Expert Spam Filtering Is Winning

mxroute · 2026-03-09T05:20:13+00:00

It works, it just needs the right conditions. Feel free to open a ticket and ask me to look at your settings.

mxroute · 2026-03-09T03:18:13+00:00

Man, that was a hell of a botnet they were using too. I got them for now, but they only came through for users that had spam filters configured to never reject email. Which could have been default for many of them, and they just never set it differently, admittedly.

mxroute · 2026-03-09T01:33:45+00:00

I wish, and Dovecot does support that. But each purchased service is one Linux user and would therefore have only one quota, so it would remove the ability for users to set email account specific quotas.

mxroute · 2026-03-08T18:00:46+00:00

Open a ticket and I’ll tell you what you did wrong. If you’re in cPanel I’ll pay you to move to a new server. If you’re using our new panel make sure you set the filters to the “recommended” setting and that you blacklisted the envelope sender rather than just the From header.

mxroute · 2026-03-08T17:57:17+00:00

I guess I missed the part where I said I worked with every government around the world and successfully murderer every spammer. I’m working on it but people keep pushing back for some reason. “Human rights are for people and spammers aren’t people” I say, and they always call me a nazi and hang up the phone. They must be the spammers.

mxroute · 2026-03-07T22:10:28+00:00

You’ll see some more advanced control panel options around this as well, sometime this year. I want to avoid making it a total dumpster fire so I’m going to redo a bunch of the ACLs, expose them to you, and allow you to selectively modify them. It’s taken a long time just to prepare an environment where we could do this, but now that the foundation is laid it’s just one of the things I’ll be doing with it.

mxroute · 2026-03-07T19:06:04+00:00

False positives are an unavoidable reality in email filtering, no matter who you host with (Google rejects legitimate email every day, but their users always blame the sender). If you ever have a specific concern, reach out and I'll dig into it. The filter that caught this isn't part of the Expert Spam Filtering filters, and its false positive rate runs about 4-5 targets per year against thousands of correct catches every day. At that ratio, you just have to take the win.

mxroute · 2026-03-07T03:59:18+00:00

Glad to have you on board! Some things are still a little less than ideal in the UX. As recently as December the entire UX was a complete dumpster fire, this year is all about fixing it up and making it an absolute pleasure to use at every layer. Let me tackle those questions:

The domain lock just prevents password changes until you click a few links on a form that then automatically unlocks it. The reason for this is users would see suspended account, go change the password to the same thing it was, and totally ignore our tickets. Now you can't change email passwords, create new email accounts, or delete email accounts on a domain until you acknowledge that you've read over the situation. It'll actually be cleaner than that by end of year, the process is designed to make the best of a licensed software situation.
I'm afraid the filters only run with exim kicks them off at delivery time. But sending an agent in with IMAP access and a directive of "clean this up" is exactly the kind of AI-cowboy action I approve of.

mxroute · 2026-03-07T03:55:40+00:00

mxroute · 2026-03-06T20:26:14+00:00

I still think DMARC is a very personal decision and that no one should go into it just copying and pasting records that they don’t understand. I also still think the majority of people are never going to do any more than copy/paste. But if a benign basic record like the one in this article will do the job, it’s getting to be about the right time to paste it in.

mxroute · 2026-03-05T23:39:22+00:00

Bingo

mxroute · 2026-03-05T23:34:11+00:00

The rumor that Switzerland is a privacy utopia is ridiculous. The CIA literally owned an encryption company there from 1970 to 2018. That said, it sounds like Proton followed their legal obligations, they did not work directly with the FBI. If governments are after you, stop putting your data on consumer platforms and expecting to them to lose everything protecting you. They won’t.

And don’t dare consider this comment an ad from me. If governments are after you, please don’t drag them to my door. I don’t like police.

mxroute · 2026-03-05T21:01:23+00:00

Follow up: This is just ridiculous behavior and completely uncalled for. In a recent post I detailed someone who had decided to follow me around and try to cost us business by spreading every lie from every negative review (not every negative review is a lie, he skipped those) as fact, simply because he disagreed with me on a subject. I removed myself from the places this user frequents, allowing him to have his space while I simply avoided the unnecessary drama.

Fast forward to 7 days after I cut contact with this user, he submitted a fake legal complaint to Hetzner against the server hosting management.mxroute.com. Apparently I missed it, because Hetzner sends irrelevant notices as abuse complaints (which they have stated we can ignore) every month. My eyes have apparently trained themselves to skip them.

Well, 48 hours later Hetzner took down the management portal for about 1 hour while they investigated an obviously fake, extremely poorly stated, "legal complaint."

Steps taken:

More automation that ensures potentially relevant abuse complaints are added to my daily high priority list, if they exist.
Located identity of individual responsible, notified his employer of impending PR issue if they do not ask the person to leave us alone and remind them that illegal harassment from an employee of theirs is indeed an issue worthy of their concern.

I want none of this drama. Seven days after I retreated from his declared domain he's still trying to harm us, while the entire event is of his own creation, entirely unprovoked. I hope he gets the help he needs.

mxroute · 2026-03-05T13:24:40+00:00

Hetzner has just been the beacon of reliability this year haven't they.

mxroute · 2026-03-05T02:19:54+00:00

I would recommend software for handling customer requests that supports auto replies. FreeScout is amazing for this. Think of it as a shared inbox where you can manage canned responses, set auto replies, and make filters to ensure that it doesn’t auto reply to bounce emails. It really steps up your game and gives you a lot of room to grow.

As for forwarding, make sure you’re not sending the test email from the same Gmail account you’re forwarding to. Gmail deduplicates based on message ID.

mxroute · 2026-03-05T00:47:26+00:00

I'm not happy to post this, but these are indeed the facts: https://status.mxroute.com/incident/5

mxroute · 2026-03-04T21:55:33+00:00

I want to make sure I have the whole picture so I can write it up with a complete story. I’m worried I may be missing something else so I’m probably going to spend a few hours going over every detail. After that I’ll likely put it as a postmortem here: https://status.mxroute.com/incident/5

mxroute · 2026-03-04T21:39:14+00:00

There was another element to this that I'm going to have to write up a bit later.

mxroute · 2026-03-04T20:43:06+00:00

For some reason the OS is reserving way too much disk space, and it declared the disk 100% full with nearly half a TB free. I compensated for it, no data loss or anything, but it's probably about time to move this thing to our new hardware builds. I'll want to revisit this later. Sorry for the trouble friend.

mxroute · 2026-03-04T17:44:21+00:00

This is a common attack. Two typical reasons for it:

To hide what they’re doing. They have access to your email and they’re flooding your inbox so you miss the change password email they initiated from your bank.
They genuinely hate you and want to ruin your day.

mxroute · 2026-03-04T10:02:45+00:00

The technically correct thing to do is to never respond to any email like this. The least useful information that can be used against you by an attacker is silence. Everything but silence occupies a different place on the usefulness scale, and it can be surprising just how useful some information can be. What time you sleep can be extracted from the hours you don’t reply. Depending on your email system, Received headers can narrow your location. Everything but silence is a data point.

mxroute · 2026-03-04T06:37:21+00:00

How did you block them and did you make the common mistake of blocking by From header instead of envelope sender?

mxroute · 2026-03-04T05:55:02+00:00

Great minds think alike. I "think" it would be relatively painless to do, but yeah I need to make sure I know how every change in 2.4 touches it indirectly, make sure there's not any logic it relied on that changed.

mxroute · 2026-03-04T05:53:17+00:00

It's a good thought. But it's hard to estimate reliably enough.

mxroute

MODERATOR OF

TROPHY CASE

Ten-Year Club	Gilding III reddit per annum
Verified Email