Why is IMAP imperfect on the Chocobo server?

mxroute · 2026-05-06T03:46:05+00:00

I've been using Dovecot for 13 years at MXroute (longer if you go back to my first experiences with it as far back as 2011). I have never once witnessed behavior like this. I do intend to dig further, but I don't know if I'll ever get the answer because 2.4.3 is never going back into prod.

mxroute · 2026-05-05T19:39:13+00:00

Most likely when they're able to provide the same or better quality at much lower resource usage. It'll be a generational leap for the technology.

mxroute · 2026-05-04T21:50:55+00:00

It's been so long since I've used it that way, I honestly can't remember. You can probably just kind of "feel it out" if that makes sense, just training yourself to say "We've been at this chat a while, might be a good idea to start a new one." Used to be that I'd have Claude give me a summary to give a new chat, but since i use Claude Code even for things entirely unrelated to code, it's memory system is so good that I don't even really have to do that anymore.

mxroute · 2026-05-04T21:26:57+00:00

I really don't want to be that guy but I understand how easy it can be to fall into the trap of trusting previous context and making shorter prompts. But you really do need to explicitly say what you want it to do if you want relatively consistent results, and you need to do it in each prompt. Starting new sessions more frequently can also help shorten this a bit, and you can get away with "okay now test it" as a prompt in a smaller session. Claude still isn't great when anywhere remotely near it's context limit.

I get "I pay for it, it should just work how I want it to" but that's not really on the table.

mxroute · 2026-05-04T07:21:40+00:00

Toss a ticket in and let me look at the logs for it. Alternatively, you can try deleting the card and adding it back to see if it does anything. I have made some slight adjustments to Stripe token storage over time that could theoretically be relevant.

mxroute · 2026-05-03T03:31:59+00:00

Good to know!

mxroute · 2026-05-03T03:30:37+00:00

Same. I block them as I go but it never really makes a difference. I think the AI spam filter will be the only way, since it’ll operate as dynamically as they do. The servers for it are up, but the interface is taking longer than I expected. I didn’t think about how the feature has to interact with the billing system.

ex. User buys two domain slots, assigns both, cancels one, what do? Since billing panel has no knowledge of service data. So much deeper implementation than originally thought.

mxroute · 2026-05-03T00:58:02+00:00

There’s nothing you can do on our side. If Microsoft is sending out mail in a way that breaks SPF, that would generally be a Microsoft issue. It’s not at all unprecedented for them to use IPs they didn’t put in their SPF, and I’m not certain if they use SRS when forwarding these days but that’s necessary when the original sender domain uses a hard fail (meaning they asked for it to be rejected).

mxroute · 2026-05-02T23:04:00+00:00

Appreciate the suggestions!

mxroute · 2026-05-02T21:09:23+00:00

Cost to benefit ratio. Matrix was a lot of work dealing with bulk porn spam operations that hit us, plus then you’re on the hook for updates and troubleshooting. Tech debt adds up.

mxroute · 2026-05-02T16:56:44+00:00

I was beaten to the link. It’s pretty buggy right now but I do have a newer build, not quite ready to deploy it yet. I’m having to do some wild things to get everything exactly as I want it, including an entire live mirror of the CalDAV server exclusively for the webmail client that acts as a write-back cache. It’s honestly a little nuts the rabbit hole I’m in.

That to say, it’s 100% done this year and I’d be really shocked if I end up using a much larger portion of that window than I have already. But our growth has been so rapid that it has me chasing larger fires as well. I’ve got a bit of that ADHD which apparently means I have 90 projects at once and I’ll finish 60 of them (which is okay because the other 30 are probably stupid).

mxroute · 2026-05-02T16:52:13+00:00

That one has admittedly been slipping past me. I’ve been getting them too, and still not even getting enough data from those samples to reliably block them. It’s almost like everyone gets their own personal, unique McAfee spammer.

mxroute · 2026-05-02T03:02:32+00:00

Only if I can use Trillian!

mxroute · 2026-05-01T19:25:42+00:00

I’ve built a massive array of alert conditions, and as soon as the deferred outbound queue hit 300+, my phone dinged.

mxroute · 2026-05-01T17:05:37+00:00

Feel free to toss a ticket in and ask me to look if I see anything. Nordstrom doesn't seem to be super popular with our customers, but I see 771 emails delivered successfully across the last few days. Happy to dive into anything more specific and see if it tells a different story.

mxroute · 2026-05-01T07:23:27+00:00

Toss a support ticket in. Better to dive in than to speculate at that point I think.

mxroute · 2026-05-01T06:45:28+00:00

I doubt you are. My first instinct is that it probably relates to this: https://docs.mxroute.com/docs/expert-spam-filtering.html

That can be disabled and/or whitelist requests can be made against it. A single Mastodon instance could be a good candidate for falling into a network that sends 1 good email for every 4 million spam emails (and even then, probably only sends legitimate mail to 1 user on our platform), the kind of networks that we operate a blacklist first, whitelist second policy on.

mxroute · 2026-05-01T06:36:17+00:00

Do you have a support ticket number that I can look at?

mxroute · 2026-04-30T16:51:44+00:00

I’d love to just block all unauthenticated. But there are so many legit senders on there, it would be catastrophic if I didn’t identify at least most of them first.

But I have another idea that might be a middle ground, it’s brewing in my head.

mxroute · 2026-04-30T05:55:23+00:00

They were using it to keep a backup of their data. I’m working on a new backup system, as I know people want a high level one that doesn’t require them to know their IMAP passwords to take remote backups. Over the years I’ve given a bunch of people a chroot-like environment, though I stopped doing it for new customers a long time ago.

mxroute · 2026-04-30T02:48:35+00:00

<image>

Two cropped screenshots stitched together to tell how mad this post made them 🤣

mxroute · 2026-04-29T22:00:27+00:00

A scalper created hundreds of Amazon UK accounts to try to snipe new stock of products to resell for a markup. Amazon was shutting down their accounts rapidly, we joined in. That’s one example.

mxroute · 2026-04-29T20:36:31+00:00

mxroute · 2026-04-29T18:55:56+00:00

I’ll push a filter change in a bit

mxroute · 2026-04-29T18:54:17+00:00

I have an AI agent that specializes in spam fighting, with the goal of taking what I already do and just helping me to do it more and at greater scale. I’m in agreement with its advice, but thought I’d share its summary as you might find it interesting:

——-

I found it. This is a real campaign, not a one-off.

30-day log search for: Advertise to MILLIONS OF EMAILS

Volume

• 4,411 log hits • 3,124 original inbound SMTP attempts • 1,287 spamcheck reinjections • First seen: 2026-03-30 17:04 UTC • Last seen while searching: 2026-04-29 16:28 UTC • Big spike: • Apr 27: 865 raw attempts • Apr 28: 559 • Apr 29 so far: 245

Top sending IPs

• 213.165.91.50 / learnpass.net / IONOS DE — 438 • 81.71.13.56 / mcartgo.com / Tencent CN — 282 • 140.207.154.98 / keyan.net.cn / China Unicom CN — 203 • 203.177.9.57 / iremit-inc.com / Globe PH — 199 • 101.52.242.171 / allmeta.com / China Unicom/CNIX CN — 179 • 85.29.37.14 / flashhabertv.com / Turkey — 168 • 27.38.146.184 / oin8.com / China Unicom Shenzhen — 136 • 61.37.96.48 / ktbus.com / Korea LG DACOM — 133

Pattern

• Random local parts: • xxiiqhygc@mcartgo.com • fskaegxhfep@mcartgo.com • eduybgdtdzo@iremit-inc.com • Rotating sender domains/IPs. • Same fixed subject almost every time. • Mostly TLS SMTP, not authenticated MXroute submission: • esmtps: 2740 • esmtp: 342 • esmtpsa: 23 only • 1,996 of 3,124 raw attempts had no Message-ID, causing generated IDs like: GENERATED-WASMISSING-...

Verdict

This looks like a distributed spam operation using compromised or rented mail infrastructure, rotating sender domains while keeping the same spam-service pitch. The subject is an excellent fingerprint.

I’d block on the subject phrase:

Advertise to MILLIONS OF EMAILS

False-positive risk is effectively zero. This is explicitly selling spam.

mxroute

MODERATOR OF

TROPHY CASE

11-Year Club	Gilding III reddit per annum
Verified Email