The mail server in a router is easy to host, the problem is:
1) Uptime (though this could be partially alleviated by retries)
and most of all:
2) "Trust"/"Spam score"
It's the main reason to use Sendgrid, AWS, Google, etc. Their "value" is not the email service, it's that their SMTP servers are trusted.
If tomorrow I can just send from localhost instead of going through Google it's fine for me, but in reality, my emails won't arrive due to these filters.
I use a small local provider (posteo) and have 0 problems with spam.
So a 20 pound monkey can also throw around some weight. To be fair I only use it for personal stuff its probably different if you need enterprise scale l.
The specific concern around uptime & reliability was baked into email systems from almost the start - undeliverable notifications (for the sender) and retries.
But yes, the “trust / spam score” is a legit challenge. If only device manufacturers were held liable for security flaws, but we sadly don’t live in that timeline.
Its not a device/MTA issue, SMTP just is not a secure protocol and there is not much you can do in order to 'secure' human communication. Things like spoofing or social engineering are near impossible to address within SMTP without external systems doing some sort of analysis on the messages or in combination with other protocols like DNS.
SMTP isn't at fault, the social ecosystem is at fault. Every system where identities are cheap has a spam problem. If you think a system has cheap identities and no spam, it probably doesn't have cheap identities — examples are HN or Reddit.
Trust / spam score is the largest one I think, second to consumer ISPs blocking the necessary ports for receiving mail.
Even if your "self hosting" is renting a $5/month VPS, some spam lists (e.g. UCEPROTECT) proactively mark any IP ranges owned by consumer ISPs and VPS hosting as potential spam. I figured paying fastmail $30/yr was worth never having to worry about it.
For "Trust", I believe patio11 described this system as the "Taxi Medallion of Email".
e.g. you spend a lot of money to show that you are a legitimate entity or you pay less money to rent something that shows you are connected to said entity.
In France it's possible without legal consequences (though immoral), if you call 119, you can push to have a baby taken from a family for no reason except that you do not like someone.
Claim that you suspect there may be abuse, it will trigger a case for a "worrying situation".
Then it's a procedural lottery:
-> If you get lucky, they will investigate, meet the people, and dismiss the case.
-> If you get unlucky, they will take the baby, and it's only then after a long investigation and a "family assistant" (that will check you every day), that you can recover your baby.
Typically, ex-wife who doesn't like the ex-husband, but it can be a neighbor etc.
One worker explains that they don't really have time to investigate when processing reports: https://www.youtube.com/watch?v=VG9y_-4kGQA
and they have to act very fast, and by default, it is safer to remove from family.
The boss of such agency doesn't even take the time to answer to the journalists there...
This is very common, all "think of the children" laws are ripe for abuse. I'm convinced the secrecy around child abuse/child protective services is regularly abused both by abusive parents and abusive officials.
If you call 119 it gets assessed and potentially forwarded to the right department, which then assesses it again and might (quite likely will) trigger an inspection. The people who turn up have broad powers to seize children from the home in order to protect them from abuse.
In general this works fine. Unfortunately in some circumstances this does give a very low skilled/paid person (the inspector) a lot of power, and a lot of sway with judges. If this person is bad at their job for whatever reason (incompetence/malice) it can cause a lot of problems. It is very hard to prove a person like this wrong when they are covering their arse after making a mistake.
afaik similar systems are present in most western countries, and many of them - like France - are suffering with funding and are likely cutting in the wrong place (audit/rigour) to meet external KPIs. One of the worst ways this manifests is creating 'quick scoring' methods which can end up with misunderstandings (e.g. said a thing they didn't mean) ranking very highly, but subtle evidence of abuse moderate to low.
So while this is a concern, this is not unique to France, this is relatively normal, and the poster is massively exaggerating the simplicity.
In Sweden there is a additional review board that go through the decision made by the inspector. The idea is to limit the power that a single inspector has. In practice however the review board tend to rubber stamp decisions, so incompetence/malice still happens.
There was a huge mess right after metoo when a inspector went against the courts rulings. The court had given the father sole custody in a extremely messy divorce, and the inspector did not agree with the decision. As a result they remove the child from his father, in direct contrast to the courts decision, and put the child through 6 years of isolation and abuse with no access to school. It took investigative journalists a while, but the result of the case getting highlighted in media was that the inspector and supervisor is now fired, with two additoal workers being under investigation for severe misconduct. Four more workers would be under investigation but too long time has passed. The review board should have prevented this, as should the supervisor for the inspector, but those safety net failed in this case in part because of the cultural environment at the time.
It is fairly lenient. The review board, assigned political, do hold a bit of moral responsibility and got no punishment.
The reason I mentioned that this occurred right after metoo is that the cultural environment in Sweden was a bit unstable. Some people felt they could not trust the courts, which include people who worked as inspectors for the government. The review board is also selected politically, which may add a second explanation for why they permitted the misconduct. It was a very political time and everyone wanted to be perceived as being on the right side of history.
The case has been debate in Swedish parliament but the reaction has been to not really talk about it. People ignored the law and rules, and they shouldn't have done that, and that is then that.
“ If this person is bad at their job for whatever reason (incompetence/malice) it can cause a lot of problems. It is very hard to prove a person like this wrong when they are covering their arse after making a mistake.”
This seems guaranteed to occur every year then… since incompetence/malice will happen eventually with thousands upon thousands of cases?
We are also talking about a country who wants to ban anonymous VPNs in the name of protecting the children and ask everyone to give their ID card to register account on Instagram, TikTok, etc.
1) Uptime (though this could be partially alleviated by retries)
and most of all:
2) "Trust"/"Spam score"
It's the main reason to use Sendgrid, AWS, Google, etc. Their "value" is not the email service, it's that their SMTP servers are trusted.
If tomorrow I can just send from localhost instead of going through Google it's fine for me, but in reality, my emails won't arrive due to these filters.
reply