Tag: fusemail

Sourcing for a new email service

Couple of years ago I wrote about the initial troubles with Fusemail service not long after having switched to it. The grade for the service level during last couple of years is “fair” – the service is usable, and has many good features, but its stability is not stellar. For this reason it is in my plans to move the email service out of Fusemail.. but where to?

There are several hosted email solutions available – such as Rackspace Webmail or BlueTie Business Email. From time to time I’ve reviewed Rackspace’s features, and among other things they still did not support user-by-user adjustment of spam filter aggressiveness, or the ability to alias users and domains to actual accounts. Especially for the latter reason using Rackspace would be prohibitively expensive for me, so the search had to continue.

I think I have now found a workable solution: an in-house Postfix+Dovecot server with Google Postini as the edge (MX) service. Postfix is an incredibly robust and infinitely configurable mail server that I have only had positive experiences with. But I would rather not have to deal with spam filtering, and I also would rather not have to stress about “high availability” of the in-house server. Yes, the server will generally be up and receiving email, but should there be a hardware failure, I would want the inbound mail to be both cached and accessible while the server is repaired. Postini Message Continuity system provides this at $25/year/user (including spam/virus filtering), which roughly equals the annual cost of Fusemail service. If the receiving email server becomes unavailable, the arrived messages are cached, and are accessible via Gmail. Once the in-house service is then restored, the cached emails are quickly delivered.

However, one issue remained: in my configuration several of the aliased domains have ‘forward’ addresses that don’t have an associated user account at Fusemail, but that Fusemail has allowed to be forwarded to external destinations without an extra fee (or a separate account). I would not want to have to set up individual accounts at $25/year each to take care of these external forwards. But there is a way! Information about the aliased users and domains is retained in the messages as they’re forwarded by Postini. So by setting up one generic – or a “forwarder” – account at Postini, and then aliasing any such external forward accounts to it, it is possible to separate and correctly forward the emails to their intended recipients using Postfix’s rewriting rules.

Note that the in-house email server will need to be set to receive unauthenticated emails only from Postini’s IP range; that way spammers can’t bypass Postini filtering should they discover your SMTP server via port scan (and they will discover it, sooner or later). Also note that while Postini Message Continuity homepage mentions Exchange Server as the in-house mail server, they also provide instructions for how to integrate Postfix (more info can be found on the web).

While this solution does require familiarity with Postfix/Dovecot, it should offer an extremely stable email setup – and maximum amount of control over how email is routed – at a very reasonable cost.

When I get around to implementing this configuration I’ll write an article or series of articles of the process. Meanwhile I welcome any feedback, as well as suggestions for other comparable services. If a stable/high quality, reasonably priced, outsourced solution with good amount of control (equal or better than Fusemail) exists, I would consider it. But for now it seems that currently the only/best solution that won’t miss a beat while not breaking the bank is the one I’ve outlined above.

Fusemail auto-suspends spam-suspect accounts!

My troubles with Fusemail were caused by automated outbound spam filtering system Fusemail utilizes!  Fusemail filters all outbound email for spam and when their system thinks an email you’re sending is spam, it incredibly deactivates your account, automatically! According to their tech support (who finally returned my call 15 hours later) the block from a suspected spammer account is removed usually very quickly, and in case of my yesterday’s troubles the block removal, somehow, slipped through the cracks.

Once the account was reactivated, I tried re-sending the email that triggered the trouble, and sure enough, the account became blocked again! This time it was unblocked within minutes, but what’s concerning is that it’s just a standard business email with few paragraphs of text, a bulleted list, and few domain names mentioned.  I also sent it to an internal distribution list that I had defined in Fusemail.  No external recipients.

So, basically, it seems I’m not allowed to send this email because the email is rejected before it’s sent, and then my account becomes blocked until they unblock it.  What an incredibly, incredibly stupid way of operating an email gateway service!! Because any outbound message that you send can be considered spam and thus lead to the automated account suspension—and if you run a spam filter you know that ‘good’ emails get trapped in the spam filter now and then while an occasional spam mail gets through—Fusemail can in a business setting be only considered a mail RECEIVING service.  Imagine sending a completely innocuous email in the middle of a busy day, and your account becomes suspended if their automated filtering system deems your email spam! Perhaps they’ll unblock it in a few minutes, but how many inbound messages bounce during that time? Or, like in my case, you send an email on Saturday evening and your account is suspended until the next morning — both for sending and receiving.

It is reasonable for a mail service provider to monitor outbound mail for spam to prevent abuse of their systems.  But rather than having an automated system block accounts on its own, it should absolutely work in reverse where potential spammer accounts would be flagged for suspension, and then a technician would assess whether the user was indeed sending spam.  My guess is that false positives occur way more often than actual spammers being shut down; and besides, it’s much less of a problem if a spammer get few messages out before being shut down than legitimate users being shut down on suspicion. Otherwise, like in the case of my email that triggered the trouble, I can never send the message without reformatting it (or, perhaps, sending it individually to all intended recipients). For all I care I should be able to send GTUBE message through the system without it getting blocked. I’m not sending spam.

Fusemail is still a reasonably good solution for receiving mail; it has integrated spam-filter even with an optional sender confirmation, and there is [supposedly] reasonable amount of redundancy so mail reception for multiple accounts is more stable than, say, running an internal singular mail server.

But for outbound email I will be setting up an internal SMTP server.  I can’t risk an outbound email disabling mail reception for an unknown period of time. If you’re considering Fusemail, then consider running Postfix on *NIX, or perhaps some simple Windows SMTP server like Corporate SMTP Server locally for outbound mail.

Fusemail, this sucks! Fix it!

Fusemail, strike one

Over last several weeks I’ve gradually externalized both my own and my employer’s mail systems from internal servers to an outsourced service.  My own mail has been running for years on qmail on FreeBSD.  It’s worked well, but the age of my own server has become a growing concern, and in general in event of a system failure mail would not flow – that’s not good, and nobody’s going to fix it if I’m out of town.  So paying couple of bucks per month per mailbox is—at least in theory—worth it to not have to stress over mail system (even though I’ve found Postfix/Dovecot really interesting and actually quite pleasant to configure.. I was going to move the qmail system to Postfix before I started thinking about outsourcing the whole thing to save time).

Meanwhile, my employer’s email has been running on Exchange for several years, starting preceding my time with the company.  It has been a grief, though I’m sure it’s partially due to the fact that the the mail server is also the domain controller of a small office LAN. But why should it be? Qmail or Postfix run quite well on a Linux/*BSD server with Apache, MySQL, BIND. So I’ve been looking forward getting rid of Exchange, and migrating to Postfix/Dovecot system until, again, I started thinking that perhaps it’s not worth the stress to run an internal mail server. I’m the only person tending to it and, say, if I’m on a vacation and the mail goes down, it would not be good.

Once I started considering outsourcing email an option, I started evaluating various services. Fusemail and Mailtrust quickly bubbled to the top. Fusemail has more features, and the deciding factors (in Fusemail’s favor) were the ability to adjust the spam filtering (Mailtrust only has “on” or “off” options which is a bit scary — if the filtering is too stringent or too lenient, there’d be nothing that could be done about it.. Mailtrust’s rep suggested that I might want to look into an external spam filtering solution if I wanted more control.. but no thanks; I had been running Katharion for mail filtering for several months which worked ok, but if I was going to outsource the mail, I wanted an integrated solution), and the ability to increase a mailbox allocation for an individual user by purchasing more user accounts and allocating their mailbox allowance to the existing users. Mailtrust is fixed to 10Gb.

On the web there is about 50/50 comments for and against the quality of support for both Fusemail and Mailtrust, so from the comments alone it was impossible to deduce which service would have better support. Pre-sales support was slightly better on Fusemail side, and the few quirks ran across during setup have been addressed satisfactorily.

Strike One

Tonight (Saturday evening) around 18:00 my user account under my employer’s master account suddenly disappeared.  I access mail from Outlook via IMAP, and suddenly Outlook prompted for the account password. So I logged in to Fusemail admin account and clicked on my user name. [Paraphrasing] “Cannot edit terminated user account”.  What?! To terminate a user account in Fusemail you have to check the checkbox next to the user name, click “Terminate”, check another checkbox (“yes, I’m sure I want to do that”), and then click on “Yes”. Only then does a user account get removed, or scheduled for deletion as it takes many, many hours for the username actually be purged from the system so that it can be taken into use again. I most certainly did not execute those steps.  I’m the only one with access to that admin account, and the password is sufficiently complex so that it’s very unlikely the account would’ve been compromised. This leaves system error as the most likely cause.  I called the emergency support around 18:30 and left a message (they claim to have someone on call), then again again around 20:00, and also opened an “Urgent” support ticket through their support system at 22:40.  It’s now over six hours since my first “emergency” support request, so I can only assume the on-call person has gone to party (or that they don’t have an on-call tech in the first place). The emergency support number instructs the caller that “while the support technician is not immediately available, it does not mean that support would not be available immediately”. It’s looking like they were wrong.

I didn’t lose a tremendous amount of email (and perhaps Fusemail can restore it), but during this downtime emails to my account which has multiple “admin” aliases are being rejected.  If I was running my own mail server I could obviously have fixed a problem already, but an outsourced solution is supposed to *reduce* system management stress.

Longevity of this outsourcing attempt depends largely on how Fusemail will deal with this situation. Having to reconfigure my user account and its associated aliases would be annoying, but more than restore I want to know what caused the problem, can they be sure to prevent it from recurring, and what’s the deal with the non-existent emergency support.

If the deleted account would’ve been that of the CEO of my employer, or my personal primary account (which I have also outsourced to Fusemail in a separate account), this first strike would’ve likely been also the last for Fusemail.

—

Couple of considerations for those who’re comparing, say, Fusemail and Mailtrust, or considering mail outsourcing in the first place:

  • Forward/distribution management is currently better implemented in Mailtrust.  It’s workable in Fusemail, but it’s more straightforward in Mailtrust. If this is an important feature to you, pay attention when you’re comparing the services.
  • Secure connections (SMTP, IMAP, POP) work better with Mailtrust than with Fusemail. Fusemail is supposedly looking into this. Not a huge issue for me since the SMTP traffic is generally not encrypted anyway, so encrypting the last leg (from the service to the client) isn’t very significant.
  • Fusemail’s IMAP is not blazingly fast even when accessed from a fast net connection. Same goes occasionally for their web client. They are, however, generally within acceptable limits.
  • A general comment if you’re using SPF: when you use a service provider’s SMTP servers you can’t positively lock down who’s authorized to send mail for your domain. If someone who’s hosting their mail at Fusemail decides to send spam spoofing one of my domains, they’ll appear as authorized for the recipient’s spam filter since I’ve authorized Fusemail’s SMTP servers in my domains’ SPF records.
  • Test (!) the support of different providers by sending them a support request on Saturday evening. See when you get a response. Fusemail claims on their website: “24x7x365 Support”, but I’m now finding that it is not completely solid; it should instead read: “You can leave us a message 24x7x365″.
  • If you don’t have large number of users to support and they use IMAP to access the remote email, consider setting up backup mailboxes at gmail (free!), and creating a mail rule (available at least in Fusemail) which automatically copies those backup mailboxes for all inbound email.