Hi,

I'm running my own mail server for my own domain (chmurka.net) on a
dedicated IP address in RamNode (81.4.124.88). Despite doing everything I
possibly can (I have SPF records, I have OpenDKIM running to add DKIM
headers, I have TLS enabled with a certificate from Let's Encrypt)
sometimes email sent by me ends up in spam folders.

I checked and I'm not in any RBLs (none I know of). Maybe the IP
reputation is bad, because it belongs to a VPS hosting company (even if
it's used exclusively by me for the last seven years and there's been no
spam or abuse coming from it since then).

Do any of you have any suggestions where to check the IP, how to de-list
it, or where to move the SMTP server? Or maybe there's some paid relay
service that I could sign up to, and they will relay my mail?

I need to change only outgoing SMTP to work this way. Incoming mail works
fine (because why wouldn't it...).

Adam W. <gof-cut-this-news@cut-this-chmurka.net.invalid> wrote:
>I'm running my own mail server for my own domain (chmurka.net) on a
>dedicated IP address in RamNode (81.4.124.88). Despite doing everything I
>possibly can (I have SPF records, I have OpenDKIM running to add DKIM
>headers, I have TLS enabled with a certificate from Let's Encrypt)
>sometimes email sent by me ends up in spam folders.

What ISPs are doing this to your mail? Are they competent well-run ISPs
whose administrators you can contact, or is it just gmail?

Some ISPs use content filters and there is really nothing you can so to
avoid stuff being marked as spam other than to avoid certain patterns in
your text.

Some ISPs will put the filtering data in the headers so that if the final
recipient can send you the original message with all headers included, you
can figure out what filters were set off.
--scott

--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On 30/12/2023 19:33, Adam W. wrote:
> Hi,
>
> I'm running my own mail server for my own domain (chmurka.net) on a
> dedicated IP address in RamNode (81.4.124.88). Despite doing everything I
> possibly can (I have SPF records, I have OpenDKIM running to add DKIM
> headers, I have TLS enabled with a certificate from Let's Encrypt)
> sometimes email sent by me ends up in spam folders.
>
> I checked and I'm not in any RBLs (none I know of). Maybe the IP
> reputation is bad, because it belongs to a VPS hosting company (even if
> it's used exclusively by me for the last seven years and there's been no
> spam or abuse coming from it since then).
>
> Do any of you have any suggestions where to check the IP, how to de-list
> it, or where to move the SMTP server? Or maybe there's some paid relay
> service that I could sign up to, and they will relay my mail?
>
> I need to change only outgoing SMTP to work this way. Incoming mail works
> fine (because why wouldn't it...).
Before moving to another VPS, I suggest move your dns to CloudFlare
(FREE) and see if it works for you. I have all my domains on CloudFlare
and no problems so far.

Read the docs and if you have any questions post back. I think it is the
best way to manage Domains, Website and Emails.

<https://www.cloudflare.com/en-gb/developer-platform/email-routing/>

You continue to use the same Registrar as now except that you use
CloudFlare for all the management of your domain(s). Create new emails,
create subdomains etc etc. You can also create create "Catch-All" emails
so that any emails sent to your domain address will still be delivered.
this allows you to create disposable emails easily.

If you are still interested to USE a VPS then you can try Contabo. They
have fixed price plans and you can start with one month to see if it
works after which you can change it to 12 month plan.

<https://contabo.com/en/vps/>

On 30/12/2023 19:33, Adam W. wrote:
>
> I'm running my own mail server for my own domain (chmurka.net) on a
> dedicated IP address in RamNode (81.4.124.88). Despite doing everything I
> possibly can (I have SPF records, I have OpenDKIM running to add DKIM
> headers, I have TLS enabled with a certificate from Let's Encrypt)
> sometimes email sent by me ends up in spam folders.
>

I just checked your domain and YOU DON'T HAVE A CERTIFICATE (or you have
but not configured correctly). That could be the first problem. There
might be others but first configure the certificate correctly. Your
record is here:

<https://crt.sh/?q=chmurka.net>

Firefox, Edge and Chrome is flagging that the domain hasn't got a
certificate.

Jack Lemmon <invalid@invalid.net> wrote:
>On 30/12/2023 19:33, Adam W. wrote:
>>
>> I'm running my own mail server for my own domain (chmurka.net) on a
>> dedicated IP address in RamNode (81.4.124.88). Despite doing everything I
>> possibly can (I have SPF records, I have OpenDKIM running to add DKIM
>> headers, I have TLS enabled with a certificate from Let's Encrypt)
>> sometimes email sent by me ends up in spam folders.
>
>I just checked your domain and YOU DON'T HAVE A CERTIFICATE (or you have
>but not configured correctly). That could be the first problem. There
>might be others but first configure the certificate correctly. Your
>record is here:
>
><https://crt.sh/?q=chmurka.net>
>
>Firefox, Edge and Chrome is flagging that the domain hasn't got a
>certificate.

What would that have to do with mail? He might not even have a web server
on the domain, but that shouldn't affect mail filtering.
--scott

--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On 12/30/23 18:48, Scott Dorsey wrote:
> What would that have to do with mail? He might not even have a web
> server on the domain, but that shouldn't affect mail filtering.

Not having a (trusted) certificate for inbound email might be a thing.

But I'd expect that to have very little to do with outbound email and
placement of messages the OP sends.

--
Grant. . . .

Scott Dorsey <kludge@panix.com> wrote:

> What ISPs are doing this to your mail? Are they competent well-run ISPs
> whose administrators you can contact, or is it just gmail?

One example is poczta.fm, but there are many other ISPs. I had a similar
problem with gmail and with Microsoft-handled mail (hotmail, outlook.com).
It's not a problem with a single ISP.

> Some ISPs use content filters and there is really nothing you can so to
> avoid stuff being marked as spam other than to avoid certain patterns in
> your text.

It doesn't seem to be content-related.

> Some ISPs will put the filtering data in the headers so that if the final
> recipient can send you the original message with all headers included, you
> can figure out what filters were set off.

One person told me it was the "IP reputation". I don't know if it's
related, but:

https://www.ipqualityscore.com/ip-reputation-check/lookup/81.4.124.88

https://www.ipqualityscore.com/ip-reputation-check/lookup/176.56.237.216

"IP Reputation Reputation Issues Detected
This IP address has been detected as a proxy connection, which could be
hurting your IP reputation."

"Proxy/VPN Proxy/VPN Detected
This IP address appears to be a low risk proxy connection."

This is strange, because there's no proxy there and never has been. They
probably listed whole range of IPs.

I contacted them, let's see what happens...

Jack <invalid@invalid.invalid> wrote:

> Before moving to another VPS, I suggest move your dns to CloudFlare
> (FREE) and see if it works for you. I have all my domains on CloudFlare
> and no problems so far.
>
> Read the docs and if you have any questions post back. I think it is the
> best way to manage Domains, Website and Emails.
>
> <https://www.cloudflare.com/en-gb/developer-platform/email-routing/>

Is it possible to use only their mail relay, without moving my domain to
them? How much does it cost?

It would be best for me to keep the incoming SMTP as it is (and of course
DNS and other stuff), and only use their outgoing SMTP relay.

> If you are still interested to USE a VPS then you can try Contabo. They
> have fixed price plans and you can start with one month to see if it
> works after which you can change it to 12 month plan.
>
> <https://contabo.com/en/vps/>

Seems to be similarly priced to RamNode. Do you have an example IP from
them that I could check the reputation of?

Jack Lemmon <invalid@invalid.net> wrote:

> I just checked your domain and YOU DON'T HAVE A CERTIFICATE (or you have
> but not configured correctly). That could be the first problem. There
> might be others but first configure the certificate correctly. Your
> record is here:
>
> <https://crt.sh/?q=chmurka.net>
>
> Firefox, Edge and Chrome is flagging that the domain hasn't got a
> certificate.

I do have a certificate, but not on a web server. I'm only talking about
the SMTP server, not about the web. Here's how it works for incoming SMTP.

$ openssl s_client -connect mx.chmurka.net:25 -starttls smtp -quiet
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = mx.chmurka.net
verify return:1
250 DSN

Grant Taylor <gtaylor@tnetconsulting.net> wrote:

> But I'd expect that to have very little to do with outbound email and
> placement of messages the OP sends.

BTW, Grant, did you receive my email?

Subject: news.chmurka.net and de.* and uk.* hierarchies
Date: Sun, 24 Dec 2023 13:01:11

You were in Bcc, because I sent it to all my feeds.

If not, it might be the same problem (and if you have it somewhere in the
spam folder, it would be helpful if I could see the spam-related
headers)...

On 31/12/2023 17:26, Adam W. wrote:
> Is it possible to use only their mail relay, without moving my domain to
> them? How much does it cost?

Is it possible to use their mail relay ? YES

No need to move your domain. It costs ZERO dollars $$$$$$$$$

>
> It would be best for me to keep the incoming SMTP as it is (and of course
> DNS and other stuff), and only use their outgoing SMTP relay.
You use their DNS and other stuff except that you continue paying your
current registrar. They give you a new DNS (in fact two DNS's) which you
need to enter on your Registrar's website. After doing that, all the
management is done on CloudFlare. If you don't like using them, you
simply delete the DNS numbers from your registrar's website and it
becomes back to as before. CloudFlare will inform you that your DNS has
changed just in case somebody has hacked your account. If you ignore
their messages after 3 attempts by them, they simply delete your details
from their website. You don't need to do anything.

If you have a spare domain, why not try it and see how it works. I use
them for everything except the payment for domains is to my Registrar in
the UK. I try to find the cheapest ones without worrying about their
features because CloudFlare is what I like.

There is also Namecheap for the same thing. It is also free.

<https://www.namecheap.com/support/knowledgebase/article.aspx/536/51/how-do-i-set-my-domain-to-use-namecheaps-freedns-service/>

>
> Seems to be similarly priced to RamNode. Do you have an example IP from
> them that I could check the reputation of?

My IP address is: 85.190.246.107. However, if you use CloudFlare then
this is not relevant because the email will appear to come from
CloudFlare rather than your own VPS. Spamming is strictly not allowed by CloudFlare so you have to be very careful.

One thing you have to know is that Google doesn't like people using PHP
mail. I was using php mail on Namecheap hosting and I found GMAIL just
tossed the emails without delivering them. now I only use SMTP and there
are some free SMTP providers for websites or you can use GMAIL or
Outlook.com (Microsoft) by creating a special password for that. that's
another matter and I don't want to complicate the matters here.

Good luck and wish you a very Happy New Year.

In article <ums812$58u$3$arnold@news.chmurka.net>,
Adam W. <gof-cut-this-news@cut-this-chmurka.net.invalid> wrote:
>Scott Dorsey <kludge@panix.com> wrote:
>
>> What ISPs are doing this to your mail? Are they competent well-run ISPs
>> whose administrators you can contact, or is it just gmail?
>
>One example is poczta.fm, but there are many other ISPs. I had a similar
>problem with gmail and with Microsoft-handled mail (hotmail, outlook.com).
>It's not a problem with a single ISP.

Start out with poczta.fm then, and talk to their postmaster. Give them a
message that was sent and ask what they are doing to flag it as being spam.

>> Some ISPs use content filters and there is really nothing you can so to
>> avoid stuff being marked as spam other than to avoid certain patterns in
>> your text.
>
>It doesn't seem to be content-related.

Okay, that is good.

>> Some ISPs will put the filtering data in the headers so that if the final
>> recipient can send you the original message with all headers included, you
>> can figure out what filters were set off.
>
>One person told me it was the "IP reputation". I don't know if it's
>related, but:
>
>https://www.ipqualityscore.com/ip-reputation-check/lookup/81.4.124.88
>
>https://www.ipqualityscore.com/ip-reputation-check/lookup/176.56.237.216
>
>"IP Reputation Reputation Issues Detected
>This IP address has been detected as a proxy connection, which could be
>hurting your IP reputation."

There are dozens of different services which claim to describe your
"IP reputation." This is one of them. Is this the one that is your
problem? Nobody can tell. Ask the postmaster at poczta if he is using
any of these services.

You should be able to ask the folks at ipqualityscore.com why your IP
is showing up as being a proxy. It is possible that at one point it was
used by a proxy. It's not dynamic, right?

But whether that will fix your mail problem or not, I have no idea.
What IS the address of your mail server anyway?
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On 31.12.23 19:22, Adam W. wrote:
> Scott Dorsey <kludge@panix.com> wrote:

<snip>

> One person told me it was the "IP reputation". I don't know if it's
> related, but:
>
> https://www.ipqualityscore.com/ip-reputation-check/lookup/81.4.124.88
>
> https://www.ipqualityscore.com/ip-reputation-check/lookup/176.56.237.216
>
> "IP Reputation Reputation Issues Detected
> This IP address has been detected as a proxy connection, which could be
> hurting your IP reputation."
>
> "Proxy/VPN Proxy/VPN Detected
> This IP address appears to be a low risk proxy connection."

I never heard about this site, but I tested few small shared
hosting/e-mail provider e-mail gateway IP-s.
Seems like hardcoded complaint, got same "problem" with every small
provider. Bigger, better known service providers don't have that message
though, so they are done little bit homework to make this issue believable.

I suggest mxtoolbox.com (which aggregates several more known blacklists)
and talosintelligence.com for checking IP and domain.
Talos shows neutral and not enough mail traffic for your IP. This is
probably one issue: irregular patterns and not enough daily sent
messages. Microsoft is known to maintain IP reputation and daily limits
related to previous volumes.
Microsoft by the way has "Smart Network Data Service"
(https://sendersupport.olc.protection.outlook.com/snds/), which allows
netblock owner to receive spam complaints and shows statistics per IP.
Though that isn't help you much, if you don't have your own IP addresses.

Bigger picture: all VPS providers are somewhat abused by spammers. Your
best hope is go to with expansive (because spammers prefer cheap) and
zero tolerance to spam provider.
Realistically, get dedicated server from provider, who don't offer VPS.
Another idea: get static IP from your home ISP and preferably business
class service package.
I have over decade experience hosting my personal e-mail server in that
kind "office Internet with static IP" setups (few different ISP-s over
years) and only issue was once to need delist my IP from Spamhaus Policy
Block List (there is self service delisting or whitelisting option).
I had even forwarding service for few accounts. Sometimes spam got
forwarded (slipped through my filter), still no issue with hotmail or
gmail, no blacklisting.

Best regards,
U.ee

On 31/12/2023 18:29, Adam W. wrote:
>
> I do have a certificate, but not on a web server. I'm only talking about
> the SMTP server, not about the web. Here's how it works for incoming SMTP.
>
> $ openssl s_client -connect mx.chmurka.net:25 -starttls smtp -quiet
> depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
> verify return:1
> depth=1 C = US, O = Let's Encrypt, CN = R3
> verify return:1
> depth=0 CN = mx.chmurka.net
> verify return:1
> 250 DSN

ivo@flamingo ~ $ host mx.chmurka.net
mx.chmurka.net has address 81.4.124.88
ivo@flamingo ~ $ host 81.4.124.88
88.124.4.81.in-addr.arpa domain name pointer vps.chmurka.net.
ivo@flamingo ~ $

A lot complaining if the name on the certificate don't match the reverse
of the ip('s). I suggest to change your certificate or your reverse.

Sincerely

--
Ivo Gandolfo

Ivo Gandolfo <usenet@bofh.team> wrote:
>
>ivo@flamingo ~ $ host mx.chmurka.net
>mx.chmurka.net has address 81.4.124.88
>ivo@flamingo ~ $ host 81.4.124.88
>88.124.4.81.in-addr.arpa domain name pointer vps.chmurka.net.
>ivo@flamingo ~ $

Okay, now THIS is a major issue. If your rDNS doesn't match up with your
forward DNS, a lot of sites are going to drop email.

>A lot complaining if the name on the certificate don't match the reverse
>of the ip('s). I suggest to change your certificate or your reverse.

This will cause major problems for web services, but the SSL certs on the web
server have nothing to do with email. rDNS does, though.
--scott

--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On 12/31/23 11:31, Adam W. wrote:
> BTW, Grant, did you receive my email?

Yes, I did.

Sorry for not responding yet. I've been slow / lackadaisical to respond
to things over the holidays.

> You were in Bcc, because I sent it to all my feeds.

ACK

> If not, it might be the same problem (and if you have it somewhere in the
> spam folder, it would be helpful if I could see the spam-related
> headers)...

No, it delivered to my Inbox. I've since files it in my Usenet News
Server folder, unread, for future action.

I'll try to make a point to respond to you in the next day or so.

--
Grant. . . .

On 12/31/23 16:15, Scott Dorsey wrote:
> Okay, now THIS is a major issue. If your rDNS doesn't match up with
> your forward DNS, a lot of sites are going to drop email.

+1 (for an extremely large value of one)

I advocate for having sending server hello with an FQDN that matches the
name that forward & reverse DNS. -- Many will say that this isn't as
important. I think it shows good intentions. And I believe that
visible good intentions are a Good Thing (TM) when trying to make your
system stand out as a good netizine.

--
Grant. . . .

According to Scott Dorsey <kludge@panix.com>:
>>A lot complaining if the name on the certificate don't match the reverse
>>of the ip('s). I suggest to change your certificate or your reverse.
>
>This will cause major problems for web services,

Yup. You need matching rDNS.

> but the SSL certs on the web server have nothing to do with email.

This might be a good time to review RFCs 6698 and 8461.

In this case the rDNS is much more likely to be the problem, but the SSL
certs on the server can have plenty to do with mail.

--
Regards,
John Levine, johnl@taugh.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly

Scott Dorsey <kludge@panix.com> wrote:

>>ivo@flamingo ~ $ host mx.chmurka.net
>>mx.chmurka.net has address 81.4.124.88
>>ivo@flamingo ~ $ host 81.4.124.88
>>88.124.4.81.in-addr.arpa domain name pointer vps.chmurka.net.
>>ivo@flamingo ~ $
>
> Okay, now THIS is a major issue. If your rDNS doesn't match up with your
> forward DNS, a lot of sites are going to drop email.

Hmm, I didn't know that.

I think I fixed it:

- created new certificate for vps.chmurka.net
- made Postfix use this key and certificate (instead of the one for mx.chmurka.net)
- changed MX from mx.chmurka.net to vps.chmurka.net
- changed banner from "220 chmurka.net ESMTP" to "220 vps.chmurka.net ESMTP"

Hopefully it will be better now...

Thanks!

Grant Taylor <gtaylor@tnetconsulting.net> wrote:

> I advocate for having sending server hello with an FQDN that matches the
> name that forward & reverse DNS.

I did it too (I'm not sure which configuration option affects EHLO, maybe
it takes it from smtpd_banner, or maybe from hostname, but I checked that
it sends vps.chmurka.net now). Thanks.

Grant Taylor <gtaylor@tnetconsulting.net> wrote:

>> BTW, Grant, did you receive my email?
>
> Yes, I did.
>
> Sorry for not responding yet. I've been slow / lackadaisical to respond
> to things over the holidays.

Sure, no problem. I have de.* and uk.* up and running with other peers, so
it's not a huge priority. I already configured incoming.conf on my side,
but I didn't want to configure newsfeeds without prior agreement.

> No, it delivered to my Inbox.

That's the most important thing for me now :)

Thanks.

Grant Taylor <gtaylor@tnetconsulting.net> wrote:
>
>I advocate for having sending server hello with an FQDN that matches the
>name that forward & reverse DNS. -- Many will say that this isn't as
>important. I think it shows good intentions. And I believe that
>visible good intentions are a Good Thing (TM) when trying to make your
>system stand out as a good netizine.

I don't care about that. What I care about is whether this is the cause
of the immediate problem or not. You could find this out by looking at
one of the messages that were dropped into a spam folder and see the
headers which would indicate why the message was marked as spam. But
this is likely to be one of them. There may be more, though.
--scott

--
"C'est un Nagra. C'est suisse, et tres, tres precis."

Adam W. <gof-cut-this-news@cut-this-chmurka.net.invalid> wrote:
>I did it too (I'm not sure which configuration option affects EHLO, maybe
>it takes it from smtpd_banner, or maybe from hostname, but I checked that
>it sends vps.chmurka.net now). Thanks.

So, why IS it called vps.chmurka.net if it is not a vps? This may also
be causing some alarm bells to go off.
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On 1/1/24 10:34, Scott Dorsey wrote:
> So, why IS it called vps.chmurka.net if it is not a vps? This may
> also be causing some alarm bells to go off.

I've found that what something is called is of less importance than it
consistently using that name; rDNS, fDNS, HELO/EHLO, etc.

What something is called can start to be a problem if recipients are
trying to do pattern matching to filter out things that are generic
reverse DNS, often found on residential IPs.

Part of the reasoning for this is that it's very difficult to tell with
any modicum of certainty what strings of letters mean. Does "vps" stand
for "virtual private server" or "vital production service" or "VICTORY,
please sir!". This is only exacerbated by multiple languages, regional
influences, and countless other things.

--
Grant. . . .

Grant Taylor <gtaylor@tnetconsulting.net> wrote:
>On 1/1/24 10:34, Scott Dorsey wrote:
>> So, why IS it called vps.chmurka.net if it is not a vps? This may
>> also be causing some alarm bells to go off.
>
>I've found that what something is called is of less importance than it
>consistently using that name; rDNS, fDNS, HELO/EHLO, etc.

This is true. But why it is called that?

>What something is called can start to be a problem if recipients are
>trying to do pattern matching to filter out things that are generic
>reverse DNS, often found on residential IPs.

Yes, and people will sometimes use that technique on address blocks that it
is not suited for.

If someone is manually looking over addresses they may very well mark it
as a VPS address. Did that happen? Probably not. But why is it called that?
--scott

--
"C'est un Nagra. C'est suisse, et tres, tres precis."