Gilles Chehade, an OpenSMTPD developer, writes about running mail servers, OpenSMTPD internals, spam filtering, and OpenBSD.
HN commenters recommend his posts as a rebuttal to the 'mail is hard' claim, as a mail server setup guide, and for his OpenSMTPD advisory postmortem.
I haven't used DCC, but it looks like an interesting anti-spam toolkit:
https://www.dcc-servers.net/dcc/
It appears to support "weak" IP matching:
> All or part of the IP address of the SMTP client can be optionally ignored by DCC clients as far as the greylist triple is concerned. This feature may be useful for legitimate mail systems that shuffle messages among SMTP clients between retransmissions. See the dccm and dccd man pages.
https://www.dcc-servers.net/dcc/greylist.shtml
It doesn't quite sound like it does a job of 100% "same email, same sender, different mx in same domain" -but I suspect it works well enough in practice?
> Usually the DCC greylist system requires that an almost identical copy of the message be retransmitted during the embargo. If weak-body is present, any message with the same triple of sender IP address, sender mail address, and target mail address ends the em-bargo, even if the body of the message differs.
> If weak-IP is present, all mail from an SMTP client at an IP address is accept after any message from the same IP address has been ac-cepted.
https://www.dcc-servers.net/dcc/dcc-tree/dccd.html#OPTION-G
I can't recall what I used for greylisting last -possibly greylistd.
Anyway, the smart play these days might be to whitelist/greylist via SPF - I'm not sure if spammers (of the variant caught by greylists) generally have…
I used to run Postfix + Dovecot + Rspamd with all the bells and whistles enabled [1], but I recently switched to OpenSMTPD + spamd on OpenBSD.
Unlike rspamd, which has pluggable modules for everything under the sun (RBLs, word filters, Bayesian filtering + learning), spamd uses plain ol' graylisting with some PF integration to throttle spammers connections to 1 character/second for maximum annoyance.
With Rspamd, I never got any spam in my Inbox. With spamd, I get maybe 1 spam mail every two weeks. To me, spamd's ridiculous simplicity is worth the tradeoff.
You do have to be careful with graylisting large mailers like Gmail, since they rarely retry the mail from the same IP address. For this, OpenBSD's smtpctl now has the spfwalk [2] command to whitelist the big guys. That's what I use in my current setup [3], which was linked here a few days ago.
[1] https://www.c0ffee.net/blog/mail-server-guide/
[2] https://poolp.org/posts/2018-01-08/spfwalk/
[3] https://github.com/cullum/dank-selfhosted
Chip in with a couple of friends who might be on the lookout for a gmail/proton/whatever alternative as well, get an OpenBSD VPS at 1984 Hosting, C*ckbox, FlokiNET, or basically any other hoster that allows communication via port 25 and set up OpenSMTPd and Dovecot. There are plenty[0] write-ups[1] on how to do so in case you need info.
[0] https://poolp.org/posts/2019-08-30/you-should-not-run-your-mail-server-because-mail-is-hard/
[1] https://karchnu.fr/posts/2020-09-17-certificate-smtp-imap-antispam.html
OpenSMTPD is the right answer if you want a general purpose mail server [1] that is secure by default. [2]
[1]: https://poolp.org/posts/2021-01-31/january-2021-opensmtpd-libtls-conversion-and-unix-domain-sockets-support-noosmtpd/
[2]: https://www.openbsd.org/security.html
Hello,
Main developer from the OpenSMTPD project here.
I also wrote an article a few weeks ago about running your own mail server which is located here:
https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-dovecot-and-rspamd/#begintech
The postmortem is worth reading:
https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissected/
It's worth reading through the systemic mitigations that would make a clone of this bug impossible in the future.