Alternatives regarding email for VPS with bad reputation IP

wankel · March 29

Hi all,
During last year's memorable BF/CM/flash-deals festival, I snagged a (well, actually more than a single) nice deal from a (plural) well-regarded provider.

The VPS has been put to good use idling over the past few months, until I put a website/mailserver on it for my sister. Now it turns out the IPv4 that came with the server is "sub-optimal" for actual use; it (and the whole /24) is listed by SpamRATS.

The IP is not eligible for removal from SpamRATS, as it is on their "worst offenders list". The result is that mails from her server are bounced by major mail providers (and thus mostly anyone who doesn't run their own infrastructure won't receive her mails).

What are my options at this point?

The provider offers a new IP for a small fee, but that IP shares its subnet with suspected mass mailers / spammers. I fear a new IP will suffer the same fate before too long;
Use SMTP relay via another VPS. It probably involves some configuration on both sides; I haven't used SMTP relay for mail servers before;
Mix and match her domain on the VPS with a shared hosting account (I'm still holding on to MyW lifetime reseller package, looking seriously at @MichaelCee 's offers) and send mails through there;
Seeing OnePoundMail / MXroute mentioned, would that help out or is that a complete external mail solution?
Other options?

So far I may have been lucky with assigned IPs at various hosters, as this situation is new for me. Thank you for your input!

ahnlak · March 29

Option 4 is the most painless path - it's a fairly common use case, you can handle inbound through mailcow or whatever current setup you have, and use 1PM/MXR for outbound SMTP.

bingobangobongo · March 29

You could check out something like Mail Baby - it’s a relay service that’s IMO pretty reasonably priced.

This would give you the flexibility to run inbound and any specific features or setups yourself and then let someone else focussed on mail delivery handle outbound.

Mail delivery is hard. You will likely always struggle with things related for outbound. Ultimately let someone else handle it and focus on doing other fun/cool stuff with your VPS.

MXRoute or NameCrane are both great if you want to just hand off all things mail.

FrankZ · March 29

I've been using MXRoute for all my outbound mail via relay for 6+ years.
IMO Mail relay is the only way to go these days.

tetech · March 29

I run my own and have few problems, so to each his own!
I'd say NOT the option 1. Either 2 or 4 are OK.
Relaying via another VPS is pretty easy, but obviously you have to have a good "exit" IP.
Relaying outbound via MXroute will make it easier, but there start to be some interesting cases if you want to receive elsewhere and send to your own domain using MXroute, i.e. MXroute thinks it should be delivered to a local mailbox that doesn't exist.

rcy026 · March 29

@FrankZ said:
I've been using MXRoute for all my outbound mail via relay for 6+ years.
IMO Mail relay is the only way to go these days.

Same here, I use MXRoute to deliver mail from most of my vps's. It's just so much easier to set up a relay once and then you know it just works.

sanvit · March 29

@tetech said:
I run my own and have few problems, so to each his own!
I'd say NOT the option 1. Either 2 or 4 are OK.
Relaying via another VPS is pretty easy, but obviously you have to have a good "exit" IP.
Relaying outbound via MXroute will make it easier, but there start to be some interesting cases if you want to receive elsewhere and send to your own domain using MXroute, i.e. MXroute thinks it should be delivered to a local mailbox that doesn't exist.

There is a checkbox you can uncheck so that MXroute will always deliver to the set MX and not localhost. Forgot the name of the button though

emperor · March 29

@wankel said: Use SMTP relay

Just use this. Even with clean ip your email would end in spam till you build good ip reputation, so its not worth the hassle. My mail ip is clean but i choose to use MXRoute as relay only for that reason. Never looked back, mail is delivered always in inbox. You can use mail.baby, mxroute, amazon ses, etc there are a lot of free ones till 1000/3000 mails per month but you need to check reviews online which one's are good.

ahnlak · March 29

@tetech said:
I run my own and have few problems, so to each his own!
I'd say NOT the option 1. Either 2 or 4 are OK.
Relaying via another VPS is pretty easy, but obviously you have to have a good "exit" IP.
Relaying outbound via MXroute will make it easier, but there start to be some interesting cases if you want to receive elsewhere and send to your own domain using MXroute, i.e. MXroute thinks it should be delivered to a local mailbox that doesn't exist.

To that last point, there's a checkbox in MXroute to tell it not to try delivering it locally which solves that.

wankel · March 29

Thanks all for taking the trouble and reply so quickly!
MXroute -

@ahnlak said: (MXroute) is the most painless path
@FrankZ said: I've been using MXRoute (...) for 6+ years.
@tetech said: ... outbound via MXroute will make it easier ...
@rcy026 said: I use MXRoute to deliver mail from most of my vps's
@emperor said: i choose to use MXRoute as relay only for that reason. Never looked back

... that's quite unanimous !

I should have used an ordered list of course; options 1 (new IP) and 3 (use the mail functionality of a hosting package) are out. Option 2, 'roll your own',

@FrankZ said: IMO Mail relay is the only way to go these days.

vs

@tetech said: I run my own and have few problems, (...) Relaying via another VPS is pretty easy,

I'd hate to see the example of succesful, if trampled by unforseen spam, federated self hosted internet services being usurped by fewer and fewer gatekeepers, may they be US megacorporations or made-necessary middlemen.
One way (the only way?) to fight that fight is to stay relevant as the collective of self hosted mail servers by just existing; even if it is not the easiest way out.

So, SMTP relay via another VPS it is :-)

I'll be running Postfix on Debyan+Yunohost; to get me started, would any generic howto (eg, here) help me out?
The best option would be to 'just read the docs, understand and build from there', but if there are some caveats to take in account beforehand I'd be delighted to get some pointers!

emperor · March 29

@wankel said: So, SMTP relay via another VPS it is :-)

Option 3 could be same as SMTP relay, ex. Hostbrr cpanel use mail.baby and dr.server use mailchannels. You can add domain in cpanel and setup on either of this 1 email per domain and use that one as relay. OFC login for the relay would be shared host ip instead mailbaby/mailchannels

tetech · March 29

For relaying via another VPS, you should have something like this on the clients:

smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = verify
smtp_tls_CAfile = /etc/ssl/certs/ca-chain.pem
relayhost = [smtp.example.com]:587

In the sasl_passwd:

[smtp.example.com]:587 username:secretpassword

Run postmap sasl_passwd when you change it to generate a lmdb file.

On the relay it is something like:

smtpd_sasl_auth_enable=yes
smtpd_tls_security_level=encrypt
smtpd_tls_auth_only=yes
smtpd_tls_key_file=/etc/postfix/ssl/smtp.example.com.key
smtpd_tls_cert_file=/etc/postfix/ssl/smtp.example.com.crt
smtpd_tls_CAfile=/etc/postfix/ssl/ca-chain.cert.pem
smtpd_etrn_restrictions=reject
smtpd_sasl_security_options = noanonymous
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unlisted_recipient, reject_unauth_destination, check_policy_service unix:private/policy

I use PAM, so /etc/pam.d/smtp:

#%PAM-1.0
auth       required     pam_userdb.so db=/etc/postfix/sasl_users
account    required     pam_userdb.so db=/etc/postfix/sasl_users

The format of sasl_users here is a bit different, with username and password on alternating lines:

username    
secretpassword

And put it into db format, e.g. db_load -T -t hash -n -f sasl_users sasl_users.db

Generate your own certificates or use LetsEncrypt; LetsEncrypt is better otherwise Microsoft complains.

This the part related to relay. The standard postfix stuff for SPF, DKIM or whatever should be done too. Maybe that gets you started.

alento · March 29

Why go to the trouble of relaying via another VPS when services such as this exist?
AnyMXRelay

wankel · March 29

@tetech said: For relaying via another VPS, you should have something like this on the clients:
(.. complete howto ..)

That is much more than 'some pointers', seems very doable. Thanks for taking the trouble!

vitobotta · March 29

I use Mailcow for email hosting but for delivery I use Zoho Zepto relay. Deliverability is amazing, never had a problem, and it's ridiculously cheap. I pay 2.50 euros per credit, where a credit expires in 6 months and it includes 10K emails. It's an unbeatable deal IMO.

emperor · March 29

@vitobotta said: It's an unbeatable deal IMO.

Are you using zepto for your company or for your private emails ? In the verify field you need to confirm that :
We only send transactional emails from ZeptoMail Ex: Welcome emails, Password reset emails, Invoice emails etc
So if you send personal mails from this they can suspend you or ?

vitobotta · March 29

@emperor said:

@vitobotta said: It's an unbeatable deal IMO.

Are you using zepto for your company or for your private emails ? In the verify field you need to confirm that :
We only send transactional emails from ZeptoMail Ex: Welcome emails, Password reset emails, Invoice emails etc
So if you send personal mails from this they can suspend you or ?

Private email. Anything that is not mass mailing/spam is fine.

DrNutella · March 30

I usually asks the hosts to change the IP and they do

FrankZ · March 30

@wankel said: So, SMTP relay via another VPS it is :-)

Just as a clarification to my previous statement. I only use MXRoute for relay, not for any inbound mail. I use a couple of VMs as inbound and relay mail servers. All mail from my other VMs go through these mail servers. As well as all inbound mail. My domain mail gets delivered locally and only outbound mail for non local domains get relayed. This keeps all those cron job and monitoring emails from going through MXRoute. I use Rocky Linux and sendmail for my mail servers, but tetech did a nice job laying things out for using Debian with postfix.

bjo · March 30

@FrankZ said:
IMO Mail relay is the only way to go these days.

No, I even send mail via a Hetzner VPS.

skorous · March 30

@FrankZ said:

I use Rocky Linux and sendmail for my mail servers, but tetech did a nice job laying things out for using Debian with postfix.

You've talked about being old before but I didn't realize it was "Still Using Sendmail"-old. ;-)

crunchbits · March 30

@FrankZ said:
I've been using MXRoute for all my outbound mail via relay for 6+ years.
IMO Mail relay is the only way to go these days.

It's just the reality of the situation these days. Especially when it isn't uncommon to just get a /24 slapped for one bad actor with a few IPs, and the admin time staying on top of all the various lists.

For the price, something like MXRoute or baby seems like an absolute no-brainer if your e-mails are important enough to notice when they don't arrive.

Alternatives regarding email for VPS with bad reputation IP

Comments