Today i learned that your email server may be doomed just because of TLD reddit / selfhosted ---------------------------------------------------------------------- D-ff1 · 2023-10-14 12:55 If your domain gets in this list, then your emails will end up in spam folder much more often than not. [https://github.com/apache/spamassassin/blob/trunk/rulesrc/sandbox/pds /20\_ntld.cf](https://github.com/apache/spamassassin/blob/trunk/rulesr c/sandbox/pds/20_ntld.cf) ​ ---------------------------------------------------------------------- thekrautboy · 2023-10-14 13:01 And imagine what you might learn tomorrow! How exciting! ---------------------------------------------------------------------- WiseCookie69 · 2023-10-14 13:25 Well. Shouldn't be a surprise that all those fancy new tlds are a paradise for spammers and scammers. ---------------------------------------------------------------------- jkirkcaldy · 2023-10-14 13:46 I think if you want to deliver email reliably you should probably stick to the classics, .com . .org etc. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 13:52 Doesn't work if your domain on all TLDs is already taken. Blocking new TLDs by default is a bad practice and shows that the administrators of that MTA do not understand what they are doing. ---------------------------------------------------------------------- sowhatidoit · 2023-10-14 13:58 I learned (the hard way) that recently bought domains are more likely to be added on such lists. ---------------------------------------------------------------------- SecretaryOfDefensin · 2023-10-14 14:01 Yes, and..? ---------------------------------------------------------------------- Max-_-Power · 2023-10-14 14:09 That's basically the one reason I do not host an email server. The consequences if I eff this up can be catastrophic, especially when a business is relying on it to work properly. ---------------------------------------------------------------------- mpember · 2023-10-14 14:26 If that is the case, you should really consider a different domain name. You are already going to be wasting much of your time explaining to people that it is a real email address, or simply being unable to enter it into any website that has an outdated data validation check. ---------------------------------------------------------------------- multiplekeelhaul · 2023-10-14 14:29 For a myriad of reasons it's extremely annoying/difficult to host your own email server and maintain reliable delivery. I kept a few for small businesses from 1995-2016 ---------------------------------------------------------------------- 274Below · 2023-10-14 14:32 It's also possible that they *do* know what they're doing. ---------------------------------------------------------------------- lionep · 2023-10-14 14:37 We have a domain .club and we got flagged by some spam filters just because of this… we had to switch to .com for delivrability ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 14:49 No. Blocking by TLD is like blocking by company name. You can sign up on aliexpress or samsung with an email that has samsung or aliexpress in the name for instance. That's just stupid. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 14:50 Sure, getting.fit is a very stupid idea, riiiiiiight. ---------------------------------------------------------------------- crazedizzled · 2023-10-14 14:55 It is not stupid. You're the stupid one if you can't see the benefit there. ---------------------------------------------------------------------- crazedizzled · 2023-10-14 14:56 I self host an email server for non-critical emails. Like, basically things I'm only using for myself. Alerts or notifications of my services and things. For my real email, which I rely upon for work, I just pay 5 bucks for Google. ---------------------------------------------------------------------- 274Below · 2023-10-14 14:56 Your analogy does not hold water. Those TLDs aren't blocked because they're new; they're blocked because their operators choose to run them in a way that is conducive to sending spam. There are likely reasons other than "we want to enable spam" for why they choose to run them that way, but, that's also the net result. I'd highlight that, for example, .dev is not on that list. That was made available in 2019. .online is on that list, and it was made available in 2015. Again: it's possible that the folks who write the spam definitions for SpamAssassin do in fact know what they are doing. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 14:57 Please explain how blocking entire TLDs by arbitrary conditions is a good idea? Maybe we should start blocking Reddit users that contain certain words like ".*izzle.*". ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 14:57 Do you run an MTA? ---------------------------------------------------------------------- RudolphDiesel · 2023-10-14 15:02 Not only end in spam, our email server just plain rejects the emails of many of those domains. And in reality I have never ever gotten a legit email from any of those. ---------------------------------------------------------------------- crazedizzled · 2023-10-14 15:05 Because the ratio of abusers to legitimate users is obviously high enough to warrant it. The solution? Don't host your mail server on some random ass TLD. ---------------------------------------------------------------------- D-ff1 · 2023-10-14 15:09 Not healthy practice, to blindly blacklist domains. It is not easier to register such domain than regular .com. We have very nicedomain.icu. Should we have a separate email domain like domain-icu.com ? It may look spammy. ---------------------------------------------------------------------- D-ff1 · 2023-10-14 15:12 I remember when all spam came from .com/.net/.org domains and nobody came up with such dumb idea like ban a TLD. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 15:14 Any more random than .com? Maybe only allow TLD that cost 1000$/year, I mean .com is too cheap. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-14 15:14 A scammer/spammer can get domains on any TLD just as easily. It's not like restricting them to net/com/org does anything. The TLD shouldn't make the difference for spam, it's whether the domain has a decent DNS and MTA setup that matters. But many services prefer to take the easy way and just ban TLDs in bulk than to set up proper checks. ---------------------------------------------------------------------- necrogami · 2023-10-14 15:18 Rip frame.work ---------------------------------------------------------------------- WiseCookie69 · 2023-10-14 15:20 Think through it again. **Example**: The official reddit domain we all now is `reddit.com`, right? Lets take a TLD from the linked list, let's say `.icu` or even `.online`. Plenty of non-technical users might not think anything about it, when they receive an email from `reddit.icu` or even `reddit.online`. They might just glance at the sender's address, see it's from `reddit` and click on whatever link there is in the mail. Gets even worse in corporate settings, or when the email is not phising for reddit credentials, but online banking and whatnot. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 15:21 Because the people back then who host MTA today still don't do it. Only the newcomers who can't configure an MTA do that. ---------------------------------------------------------------------- Im1Random · 2023-10-14 15:25 Thats why I opted for a simple .org domain. They can't block the .com or .org TLD entirely for obvious reasons. ---------------------------------------------------------------------- who_you_are · 2023-10-14 15:30 .zip enter the channel ---------------------------------------------------------------------- 274Below · 2023-10-14 15:33 I'm the owner of all email services for a >50k headcount fortune 50 company that you have heard of. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 15:36 and I'm King Charles. ---------------------------------------------------------------------- crazedizzled · 2023-10-14 15:38 Yeah, that's because the ratio of abusers to legitimate users was not high enough to warrant it. Seriously it's not that hard to figure out. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-14 15:38 As you're probably aware, scammers frequently use domains like reddit.support-online-blablabla.org and that will go over the heads of most users just as easily. When you disable support for essential core protocols in bulk based on arbitrary criteria like this it gives excessive weight to established players and established technologies and "freezes" the whole technological landscape, or at least makes it much harder to move forward. [Moxie Marlinspike had some similar thoughts on this issue.](https://signal.org/blog/the-ecosystem-is-moving/) I get that, if you're dealing with excessive trouble coming from specific TLDs or world regions it can be easier to simply block and forget about it. I think we've all been there. I do geo-blocking for my home server because realistically speaking there's no reason why anybody should connect to it from outside my country. If you run a company and it's all you can do to stay ahead of phishing, you gotta do what you gotta do. But there's a line being crossed between that and preemtively locking large swaths of the internet based on nothing. Or worse, as a means to prevent new MTAs from simply existing, at the advantage of established huge email providers. ---------------------------------------------------------------------- WiseCookie69 · 2023-10-14 15:46 >reddit.support-online-blablabla.org Yeah, but that's much easier to discover and see-through, than something like `reddit.icu`. ---------------------------------------------------------------------- D-ff1 · 2023-10-14 15:55 It is not hard to figure out, that this fight with consequence. Spammers will move back to com/net/org eventually. It does solve 0 problems. It just puts new TLD to the graveyard just after the birth. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-14 16:02 In my experience most non-techies wouldn't be able to tell reddit.support-online.com from reddit.icu from reddit.com. Even tech people have trouble with it. That's why phishing is so hard to stamp out even in tech corporations. ---------------------------------------------------------------------- 274Below · 2023-10-14 16:19 (I thought I was in /r/sysadmin. I am not. This explains things.) Respectfully, I'm not going to be drawn in to ad-hominem attacks that are unrelated to the technical point that I was making. If someone on the internet is arguing that 2+2=5, then I think it's appropriate to challenge their credentials in mathematics. You challenged my credentials, I provided them, and you instead chose to call me a liar. That is not engaging in good faith; that's choosing to ignore the details that others have provided (for reasons unknown to me) and instead insult them. Despite that, I'm still going to respond in good faith to see if you're going to maybe consider the realities of the situation, or if you're just going to continue down this path of chosen ignorance and insults. I genuinely hope that you instead choose to engage in good faith. Your gap in knowledge is based around the economics of spam filtering offerings. Broadly speaking, I agree with you, in that wholesale blocking TLDs is bad practice. While I'm not going to speak to any technical specifics of the organization that I run, I am absolutely willing to say that organizations of my size would never, ever rely on SpamAssassian as any part of their defenses. Blocking a TLD "to help with spam defenses" at this scale would mostly be laughable. Such organizations pay many multiple providers to build a robust, layered series of defenses against all things email related. And in that regard, blocking TLDs is nonsense: if you have the resources to pay multiple (more than three) different vendors who all have their individuals areas of expertise, then you aren't going to be relying on SpamAssassin. Which brings me to SpamAssassin proper. The folks who maintain SA do a wonderful, largely thankless job... *given the resources available to them*. When I have an issue with a spam false positive/negative, I open a case with my vendor, who then analyzes the message, understands why the message was scored the way it was, applies adjustments to the algorithms, pushes the provided sample through a massive machine learning analysis process, vets the changes to ensure that it had the intended effect (without any unintended effects), and then deploys the updates to all of their customers. The SpamAssassin folks have literally none of that. They are doing everything in their power to fight spam with essentially no resources, no funding, no company proprietary samples, no direct integration with IP reputation services, and an entire database that fits in a couple megabytes of space. Comparing the SA folks to a series of dedicated companies, the ways in which they are constrained is absurd. Yet, they still do a pretty good job. And they do such a good job by making tradeoffs. One of those tradeoffs is categorizing specific TLDs as more spammy than others. *Because they are.* Because those TLD operators have policies that are more beneficial to the folks who run spam botnets. Maybe it's cheaper prices, maybe it's a slow to non- existent response time to abuse complaints. The net result is the same: some TLDs are more likely to have spam sent from them than others. And when you're working on a project such as SpamAssassin, when you don't have tens or hundreds of thousands of companies under contract, providing you with sensitive emails under NDA to allow you to update your spam definitions... you kind of have to make some tradeoffs. Like wholesale blocking of TLDs. ---------------------------------------------------------------------- sneakpeekbot · 2023-10-14 16:19 Here's a sneak peek of /r/sysadmin using the [top posts](https://np.reddit.com/r/sysadmin/top/?sort=top&t=year) of the year! \#1: [I recently had to implement my disaster recovery plan.](https:// np.reddit.com/r/sysadmin/comments/zeo31j/i_recently_had_to_implement_m y_disaster_recovery/) \#2: [Gen Z also doesn't understand desktops. after decades of boomers going "Y NO WORK U MAKE IT GO" it's really, really sad to think the new generation might do the same thing to all of us](https://np.reddit .com/r/sysadmin/comments/11k0ed5/gen_z_also_doesnt_understand_desktops _after/) \#3: [I got publicly called out today](https://np.reddit.com/r/sysadmi n/comments/10g78c7/i_got_publicly_called_out_today/) ---- ^^I'm ^^a ^^bot, ^^beep ^^boop ^^| ^^Downvote ^^to ^^remove ^^| ^^[Contact](https://www.reddit.com/message/compose/?to=sneakpeekbot) ^^| ^^[Info](https://np.reddit.com/r/sneakpeekbot/) ^^| ^^[Opt-out](ht tps://np.reddit.com/r/sneakpeekbot/comments/o8wk1r/blacklist_ix/) ^^| ^^[GitHub](https://github.com/ghnr/sneakpeekbot) ---------------------------------------------------------------------- KN4MKB · 2023-10-14 16:22 They do know, but you read like you're at the top of the dunning Kruger curve. Nobody can give you the experience it takes to understand why blocking those domains in the real world helps cut down spam, but at the very least, slow your row. You're aren't as smart as you think you sound. MTA is by no means a rare thing to know. ---------------------------------------------------------------------- Geminii27 · 2023-10-14 16:29 I'd definitely give it a boost up the spam-ratings score by default, yes. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 16:45 You provide no credentials nor do you have any. You are a random person on the web, for all we know you can be running a SPAM botnet and give ill advice on purpose. ---------------------------------------------------------------------- 274Below · 2023-10-14 16:47 If you're not going to respond to the technical points that I made, which are irrelevant to whatever credentials anyone has, then you're not interested in having a discussion. You're right and I'm wrong, and that's not going to change. Best of luck to you in your future endeavors. ---------------------------------------------------------------------- olluz · 2023-10-14 16:47 Are you often receiving legitimate emails from one of these TLDs? ---------------------------------------------------------------------- dom6770 · 2023-10-14 16:58 They removed .xyz. Good for me, my main mail domain is .xyz. Although, since I own one (3 years, I think) I only had like less than a handful of times problems with it. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 17:07 Because blocking by arbitrary conditions is bad, always, regardless of protocol. Its poor mans approach to implement security. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 17:11 Blocking or flagging an Email as SPAM because of the address is pure nonsense. There are many, many better ways. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 17:13 I gave it. There is no reason to block TLD or addressed based on the name. There are better ways to identify SPAM. Blocking by TLD is very poor and shows no technicsl skill whatsoever. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-10-14 17:16 Well, this is about choosing a domain. You can buy email from Google or Apple or Microsoft or Proton, and still use your `@example.com` domain... ---------------------------------------------------------------------- willquill · 2023-10-14 17:19 In 2010, Mexico opened up the .mx TLD for international registration. I got an mx domain immediately and years later made it my primary email, but my credit union’s email notification service can’t send to it. It’s so weird. Both me and my credit union are in the USA. I use mailbox.org as my email host, and it’s pretty great, but I have my spam filter set a little too loosely. Fortunately, it’s easy to spot the spam because it’s the only email I get in Spanish 😂 ---------------------------------------------------------------------- amplex1337 · 2023-10-14 17:24 That's like saying we should lock up the race that commits the most crime statistically, because, it's most likely going to be them committing a crime? Don't you see how bad of a policy that is and how dumb of a trend that would be if we continued with this mindset? It doesn't do anything at all to get to the root of the problem. ---------------------------------------------------------------------- amplex1337 · 2023-10-14 17:26 It basically reads like 'I don't really have time to do my job well' to me. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-10-14 17:27 The reason for blocking specifically [these TLDs](https://github.com/a pache/spamassassin/blob/a0b3d276051e3a9e6e4dca2a264a7690e85a26a3/rules rc/sandbox/pds/20_ntld.cf#L10-L29) is because they are dirt cheap, around $3-$5/year. So they are frequently abused by spammers; and less popular among 'reputable folks'. Nevertheless, I don't believe in blocking the entire TLDs; spam heuristic was relatively effective even a decade ago, before modern 'AI boom'. There are always better ways. As for namesquatting - it's very hard to get something like `simon.com`, but it's still often possible to get `namesurname.com/net/org/email/ccTLD`. Just a bit of creativity usually helps (unless you're John Doe. You will need much more creativity to find a free domain xD). ---------------------------------------------------------------------- amplex1337 · 2023-10-14 17:28 You are over-estimating people ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 17:30 .com is 7$/year and many of the old school TLDs are in the same price range. It's just a lazy idea to block an entire TLD because the TLD is cheap. ---------------------------------------------------------------------- CC-5576-03 · 2023-10-14 17:35 Yeah 99% of all gTLDs are garbage that no one should be using Why would you use any of the TLDs on that list? ---------------------------------------------------------------------- igmyeongui · 2023-10-14 17:35 Most of the spam I get is from known tlds. Com org net etc. You're 100% right from my experience. ---------------------------------------------------------------------- crazedizzled · 2023-10-14 17:36 Yeah, no, it's not like that at all. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 17:38 Thanks but according to this sub I have no experience. At least you get why blocking entire TLDs by default is a bad idea for all the poor people who bought a domain on these TLDs ---------------------------------------------------------------------- agent_kater · 2023-10-14 17:38 > our email server just plain rejects the emails > I have never ever gotten a legit email from any of those. Hm, I wonder how that can be. ---------------------------------------------------------------------- bogdoomy · 2023-10-14 17:46 it’s no different than things like twitch.tv, the way i see it ---------------------------------------------------------------------- LutimoDancer3459 · 2023-10-14 17:50 And then there are companies that use reddit-support.org as there official one... (can't remember which ones but I saw several, even from bigger comps over the years ---------------------------------------------------------------------- Simon-RedditAccount · 2023-10-14 17:57 Out of topic, but where do you find $7 nowadays? The cheapest I'm aware of is Cloudflare with it's 'no markup' cost, and it's around $10. Still cheap though. Most spam that I still see in my Spam folder (as a regular user, and not a postmaster) comes from hacked systems with originally reputable domains (i.e., some Brazilian university). I guess, everything shady without valid DKIM/SPF or mass mailed even does not make into Spam folder. ---------------------------------------------------------------------- BigLan2 · 2023-10-14 17:59 I think it's pizza hut in the US that won't allow you to use a foreign email to even create an account to order pizza. .co.uk doesn't work 🤦‍♂️ ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 18:00 Correct, that's why blocking TLD is nonsense, DKIM/SPF and more are way better to verify at least authenticity of the sender (could still be SPAM). ---------------------------------------------------------------------- hannsr · 2023-10-14 18:02 https://yourmom.zip/ ---------------------------------------------------------------------- soft-wear · 2023-10-14 18:05 I’m sorry but regardless of your stance on this issue suggesting that blocking TLDs results in less SPAM is very much a ends justify the means argument, and it’s stupid anyway since blocking .com would result in considerably less SPAM than any of these domains. The approach is way more nuanced and has to be a balance of blocking SPAM and almost never blocking legitimate email. It’s possible that these tlds do, in fact, fit that requirement, but your weird ass appeal to authority, personal attacks and complete misunderstanding of the goal of SPAM blockers isn’t helping your case. ---------------------------------------------------------------------- D-ff1 · 2023-10-14 18:06 all the time ---------------------------------------------------------------------- AdrianTeri · 2023-10-14 18:08 It's been long known from the trenches that running your own mail server is simply futile! https://hackaday.com/2022/09/07/the-era-of-distributed-independent- email-servers-is-over/ ---------------------------------------------------------------------- olluz · 2023-10-14 18:08 Like what? ---------------------------------------------------------------------- Daniel15 · 2023-10-14 18:10 .com hasn't been that cheap in a long time. IIRC the wholesale price is close to (or even over) $10 now. ---------------------------------------------------------------------- Daniel15 · 2023-10-14 18:13 I run my own email server. Two actually - one is a secondary/backup SMTP server in case the first one goes down. However, I do use an SMTP relay for outgoing emails. That's one thing I won't even try to deal with. I like having control of storage of my emails, indexing them in Solr for fast searches, etc, but someone else can deal with getting Hotmail/Outlook to accept my sent emails. ---------------------------------------------------------------------- Daniel15 · 2023-10-14 18:14 Not many providers use SpamAssassin any more (most have moved to rspamd), but I think there's similar rules for rspamd too. Rspamd can import SpamAssassin rules, too. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-10-14 18:31 Even if it's a .com address, hosting a mail server at home on a residential IP will lead you to being banned just by IP association OK so you host it in a DC somewhere with a non-residential IP Nope, now you're still banned by association because of someone else There's a spam provider that banned a /11 range in Azure for some fuck reason Hosting mail yourself sucks, you can receive but god damn it's hard to send ---------------------------------------------------------------------- death_hawk · 2023-10-14 18:32 paypal.com.cgi-bin.payments.blahblahblah.tld got some people because the first part is paypal.com. What's even worse is that paypalobjects.com and paypalcommunity.com are legitimate. paypal.com is trusted. They should have used objects.paypal.com instead because what's stopping the first guy from registering paypal- support.com or paypal-help.com? ---------------------------------------------------------------------- BouncyPancake · 2023-10-14 18:51 Our emails can get thrown in spam because we messed up a simple thing but VERY common and known domains that are legit spammers and scammers can roam free and harass us daily? I LOVE EMAIL ---------------------------------------------------------------------- Makeshift27015 · 2023-10-14 18:54 Oh good, my .ninja domain is still okay! ---------------------------------------------------------------------- Makeshift27015 · 2023-10-14 18:56 Many sysadmins block entire country IP ranges, which is pretty similar ---------------------------------------------------------------------- trisanachandler · 2023-10-14 18:56 I remember one admin used to block /16's, it always drove me nuts. And they'd refuse to unblock a single IP because it had bad neighbor's. So many /24's were blocked. This was for a regional ISP with a few million customers and far too many used their email. ---------------------------------------------------------------------- UnacceptableUse · 2023-10-14 19:14 Is that from an unfiltered source or is it because all the other tlds are filtered automatically? Or spammers have realised that there's no point in using these tlds ---------------------------------------------------------------------- igmyeongui · 2023-10-14 19:19 I'm not an expert that's only what I see on gmail. ---------------------------------------------------------------------- CrazyTillItHurts · 2023-10-14 19:20 Wow. A real life, basement-dwelling neckbeard. Can I have your autograph? ---------------------------------------------------------------------- bubblegumpuma · 2023-10-14 19:23 I think they're aware they're painting with a little bit of a broad brush, [since it seems like they do remove TLDs if they become used more often for legitimate purposes.](https://github.com/apache/spamass assin/commit/70c51bd19747f67db4fa6bb72478f55a284adfd7) FWIW, the only TLDs that I've seen used for legit websites that have been .xyz, .space (now removed, as of that commit I linked) and .online. I kinda understand why .xyz got on there despite being an appealing looking TLD that many legitimate websites now use, because they offer sub-1 dollar new domains in a variety of ways, and so it became a port for spammers. I recognize many of those other TLDs for being particularly cheap but unappealing for my purposes, like .cyou, which I believe is now one of the most commonly abused TLDs. I've pretty much only seen it used for spam websites, personally. ---------------------------------------------------------------------- DreamLanky1120 · 2023-10-14 19:28 It's difficult, I think it's problematic to block things on a large scale, but then I block .zip and .mov domains on a network-wide basis. I think for an individual or a company, it can be a reasonable decision to block things that just aren't needed and can be a risk. It's like shutting down services you don't use to reduce the attack surface. That's the right way to go, and on an individual basis you can consider your needs or even change them later. If someone like Google decides that we all probably don't want .fit emails, then that's a problem, even if they think they know, they don't know what I want. ---------------------------------------------------------------------- urielsalis · 2023-10-14 19:32 But you can't get google.randomTLD and start sending spam from it before Google buys it back ---------------------------------------------------------------------- urielsalis · 2023-10-14 19:33 Gmail filters things before it even reaches your spam folder ---------------------------------------------------------------------- KN4MKB · 2023-10-14 20:25 As someone who hosts there email on own of these odd TLDs, I understand the bias one may have against it. But you have to realize, in the real work, most real email addresses are your top several TLDs, and the majority of the rest result in spam mail. You can talk about the ethics of it all, or what should or shouldn't be, but in the real world, with real statistics and results, blocking these TLDs for end users make since. As much as I hate that too, it DOES result in a better security posture. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 20:26 but that's what some here are suggesting, that google should block .fit since it's best practice to do so, and I say no like you, that's bad practice and will and does hurt anyone on .fit that is a legit business or person. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 20:27 No it doesn't. It just prevents SPAM from these domains but not all the other 200 TLDs. ---------------------------------------------------------------------- KN4MKB · 2023-10-14 20:29 As someone who hosts there email on own of these odd TLDs, I understand the bias one may have against it. But you have to realize, in the real work, most real email addresses are your top several TLDs, and the majority of the rest result in spam mail. But you are right, it is an ends justify the means argument. In this case the ends DO justify the means, and for most companies that's all that matters. You can talk about the ethics of it all, or what should or shouldn't be, but in the real world, with real statistics and results, blocking these TLDs for end users does improve a networks security posture, without much drawbacks except for when of us rare breeds come through and have issues with it. As much as I hate that too, it DOES result in a better security posture. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 20:31 "Best" practice, says it all. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 20:31 and equally wrong. You can block DDoS when it starts or Russia because you hate Orks, but other than that you do deny legit people access. ---------------------------------------------------------------------- m50 · 2023-10-14 20:33 Not sure why you are downvoted. As someone who worked on self-hosted anti-spam software, can confirm, hosting yourself has a LOT of risk. You gotta really be vigilant about your IPs cleanliness. Even hosting in AWS has a lot of risks. Hosting your own mail is definitely something you only do if you have a full time team managing it. ---------------------------------------------------------------------- braiam · 2023-10-14 20:39 > Test rule QA scores indicate that xyz and site are no longer consistent indicators of spam The latest commit on that file. Seems like they are learning that TDL's alone aren't enough as a signal of spam. The list is also super short. ---------------------------------------------------------------------- KN4MKB · 2023-10-14 20:41 This has to be a troll. I'm out. ---------------------------------------------------------------------- trisanachandler · 2023-10-14 20:51 Best practices are often decided by whoever does it first, not who does it best. ---------------------------------------------------------------------- readit-on-reddit · 2023-10-14 20:51 By that logic the free market will never be able to provide dirt cheap TLDs. Sadly, crude and lazy broad brushes are extremely common in IT by people who seemingly don't like their jobs. ---------------------------------------------------------------------- SelectCase · 2023-10-14 21:15 If you get picked up by Google's auto phishing/spam/malware detection, your IP and TLD is fucked even if they correct it after an appeal. A ton of spam blockers/anti-malware providers take the domains Google blacklists, but also don't update their lists after a domain is removed from Google's list. My domain ended up on the list after Google identified my log-in page as phishing by mistake. Even though Google corrected their mistake and removed me from the list months ago, my email with my custom domain name is still randomly getting blocked, even though I don't self host it. My friends' and parents' antivirus software is still blasting them with warnings when they access Jellyfin or other services on my domain, even though Chrome isn't. To add insult to injury, I couldn't even log into my Internet provider's website to pay my Internet bill from my own home network because my IP was blocked by their firewall for being associated with the marked domain. Luckily, jokes on them because I don't have a static IP, so I literally just had to reboot my router to pay my bill. If I was a small business with a static IP, one false ID could have potentially wrecked a good chunk of my business. ---------------------------------------------------------------------- GrumpyCat79 · 2023-10-14 21:32 Most of the spam I was receiving about a year or two ago, when I setuped my mail server wwas from .xyz domains and I never visited a legit site with this TLD so I used to mark all emails from that TLD as spam That being said, I manage only my own emails and I am not a maintainer of a widely used spam software! ---------------------------------------------------------------------- GimpyGeek · 2023-10-14 21:37 Yeah, blocking new TLDs is stupid. We need things to not cost a fortune sometimes with crazy cybersquatting and new TLDs help with that, they also help with just the inevitable fact that the number of sites out there is constantly growing. I also think the blocked TLDs are stupid too because most domain owners using most domains would expect company/group/whatever email to come out of it at some time. If an entire TLD is blocked from most email systems, it would be stupid to even get one of these TLDs over something not banned, why even bother if you're going to have to buy a different one just for email, that doesn't match your real website, then makes your incoming emails look extra shady because they don't match your real website. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 21:46 Correct. Same argument would be to block LetsEncrypt because it can be used for phishing and more. ---------------------------------------------------------------------- crackanape · 2023-10-14 21:47 Which one? And is it your own domain or an actual outside party that you communicate with? ---------------------------------------------------------------------- readit-on-reddit · 2023-10-14 21:54 I always assume these crude broad stroke approaches are done by people who barely understand cybersecurity and honestly don't like their jobs. It just leads to inefficiency because now cheap domains are impossible because spammers like cheap domains too. Selfhosting your email is also an almost insurmountable task purely based on arbitrary constraints. Same thing with blocking IPs of a whole country. I bet the Venn Diagram between these people and the ones that change default ports and default usernames "for security" is a perfect circle. ---------------------------------------------------------------------- ElevenNotes · 2023-10-14 21:56 Thanks, you made me laugh with the Venn Diagram 😝, at least someone who gets why its a bad practice and should not be endorsed. ---------------------------------------------------------------------- readit-on-reddit · 2023-10-14 22:02 You have to realize your argument is just not rigurous. I can also invent arbitrary rules on the spot like: 1. Blocking domain names that don't look like english words or a simple combination of english words. 2. Blocking everything that isn't ".com" 3. Blocking emails with spelling errors With the rules above I guarantee the number of spam emails will also reduce. That still doesn't make it a good idea because the other side of the coin is all the false positives you also introduce. But false positives is something a lot of lazy IT admins just don't give a fuck about because is too abstract of a concept to them. ---------------------------------------------------------------------- neumaticc · 2023-10-14 22:16 or you could use mail.com e,g if your site is `poop.ooo` you can use `poopmail.com` ---------------------------------------------------------------------- ohlawdyhecoming · 2023-10-14 22:23 My work domain has apparently been graylisted by AOL/Yahoo/Oath, etc. Makes it impossible to e-mail customers, have to use my personal gmail account to get it done. Rather annoying. ---------------------------------------------------------------------- CripplingPoison · 2023-10-14 22:24 We've been using a .io (not on the list) for email on O365 E5. It's properly set up and scores 10/10 on Mail Tester. Our emails are silently dropped every so often. No bounce email or anything which sucks if you're trying to follow up with a vendor or customer. Considering the cost of .io it's probably one of the least likely TLDs to be used for spam, but there are still a ton of legacy email systems in use that drop 'unknown' TLDs. We will likely move to our .com for email some time in the future. If any of you were considering to set up email with a .io I'd strongly advise against it. Definitely stick to the main ones, a .com if you can. ---------------------------------------------------------------------- aztracker1 · 2023-10-14 22:27 A lot of places won't let you use new tlds either I started using *@myname.dev so I could start tracking each site separately a couple years ago. Quite a few only take com, net and org. ---------------------------------------------------------------------- VoXaN24 · 2023-10-14 22:37 So I need to bye 2 Domain because of this (idiot) idea ? Seems to be a $$$ solution ---------------------------------------------------------------------- asap_spergie · 2023-10-14 22:57 The age of many of the users in here is showing heavily 😂 ---------------------------------------------------------------------- mmslist · 2023-10-14 23:28 2.0 score still gets you in inbox on most systems. Now, if your emails have a spam-prone TLD but also no DKIM/SPF, mismatch/spoofed headers and other red flags, in all fairness, the high score you get is probably deserved. ---------------------------------------------------------------------- DazzlingViking · 2023-10-14 23:46 Yet most of the spam emails I get are from outlook, gmail or hotmail addresses ---------------------------------------------------------------------- StebeJubs8000 · 2023-10-14 23:48 > Using SA in 2023 tells me everything I need to know about your background and your "credentials". If you'd actually read their post, you'd see that their company doesn't use SA. You're really coming across as a tremendous tool here. ---------------------------------------------------------------------- donniebatman · 2023-10-15 00:01 Sucks for you. ---------------------------------------------------------------------- zarlo5899 · 2023-10-15 00:35 \*buy ---------------------------------------------------------------------- HexTrace · 2023-10-15 00:54 > Should we have a separate email domain like domain-icu.com ? It may look spammy. Sadly you should probably own that one anyway to prevent spammers from using it. ---------------------------------------------------------------------- Digital_Warrior · 2023-10-15 00:57 Outstanding ---------------------------------------------------------------------- primalbluewolf · 2023-10-15 01:41 > and equally wrong. You can block DDoS when it starts or Russia because you hate Orks, but other than that you do deny legit people access. Hardly a necessity. For instance, your service may not be open to people located in other countries, as an example. ---------------------------------------------------------------------- neumaticc · 2023-10-15 02:47 a .com is $3 ---------------------------------------------------------------------- maomaocake · 2023-10-15 02:51 It's bad practice sure but the people maintaining SA AFAIK don't get paid. They quite literally don't get paid enough to care, if it works well enough 90% of the time then that's what sticks. you are welcomed to contribute your effort. ---------------------------------------------------------------------- maomaocake · 2023-10-15 02:53 that's because most providers drop weird TLDs before it even reaches your spam box ---------------------------------------------------------------------- ithakaa · 2023-10-15 03:26 welcome to self hosted email ---------------------------------------------------------------------- igmyeongui · 2023-10-15 03:38 from your knowledge my experience 100% sucks haha ---------------------------------------------------------------------- theBloodShed · 2023-10-15 03:38 For anyone wondering, these top-level domains do not appear to be banned. I haven’t spent the time to dig through the SpamAssassin code (plus I’m on my phone atm), but it looks to me that this list is simply one criteria for scoring. ---------------------------------------------------------------------- nik282000 · 2023-10-15 03:56 Maybe in 1999 ---------------------------------------------------------------------- selfhosted-ModTeam · 2023-10-15 03:56 Hatespeech, Harassment, or otherwise targeted content at an individual designed to degrade, insult, berate, or cause other negative outcomes are strictly prohibited. ---------------------------------------------------------------------- nik282000 · 2023-10-15 03:59 You son of a bitch. I had banged-your.mom for a while but they jacked up the price. ---------------------------------------------------------------------- fmillion · 2023-10-15 05:02 When the list of TLDs was much smaller, it was (and still is, I think?) common to simply match the last part of the email address against the list of known valid TLDs as part of input validation. All you needed was .com, .net, .edu, .gov, .org, and a handful of country domains like .uk, .us, etc. Then the IANA went and did the vanity TLD thing, which I still maintain was more of a money grab than anything, not to mention making a much bigger issue for trademark holders. If you're Walmart, Apple, Microsoft, etc. you basically have to buy microsoft.*everything* or apple.*everything* etc. to prevent squatters--and even worse, scammers --from abusing your trademark. ---------------------------------------------------------------------- ElevenNotes · 2023-10-15 05:10 VPN exists. ---------------------------------------------------------------------- ElevenNotes · 2023-10-15 05:11 By not using SA, correct. ---------------------------------------------------------------------- ElevenNotes · 2023-10-15 05:15 Just to let you know I did not edit my post because of that. I still don't and will never believe random people on the internet about their so called "credentials". That you felt the need to flex with your job tells me more about you than you intended. A lot of people do that here, shows their immaturity and wrong world view. I simply don't care what you do, but its a reason to block you. ---------------------------------------------------------------------- silaswanders · 2023-10-15 05:32 God damn it. I have a .tv domain and my clients haven’t been getting my emails, even though they usually start the thread first. It’s not on this list, but it’s the only thing that makes sense. Thanks. ---------------------------------------------------------------------- ArtSchoolRejectedMe · 2023-10-15 05:38 Someone should start trolling, create a PR adding the .com TLD lol ---------------------------------------------------------------------- primalbluewolf · 2023-10-15 05:41 At that point, its not that its a VPN that is relevant - its that its a proxy. And sure, thats true. Doesnt change the calculus any. Zero false positives, far reduced false negatives. ---------------------------------------------------------------------- jacobwlyman · 2023-10-15 06:03 What would you say would classify as a “recently bought domain”? Is there a range? ---------------------------------------------------------------------- AdrianTeri · 2023-10-15 06:06 For those in need of **archiving** emails(private/home use) there's a solution for that. Sure it's proprietary software but for a certain demographic of pple(your parents & grand-parents) it provides a good experience for them as the "tech support" bit is only setting up credentials ... https://www.mailstore.com/en/products/mailstore-home/ ---------------------------------------------------------------------- BarServer · 2023-10-15 06:12 Oh, you won't believe how many "mail domain checks" I've encountered which only checked for like .com/.net/.org and such. It's so sad that DNS was given to us by the gods and no mere human can understand it and teach it inner workings. (If you find irony and sarcasm in this post you can keep it to yourself. "Finders keepers" after all. ;-) ) ---------------------------------------------------------------------- corporat · 2023-10-15 06:49 I own the .com for every one of my domains, so maybe 20-25 domains total ---------------------------------------------------------------------- lionep · 2023-10-15 07:07 And fortunately I bought all those domains in the same time, so dates are ok, and age of domain is mostly something checked by spam filters ---------------------------------------------------------------------- jkirkcaldy · 2023-10-15 07:11 That’s the problem when email is hosted by three companies. There may be better ways to do it, they may even be doing it those ways, but when you’re hosting for millions of people, any decision you make is likely to negatively impact *some* of your users. ---------------------------------------------------------------------- hannsr · 2023-10-15 07:50 There's also https://yourdad.zip/ . ---------------------------------------------------------------------- VoXaN24 · 2023-10-15 07:54 Good for you if you like to pay 200-250$ extra because some dev think it’s better to block a whole tld than make improvement in they’re software. But some pp don’t have the extra cash for it ? ---------------------------------------------------------------------- VoXaN24 · 2023-10-15 07:55 ~10$ a year (cloudflare domain) ---------------------------------------------------------------------- flecom · 2023-10-15 07:57 > I now use GMail for my domain exclusively. Just not worth the effort. we should just use google for everything, someone should tell amazon and microsoft to pack it up ---------------------------------------------------------------------- flecom · 2023-10-15 07:58 I run my own mail server, it works just fine when I can't I'll just stop using email, fuck google ---------------------------------------------------------------------- flecom · 2023-10-15 07:59 well ya, you're a ninja, if they blocked you that could end poorly for them! ---------------------------------------------------------------------- VoXaN24 · 2023-10-15 08:02 Bitcoin is used to commit fraud, so we ban Bitcoin ? ---------------------------------------------------------------------- Bonsailinse · 2023-10-15 08:17 They gave you a detailed explanation of technical aspects about the topic, showing a good understanding of the underlying problem. You just sit there and say "Nah that’s wrong." And nothing else. You really should think about how you engage in conversations because the way you do at the moment is typically reserved for situations in which both parties sit in a sandbox. ---------------------------------------------------------------------- fractalfocuser · 2023-10-15 08:31 I've yet to run into TLD deliverability issues but I got a funny vanity domain recently that I've been meaning to spin up a mail server for. Wonder if I'll run into this. My experience is if you do DMARC properly you'll get pulled out of that list because so few people fully implement DMARC ---------------------------------------------------------------------- ElevenNotes · 2023-10-15 08:45 Good thing I host email too for thousands of people 😁 ---------------------------------------------------------------------- RudolphDiesel · 2023-10-15 08:50 I see how that can be read the way you did. I have never gotten a legit email as long as those TLDs were still able to send an email to us. And I have never gotten a single complaint from legit email Senders that they cannot send emails either. So, I guess the 80+% of spam that we do no longer get is worth it. ---------------------------------------------------------------------- roman5588 · 2023-10-15 09:52 Russia, NK, China all blocked on my networks. Throw in a few bad actor ASN’s and my IPS is far quieter. ---------------------------------------------------------------------- Geminii27 · 2023-10-15 10:20 Flagging it as spam doesn't make it impossible, just harder. ---------------------------------------------------------------------- khoyo · 2023-10-15 11:24 That's just one of the devs personal "sandbox" config. Not a default rule. And it doesn't even look like they actually refuse the mail, just increase the badness score. ---------------------------------------------------------------------- m50 · 2023-10-15 12:09 I disagree.... And I think Microsoft has an alright offering for mail as well. But email is the one thing I absolutely will not self host, and definitely keeping it with Google who is my preferred provider. ---------------------------------------------------------------------- sowhatidoit · 2023-10-15 14:36 Good question. For me it was a week. But I don't know exactly how old it needs to be. ---------------------------------------------------------------------- Cerberus_ik · 2023-10-15 15:30 What your domain or ip was used to send spam 10 years ago? Good luck trying to get it out of an ancient spam list that has 50 million entries ---------------------------------------------------------------------- DreamLanky1120 · 2023-10-15 17:00 The big providers scan your mail for ad targeting, so I would think at this point they should have more nuanced detection than blocking a TLD. I think it's just money, adding to your targeting profile is worth it to them and spam filtering is not. So they take the easy way out with spam filtering to save resources. ---------------------------------------------------------------------- Daniel15 · 2023-10-15 18:21 For my own archival purposes, I'd just set up mbsync or a similar open source program, rather than using proprietary software. ---------------------------------------------------------------------- Namaker · 2023-10-15 21:11 Me with selfhosted mail on a .cool domain 😎 ---------------------------------------------------------------------- grumblesmurf · 2023-10-15 22:44 Spamassassin only modifies the score for those domains, they're not blocked. Unless you write spammy emails or disregard certain best practices for email (eg. no HTML-only emails, it should be mime- multipart with text and html) you shouldn't have too much to worry about. That being said, I have a similar list in my postfix blocked domains list. Send me mail from your .nft domain and your email will be outright rejected, and rightly so :) ---------------------------------------------------------------------- neumaticc · 2023-10-16 00:02 t'was just an idea you do you my guy ---------------------------------------------------------------------- aztracker1 · 2023-10-16 04:31 For web forms, is ready enough to verify an mx record for the domain part. Beyond this, everyone should verify the email address before completing any positive action anyway. I get a lot of emails from orders that I didn't make because people that don't know how email works use my email address. I mean you can place orders on MLB.com and other websites without actually confirming your email address. It's annoying. ---------------------------------------------------------------------- Low-Chapter5294 · 2023-10-16 16:02 Too funny! ---------------------------------------------------------------------- ClimberCA · 2023-10-16 18:03 A couple of years ago I got a .fun TLD. I could not figure out why 50ish% of my email was getting dropped or put in the spam folder. Then I found out that .fun had a bad score. I ended up realizing I was defeated and moved to a .ca and everything was fine after that. 🙄 ---------------------------------------------------------------------- VoXaN24 · 2023-10-16 21:24 An non-cost effective idea, The TLD blocage is just an absolute idiot idea. ---------------------------------------------------------------------- sysop073 · 2023-10-17 23:24 It's more of a $ solution. Maybe a $/2 solution.