8 ms·

Become unbannable from your email

242 points by bfoks 1y ago

predkambrij 1y ago
Another huge thing is that if you get banned from Google you (might) also lose "Sign in with <bigcorp>" - so you lose access to a lot more thing than just your email.
Anamon 11mo ago
I more or less disagree with two points this article makes. You don't have to go with a major mail hosting service to prevent deliverability issues. Any one of the hundreds of thousands of small local hosting providers should do. I've been with two tiny, local, "boutique" hosters for over 20 years and never noticed any issues. I also have it on good authority that entirely self-hosted e-mail is not as tricky as some like to claim. Set up your SPF, DKIM, and DMARC properly, and obviously don't send any spam or be an open relay, and even Google and Microsoft should have no worries doing business with you. Heck, if abuse scores were that important, Google and Microsoft would be the first hosts anyone would ban. Also, catch-all is a terrible idea. I used to do it in the mid-2000s. Think about your current spam levels and multiply it by a thousand when every spammer can try jack@, john@, joe@, etc., and everything is delivered. Add to that all the spammers that use something@your-domain as a fake sender, so you get all the non-delivery reports. Ugh. I used to do this to track leaks and non-consensual passing on of my address (the old registering at Company X with company-x@). This worked a few times, but after a few years I noticed that the amount of breaches and leaks soon make it useless. At this point, according to HaveIBeenPwned, most of the addresses I ever used have been in 20+ leaks each. It just not worth the effort anymore.
IlikeKitties 1y ago
TL;DR: Step 1: Get Your Own Domain Step 2: Make Backups This is not sufficient. Even your domain can be seized. There is no way for any service dependent on the DNS System to be irrevocably owned.
- iamnothere 1y ago
  I don’t think TFA is talking about hosting email for well-known piracy sites or terrorists. My guess is they are more concerned about arbitrary and capricious account bans for supposed TOS violations, which is more relevant to ordinary people. Your domain won’t be seized by someone because Google doesn’t like your YouTube upload or whatever.
- toast0 1y ago
  > There is no way for any service dependent on the DNS System to be irrevocably owned. All you need to do is get an ISO-3166-1 alpha-2 code issued for you, and then never change your name, and you're golden.
  - IlikeKitties 1y ago
    Nope, again, not enough. https://en.wikipedia.org/wiki/Top-level_domain#Historical_domains https://en.wikipedia.org/wiki/Top-level_domain#Historical_do...
    - toast0 1y ago
      All of those changed their names. Not always through their choice.
- commandersaki 1y ago
  Any stories of domains being seized that weren’t involved in criminal activity?
  - halfcat 1y ago
    Definitely due to trademark disputes and political pressure. Substitute “criminal activity” with “someone with power that doesn’t like what you’re doing”. Consider the eBay stalking scandal [1] and ask if those doing the stalking would be willing to bribe or coerce someone to seize the blogger’s domain. [1] https://en.wikipedia.org/wiki/EBay_stalking_scandal https://en.wikipedia.org/wiki/EBay_stalking_scandal
Tepix 1y ago
Forwarding mail is problematic. If you forward spam, your spam score can increase and suddenly you‘re on a blacklist. Also when you pick an email provider, pick one with a good privacy policy.
- jsbisviewtiful 1y ago
  Yeah the idea is good but spam scores would definitely crater your deliverability - and quickly. It's hard enough keeping spam scores within a reasonable threshold while sending subscriber approved marketing emails.
pzmarzly 1y ago
Counterpoint: I lost a domain when a registrar went out of business, and another when a registrar bumped the price 10x and refused to give me authenticode unless I physically show up to their office. Sure, I cheapened out and used shady cheap registrars, and this all happened a while ago so things are probably more regulated now, but for comparison I never permanently lost access to hosted email. (Losing access temporarily is another thing, Google likes blocking me from my own account when travelling.)
- mobilemidget 1y ago
  I'm surprised to read they had an actual physical office you _could_ show up :) was it a very distant location to head out to?
  - pzmarzly 1y ago
    It was some address in Warsaw, so if I needed that domain badly, it'd be one Ryanair flight away, and definitely an interesting experience :) But I was only using it for a small blog, so I just let it expire. I hoped I would be able to register it again immediately after it expires, but some scammers beat me to it (probably scanning for expiring domains with good reputation/SEO), so last time I checked, the domain is used to advertise some magic pills.
    - f4uCL9dNSnQm 1y ago
      Now I am curious. Was that registrar "nazwa.pl"?
      - pzmarzly 11mo ago
        No. Nazwa may be a bait-and-switch scam when it comes to pricing, but they are a big registrar that has to play by the rules set by NASK. I used a small "PHP+MySQL+email+domain" provider, that (as I later learned) was so small they didn't want to fork out a few grands a year to NASK to be a proper registrar themselves, so they instead used another (still shady) registrar under the hood.
hu3 1y ago
That's good but make sure you don't lose the domain. Ever.
- deleted 1y ago
  [deleted]
- brulard 1y ago
  And that's the real hard part
  - iamnothere 1y ago
    Have you ever lost a domain? I haven’t despite having many domains across a number of registrars over the years. Are people just using bad registrars or what?
    - brulard 1y ago
      Yes, I have. Due to a human mistake we lost a family domain, where I hosted one of my important e-mails.
      - iamnothere 1y ago
        Sorry to hear that. Some registrars let you pre pay for multiple years now, it’s a good idea if you have a crucial domain that you know you will be holding onto.
      - throwaway2037 1y ago
        Did you try to contact ICANN and explain the issue? If you could prove ownership for many years, your case would be quite strong.
- throwaway2037 1y ago
  What scenarios are you thinking about to lose the domain? To me, the most common would be forget the pay the bill, or your credit card on file expires. A light Google search tells me that it is possible with several different providers to pay for up to 10 years in advance. Still, the exact same issues can happen at the 10 years and 1 day mark! How do large corporations handle this problem? Do they have a special contract where the domain register will always keep the domain registered, then bill the corporation directly? That seems like a business venture with juicy margins.
manytimesaway 1y ago
"How to become unbannable" Step 1 : go with the one company that's known worldwide for abusive & permanent bans with no recourse. This post is a bit too generic, but it's true that using your own domain for mailing is the best solution to avoid getting locked out. Although you need to pick a good registrar, too...
- morshu9001 1y ago
  well your recourse is repointing the domain
  - xp84 1y ago
    It's worth pointing out just in case someone might forget/not think of it... Don't register your domain or DNS with Google Domains / GCP if you host your email with Google Workspace... since if you get locked out of the Google account you could be unable to update your DNS. The saddest thing though is that in some ways Gmail is harder to hack into than some registrars. I remember a postmortem write-up from a guy who had his personal domain easily hijacked by social engineering someone at the domain registrar, which then served as the foothold of a larger identity theft attack against him. Google, by virtue of simply not even doing customer service, is much harder to social engineer, so the author of that piece pointed out that ironically if he'd put more of his eggs in the GOOG basket, he'd have been safer.
    - halfcat 1y ago
      > Don't register your domain or DNS with Google Domains / GCP if you host your email with Google Workspace... since if you get locked out of the Google account you could be unable to update your DNS. This seems like a potential rabbit hole. Use a different domain with your registrar than the domain you’re registering. Same thing with DNS host. Do you have two domains with two registrars and two DNS hosts? Presumably if either one gets compromised, the control of one domain could be used to gain control of the other. And you’ve quadrupled your attack surface by having two domains with two registrars and two DNS providers. I don’t disagree with you, but I also don’t know a robust solution for this (happy to hear one, if you have it).
JoshTriplett 1y ago
I learned this lesson when switching away from the first ISP I had email through. Rather than switching to another transient ISP email, I registered a domain. I've been through a couple of email providers but my email address never needs to change again.
simojo 1y ago
There are online services where a bad actor can enter your email to automatically sign you up for hundreds, thousands of marketing emails. In the event that that happens, given that you have full control over the domain, you could just divert whatever <x>@yourdomain.com to a black hole. What will happen when email attacks become more advanced--to the point of signing up thousands of different <x'>@yourdomain.com? What strategy would one have then? You would most certainly have to part ways with that domain. The author makes a good point, your email address is (arguably) more important than your home address. Perhaps there already are, but I hope for better safeguards against these kinds of attacks.
- kibwen 1y ago
  For every crucial service (banking, etc), generate a unique, cryptographically-strong email address, save it to your password manager, and have its mail forwarded to your common inbox. If only phone numbers were so easy to mask.
  - ahmedfromtunis 1y ago
    1) what does it mean for an email *address* to be cryptographically strong? 2) in case of hard to remember address, what do you do if asked to write it down with no access to your records? (It happened to me once before)
    - halfcat 1y ago
      > what does it mean for an email address* to be cryptographically strong?* Something someone couldn’t guess, like: <uuid>@domain.com c4694056-63dd-476f-9823-2548aa3d754a@domain.com > in case of hard to remember address, what do you do if asked to write it down with no access to your records? It’s a tradeoff. You’d probably want to use the cryptographically secure addresses sparingly. Another option would be to use your password manager to create a “memorable” password, which is usually multiple random words, like: essay-curve-white-cable@domain.com But again there’s only so many of these you’ll memorize, so use sparingly. Compare it to the cost of just changing the email. Maybe with a bank it’s more work and risk, so it’s worth the added effort, but if it’s the email you use to order pizza, just change it.
jwkerr 1y ago
Over the past few weeks I've been systematically migrating every one of my accounts to a domain under my control. During the process I've been marking them in a spreadsheet with their 2FA status (no 2FA, TOTP, security key, etc.) and adding their passwords to a password manager. This is all in case I ever need to go through the migration process again for whatever reason, or if I lose/break a Yubikey, I will know what I'm signed up for, and will know where to enrol my new Yubikey(s). It really is a massive hinge for many people that isn't even really considered, most people's entire digital lives would be uprooted if they lost access to their email for whatever reason. Thankfully that doesn't really ever happen to most "normal" people to my knowledge, since most just use Gmail, but I know it can and has happened through account bans or such.
- bxsioshc 1y ago
  [dead]
- huflungdung 1y ago
  [dead]
- EvanAnderson 1y ago
  Two factor tokens that can't be backed-up create stupid make-work. Wouldn't it be great if Yubico let you back-up and restore a Yubikey? It's maddening that they haven't come up with a reasonable way to allow a purchaser to register multiple Yubikeys to enable freely restoring backups between them. (Think of if analogously to buying multiple padlocks keyed the same from the factory.) I'd prefer to be able to just set the same DKEK on the devices myself. Failing that I'd settle for Yubico being the arbiter. It would make the devices substantially more useful and less scary in loss / destruction scenarios.
  - TacticalCoder 1y ago
    > It's maddening that they haven't come up with a reasonable way to allow a purchaser to register multiple Yubikeys to enable freely restoring backups between them. It is possible, using a cryptocurrency hardware wallet allowing to install tiny apps on the hardware wallets. These wallets are meant to initialized by a "seed" and there's a protocol to easily write down that seed (a list of words, all coming from a dictionary of 2048 words and the list of words contains a checksum in [part of] the last word). Now from that seed, cryptocurrencies hardware wallet can derive any secret. And it's possible to derive a secret that's used like Yubikey. So as long as you have your "seed" backed up somewhere, you can duplicate your 2FA key. I did test the old U2F version, pre FIDO2/webauthn, using early Ledger Nano hardware wallets and it worked. I think there's now a more recent version available but haven't checked that. A Ledger Nano S Plus, from their website, costs 70 EUR / 80 USD. I'd say it's not too pricey to try it and see if it could suit you. Check their available apps first and see if there's one that can simulate a Yubikey (or a similar 2FA security key). I know HN loves to hate on cryptocurrencies but I'd say that at least the crypo-bros got the "you cannot trust your computer" part right. The attack surface of a cryptocurrency hardware wallet is not only minimal: it's minimal on purpose, built on the premises that computers were not devices to be trusted. They're literally built with the idea that they can be used on a compromised computer and you should still be safe, so there's that.
iamnothere 1y ago
Looks like a good intro for people who want partial self-hosting, which is better than leaving it with a megacorp (especially for non-professional email). In before: * running your own mail is too much of a burden * I used to host my own mail but I couldn’t figure out DNS or used a bad IP or something and Microsoft/Gmail won’t accept my mail * if “they” want to ban you they will just seize your domain or kick down your door and shoot your dog * it’s good that they can ban you from your email because I don’t like spam Edit: lol, I was not in fact “in before” the comment about domain seizures. Unbelievable.
mobilemidget 1y ago
Creating aliases for the addresses you are actually using, e.g. a netflix@ signup is preferred over a general catch all, .. and all that spam senders can generate approach.
- ROBLOX_MOMENTS 1y ago
  Some services will also ban you for this. Samsung, Amazon, ... so you have to use generic or random words on left side.
  - commandersaki 1y ago
    Been using this with Amazon and plenty of other services for decades, not sure where you’re coming from.
    - ROBLOX_MOMENTS 11mo ago
      Samsung now blocks the word samsung at registration time. Previously if you signed up successfully they would disable your account at a random point in the future.
    - mobilemidget 1y ago
      i encountered the samsung@ issue too, so that turned into sumsang@ which worked. :)
gblargg 1y ago
I like email forwarding services like mailgw [1]. If my email provider gives me problems, I can just forward to a different one. [1] https://www.mailgw.com https://www.mailgw.com
fnord77 1y ago
Services should allow secondary email addresses.
- halfcat 1y ago
  Does a secondary/recovery email increase or decrease the chance of the primary email getting compromised?
marssaxman 1y ago
I've been doing this for years, though I don't really think of it as "having a backup" so much as "using an IMAP client". Works fine. It's really useful to be able to make up a new email address for every company who wants one; they each get their own folder. If I get any unexpected mail, it's obvious where it came from and easy to deal with, though in practice this rarely happens.
- BeetleB 1y ago
  > I've been doing this for years Downloading email via POP or IMAP? Ever since I started using email in the 90's. I never deviated from it. In the old days, even the free mail hosts gave you POP access. My own domain? Doing it for over 20 years.
  - marssaxman 1y ago
    Yep, pretty much the same story here. The only (relatively) recent innovation is the bit where mail sent to foo@domain.com lands in a folder called "foo", so I neither have to sort out a messy inbox nor check many accounts individually.
  - bigwheels 1y ago
    As of last week, Google is on-track to discontinue POP-polling functionality. I've been using this for about 20 years, not sure what to do. What a pain. Gmail will no longer support checking emails from third-party accounts via POP (support.google.com) https://news.ycombinator.com/item?id=45439670 https://news.ycombinator.com/item?id=45439670 - 6 days ago, 372 comments
    - pessimizer 1y ago
      This is alarming if you just skim the headline (which I did, and was slightly alarmed), but it is about having gmail download from third-party accounts, not downloading emails from gmail. I don't think many people do this anyway, but I'm sure it was very convenient for some.
- layer8 1y ago
ozim 1y ago
You don’t have to have a single email address. I have plenty and various providers. Then use mail client instead of webmail. I use thunderbird and have multiple boxes I just backup Thunderbird profiles folder to my NAS.
- cosmic_cheese 1y ago
  Local mail clients are excellent for taking full control of your mail without contortions.
  - isaachinman 1y ago
    Can you elaborate on what you mean by that?
    - ozim 11mo ago
      I can say that in the article author was setting up own mail server and domain. To have copy of all your mails locally or to back them up to NAS, having desktop mail client is much easier way than setting up mail server.
wtf77 1y ago
That's fine for your own domain, but I usually download my emails via IMAP and don't leave anything on the remote server. Finally, do you really keep your emails? Emails are ephemeral, often just informative, and if there's anything important, I process it and delete the email. I may archive 'sentimental' emails, but I rarely search the archive as I mainly delete emails.
- jrm4 1y ago
  Do you mean "on the server?" I don't -- and just the opposite here; the cost of keeping literally all of them is close enough to zero, I never delete any emails and use "read/unread." I just archive yearly.
- cosmic_cheese 1y ago
  I keep mail because there’s been things that only became important or useful long after the fact. You just never know. They can also serve as a sort of snapshot of a certain point in time that’s very effective at jogging your memory. I’ve had occasions where old emails reminded me of things that happened that I’d nearly forgotten or conflated details about.
bxsioshc 1y ago
I never really understood why "owning" a domain is any more owning than you own your Gmail address: a company is letting you use it and that works until they don't. What an I missing?
- IlikeKitties 1y ago
  You aren't missing much only that domains are a bit more portable between registrars and they've historically been a bit more resistant against random bannings.
- iamnothere 1y ago
  > What an I missing? The contractual requirements that ICANN imposes upon registrars. They can’t just take your domain for any old reason. The rules are fairly well defined and registrars can lose their accreditation if they do not follow them. https://www.icann.org/en/contracted-parties/accredited-registrars/registrar-accreditation-agreement/registrant-rights-and-responsibilities-under-the-2009-registrar-accreditation-agreement-27-06-2011-en https://www.icann.org/en/contracted-parties/accredited-regis...
- VariousPrograms 1y ago
  You probably won't get hacked and have your domain taken down for distributing malware. But you also probably won't be randomly banned by Google/Proton. Neither feels like "full, unbannable control of my email" to me. If anything, I'm more concerned about my little old domain getting hijacked than getting banned from a hosted email account.
  - bxsioshc 1y ago
    [dead]
lxgr 1y ago
> With this solution, there's a high chance that if they ban you by mistake (AI bots are to blame), they will not disable the forwarding mechanism. Why bet on that instead of doing it the other way around (i.e. making the self-operated mail server the primary that forwards to the service provider inbox), or at least practicing doing so by pointing the MX records accordingly?
- pseidemann 1y ago
  Afaik sending emails is much harder than receiving, because of several layers of anti-spam measurements, which don't apply for receiving (besides local spam filters).
  - lxgr 1y ago
    Yes, but send and receive paths don't have to be symmetric. It's perfectly fine to send via the third-party provider and receive to your own server and forward to the third-party provider. The forwarding MX would need to support things like ARC and DKIM, though, or the forwarded emails themselves run a high risk of getting dropped as spam by the third-party provider.
jrm4 1y ago
Been doing this for years, and surprised he didn't seem to mention the other benefit: "infinity" email addresses. Oh, rando burger spot wants an email for some free fries? Great, hit me up at randoburgerspot@"mydomain".com .
- deadbabe 1y ago
  This is the most useful thing about having your own domain for email.
- imiric 1y ago
  I like that as well, but it's exhausting having to explain every time that, no, I don't in fact work at randoburgerspot...
  - jrm4 1y ago
    What? It's your opportunity to nerd out and lecture people on why they're doing email WRONG!!! (only half joking)
    - EvanAnderson 1y ago
      I usually just say "I receive all email @mydomain.com. I make one-off emails so I can tell who sells my email address." Most "normies" get it.
  - jcynix 1y ago
    Easy, just remove the vowels from the local part of the address: rndbrgr@example.com Even easier: I have a list of pre-generated fantasy addresses on my smartphone and can pass one to randoburgerspot on the fly.
    - robocat 1y ago
      > fantasy addresses Highly unrecommended if it's important or you're a repeat customer. It is easiest to pick a consistent generation scheme that helps you to remember the email address you gave. Obviously record it somewhere too (a folder for the first you've-just-signed-up email is easy) For throwaway accounts it doesn't matter what you give.
shaicoleman 1y ago
I've self hosted my email forwarding service on my own domain for over a decade, but eventually gave up because of deliverability issues that were out of my control - primarily with Microsoft's email services. I've switched 3 years ago to a hosted forwarding service forwardemail.net Pros: * Allows to switch email providers if needed * Allows to forward email to multiple providers * Allows to store backups of emails * Allows to have emails on multiple domains for different contexts (personal/professional/projects/etc.) * Allows to have different email addresses per service. If you get spam on that email address you can just stop forwarding emails for it. * Allows to have reliable mail rules based on the email address * Allows also to send emails from multiple addressses * Most spam is filtered before it reaches the inbox * Open source * Would be easy to switch to a different email forwarding service if needed (or self host it). * Excellent track record over 8+ years Cons: * They have the potential to snoop on your emails. Any service that's really important would have 2FA enabled, so I accept the risk. * They have the potential to send emails on your behalf - again, they've earned my trust, so I accept the risk for that. * Add another point possible failure. So far I haven't noticed any issues with it. * There's greylisting that delays emails for 5 minutes if they are not on the whitelist, which affects some of less common sending services. * In very rare cases, some services ban registering with a forwarding email addresses. * You need to make sure you don't lose your domain. I renew it 5 years before expiry with a reputable domain registrar (NameCheap). Overall, it's been working great for me.
- sunnybeetroot 11mo ago
  What’s your plan after for after those 5 years and you can’t renew? Domain expires, someone registers it and now has access to all your accounts? Albeit maybe you won’t care because you won’t be around but I wonder how it’ll impact your family/friends
bks 1y ago
Forwarding emails is problematic especially if your provider for the primary mx does not have great spam filtering and then you end up sending spam to your backup account. It certainly does not get around the ...if your account gets banned maybe the forwards will still work... concept but in general something like https://github.com/joeyates/imap-backup https://github.com/joeyates/imap-backup to backup your email and then add them to a typical backup process with your other files works well.
qyckudnefDi5 1y ago
Anyone wanna share their email strategy? I'm thinking of going for the following but I'm still undecided: 1. 1 custom domain (<simple-word-or-two>.com): this will be used for friends, family and any online accounts that know me IRL. Use Fastmail masked addresses with my custom domain where it makes sense like an online account for amazon. 2. 1 custom domain (<online-nickname>.xyz): this will be used for a blog, professional IRL interviews, correspondence, github. Use Fastmail masked addresses with my custom domain where it makes sense. 3. Masked emails using fastmail.com: for online accounts that are ephemeral, random newsletter signups etc. Don't want to associate any of my custom domains or IRL identity. Don't care if these are portable. My main goals are: - Separate my online identity/alias used for my blog (2) from gov entities, banks etc (1). - for more anonymity/privacy use the fastmail.com domain with masked addresses to blend in with others on this domain. I'd love feedback and to read what you do if you want to share :)
- atrettel 1y ago
  Your strategy seems good to me. The primary reference that I use for this kind of stuff is Michael Bazzell's book "Extreme Privacy". It goes into some detail about his strategy for using custom domains to compartmentalize things. That's what I base my own strategy on. The only thing that I would add is that I prefer to "salt" my single-purpose email addresses with a bunch of random characters to prevent enumeration attacks, since it would be trivial to figure out the email address that I use for different services by just guessing. If I used amazon@domain.net, I might also use uber@domain.net, etc. Adding a salt prevents this from happening.
- commandersaki 1y ago
  I just use a Fastmail address for my resume and such. I dont want to use my personal domain because while not offensive it sounds a bit silly.
- furyofantares 1y ago
  > 1 custom domain (<online-nickname>.xyz) I got banned by .xyz once. I did manage to get it cleared up, but being banned by the TLD itself is pretty unpleasant. It's hard to even figure out that's what happened. And then I had to "prove" I was no longer distributing malware, with a list of what things I'd done to clean up the site and prevent further malware distribution - which was difficult as I was never distributing malware to begin with. Just a static website for a wordle variant, no ads or other 3rd party content.
binarymax 1y ago
Anyone else have a .io domain and worried about the future?
- cipehr 1y ago
  What’s happening with io in the future?
  - bigstrat2003 1y ago
    Apparently .io is the TLD for the British Indian Ocean territory, which (as I understand it) is going to go away as the UK is going to release the land. From what I understand the TLD would normally go away when the political entity does, but there has been a lot of concern in the industry because this particular TLD was very popular with outsiders.
- bigstrat2003 1y ago
  Yeah kinda. Honestly when I signed up for it I had no idea it was a country TLD, let alone that it might disappear so easily one day. If it does go away I'll live, but it will be quite annoying to have to switch my entire digital life over to a new domain. I've had my domain for 10+ years so lots of stuff is pointed there.
  - zzo38computer 1y ago
    Although I had not signed up for .io domain names, I did expect it to be a country TLD when I saw it, because it is two letters, so to me it seems obvious that it is.
    - bigstrat2003 1y ago
      I wasn't aware of that convention when I signed up. I just figured it was like any other TLD.
hk1337 1y ago
I am actually working on doing the opposite and getting rid of my custom domains. I’m not really doing anything with them except spending money to have them. Working on getting all my socials to basically match with a similar username and just go from there. If I host my blog, assuming I actually start making posts, on GitHub with a custom domain, when I die then the domain will likely expire and the blog is no longer accessible. If I keep it with my GitHub .io url, it’ll be there for as long as the account is there.
tadasv 1y ago
I'm thinking about trying something similar to this on top of AWS SES. They make it fairly trivial to accept email and store it to S3. So email forwarding would be straight to S3 backup. But still would need a system to backup these emails to some local storage. Not sure what's the best way to handle this, I had my gmail account since the early days and it's baked into so many important accounts. It definitely crosses my mind what it'd be really difficult if I were blocked out somehow.
- Evidlo 1y ago
  Just start going through your accounts gradually over several years and you won't experience much friction.
aussieguy1234 1y ago
I guess the real question here is: Who is more likely to ban you, Google and co or your domain registar? For most people, who are not doing anything shady/controversial with their domain and are using a .com or .net domain (which are price regulated by ICANN), are not using a shady registrar and will always have the cash on hand to renew as needed, the answer will be Google and co. Its a good idea to set up auto-renew on a credit card, so you can be sure it will go through and you won't forget to renew it.
- commandersaki 1y ago
  I pay for 10 years in advance, which you can do with com/net/org.
  - aussieguy1234 1y ago
    Not a bad idea, although i'd worry i'd forget to renew, may not remember something I set up a decade ago at the right time.
- aussieguy1234 1y ago
  I guess another consideration is also, should something happen, what level of support will you get? Most domain registrars will at least have some customer support. But good luck getting support for a free gmail account.
commandersaki 1y ago
How does Google paid email service work with catch all email addresses? Can you send with an arbitrary alias without setting up a separate identity? Will it automatically respond to the correct alias?
caminanteblanco 1y ago
This was actually way more actionable than I was expecting
jadenPete 1y ago
I’ve considered running an email server on my personal domain for some time, but the effort of changing my email hasn’t felt worth it to me, given how many services I’ve signed up for with my current email (a Gmail address). Is anyone aware of any strategies to make this easier? It’d be nice if I could set up forwarding so services would automatically use my new email, but I’m not sure if something like that exists.
- unanimous 1y ago
  Many email service providers give you the option to fetch all emails from a different service not just as a one-time thing, but ongoing. I'm not sure how that could be set up when running your own email server, but I bet there's a way. Even if there isn't, you can set up automatic forwarding in Gmail. There's a chance forwarding is better than fetching. I once had a Gmail account stolen, and account recovery was locked for some reason, but email forwarding had been set up and I was still able to get all emails the address received. In case it's relevant, I happen to use Fastmail now and their "mail fetch" feature involves imap.
- layer8 1y ago
  You can have the Gmail emails be forwarded to your own email server, or have your server fetch them from Gmail, and then migrate bit by bit, the most important accounts first. Before SPF and the like, it used to be trivial to also send email with a different From address (like your existing Gmail address) from your own server, but that’s not the case anymore.
RachelF 1y ago
The counterpoint for having your own domain is that emails you send have a good chance of being classified as spam.
- mxuribe 1y ago
  Yes, but, there are things one can do to help alleviate or avoid being classified as spammer...such as setting up SPF, DKIM, DMARc, etc. properly. Also, have folks send emails into your new inbox first, then reply, etc...Also, "warm up" the sending outbound by sending into legitimate services little by little, etc. Now, if you were to stand up your own self-hosted mail server, that makes things a little harder, but even then, there are things one can do...so its not dire.
geor9e 1y ago
My gmail backup solution is a Synology NAS, set up to continuously backup GDrive, and then I periodically click export to GDrive at takeout.google.com
8cvor6j844qw_d6 1y ago
I have the opposite thoughts on email domains. Personal email domains makes you very identifiable just by lookung at your domain. Using aliasing services (e.g. Mozilla Relay, Addy.io, etc.) with their default address generation ensures your email address itself does not disclose your domains when the eventual data breach occurs. Plus catch-all addresses makes you an easy target for spam by sending to any email address on that domain vs need to know specific email address on typical email services.
whycome 1y ago
We are all so vulnerable and have no protections. This is where government should be stepping in, but they won't until it happens to enough important people. This is fundamental
cosmin800 1y ago
Some pointed to already, but hosting anything at google is not the way forward.
mcv 1y ago
I think there are two pieces of legislation needed here: 1. Email providers need to be required to forward your email to your new address for a year if you ever lose your email for any reason. 2. Domain registrars need to save your domain name for a year and allow you ample time to reregister if you ever let it lapse for any reason.
dzhiurgis 1y ago
Doing this is worth it on sole reason you get to degoogle yourself (you can host email on iCloud+ plan). What I’m slowly doing is staggering my addresses by importance - trying to separate personal from all the spam / registration / etc. Saying that it’s probably been years since I used email to actually message someone.
internet_points 1y ago
Highly recommend mbsync/isync for backing up your email. Quite simple to set up for fastmail, gmail. Everyone recommends n+1 backups of everything else, why should your email be less deserving? As a bonus, if you install notmuch you get quick offline searches and can "mine" your email with shell scripts (or easily share it with sam altman if you're into that kind of thing). (Alternatively, if you prefer being GUI, just install Thunderbird – this can also download your full imap and give you local search. You don't even have to use Thunderbird for it to be useful as a backup; it's probably the easiest way to quickly become more independent from google randomly deciding your account should be locked, which does happen.)
kameit00 1y ago
I am using my own Mail Server (mailcow) beside my old gmail and other adresses. But for convenient, searchable offline Backups, I use Mailsteward (macOS) ... if it is of interest for someone: https://mailsteward.com https://mailsteward.com (alternatives for other OS: https://alternativeto.net/software/mailsteward/ https://alternativeto.net/software/mailsteward/) Then I put the database on multiple backup locations regularly. Another thing, some people do not already know: If you don't need a throwaway-adress for some services, and you just want to make your mailbox more structured, you can use '+' before the '@' to add another word to your email adress. Like: your.name+randomName@gmail.com The +randomName will be ignored and the emails are received at your.name@gmail.com. But most Servers (I use) will put a '[randomName]' before the subject of the received email. Which can be quite handy for handling your emails. Even more, if the company uses multiple different adresses to send you emails.
trallnag 1y ago
I have my own domain trallnag.com for this purpose, but it's always a huge pain to spell the domain to someone in person or over the phone. The leaf being a made up word does not make things simpler. So for these cases I've started to fall back on gmail.com or outlook.com
sdf4j 1y ago
When I see suggestions to "own" your email domain, how do you manage the chicken-egg problem of needing an email address in the first place to register the domain you want to lease? Are there registrars that let you walk in with a physical ID to proof you are you in case your email gets compromised and they get access to the registrar? Any experience with that?
deleted 1y ago
[deleted]

242 points by bfoks 1y ago

Another huge thing is that if you get banned from Google you (might) also lose "Sign in with <bigcorp>" - so you lose access to a lot more thing than just your email.

Anamon 11mo ago

I more or less disagree with two points this article makes. You don't have to go with a major mail hosting service to prevent deliverability issues. Any one of the hundreds of thousands of small local hosting providers should do. I've been with two tiny, local, "boutique" hosters for over 20 years and never noticed any issues. I also have it on good authority that entirely self-hosted e-mail is not as tricky as some like to claim. Set up your SPF, DKIM, and DMARC properly, and obviously don't send any spam or be an open relay, and even Google and Microsoft should have no worries doing business with you. Heck, if abuse scores were that important, Google and Microsoft would be the first hosts anyone would ban. Also, catch-all is a terrible idea. I used to do it in the mid-2000s. Think about your current spam levels and multiply it by a thousand when every spammer can try jack@, john@, joe@, etc., and everything is delivered. Add to that all the spammers that use something@your-domain as a fake sender, so you get all the non-delivery reports. Ugh. I used to do this to track leaks and non-consensual passing on of my address (the old registering at Company X with company-x@). This worked a few times, but after a few years I noticed that the amount of breaches and leaks soon make it useless. At this point, according to HaveIBeenPwned, most of the addresses I ever used have been in 20+ leaks each. It just not worth the effort anymore.

IlikeKitties 1y ago

TL;DR: Step 1: Get Your Own Domain Step 2: Make Backups This is not sufficient. Even your domain can be seized. There is no way for any service dependent on the DNS System to be irrevocably owned.

iamnothere 1y ago
I don’t think TFA is talking about hosting email for well-known piracy sites or terrorists. My guess is they are more concerned about arbitrary and capricious account bans for supposed TOS violations, which is more relevant to ordinary people. Your domain won’t be seized by someone because Google doesn’t like your YouTube upload or whatever.
toast0 1y ago
> There is no way for any service dependent on the DNS System to be irrevocably owned. All you need to do is get an ISO-3166-1 alpha-2 code issued for you, and then never change your name, and you're golden.
- IlikeKitties 1y ago
  Nope, again, not enough. https://en.wikipedia.org/wiki/Top-level_domain#Historical_domains https://en.wikipedia.org/wiki/Top-level_domain#Historical_do...
  - toast0 1y ago
    All of those changed their names. Not always through their choice.
commandersaki 1y ago
Any stories of domains being seized that weren’t involved in criminal activity?
- halfcat 1y ago
  Definitely due to trademark disputes and political pressure. Substitute “criminal activity” with “someone with power that doesn’t like what you’re doing”. Consider the eBay stalking scandal [1] and ask if those doing the stalking would be willing to bribe or coerce someone to seize the blogger’s domain. [1] https://en.wikipedia.org/wiki/EBay_stalking_scandal https://en.wikipedia.org/wiki/EBay_stalking_scandal

Tepix 1y ago

Forwarding mail is problematic. If you forward spam, your spam score can increase and suddenly you‘re on a blacklist. Also when you pick an email provider, pick one with a good privacy policy.

jsbisviewtiful 1y ago
Yeah the idea is good but spam scores would definitely crater your deliverability - and quickly. It's hard enough keeping spam scores within a reasonable threshold while sending subscriber approved marketing emails.

pzmarzly 1y ago

Counterpoint: I lost a domain when a registrar went out of business, and another when a registrar bumped the price 10x and refused to give me authenticode unless I physically show up to their office. Sure, I cheapened out and used shady cheap registrars, and this all happened a while ago so things are probably more regulated now, but for comparison I never permanently lost access to hosted email. (Losing access temporarily is another thing, Google likes blocking me from my own account when travelling.)

mobilemidget 1y ago
I'm surprised to read they had an actual physical office you _could_ show up :) was it a very distant location to head out to?
- pzmarzly 1y ago
  It was some address in Warsaw, so if I needed that domain badly, it'd be one Ryanair flight away, and definitely an interesting experience :) But I was only using it for a small blog, so I just let it expire. I hoped I would be able to register it again immediately after it expires, but some scammers beat me to it (probably scanning for expiring domains with good reputation/SEO), so last time I checked, the domain is used to advertise some magic pills.
  - f4uCL9dNSnQm 1y ago
    Now I am curious. Was that registrar "nazwa.pl"?
    - pzmarzly 11mo ago
      No. Nazwa may be a bait-and-switch scam when it comes to pricing, but they are a big registrar that has to play by the rules set by NASK. I used a small "PHP+MySQL+email+domain" provider, that (as I later learned) was so small they didn't want to fork out a few grands a year to NASK to be a proper registrar themselves, so they instead used another (still shady) registrar under the hood.

hu3 1y ago

That's good but make sure you don't lose the domain. Ever.

deleted 1y ago
[deleted]
brulard 1y ago
And that's the real hard part
- iamnothere 1y ago
  Have you ever lost a domain? I haven’t despite having many domains across a number of registrars over the years. Are people just using bad registrars or what?
  - brulard 1y ago
    Yes, I have. Due to a human mistake we lost a family domain, where I hosted one of my important e-mails.
    - iamnothere 1y ago
      Sorry to hear that. Some registrars let you pre pay for multiple years now, it’s a good idea if you have a crucial domain that you know you will be holding onto.
    - throwaway2037 1y ago
      Did you try to contact ICANN and explain the issue? If you could prove ownership for many years, your case would be quite strong.
throwaway2037 1y ago
What scenarios are you thinking about to lose the domain? To me, the most common would be forget the pay the bill, or your credit card on file expires. A light Google search tells me that it is possible with several different providers to pay for up to 10 years in advance. Still, the exact same issues can happen at the 10 years and 1 day mark! How do large corporations handle this problem? Do they have a special contract where the domain register will always keep the domain registered, then bill the corporation directly? That seems like a business venture with juicy margins.

manytimesaway 1y ago

"How to become unbannable" Step 1 : go with the one company that's known worldwide for abusive & permanent bans with no recourse. This post is a bit too generic, but it's true that using your own domain for mailing is the best solution to avoid getting locked out. Although you need to pick a good registrar, too...

morshu9001 1y ago
well your recourse is repointing the domain
- xp84 1y ago
  It's worth pointing out just in case someone might forget/not think of it... Don't register your domain or DNS with Google Domains / GCP if you host your email with Google Workspace... since if you get locked out of the Google account you could be unable to update your DNS. The saddest thing though is that in some ways Gmail is harder to hack into than some registrars. I remember a postmortem write-up from a guy who had his personal domain easily hijacked by social engineering someone at the domain registrar, which then served as the foothold of a larger identity theft attack against him. Google, by virtue of simply not even doing customer service, is much harder to social engineer, so the author of that piece pointed out that ironically if he'd put more of his eggs in the GOOG basket, he'd have been safer.
  - halfcat 1y ago
    > Don't register your domain or DNS with Google Domains / GCP if you host your email with Google Workspace... since if you get locked out of the Google account you could be unable to update your DNS. This seems like a potential rabbit hole. Use a different domain with your registrar than the domain you’re registering. Same thing with DNS host. Do you have two domains with two registrars and two DNS hosts? Presumably if either one gets compromised, the control of one domain could be used to gain control of the other. And you’ve quadrupled your attack surface by having two domains with two registrars and two DNS providers. I don’t disagree with you, but I also don’t know a robust solution for this (happy to hear one, if you have it).

JoshTriplett 1y ago

I learned this lesson when switching away from the first ISP I had email through. Rather than switching to another transient ISP email, I registered a domain. I've been through a couple of email providers but my email address never needs to change again.

simojo 1y ago

There are online services where a bad actor can enter your email to automatically sign you up for hundreds, thousands of marketing emails. In the event that that happens, given that you have full control over the domain, you could just divert whatever <x>@yourdomain.com to a black hole. What will happen when email attacks become more advanced--to the point of signing up thousands of different <x'>@yourdomain.com? What strategy would one have then? You would most certainly have to part ways with that domain. The author makes a good point, your email address is (arguably) more important than your home address. Perhaps there already are, but I hope for better safeguards against these kinds of attacks.

kibwen 1y ago
For every crucial service (banking, etc), generate a unique, cryptographically-strong email address, save it to your password manager, and have its mail forwarded to your common inbox. If only phone numbers were so easy to mask.
- ahmedfromtunis 1y ago
  1) what does it mean for an email *address* to be cryptographically strong? 2) in case of hard to remember address, what do you do if asked to write it down with no access to your records? (It happened to me once before)
  - halfcat 1y ago
    > what does it mean for an email address* to be cryptographically strong?* Something someone couldn’t guess, like: <uuid>@domain.com c4694056-63dd-476f-9823-2548aa3d754a@domain.com > in case of hard to remember address, what do you do if asked to write it down with no access to your records? It’s a tradeoff. You’d probably want to use the cryptographically secure addresses sparingly. Another option would be to use your password manager to create a “memorable” password, which is usually multiple random words, like: essay-curve-white-cable@domain.com But again there’s only so many of these you’ll memorize, so use sparingly. Compare it to the cost of just changing the email. Maybe with a bank it’s more work and risk, so it’s worth the added effort, but if it’s the email you use to order pizza, just change it.

jwkerr 1y ago

Over the past few weeks I've been systematically migrating every one of my accounts to a domain under my control. During the process I've been marking them in a spreadsheet with their 2FA status (no 2FA, TOTP, security key, etc.) and adding their passwords to a password manager. This is all in case I ever need to go through the migration process again for whatever reason, or if I lose/break a Yubikey, I will know what I'm signed up for, and will know where to enrol my new Yubikey(s). It really is a massive hinge for many people that isn't even really considered, most people's entire digital lives would be uprooted if they lost access to their email for whatever reason. Thankfully that doesn't really ever happen to most "normal" people to my knowledge, since most just use Gmail, but I know it can and has happened through account bans or such.

bxsioshc 1y ago
[dead]
huflungdung 1y ago
[dead]
EvanAnderson 1y ago
Two factor tokens that can't be backed-up create stupid make-work. Wouldn't it be great if Yubico let you back-up and restore a Yubikey? It's maddening that they haven't come up with a reasonable way to allow a purchaser to register multiple Yubikeys to enable freely restoring backups between them. (Think of if analogously to buying multiple padlocks keyed the same from the factory.) I'd prefer to be able to just set the same DKEK on the devices myself. Failing that I'd settle for Yubico being the arbiter. It would make the devices substantially more useful and less scary in loss / destruction scenarios.
- TacticalCoder 1y ago
  > It's maddening that they haven't come up with a reasonable way to allow a purchaser to register multiple Yubikeys to enable freely restoring backups between them. It is possible, using a cryptocurrency hardware wallet allowing to install tiny apps on the hardware wallets. These wallets are meant to initialized by a "seed" and there's a protocol to easily write down that seed (a list of words, all coming from a dictionary of 2048 words and the list of words contains a checksum in [part of] the last word). Now from that seed, cryptocurrencies hardware wallet can derive any secret. And it's possible to derive a secret that's used like Yubikey. So as long as you have your "seed" backed up somewhere, you can duplicate your 2FA key. I did test the old U2F version, pre FIDO2/webauthn, using early Ledger Nano hardware wallets and it worked. I think there's now a more recent version available but haven't checked that. A Ledger Nano S Plus, from their website, costs 70 EUR / 80 USD. I'd say it's not too pricey to try it and see if it could suit you. Check their available apps first and see if there's one that can simulate a Yubikey (or a similar 2FA security key). I know HN loves to hate on cryptocurrencies but I'd say that at least the crypo-bros got the "you cannot trust your computer" part right. The attack surface of a cryptocurrency hardware wallet is not only minimal: it's minimal on purpose, built on the premises that computers were not devices to be trusted. They're literally built with the idea that they can be used on a compromised computer and you should still be safe, so there's that.

iamnothere 1y ago

Looks like a good intro for people who want partial self-hosting, which is better than leaving it with a megacorp (especially for non-professional email). In before: * running your own mail is too much of a burden * I used to host my own mail but I couldn’t figure out DNS or used a bad IP or something and Microsoft/Gmail won’t accept my mail * if “they” want to ban you they will just seize your domain or kick down your door and shoot your dog * it’s good that they can ban you from your email because I don’t like spam Edit: lol, I was not in fact “in before” the comment about domain seizures. Unbelievable.

mobilemidget 1y ago

Creating aliases for the addresses you are actually using, e.g. a netflix@ signup is preferred over a general catch all, .. and all that spam senders can generate approach.

ROBLOX_MOMENTS 1y ago
Some services will also ban you for this. Samsung, Amazon, ... so you have to use generic or random words on left side.
- commandersaki 1y ago
  Been using this with Amazon and plenty of other services for decades, not sure where you’re coming from.
  - ROBLOX_MOMENTS 11mo ago
    Samsung now blocks the word samsung at registration time. Previously if you signed up successfully they would disable your account at a random point in the future.
  - mobilemidget 1y ago
    i encountered the samsung@ issue too, so that turned into sumsang@ which worked. :)

gblargg 1y ago

I like email forwarding services like mailgw [1]. If my email provider gives me problems, I can just forward to a different one. [1] https://www.mailgw.com https://www.mailgw.com

fnord77 1y ago

Services should allow secondary email addresses.

halfcat 1y ago
Does a secondary/recovery email increase or decrease the chance of the primary email getting compromised?

marssaxman 1y ago

I've been doing this for years, though I don't really think of it as "having a backup" so much as "using an IMAP client". Works fine. It's really useful to be able to make up a new email address for every company who wants one; they each get their own folder. If I get any unexpected mail, it's obvious where it came from and easy to deal with, though in practice this rarely happens.

BeetleB 1y ago
> I've been doing this for years Downloading email via POP or IMAP? Ever since I started using email in the 90's. I never deviated from it. In the old days, even the free mail hosts gave you POP access. My own domain? Doing it for over 20 years.
- marssaxman 1y ago
  Yep, pretty much the same story here. The only (relatively) recent innovation is the bit where mail sent to foo@domain.com lands in a folder called "foo", so I neither have to sort out a messy inbox nor check many accounts individually.
- bigwheels 1y ago
  As of last week, Google is on-track to discontinue POP-polling functionality. I've been using this for about 20 years, not sure what to do. What a pain. Gmail will no longer support checking emails from third-party accounts via POP (support.google.com) https://news.ycombinator.com/item?id=45439670 https://news.ycombinator.com/item?id=45439670 - 6 days ago, 372 comments
  - pessimizer 1y ago
    This is alarming if you just skim the headline (which I did, and was slightly alarmed), but it is about having gmail download from third-party accounts, not downloading emails from gmail. I don't think many people do this anyway, but I'm sure it was very convenient for some.
layer8 1y ago

ozim 1y ago

You don’t have to have a single email address. I have plenty and various providers. Then use mail client instead of webmail. I use thunderbird and have multiple boxes I just backup Thunderbird profiles folder to my NAS.

cosmic_cheese 1y ago
Local mail clients are excellent for taking full control of your mail without contortions.
- isaachinman 1y ago
  Can you elaborate on what you mean by that?
  - ozim 11mo ago
    I can say that in the article author was setting up own mail server and domain. To have copy of all your mails locally or to back them up to NAS, having desktop mail client is much easier way than setting up mail server.

wtf77 1y ago

That's fine for your own domain, but I usually download my emails via IMAP and don't leave anything on the remote server. Finally, do you really keep your emails? Emails are ephemeral, often just informative, and if there's anything important, I process it and delete the email. I may archive 'sentimental' emails, but I rarely search the archive as I mainly delete emails.

jrm4 1y ago
Do you mean "on the server?" I don't -- and just the opposite here; the cost of keeping literally all of them is close enough to zero, I never delete any emails and use "read/unread." I just archive yearly.
cosmic_cheese 1y ago
I keep mail because there’s been things that only became important or useful long after the fact. You just never know. They can also serve as a sort of snapshot of a certain point in time that’s very effective at jogging your memory. I’ve had occasions where old emails reminded me of things that happened that I’d nearly forgotten or conflated details about.

bxsioshc 1y ago

I never really understood why "owning" a domain is any more owning than you own your Gmail address: a company is letting you use it and that works until they don't. What an I missing?

IlikeKitties 1y ago
You aren't missing much only that domains are a bit more portable between registrars and they've historically been a bit more resistant against random bannings.
iamnothere 1y ago
> What an I missing? The contractual requirements that ICANN imposes upon registrars. They can’t just take your domain for any old reason. The rules are fairly well defined and registrars can lose their accreditation if they do not follow them. https://www.icann.org/en/contracted-parties/accredited-registrars/registrar-accreditation-agreement/registrant-rights-and-responsibilities-under-the-2009-registrar-accreditation-agreement-27-06-2011-en https://www.icann.org/en/contracted-parties/accredited-regis...
VariousPrograms 1y ago
You probably won't get hacked and have your domain taken down for distributing malware. But you also probably won't be randomly banned by Google/Proton. Neither feels like "full, unbannable control of my email" to me. If anything, I'm more concerned about my little old domain getting hijacked than getting banned from a hosted email account.
- bxsioshc 1y ago
  [dead]

lxgr 1y ago

> With this solution, there's a high chance that if they ban you by mistake (AI bots are to blame), they will not disable the forwarding mechanism. Why bet on that instead of doing it the other way around (i.e. making the self-operated mail server the primary that forwards to the service provider inbox), or at least practicing doing so by pointing the MX records accordingly?

pseidemann 1y ago
Afaik sending emails is much harder than receiving, because of several layers of anti-spam measurements, which don't apply for receiving (besides local spam filters).
- lxgr 1y ago
  Yes, but send and receive paths don't have to be symmetric. It's perfectly fine to send via the third-party provider and receive to your own server and forward to the third-party provider. The forwarding MX would need to support things like ARC and DKIM, though, or the forwarded emails themselves run a high risk of getting dropped as spam by the third-party provider.

jrm4 1y ago

Been doing this for years, and surprised he didn't seem to mention the other benefit: "infinity" email addresses. Oh, rando burger spot wants an email for some free fries? Great, hit me up at randoburgerspot@"mydomain".com .

deadbabe 1y ago
This is the most useful thing about having your own domain for email.
imiric 1y ago
I like that as well, but it's exhausting having to explain every time that, no, I don't in fact work at randoburgerspot...
- jrm4 1y ago
  What? It's your opportunity to nerd out and lecture people on why they're doing email WRONG!!! (only half joking)
  - EvanAnderson 1y ago
    I usually just say "I receive all email @mydomain.com. I make one-off emails so I can tell who sells my email address." Most "normies" get it.
- jcynix 1y ago
  Easy, just remove the vowels from the local part of the address: rndbrgr@example.com Even easier: I have a list of pre-generated fantasy addresses on my smartphone and can pass one to randoburgerspot on the fly.
  - robocat 1y ago
    > fantasy addresses Highly unrecommended if it's important or you're a repeat customer. It is easiest to pick a consistent generation scheme that helps you to remember the email address you gave. Obviously record it somewhere too (a folder for the first you've-just-signed-up email is easy) For throwaway accounts it doesn't matter what you give.

shaicoleman 1y ago

I've self hosted my email forwarding service on my own domain for over a decade, but eventually gave up because of deliverability issues that were out of my control - primarily with Microsoft's email services. I've switched 3 years ago to a hosted forwarding service forwardemail.net Pros: * Allows to switch email providers if needed * Allows to forward email to multiple providers * Allows to store backups of emails * Allows to have emails on multiple domains for different contexts (personal/professional/projects/etc.) * Allows to have different email addresses per service. If you get spam on that email address you can just stop forwarding emails for it. * Allows to have reliable mail rules based on the email address * Allows also to send emails from multiple addressses * Most spam is filtered before it reaches the inbox * Open source * Would be easy to switch to a different email forwarding service if needed (or self host it). * Excellent track record over 8+ years Cons: * They have the potential to snoop on your emails. Any service that's really important would have 2FA enabled, so I accept the risk. * They have the potential to send emails on your behalf - again, they've earned my trust, so I accept the risk for that. * Add another point possible failure. So far I haven't noticed any issues with it. * There's greylisting that delays emails for 5 minutes if they are not on the whitelist, which affects some of less common sending services. * In very rare cases, some services ban registering with a forwarding email addresses. * You need to make sure you don't lose your domain. I renew it 5 years before expiry with a reputable domain registrar (NameCheap). Overall, it's been working great for me.

sunnybeetroot 11mo ago
What’s your plan after for after those 5 years and you can’t renew? Domain expires, someone registers it and now has access to all your accounts? Albeit maybe you won’t care because you won’t be around but I wonder how it’ll impact your family/friends

bks 1y ago

Forwarding emails is problematic especially if your provider for the primary mx does not have great spam filtering and then you end up sending spam to your backup account. It certainly does not get around the ...if your account gets banned maybe the forwards will still work... concept but in general something like https://github.com/joeyates/imap-backup https://github.com/joeyates/imap-backup to backup your email and then add them to a typical backup process with your other files works well.

qyckudnefDi5 1y ago

Anyone wanna share their email strategy? I'm thinking of going for the following but I'm still undecided: 1. 1 custom domain (<simple-word-or-two>.com): this will be used for friends, family and any online accounts that know me IRL. Use Fastmail masked addresses with my custom domain where it makes sense like an online account for amazon. 2. 1 custom domain (<online-nickname>.xyz): this will be used for a blog, professional IRL interviews, correspondence, github. Use Fastmail masked addresses with my custom domain where it makes sense. 3. Masked emails using fastmail.com: for online accounts that are ephemeral, random newsletter signups etc. Don't want to associate any of my custom domains or IRL identity. Don't care if these are portable. My main goals are: - Separate my online identity/alias used for my blog (2) from gov entities, banks etc (1). - for more anonymity/privacy use the fastmail.com domain with masked addresses to blend in with others on this domain. I'd love feedback and to read what you do if you want to share :)

atrettel 1y ago
Your strategy seems good to me. The primary reference that I use for this kind of stuff is Michael Bazzell's book "Extreme Privacy". It goes into some detail about his strategy for using custom domains to compartmentalize things. That's what I base my own strategy on. The only thing that I would add is that I prefer to "salt" my single-purpose email addresses with a bunch of random characters to prevent enumeration attacks, since it would be trivial to figure out the email address that I use for different services by just guessing. If I used amazon@domain.net, I might also use uber@domain.net, etc. Adding a salt prevents this from happening.
commandersaki 1y ago
I just use a Fastmail address for my resume and such. I dont want to use my personal domain because while not offensive it sounds a bit silly.
furyofantares 1y ago
> 1 custom domain (<online-nickname>.xyz) I got banned by .xyz once. I did manage to get it cleared up, but being banned by the TLD itself is pretty unpleasant. It's hard to even figure out that's what happened. And then I had to "prove" I was no longer distributing malware, with a list of what things I'd done to clean up the site and prevent further malware distribution - which was difficult as I was never distributing malware to begin with. Just a static website for a wordle variant, no ads or other 3rd party content.

binarymax 1y ago

Anyone else have a .io domain and worried about the future?

cipehr 1y ago
What’s happening with io in the future?
- bigstrat2003 1y ago
  Apparently .io is the TLD for the British Indian Ocean territory, which (as I understand it) is going to go away as the UK is going to release the land. From what I understand the TLD would normally go away when the political entity does, but there has been a lot of concern in the industry because this particular TLD was very popular with outsiders.
bigstrat2003 1y ago
Yeah kinda. Honestly when I signed up for it I had no idea it was a country TLD, let alone that it might disappear so easily one day. If it does go away I'll live, but it will be quite annoying to have to switch my entire digital life over to a new domain. I've had my domain for 10+ years so lots of stuff is pointed there.
- zzo38computer 1y ago
  Although I had not signed up for .io domain names, I did expect it to be a country TLD when I saw it, because it is two letters, so to me it seems obvious that it is.
  - bigstrat2003 1y ago
    I wasn't aware of that convention when I signed up. I just figured it was like any other TLD.

hk1337 1y ago

I am actually working on doing the opposite and getting rid of my custom domains. I’m not really doing anything with them except spending money to have them. Working on getting all my socials to basically match with a similar username and just go from there. If I host my blog, assuming I actually start making posts, on GitHub with a custom domain, when I die then the domain will likely expire and the blog is no longer accessible. If I keep it with my GitHub .io url, it’ll be there for as long as the account is there.

tadasv 1y ago

I'm thinking about trying something similar to this on top of AWS SES. They make it fairly trivial to accept email and store it to S3. So email forwarding would be straight to S3 backup. But still would need a system to backup these emails to some local storage. Not sure what's the best way to handle this, I had my gmail account since the early days and it's baked into so many important accounts. It definitely crosses my mind what it'd be really difficult if I were blocked out somehow.

Evidlo 1y ago
Just start going through your accounts gradually over several years and you won't experience much friction.

aussieguy1234 1y ago

I guess the real question here is: Who is more likely to ban you, Google and co or your domain registar? For most people, who are not doing anything shady/controversial with their domain and are using a .com or .net domain (which are price regulated by ICANN), are not using a shady registrar and will always have the cash on hand to renew as needed, the answer will be Google and co. Its a good idea to set up auto-renew on a credit card, so you can be sure it will go through and you won't forget to renew it.

commandersaki 1y ago
I pay for 10 years in advance, which you can do with com/net/org.
- aussieguy1234 1y ago
  Not a bad idea, although i'd worry i'd forget to renew, may not remember something I set up a decade ago at the right time.
aussieguy1234 1y ago
I guess another consideration is also, should something happen, what level of support will you get? Most domain registrars will at least have some customer support. But good luck getting support for a free gmail account.

commandersaki 1y ago

How does Google paid email service work with catch all email addresses? Can you send with an arbitrary alias without setting up a separate identity? Will it automatically respond to the correct alias?

caminanteblanco 1y ago

This was actually way more actionable than I was expecting

jadenPete 1y ago

I’ve considered running an email server on my personal domain for some time, but the effort of changing my email hasn’t felt worth it to me, given how many services I’ve signed up for with my current email (a Gmail address). Is anyone aware of any strategies to make this easier? It’d be nice if I could set up forwarding so services would automatically use my new email, but I’m not sure if something like that exists.

unanimous 1y ago
Many email service providers give you the option to fetch all emails from a different service not just as a one-time thing, but ongoing. I'm not sure how that could be set up when running your own email server, but I bet there's a way. Even if there isn't, you can set up automatic forwarding in Gmail. There's a chance forwarding is better than fetching. I once had a Gmail account stolen, and account recovery was locked for some reason, but email forwarding had been set up and I was still able to get all emails the address received. In case it's relevant, I happen to use Fastmail now and their "mail fetch" feature involves imap.
layer8 1y ago
You can have the Gmail emails be forwarded to your own email server, or have your server fetch them from Gmail, and then migrate bit by bit, the most important accounts first. Before SPF and the like, it used to be trivial to also send email with a different From address (like your existing Gmail address) from your own server, but that’s not the case anymore.

RachelF 1y ago

The counterpoint for having your own domain is that emails you send have a good chance of being classified as spam.

mxuribe 1y ago
Yes, but, there are things one can do to help alleviate or avoid being classified as spammer...such as setting up SPF, DKIM, DMARc, etc. properly. Also, have folks send emails into your new inbox first, then reply, etc...Also, "warm up" the sending outbound by sending into legitimate services little by little, etc. Now, if you were to stand up your own self-hosted mail server, that makes things a little harder, but even then, there are things one can do...so its not dire.

geor9e 1y ago

My gmail backup solution is a Synology NAS, set up to continuously backup GDrive, and then I periodically click export to GDrive at takeout.google.com

8cvor6j844qw_d6 1y ago

I have the opposite thoughts on email domains. Personal email domains makes you very identifiable just by lookung at your domain. Using aliasing services (e.g. Mozilla Relay, Addy.io, etc.) with their default address generation ensures your email address itself does not disclose your domains when the eventual data breach occurs. Plus catch-all addresses makes you an easy target for spam by sending to any email address on that domain vs need to know specific email address on typical email services.

whycome 1y ago

We are all so vulnerable and have no protections. This is where government should be stepping in, but they won't until it happens to enough important people. This is fundamental

cosmin800 1y ago

Some pointed to already, but hosting anything at google is not the way forward.

mcv 1y ago

I think there are two pieces of legislation needed here: 1. Email providers need to be required to forward your email to your new address for a year if you ever lose your email for any reason. 2. Domain registrars need to save your domain name for a year and allow you ample time to reregister if you ever let it lapse for any reason.

dzhiurgis 1y ago

Doing this is worth it on sole reason you get to degoogle yourself (you can host email on iCloud+ plan). What I’m slowly doing is staggering my addresses by importance - trying to separate personal from all the spam / registration / etc. Saying that it’s probably been years since I used email to actually message someone.

internet_points 1y ago

Highly recommend mbsync/isync for backing up your email. Quite simple to set up for fastmail, gmail. Everyone recommends n+1 backups of everything else, why should your email be less deserving? As a bonus, if you install notmuch you get quick offline searches and can "mine" your email with shell scripts (or easily share it with sam altman if you're into that kind of thing). (Alternatively, if you prefer being GUI, just install Thunderbird – this can also download your full imap and give you local search. You don't even have to use Thunderbird for it to be useful as a backup; it's probably the easiest way to quickly become more independent from google randomly deciding your account should be locked, which does happen.)

kameit00 1y ago

I am using my own Mail Server (mailcow) beside my old gmail and other adresses. But for convenient, searchable offline Backups, I use Mailsteward (macOS) ... if it is of interest for someone: https://mailsteward.com https://mailsteward.com (alternatives for other OS: https://alternativeto.net/software/mailsteward/ https://alternativeto.net/software/mailsteward/) Then I put the database on multiple backup locations regularly. Another thing, some people do not already know: If you don't need a throwaway-adress for some services, and you just want to make your mailbox more structured, you can use '+' before the '@' to add another word to your email adress. Like: your.name+randomName@gmail.com The +randomName will be ignored and the emails are received at your.name@gmail.com. But most Servers (I use) will put a '[randomName]' before the subject of the received email. Which can be quite handy for handling your emails. Even more, if the company uses multiple different adresses to send you emails.

trallnag 1y ago

I have my own domain trallnag.com for this purpose, but it's always a huge pain to spell the domain to someone in person or over the phone. The leaf being a made up word does not make things simpler. So for these cases I've started to fall back on gmail.com or outlook.com

sdf4j 1y ago

When I see suggestions to "own" your email domain, how do you manage the chicken-egg problem of needing an email address in the first place to register the domain you want to lease? Are there registrars that let you walk in with a physical ID to proof you are you in case your email gets compromised and they get access to the registrar? Any experience with that?

deleted 1y ago

[deleted]