Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I have literally never (to my knowledge) been rejected by one of the big boys (i.e. gmail or outlook). Was quite nervous about it in the beginning, but I haven't run into any issues.

I have had a number of bumps:

   1. In exchanging emails with someone with a custom domain, I found there SPF record was broken and thus my server was rejecting their emails. I've weakened my policy and now their mail goes to my Junk, which I then manually move to my inbox because I'm lazy and don't want to set up a custom rule.

   2. I wanted to subscribe to the Tarnsap mailing list, and had to decrease the minimum TLS level for outgoing mail to "none." Dr. Percival believes TLS on SMTP is "silly" (which, in the sense that all email is insecure, is true, but in the sense that email with modern security measures is better than nothing, is in itself a "silly" opinion).

   3. I had some server downtime recently (https://figbert.com/posts/wrong-way-to-switch-server-os/) and couldn't receive emails, which sucked. But that was on me.
I highly recommend giving it a go!


Just to defend Dr. Percival a little here(since I have the same stance, though we do also support TLS), the RFC's require you to support non-encrypted SMTP. Since you HAVE to support it(not only per RFC but because in the real world so many SMTP communicators are stupid, lazy, or ignorant), there is little point in trying to make email secure. Until such time as everyone decides TLS1.3+ is required for SMTP, there is no hope, so why bother.

Our external auditors get all upset about it every single year, and every single year, I show them the RFC's and they then shutup about it for a year. If you feel strongly enough about it, try to get a RFC passed where SMTP requires TLS now.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: