I wish they'd gone into a bit more detail about the issues they had, where they hosted, how they tried to fix their ip reputation, which providers blocked them, etc.
I've experienced the same issues in the past, but didn't find any of the insurmountable.
Though admittedly mine is more 'small business' than 'self-hosted', so I can afford to buy a small IP block and run on dedicated hardware.
And this is happening after SPF, DKIM and DMARC provided a solution to the spam problem.
Any mail system can remove practically all spam by insisting messages conform to those three standards
But that is not true at all. Spammers can easily send mail with all proper SPF, DKIM and DMARC records and signatures. A lot of spam is and will be sent like that. Those extensions do not make spam impossible, they just make it easier to track and block.
But this does not change the point of the article – in this case it is a specific domain sending very specific non-spam messages. SPF/DKIM/DMARC prove it is not someone else – GMail has no ground for blocking these (unless were are not told something).
And GMail has been breaking mail for years now. E.g. I hate them for breaking message threading by ignoring threading headers and forcing own view on how messages should be grouped.
How does one send a spam email that passes SPF and DKIM if one doesn't have access to the DKIM private key, or the DNS server to edit the SPF or DKIM records?
You can't... But you can register a domain and set up your own DKIM key and DNS records and then use it to send spam (until you get blacklisted, anyway). There's a cost to doing that, though, so it's less appealing.
Anyone know a decent alternative at a reasonable price though? What if I have an @gmail today, and I want to move my storage elsewhere and have that just forward?
I feel like step 1 is just buying a domain so you can have control over your e-mail address, and then you can switch providers whenever you want (or host it yourself).
If you already pay for extra iCloud storage you can use a custom domain for e-mail with iCloud... Many people are already paying for this, and if not it's only $1/mo. Apple's still a pretty big e-mail provider, so maybe that doesn't address all of your concerns, but it's a really cheap way to use a custom domain that more people should take advantage of imo.
I host my own e-mail and it's pretty care free these days (I don't send bulk e-mails, though, so I don't contend with rate limits at all). Honestly, more people should do it instead of buying into all of the fearmongering about e-mail... It's a little tricky to set up right, but the impossibleness of the situation is somewhat exaggerated. The best defense for self-hosted e-mail is if more people actually do it... Otherwise you're just capitulating to the large (and slightly less large) mail providers.
+1 on having your own domain. I was using gmail for a long time, and recently switched to my hosting provider’s included-with-purchase email. Having my own domain made the move transparent to everyone, and relatively painless.
My recommendation for everyone is to use Fastmail and a custom domain.
Fastmail is extremely reliable, and since they charge money they also offer customer support. A few years ago I lost a lot of emails due to a client bug, and Fastmail support was very helpful recovering them from backup.
Use a custom domain so you can change providers in the future so you're not locked into your provider and can change if you aren't happy with them anymore.
I’m also using fastmail and I’m happy with them. Their native android email client is a little clunky but I still use it and I have the option to use other mail clients too.
You purchase your own domain through a provider like Porkbun or Namecheap, something like clover333.com
Then you pay for a service like Fastmail (you need at least the Standard plan for custom domains). And you setup Fastmail to use your custom domain as the address. There are various ways to handle this, but if you just do the simple approach and use Fastmail as the nameserver it's pretty straightforward.
Go to Namecheap (or similar) and buy a domain, then your email provider will give you two things to paste into their settings, and then shortly after that your custom domain will be online. It’s very easy.
Why use a custom domain? your email is the base of your digital identity and online security, owning your email is a huge improvement in security.
If you ever want to change email providers you can easily import your mail to any provider and you don’t have to update any websites or setup forwarding. You can also setup unlimited catch all emails.
The main example I point to is if you get banned from Google and use gmail then you lose access to all your accounts. Google has no customer service so you’re cooked if that happens. Or if you use your email through your ISP then you can never switch and they can charge you higher prices knowing this.
It isn’t all sunshine and rainbows, it’s more expensive, not all email providers allow custom domains and they may charge more for them, and you still need a secondary backup email in case you ever lose access to your domain.
There’s also the threat of someone scooping your domain, so buy it for a very long period with auto renewal enabled, transfer lock on, and WHOIS protection on. The threat is low but even Google has forgotten to renew their domains.
Any advice or hints on how to switch over? I wanted to do it years ago but I dread having to change my main mail address on everything, from apps, tools and games to bills or RL document-related stuff, it sounds like a horrible mess and ton of work
My recommendation (assuming you have a normal @gmail addy and not a custom domain like I had) would be to use email forwarding. So you can leave your Gmail as is, but set it up (in the settings) to automatically forward all your email to your new protonmail address. Then you can gradually change the important contacts/sites to your new email at your leisure.
I do highly recommend buying a domain and setting up your own email address though, it gives you a lot more portability going forward. You can actually do a lot with your own domain, and it helps you maintain trust better.
Anyway, enough preaching lol, protonmail also maintains a guide to help people switch: https://proton.me/easyswitch
They do, I have used them myself for years and have no complaints!
If you are setting up a forward/IMAP collection from Gmail though, be sure to set it to delete messages from Gmail after forwarding/collection. Any email you leave on a server longer than 30 days is classified "abandoned property" for the purposes of warrantless searches in the US (and if you're European using Gmail, this applies to you too), even if you're still actively accessing the email inbox.
Thanks for mentioning this provider. I've actually switched over now. You should ask for a referral fee :) After reading about it, I'm quite impressed with their implementation. It's very thorough.
If you're recommending setting up a forward/IMAP collection from a Gmail account, don't forget to mention deleting the messages from the server as well! Emails left on a server for more than 30 days are considered "abandoned property" for the purposes of warrantless search.
The most I could find is that the Electronic Communications Privacy Act allows for warrants to be issued for emails less than 180 days old. I've found vague references and snippets from articles no longer available that seem to claim some acts that have passed since then allow for simple subpoenas instead of full on warrants for said emails, but 180 days is the only threshold I've found and again, it's for less than 180 days that's at danger.
Can you describe what part? If it's the lack of IMAP it's because ProtonMail does not act as a typical mailbox. There's a nonzero chance you can lose all of your email (you need to lose access to your account and access to all of your devices at the same time). Your email is only "readable" at the time of transmission (ie when it's actively being sent or received). Your received emails (and copies of your sent email) are then one-way encrypted by Proton in your inbox. Your private key that can decrypt them is stored on Proton's servers, but that key is encrypted with your password and that password is only stored via one-way hash on their servers (you can see where a loss of access now becomes slightly possible). When your Proton client accesses the mailbox, it receives the content and decrypts it locally. Proton has absolutely zero ways of decrypting your email on their own. And their SMTP server does not save a copy of your emails in transit. This is why you'll see "zero access encryption data at rest" used in reference to Proton. Data at rest is basically data that is stored on an effectively "permanent"medium (ie not RAM, and there are caveats, but they're edge cases). So when your email is just sitting there (at rest), no one but you can read them. Proton can't even be forced legally to hand them over because they couldn't do so even if they wanted to. It's virtually the most secure email can be out of the box, aside from key management which is still really secure (them having even an encrypted version of your key makes it slightly more vulnerable). If you setup email encryption (ie, something like PGP or GPG), you can make it even more secure, but that has all the same caveats as it does elsewhere. The recipient needs your public key and you need their public key.
For those considering Proton Mail: There is one great benefit or disadvantage, depending on how you see it. As all traffic is encrypted, Proton Mail does not support standard IMAP or POP3. It's therefore best used with the official Proton Mail app rather than third party apps. On desktop, you can use your favourite email client (Thunderbird et al) only if you install a "bridge" which decrypts incoming emails before forwarding them to the client: this bridge is, in turn, only available to paying subscribers.
That said, it's a great service, and the fact that they have a viable business model which doesn't depend on selling out their users might be a good thing.
I presume ProtonMail markets this as a security feature? It guarantees your provider cannot sniff your email content and can’t be compelled to disclose user emails to law enforcement.
Proton is end-to-end encrypted - they don't have the keys themselves. With TLS, encryption is between you and the server, but the information can be decrypted on the server side.
I fail to see how the mails being encrypted stops them from using IMAP(s) like everyone else. IMAP doesn't care what the contents of the email it's sending/fetching are, and is perfectly compatible with other E2EE solutions like PGP/GPG which they say their solution is based on.
If IMAP is enabled on a provider, that provider can access your emails, unless you've encrypted the content of the email itself (with something like pgp or gpg). Proton only has access to emails in transit and after that, it can no longer access your email as it's entirely encrypted. Since Proton doesn't save the emails in transit, it has zero ability to provide those emails even if given an enforceable subpoena. Other providers that use IMAP can and do have access to your emails and can give them to a government authority if given an enforceable request.
The difference is the data at rest protocols on different providers. Proton has zero access encryption for data at rest. It only has access for data in transit and its ephemeral in that once it's done with that transaction, it no longer has that data.
They're not using a different protocol for delivery, they still use IMAP and SMTP, but other mail clients can't decrypt the message content from Proton because they don't have the keys (and nor do Proton). Proton do supply a "bridge" app if you want to use your Proton mail with a desktop email client, which handles the decryption between your computer and Proton by accessing the Proton encryption keys on your computer.
TLS is like a padlock on a box, and you have the key. Encrypted content is if the letter in the box is also written in code, needing another key to translate into plain language.
Proton doesn't use IMAP. Your inbox isn't quite like other internet mailboxes. You can't access it with TLS. You access it via normal TCP/IP traffic. The contents are encrypted and can only be decrypted on your device. This is why IMAP doesn't work. The Bridge acts as a Proton client, decrypts the data and then acts as a local IMAP server so you can connect to it via another IMAP client. Proton cannot read your email at any other time other than ephemerally at the moment it receives the email, which it then encrypts one way into your inbox. It cannot decrypt it. Only your devices can. Your devices get the private key from Proton's servers, but they're encrypted with your account password. So you grab the encrypted key and decrypt it locally on your device. It's not the most secure, but it's the most secure you can do without having to manage your own keys. It should be noted that you can possibly lose access to your email. This would require losing access to your physical devices and losing your password at the same time. As long as you have a device that has your key, you can restore access to your account which allows it to update the encryption on the key, etc. If you lose your physical devices and lose your password, you can only restore access to your account, but not any of your email up until that point.
Buy a custom domainname ($10-30 a year, do not use godaddy) and get a paid mail provider ($3-5 a month). Other commenters posted a few good ones. I like soverin.net
allow me to second proton mail. First they're in the EU, so fall under their privacy protection rules. Secondly, the service is technically an encrypted email service. They operate on a fremium basis, letting you have basic email for free, but also,if you upgrade, you can do lots of things (like they'll manage your email server if you happen to have a domain)
Sorry about that. I have Firefox on high security settings and it didn't give me any problems or I wouldn't have posted it. I was going to post the text for you but it's insecure for me too now.
Oh no worries, someone posted an archive link up there. I'm mostly curious why is it marked as insecure, thought it might be something with my local setup perhaps if it works for others. I'm also on FF, strict settings.
The term you’re looking for is ‘Horizontal Conduct’ and it’s illegal. The hard part of course is making that claim against the team of lawyers that Google would be able to field.
Yeah, I think this is done to provide the illusion of choice. The rate limits are high enough to allow personal emails through, but for any mass emails or corporate emails this forces you to use Google. Unfortunately a standard corporate strategy, it’s why corporate office suites are so generic and tend to be from one of the big companies.
This has been my observation as well. The lowest priority notifications from my exocortex use e-mail, and they don't seem to have any trouble getting through. I haven't tried to run a mailing list or anything like that, though, so it wouldn't surprise me.
When I went to the DMV my independent mail server was immediately filtered into spam when I tried to email them my proof of insurance. It was no trivial thing for them to get it out of the spam filter, either
I had delayed messages, kicked back messages, and messages lost in the ether. I finally gave up and went to a small hosting company that seems ok so far.
I gave up self hosting email. Between Microshaft's SmartScreen and google, it was more hassle than it was worth. Now I use a privacy friendly (paid) email solution
Add comment