><div><br></div>Thank you very much Andrew that's very insightful I'll have to double<br>check what MAIB's defaults are. I know that they're way better defaults<br>then what ships via APT<br><br><div class="gmail_quote"><div dir="ltr">On Tue, Feb 20, 2018, 4:35 PM Bob B <<a href="mailto:bob@softscape.ca">bob@softscape.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I think you meant this to the list....<br>
<br>
> -----Original Message-----<br>
> From: Chamunks [mailto:<a href="mailto:chamunks@gmail.com" target="_blank">chamunks@gmail.com</a>]<br>
> Sent: Tuesday, February 20, 2018 3:34 PM<br>
> To: Bob B<br>
> Subject: Re: [kwlug-disc] So, I took the plunge... Mail In A Box<br>
><br>
> Thank you very much Andrew that's very insightful I'll have to double<br>
> check what MAIB's defaults are. I know that they're way better defaults<br>
> then what ships via APT<br>
><br>
><br>
> On Tue, Feb 20, 2018, 1:48 PM Bob B <<a href="mailto:bob@softscape.ca" target="_blank">bob@softscape.ca</a>> wrote:<br>
><br>
><br>
> Thanks for checking that. I must've mis-interpreted Teksavvy's<br>
> position on that then, oh well.<br>
><br>
> BB<br>
><br>
><br>
> > -----Original Message-----<br>
> > From: kwlug-disc [mailto:<a href="mailto:kwlug-disc-bounces@kwlug.org" target="_blank">kwlug-disc-bounces@kwlug.org</a>] On Behalf<br>
> Of<br>
> > Chamunks<br>
> > Sent: Tuesday, February 20, 2018 1:11 PM<br>
> > To: KWLUG discussion<br>
> > Subject: Re: [kwlug-disc] So, I took the plunge... Mail In A Box<br>
> ><br>
> > @bob, I've managed to telnet into Google's servers with my home<br>
> connection<br>
> > using a Teksavvy ppoe connection and static IP. I just wish that<br>
> the miab<br>
> > script would run on a raspberry pi I'd run it from home instead.<br>
> ><br>
> ><br>
> > On Mon, Feb 19, 2018, 10:21 PM Andrew Kohlsmith (mailing lists<br>
> account)<br>
> > <<a href="mailto:aklists@mixdown.ca" target="_blank">aklists@mixdown.ca</a>> wrote:<br>
> ><br>
> ><br>
> > On Feb 19, 2018, at 1:18 PM, doug moen<br>
> <<a href="mailto:doug@moens.org" target="_blank">doug@moens.org</a>> wrote:<br>
> > One of the things you need for an email server is a<br>
> high<br>
> > quality IP address that won't be blacklisted by DNS black hole<br>
> spam<br>
> > filtering. Most of my spam is rejected based on the IP address. So<br>
> you<br>
> > need to own a static IP address, and establish a high reputation<br>
> for it.<br>
> > That might be hard if the IP address lives in a bad neighbourhood,<br>
> eg a<br>
> > residential IP block, or maybe even a cloud VPS block.<br>
> ><br>
> ><br>
> > I’ve run my own email server since 2001 (used to be qmail,<br>
> but for<br>
> > the last decade at least it’s been postfix). I do a very light<br>
> spam<br>
> > filtering, but am religious about keeping my IPs squeaky clean to<br>
> avoid<br>
> > blacklists.<br>
> ><br>
> > For almost that entire time I’ve been using colocated server<br>
> space<br>
> > from Mark Steffen (local guy, hangs out on this list too) and in<br>
> the most<br>
> > recent incarnation as colocated space with his Indieserve networks<br>
> > company.<br>
> ><br>
> > The only time I’ve had issues with blacklists has been when<br>
> I’ve<br>
> > messed something up. As far as “IP neighbourhoods” goes, Mark runs<br>
> a<br>
> > pretty tight ship. I’m happy to recommend his network for your VPS<br>
> or<br>
> > colocation needs.<br>
> ><br>
> > Other things which go a long way to preventing your domain<br>
> from<br>
> > getting blacklisted involve basic good netizen things:<br>
> > * have a reverse IP mapping set up correctly and matching<br>
> your SMTP<br>
> > server banner<br>
> > * have correct (and tight) SPF DNS entries<br>
> ><br>
> > As far as how I limit my own exposure to spam in postfix:<br>
> > Obvious things for smtpd_sender_restrictions:<br>
> > * tighten up relay_domains and relay_networks<br>
> > * use basic helo_checks as low-cost rejection<br>
> > * refuse_unknown_sender_domain<br>
> ><br>
> > Less obvious things for smtpd_sender_restrictions:<br>
> > * reject_non_fqdn_sender<br>
> > * reject_invalid_hostname<br>
> ><br>
> > and for smtpd_recipient_restrictions:<br>
> > * basic helo_checks<br>
> > * basic client_checks<br>
> > * reject_unauth_destination<br>
> > * reject_invalid_hostname<br>
> > * reject_non_fqdn_hostname<br>
> > * reject_non_fqdn_sender<br>
> > * reject_non_fqdn_recipient<br>
> > * reject_unknown_sender_domain<br>
> > * reject_unknown_recipient_domain<br>
> > * reject_rbl_client <a href="http://zen.spamhaus.org" rel="noreferrer" target="_blank">zen.spamhaus.org</a><br>
> > * reject_unauth_pipelining<br>
> ><br>
> > As you can see, I’m only using one RBL. spamhaus is pretty<br>
> reliable<br>
> > and they don’t have a hair-trigger anaphylactic reaction to an<br>
> individual<br>
> > spam report from some random internet user like other lists.<br>
> ><br>
> ><br>
> > The basic helo_checks and sender/client checks just reject<br>
> mail<br>
> > outright if the server contacting me claims to be <a href="http://mixdown.ca" rel="noreferrer" target="_blank">mixdown.ca</a> or<br>
> localhost,<br>
> > or if they claim to be coming from an RFC1918 IP space.<br>
> ><br>
> > Also recommended, but probably doesn’t do anything for spam<br>
> is to<br>
> > set up SSL/TLS and tighten up the acceptable ciphers/hashes. I did<br>
> the<br>
> > same for my web server and that took a LOT of tweaking and testing<br>
> to get<br>
> > the A+ ratings from the various online checkers. I’d also<br>
> recommend<br>
> > obfuscating the SMTP software banner so help prevent people from<br>
> targeting<br>
> > specific attacks against your software, should anything subtle<br>
> show up<br>
> > before you read about it and fix it.<br>
> ><br>
> > For email, <a href="http://mxtoolbox.com" rel="noreferrer" target="_blank">mxtoolbox.com</a> is pretty good. They’ll also do<br>
> blacklist<br>
> > checks.<br>
> ><br>
> > -A.<br>
> ><br>
> > _______________________________________________<br>
> > kwlug-disc mailing list<br>
> > <a href="mailto:kwlug-disc@kwlug.org" target="_blank">kwlug-disc@kwlug.org</a><br>
> > <a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" rel="noreferrer" target="_blank">http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org</a><br>
> ><br>
><br>
><br>
><br>
<br>
<br>
</blockquote></div>