Email feels like one of the most decentralized internet concepts, and ironically it's seemingly the one thing I can't self-host unless, from what I've heard, I enjoy being permanently marked as spam / blacklisted. What's going on? How do we fix this?
I host my own email server with Vultr on an OpenBSD VM using OpenSMTPD and Dovecot, relaying all outbound mail through SMTP2Go (their free tier more than meets my needs). I have all of the necessary DNS entries set to mark my mail as legit, and I sign all outgoing mail using strong 2048-bit RSA keys. Thus far, I'm able to send mail and not have it marked as spam (at least to everyone that I've corresponded with thus far). It was a lot of work to get to that point, but not terrible.
If you set everything up right, and choose the host for your mail server carefully, and never change IP, after a fairly short time you won't have much problem with being marked as spam. No more so than with any other email host.
As is so often the case, the people that say you should never do it probably have little relevant experience, they are just repeating something they heard.
But there is one piece of this that's ridiculous, broken and almost cruel: silently dropping messages marked as "spam" with no notification given back to the sender.
Why does this practice exist ? Who believes that this is decent or acceptable behavior ?
If gmail doesn't want my inbound message - for any reason - that is just fine.
If they drop it on the floor without telling me that is totally shitty.
I have been hosting my own for at least 15 years now, and I don't have big issues - I can deliver email to MS, gmail, et al.
Pick a decent hosting provider (not the cheapest options around!), make sure you have matching reverse DNS, forward DNS and HELO name (exactly the same is best!) on both v4 and v6 (if you have v6), disable IPv6 privacy addressing for your mail server (again, if you have v6), make sure you set up SPF, DKIM and DMARC, and keep your server secured.
By following these rules, in 15 years I have had only had deliverability issues with AT&T and Deutsche Telekom - both of which were fairly easily resolved.
In terms of software, you can use one of the out-of-the-box email server packages, but I personally run postfix, dovecot and rspamd on a debian stable VM. Stick to the versions from the repos and you'll have very few problems upgrading it in future, too - my current mailserver VM started on Debian Squeeze or Lenny around 2010, and is currently on bullseye (the latest stable).
So you think, fine, whitelists! But you still need to be able to accept messages by new authors without knowing their From: address ahead of time. You'd have to comb through your spam folder past tens of thousands of messages from new authors to find the one new genuine sender. Rings of trust don't solve it either because either you get spammed by someone in a ring of trust, or messages end up in concentric rings of spam folders.
You can host your own mail. It's just very hard to do it correctly, easy to screw up, and there's basically no gain whatsoever by doing it yourself. Some problems are just difficult and cannot be easily solved by a single person. You can't be your own CA [and have anyone trust your connections]. You can't create your own TLD [and have everyone be able to resolve it]. You can't create your own ASN. You can't create your own IP address. There are some things in life you have little to no control over, even on the Internet.
I was hosting my own mail server, did not have open relays and I know 100% sure nobody on my server sent spam. It was fully configured with all the DMARC and SPF trimmings.
Yet one of my users needed to email users at live.com/outlook.com/hotmail.com and kept getting banned. Every time I was able to unblock it using an automated link.
One time it didn't work and I actually got through to someone. He was like "Yeah, your server doesn't send enough legitimate emails so it doesn't build up 'reputation'". This sounds ridiculous, not sending spam is not enough, you have to send a certain amount of legit mails to stay unblocked??
Anyway it kept happening so I eventually gave up :( It only happened with consumer MS-hosted emails addresses though. I had no issue reaching companies using M365 for business.
But email is just so incredibly broken... All the patches to kinda try and fix it are a mess. We need a whole new protocol.
What often happens is that virtual hosting firms (Linode, Digital Ocean, etc.) are often used by spammer's for their hosting too, and so if you try to host by renting a "cloud vm" or "cloud server" and are unlucky to have an IP address a spammer previously poisoned, or just happen to be in the same netblock as a prior spammer, you find your new IP often 'blocked' from the big services, for no good reason than you happen to be from a "bad neighborhood". And this is usually the genesis for all the scary stories about "can't self host".
But reality is, you can self host, but you do have to set things up with all the modern requirements (SPIF, DKIM, etc.) as well.
https://www.google.com/search?client=firefox-b-1-d&q=self+ho...
So far I've managed to avoid needing to relay my mail out using something like SMTP2Go but eventually I may have to. For now GMail seems to be learning when I email my regulars and Microsoft unbanned me after I joined their Outlook.com Smart Network Data Services (SNDS)
In better news, incoming mail works flawlessly. It's even spam free if you use a catch all address (dodgywebsite.example@yourdomain.example) and drop mail from any company that leaks your address out.
You start by taking every person who says "not worth it, man, just use GMail" and beating them with a rubber hose until they install and run a mail service for their vanity domains.
More seriously, it's possible we've let this problem fester for so long that it's going to take serious effort to fix. By which I mean governmental intervention. Google, Microsoft and Yahoo cannot be allowed to dictate who gets to send and receive email, as they effectively do now through their massive marketshare dominance.
Spam is a problem, but it's not an intractable one. In the 90s, sure, the technical problem was pretty hard. By the 00s, everybody just let Google handle it because Google wasn't going to Be Evil, and Google managed to solve it with a giant technical hammer.
Technical people also tend to dismiss solutions because they don't fix every problem. The old Spam Solutions Checklist exemplifies this attitude. But what we have now is worse, i.e. just letting the world's most invasive corporation control all of it.
That being said, when you set it up, make sure you set up an SPF record. Also, check the IP Address to make sure it is not already blacklisted.
Cpanel makes it almost effortless to set up an email server, if you have just a little bit of tech know-how.
If you have a static IPv4 in a range that is not actively hostile, and you have proper SFF/DMARC records, things should generally work out?
And otherwise, services like https://www.mailchannels.com/ should help? (Still, you will need proper SPF records.)
I've literally had a 95+% delivery rate from users in actual Lagos Nigeria using the strategy outlined above.
1) those who say you can't and/or shouldn't do it. They don't know you. They might as well say you can't fix your own computer, you can't learn to write a shell script, or you can't fix your own car. They "can't" because they're afraid of failing. Ignore them completely.
2) those who say you can, and give you tips on what's difficult and how to make things better. Obviously we can self host, as many people, myself included, do self host, have done so for ages, and will continue to do so.
Some people in category 1) try to make themselves seem reasonable by bringing up these huge lists of things you have to do, but it's all completely doable. Just recognize when a particular person happens to be in category 1), and stop wasting time with them :)
I've self-hosted continuously since the late '90s, and I've even experimented with starting over, so to speak (that is, starting with a completely new domain and new IP), and it's work, but nothing beats OWNING your own data and email. Having direct access to logs means you know exactly whether delivery attempts were made, whether destination servers accepted email for delivery, and precisely when. If you have an interest, it's totally worth it.
That said, I abandoned running my own email server years ago. It only went down a couple times on me, but when it did it was always when I really didn't have time to fix it (which is basically always). It's not really difficult at all, but it's MUCH HARDER than just using gmail or whatever.
- A handful of instances provided by large companies would probably crop up and end up hosting the majority of users
- Spammers would notice that they could reach a large number of people via Mastodon, and start spamming
- The providers of these large instances would moderate heavily to prevent their own instances being used for spam, and begin blocking / not federating with small instances
I should add that spam is probably _already_ a problem on Mastodon, but perhaps not to the extent that it is for email since the average Mastodon user is (for now!) way less likely to fall for a scam and therefore a much less valuable target.
* If you're whitelisted you get through or I can manually whitelist you.
* If you're not whitelisted, I send a bounceback response stating that I'll look at your email for $X where X is set by me ( e.g. $0.25 or $1, but I decide). No guarantee of refund, but I have the option of refunding. For me, if you wasted my time, I won't refund. However, if you're a legit human that isn't marketing to me, then I would refund.
Then, I just adjust the price until spam disappears or I'm willing to look at your spam at that price.
All that's required is to properly configure the service. Beyond that you probably haven't paid the people who run the other system enough to accept mail from you; they're under no obligation.
I'd go on about socioeconomic factors, demand-side economies of scale, perverse incentives and why it's more expensive to send than receive but that's a whole thesis dissertation and belaboring the point a fair bit.
Some mail servers (Gmail, Outlook) discriminate against small mail providers by marking their stuff as spam. Ironic, because the spam I receive almost exclusively comes from free mailboxes. It doesn't happen consistently, and it tends not to happen anymore once the other party responds.
Truth to be told, I receive WAY more email than I actually send so I usually don't need to care about being marked as a spammer. I care more about control over my emails than I care about the occasional reminder I need to give Outlook users to check the spam folder.
The only problem with email self-hosting is just how many moving parts are involved in a typical setup if you're using tools from unix-land. You need many different programs to work together in a typical setup:
- postfix
- dovecot
- spamassassin
- fail2ban
- kerberos
- ssl+tls
- etc..
And you have to know about how unix account security works because some of the older programs haven't been updated to use modern authentication mechanisms and so they need to be isolated and carefully managed, etc.
The other problem is DNS/verification. You have to set up your DNS records with arcane configuration options that are not well documented in order to play along nicely with the email community and not get blacklisted/blocked.
Some projects have popped up to try and offer containers that have everything pre-configured. ymmv.
I notice that people recommend against self hosting by pointing out that gmail, aol, hotmail, etc. are likely to hide your email in spam folders, refuse it, or just silently drop it on the floor. The flip side of that is that these companies are providing broken email service to their customers: it’s not a mail delivery problem for me, it’s a mail acceptance problem for you. My email setup gives me about one false positive on incoming mail per year, at most. So don’t use these providers; their service is broken.
You may wish to consider using something like a Synology NAS where a stripped down mail server is a free feature for 5 mailboxes or less. They also support DDNS...
And when spam levels get high, a quick analysis of source IP addresses gives me new entries for a block list at my firewall. I wrote a simplistic visual basic script to harvest the IP addresses, since I still use Outlook as my PIM.
Historically, because we are - for whatever reason - unwilling or unable to deal with spammers. I mean the people sending the spam and profiting from it. There are virtually no repercussions for spamming millions of people with garbage on a daily basis. Every cent you make is profit.
Putting spammers in prison would make it a lot easier to go back to hosting our own mail servers.
That's okay; SMTP is a system based on forwarding hosts. You still have an SMTP server; it just doesn't send directly to a destination, but is configured to talk to an other SMTP server, one which is reputable (or else itself routes through a reputable one).
Hosting the receive side of e-mail is no problem at all; you do need an ISP with port 25 open. You can also run your own SMTP server easily. I run a TLS-enabled SMTP server on port 587, to which K-9 mail on my phone connects.
Hosting you rown IMAP server, webmail and all that: all no problem.
Just you have to figure out the sending situation.
I've not had trouble being marked as spam, I have set up dkim and spf.
The real reasons you cannot self host is a combination of:
ISPs blocking outgoing TCP traffic with destination port 25 and does not provice a smart-host / relay for you to use or does provice a smart-host, but do not document it, or configures it in such a way that it only relays if you have some authentication that you don't, or that reverse-dns is configured (at the same time, they do not provide reverse-dns for you).
Is an e-mail provider required in order to run a Mastodon server.
https://docs.joinmastodon.org/user/run-your-own
I think e-mail, i.e., the software, is "decentralised" if one is willing to break conventions and standards applying to how it is used. The way email software is used today is of course highly centralised, for various reasons. However the option of using email software to administer email in a decentralised way, i.e., going against standards and conventions, is not a topic one ever sees discussed.
With every item of software, there was a time before the standards and conventions existed. The software still works without the standards and conventions. Someone had to test it before those "rules" were established.
But an "email industry" has arisen, and a ridiculous number of individuals and organisations choose to depend on mostly unregulated third party "email providers". When people encourage others to follow conventions and standards, such as using third party email providers, e.g., because it's easy, and others follow these suggestions, a decentralised solution can effectively become centralised.
https://support.google.com/mail/answer/81126
https://mxtoolbox.com/diagnostic.aspx
Test test test, and you will be fine.
That is: When self-hosting email you can reliably receive email, but can't reliably send it.
The fundamental problem is that email is a broken protocol and too many people are making too much money mitigating the problem of spam rather than solving it.
Companies that need to keep their email servers working have to deal with extortion from anti-spam companies to attain reliable message delivery. It is a racket.
This means that even if you get everything working 100% with all the perfect security protocols and conventions in place the chances of anybody actually receiving your email at this point is roughly 50/50. There is nothing you can do to ensure reliable message delivery without getting your servers whitelisted by most of the popular spam houses. And even then you have to deal with large public companies like Google and Microsoft that may or may not forward messages to recipient based on secret rules that change constantly.
So while it is possible, I host my own email, I can't rely on it. I use gmail for situations were reliability matters.
It is better to use something like Mastodon for correspondence if you can help it.
One fantastic tool is: https://www.mail-tester.com/
And another is Gmail. When you send an email to Gmail you can see some spam info in the headers which you can use to fix problems.
I just hope I never get blacklisted. Sometimes you can fix this by sending the blacklist a message but this is not always possible.
What you can't do easily is talk to other large public email servers. Which I don't.
My home email server receives email I send to it, but won't forward email to other domains. This is very useful - basically anything on the iPhone is shareable via email, so now I can capture a copy of things outside of the phone easily and privately from anywhere without having to go through an untrusted third party such as Google.
In addition to having SMTP setup, I have IMAP setup, so I can retrieve email from my phone or other email client that various other self-hosted services on my local network generate, or my desktop PC running Thunderbird.
I do have to monitor logs as I get regular password-guessing attempts on the services. I have a script that checks for repeated failed logins or other bad behaviors and adds malicious IPs to a blocklist ipset.
It would be interesting to federate with others and participate in a private SMTP network. I'm sure these already exist.
I also run a mailing list server.
So my email is usually sent from a gmail.com address, and I usually receive email on my own domain.
Some lessons - sending email from your own domain is difficult as you have to not only make it accepting to spammer-averse sites. You also have to protect it from sites that would LOVE to relay email through your server.
As for receiving and reading email on your own domain - you have to provide your own spam filters - and this is VERY DIFFICULT. 320 billion spam emails are sent every day, and 94% of malware is delivered in those emails. That's one reason I use gmail as the way I read email.
I tried mailinabox and mailcow which didn’t work out, but mailu did.
Final setup is a pfSense vm on vultr, VPN back to my local pfSense box (with snort filtering) and mailu in an LXD container. Mailu guides you through setting up various dns records which helped me a lot.
1. Setup SPF, DKIM, and DMARC - you need to do all three.
2. You want to use an IP range that is not otherwise used by spammers or marketing people. This may be hard with a virtual server in just about any datacenter.
3. Consider a 3rd party spam filter, unless you like spending a lot of time on spam filtering.
My experience has been that all the major providers will deliver mail if it's appropriately signed with DKIM and you have proper SPF records, as long as you aren't originating from an IP that has a low reputation score. The biggest challenge is getting a clean IP, since there is limited IPv4 address space and most IPs have been recycled so much at this point that they all have low reputation scores. The best way to get an IP with a good reputation score is to host on physical hardware, not on VMs, with a smaller provider that has minimal customer churn.
There are some nice middle grounds for self hosting like zimbra, or for the less adventurous, a tool like MDaemon which lets you self host but provides support in the right areas. Incoming email is pretty trivial, and outbound email can be greatly improved by using an external outbound email service. Whatever works for the level of time you want to invest and maintain.
Try it out with a domain and you'll see if it's ok for you. You have to remember a lot of developers today don't have devops or hosting skills. There are developers who did have to manage complex web hosting themselves so it's not completely out of the realm of possibility. I self hosted for a long time, switched to cloud, and am thinking of switching back.
After setting up the technical side (which you can test with a site like https://www.mail-tester.com), you need an IP (v4) without a bad reputation. This is the hardest part, because it's less easy to control.
If your IP has been used to send spam, or sometimes even the neighbouring IP's, you won't get through to a lot of providers.
These are the best places (in my experience) to check IP reputation:
https://talosintelligence.com/reputation_center/lookup https://senderscore.org https://www.barracudacentral.org/lookups/lookup-reputation
And also check for blacklists, for example with https://mxtoolbox.com/blacklists.aspx.
If your IP is on a blacklist, you can remove is most of the time by requesting it via their (90's looking) websites.
Also, if you send a lot of mail, Microsoft and Google have programs for senders to monitor reputation:
https://sendersupport.olc.protection.outlook.com/snds/ https://www.gmail.com/postmaster/
But... even with an IP with a neutral reputation, your mails may be sent to the spambox. You need some volume of legitimate email over time to build trust (this is called warming up an IP).
This solutions captures the majority of spam and phishing. Occasionally, a well-crafted piece of spam gets through, and I check the Postfix config to see if I can close that hole.
What I do monitor closely are the valid emails that Postfix rejects. This happens a couple times per month, and is mainly due to the sender using GMail, and Google's mail servers being marked as sending spam.
Overall, I'm pleased with this solution. It's minimal configuration, minimal maintenance, maximum usefulness.
the best possible IP space will be somewhere that the entire /24 and parent /22 or larger block does not belong to anybody else's low cost VPS, VM, dedicated server or shared hosting. Which is hard to find these days unless you personally know somebody at a mid sized regional ISP that can sell you a custom package of colocation and some small sized piece of public IP space (like a /28 or /29 for your server) in known clean IP ranges.
Technologically: email still works the way it always has.
Societally: because email as a construct wasn't built to account for spammers, and the after-the-fact patches to address this issue aren't universally rolled out or universally adopted, and there's little incentive for the big incumbents to provide opportunities for new players by shaking up this status quo, email has devolved into a (human)-trust-based network where your mail only gets relayed if the relaying source trusts you as a person, not a pseudonymous node online.
So you can stand up an email server, but the real legwork is in getting a trusted authority to peer with you and route your traffic.
I looked later at, and set up, https://mailinabox.email/ and that worked fine too.
I'm not sure about all the cant, it's definitely possible and I never had an issue with deliverability. I had no idea what I was doing but I made sure I got all the right dkim secret and signing keys or whatever that was required set up "extra special like" for both solutions.
I was not sending mail merges though so maybe that would have thrown things off I don't know.
Email is old and used by everyone, Mastodon is new and used by nobody.
Email is targeted for attacks because it's used by a lot of people and there has been enough time to develop mass messaging tools.
Depending on your skill/software it might take time for you to test your configuration is setup correctly although there are sites like mail-tester.com that will tell you whether you have SPF/DKIM etc. setup correctly.
The problem you might have is with cloud IP addresses. Since these are reused heavily, it is possible some attacker previously used your IP to send spam and got it blacklisted. If not (there are services to check IPs) then you should be fine but note that some lists block /24 ranges of IPs instead of specific IPs so some providers are fairly unusable.
You can relay your mail via another service if you need to gather some karma for your domain but ensure you get your DNS records right. That way you can run your own full mail system from a "dodgy" IP address.
It's not for everyone but neither is IT in general. If you can fathom a Mastodon server then you can manage an email system - technically speaking. However, you must get the basics sorted out and don't send anything that can be construed as spam!
Small hosting companies struggle with email deliverability, so you have to ask yourself if it's something you want to deal with. Sometimes if you end up on a blocklist there's no easy way to get off of it, and you may find yourself unable to get an email into someone's inbox until you have the time to redo a lot of work (moving to different servers, IPs, etc).
From my perspective, you're better off using your time to do literally anything else unless email is something you want a very deep understanding of.
I've done it for my side project, not saying it was easy and require a bit of linux knowledge but nothing you can't google.
Off the top of my head you have to setup your DNS and enable DNSSEC SPF and DKIM records Make sure your reverse dns is setup correctly DMARC as well
After that it's pretty much the same as your big email providers you build up your reputation by not sending out spammy shit emails then that's it.
Note: Be sure to secure your email server otherwise someone will try to hack it
I've been running my own mail server from a VPS (vpsdime) for somewhere around 6-7 years now and the only issues I've had were related to general sysadmining headaches.
Postfix+dovecot(+mysql) setup, SPF/DKIM/DMARC and reverse-pointer record set. Both microsoft and gmail happily accept my emails and give them all the little checkmarks. Checked just a few weeks ago as I added an new domain.
It's a bit of set-up, but email is ancient tech: once set-up it doesn't need much tending.
Curious, how easy it is to set up things like a self-hosted Mastodon? Is it a few minutes, a few hours, or a few days worth of work?
There's a webpage out there (https://dnschecker.org/ip-blacklist-checker.php) that lets you look to see if you've been blacklist and there's only one massively aggressive DNS rbl that blacklists me out of many dozens of them.
I'd suggest actually trying to setup your own e-mail/dns and see if it works or not. If you wind up on a static IP that is in a ton of RBLs, move to another block or another cloud service.
That's not the case with email. You have a lot of different components to it, like postfix, dovecot, opendkim, and wtf else with as many confusing configuration options and DNS fiddling. It is so overly complicated for what it does that I'm starting to think that email was a mistake....
Hosting your own email is a problem because of these things, otherwise a fun exercise (that I gave up long time ago).
The blacklisting shouldn't be permanent, though; my self-hosted mailserver took about a year to earn the trust of GMail. I hzave no idea how Hotmail's spam filtering works. I think they just shitcan randomly, unless it's sent from Hotmail.
I'm no longer running a self-hosted server. It's hosted by my (obscure) ISP, but it's still a custom domain. I have no deliverability problems, not even to Hotmail.
Use a reputable VPS provider (one that's not likely to tolerate their customers being spammers), once you get the server check the IP against various blacklists (get a new server / IP if that happens). Make sure you set up your SSL certs and DKIM, SPF and DMARC properly.
Across the years, I had very few instances where my outgoing mail ended up in someone's spam box.
The main thing is to have a regular TLD, not something like .biz or .xyz etc, use DKIM/SPF, >> ensure your PTR record is setup << (critical) to match the domain name you're hosting your mail server on and you should be good to go.
the first BUT ... :)
* an "e-mail system" consists of many components which have to be (tightly) integrated -- MTA, MDA, MUA just to name the most obvious ones
* e-mail touches a lot of different fundamental areas of (inter)networking -- especially for example DNS ... if you don't get those things right, your outgoing mail will be considered SPAM by most of the larger mailsystems out there
* last but not least: the annoying incoming SPAM ... you have to setup some kind of filtering and maintain it
* additionally: you are targeted by several kind of attacks, because mailboxes are an essential bottleneck in lots of security-related workflows ... read: password reset / access-tokens etc.etc.
to integrate all of this is not trivial, but also not rocket-science, it just demands experience and knowhow in a lot of areas.
which leads to the second BUT ... ;)
those areas are sooo uncool right now - cloud/services/mobile/crypto/web3 ... these are the hip places to be today ...
why bother with something sooo 20th century like operating a mailsystem or a server-system at all!?
only "weirdos with alu-hats" and "old farts" are doing this ... (i'm one of them ;))
br v
If you're reluctant to use the centralized identity, you obviously have some malicious intent.
You do have to make a bit of effort to setup DKIM, SPF etc. But really it's not too difficult.
I followed their guides for the most optimal setup, and so far i feel deliverability has been comparable to commercial offerings.
Can certainly recommend.
Provide as MX to your own is impossible if you only have dynamic ip: Most ranges are on spam lists, for good reasons.
Hosting everything else is possible.
I work for a company that makes use of three components: a so called smarthost, that does AV and Spam detection, a newsletter host and groupware server.
Many more combinations are possible.
For incoming mail you need a spam-filter, but that is in your hands.
https://messari.io/article/look-to-the-stars-navigating-the-...
I even run my own webmail suite.
I even have about half a dozen friends who also use it on the regular.
Not sure what's stopping you or anyone else?
Although not directly. I got a webhoster, with my own domain, and the hoster also provides mail servers
I never noticed any problems.
Although often people do not respond to my mails.
essentialy email has been taken over by the minority for financial benefit, and creates a noncompetetive situation.
it has been obvious for years that small email servers are being squelched for thier properties, and independence rather than for something that has actually occured.
this is direct interference with a computerized messaging system, and it is causing harm.
And I generally recommend doing a lot of hosting yourself
Not sure what the story is with self hosting spam filtering. I think most people call an external service
The reason is that they have clear financial incentives to sabotage communications in order to press people into using their services.
Given the centrality of email to daily life and business, big-tech service providers do cause a clear harm by their actions, and what is needed is are successful legal prosecutions against them for that practice.
It's an interesting problem. In days of yore, the Royal Mail and US Postal Service had special powers of state that made letters sent effectively certain to be delivered. Interfering with the mail was a very serious criminal/federal offence. At one time in British law, the mere act of posting a letter was considered tantamount it having been received, and to this day many legal processes derive from that, even though the delivery has gone electronic.
The principle agent problem is that as service providers they are not impartial in their actions. While they may superficially seem to have every right to block communications to users within their domains "to prevent spam", or on "security" grounds, they are intermediaries whose good faith is not ascertainable. Even if they were acting in good faith it is a classic example of iatrogenic over-reach of "care", by which nefarious motives may be veiled by an appeal to seemingly reasonable "security" policies.
While their Terms of Service clearly make no warranty for delivery of important messages, this is not an acceptable level of service. We have hobbled along in this legal no-mans-land for 30 years at least.
Therefore I see the problem as more akin to a net-neutrality issue and is more subtle as a rights issue than it first appears. How can big service providers with an obvious conflict of interest and incentive to sabotage legitimate communications be made to play ball?
Technically we can prove, from mail relay messages, that communications have been delivered to the boundary of their digital estate, so the technical basis for a legal intervention is there. Part of the problem is that recipients who are harmed need to coordinate with senders that experience harm. And both parties need the basic technical competence to know and prove that they are being harmed.
Your mileage and anecdata may vary, but I maintain multiple mail domains for projects and businesses in Europe I've set up for people which send dozens of messages per day from self-hosted servers. Almost none of these have any problems. The only problems people report come from recipients on Microsoft and Google systems.
I sometimes politely ask people explicitly to white-list addresses, or carefully explain why a non-Google/Microsoft alternative address is a more professional and reliable contact point.
Nontheless, the 'crimes' of these big companies causes me tangible cost and I do with there was a legal remedy for it.
Hosting your own email is about as easy as hosting your own website, or server. Basically, you would have to install an email server on your own computer, and then configure it so that it can send and receive email.
If you've ever tried to set up your own web server, you know what kind of a pain it can be. You'd have to install the right software, configure it, make sure it's secure, and do all kinds of other stuff that you probably don't want to do (unless you're one of those rare people who just loves doing stuff like that).
If you think about how much time and effort it takes to manage a single computer—let alone a network or an entire data center full of them—you'll see why we're in the business of helping people with hosting, instead of telling them to host their own stuff.
it’s too easy for scammer to create a domain name.
or is it only because smtp doesn’t have any kind of authentication and rely only on IP adress?