Gilles Chehade

The postmortem is worth reading: https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissected/ It's worth reading through the systemic mitigations that would make a clone of this bug impossible in the future.

Here's a great writeup by an OpenSMTPD developer: https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opens…

I used to run Postfix + Dovecot + Rspamd with all the bells and whistles enabled [1], but I recently switched to OpenSMTPD + spamd on OpenBSD. Unlike rspamd, which has pluggable modules for everything under the sun (RBLs, word filters, Bayesian filtering + learning), spamd uses plain ol' graylisting with some PF integration to throttle spammers connections to 1 character/second for maximum annoyance. With Rspamd, I never got any spam in my Inbox. With spamd, I get maybe 1 spam mail every two weeks. To me, spamd's ridiculous simplicity is worth the tradeoff. You do have to be careful with graylisting large mailers like Gmail, since they rarely retry the mail from the same IP address. For this, OpenBSD's smtpctl now has the spfwalk [2] command to whitelist the big guys. That's what I use in my current setup [3], which was linked here a few days ago. [1] https://www.c0ffee.net/blog/mail-server-guide/ [2] https://poolp.org/posts/2018-01-08/spfwalk/ [3] https://github.com/cullum/dank-selfhosted

Always relevant link on this topic that debunks much of the Why You Should Not… https://poolp.org/posts/2019-08-30/you-should-not-run-your-mail-server…

OpenSMTPD is the right answer if you want a general purpose mail server [1] that is secure by default. [2] [1]: https://poolp.org/posts/2021-01-31/january-2021-opensmtpd-libtls-conve… [2]: https://www.openbsd.org/security.html

Chip in with a couple of friends who might be on the lookout for a gmail/proton/whatever alternative as well, get an OpenBSD VPS at 1984 Hosting, C*ckbox, FlokiNET, or basically any other hoster that allows communication via port 25 and set up OpenSMTPd and Dovecot. There are plenty[0] write-ups[1] on how to do so in case you need info. [0] https://poolp.org/posts/2019-08-30/you-should-not-run-your-mail-server… [1] https://karchnu.fr/posts/2020-09-17-certificate-smtp-imap-antispam.htm…

Hello, Main developer from the OpenSMTPD project here. I also wrote an article a few weeks ago about running your own mail server which is located here: https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opens…

https://poolp.org/posts/2019-08-30/you-should-not-run-your-mail-server… My 2 cents.

I haven't used DCC, but it looks like an interesting anti-spam toolkit: https://www.dcc-servers.net/dcc/ It appears to support "weak" IP matching: > All or part of the IP address of the SMTP client can be optionally ignored by DCC clients as far as the greylist triple is concerned. This feature may be useful for legitimate mail systems that shuffle messages among SMTP clients between retransmissions. See the dccm and dccd man pages. https://www.dcc-servers.net/dcc/greylist.shtml It doesn't quite sound like it does a job of 100% "same email, same sender, different mx in same domain" -but I suspect it works well enough in practice? > Usually the DCC greylist system requires that an almost identical copy of the message be retransmitted during the embargo. If weak-body is present, any message with the same triple of sender IP address, sender mail address, and target mail address ends the em-bargo, even if the body of the message differs. > If weak-IP is present, all mail from an SMTP client at an IP address is accept after any message from the same IP address has been ac-cepted. https://www.dcc-servers.net/dcc/dcc-tree/dccd.html#OPTION-G I can't recall what I used for greylisting last -possibly greylistd. Anyway, the smart play these days might be to whitelist/greylist via SPF - I'm not sure if spammers (of the variant caught by greylists) generally have…