So, my name is Michiel, I wrote mox, I'm modern Shakira all in one meal server.
The goal with mox is to make it really easy to run your meal server so that you'll
actually do it.
So, that you're keep in control of your data and you'll help keep email decentralized.
So, I've got a question who's running your meal server today and so I can always be good.
It's more than half, it's like the three quarters I think.
So, the rest please give it a try soon and mox is an excellent option, I think.
So, today's talk will be out simplifying meal server setup and management later on a bit more.
Now, because if it takes too much time, people are not doing it.
So, agenda for today, quick introduction to mox, what it is.
And then some pitfalls that people do still run into when they try to set up a meal server.
And stuff that we maybe can take away, make it easier.
And then some plans for the coming year for me to make changes to mox to make it easier to install.
So, I normally don't really like talking about stuff that I still am going to do, but I'm going to do it anyway.
The talk then going to do well a little bit in a section about automatic DNS updates, because this is one of the ways to potentially make it easier to run your meal server.
Quick introduction to mox.
So, it really wants to be an all in one thing.
So, you don't need anything else to run a meal server just mox.
So, it doesn't be STF decim, demark, the reporting on TLS and demark, day in MTSTS, all that stuff to send and receive messages.
Of course, you want to read your messages, so we've got, I'm at four in a bunch of extensions, and then a web meal, because it is convenient oftentimes.
But you're not there yet, you need a junk field training that TLS certificates with acne, auto configuration, internationalized email addresses.
There's an admin panel for adding and removing domains, accounts and addresses.
There's even an API for sending physics or email and getting webpooks back for delivery stuff.
And there's a web server included.
And all of this stuff, it's a complete meal server that, you know, you can run all of your email in.
It's written in Go with some funt and stuff in TypeScript and it's MIT license.
And, you know, the idea is you'll get your system.
You download the binary.
It's a Go binary static, you know, complete the standalone, and you run the quick start.
So, you give it your domain or an address at your domain, and it will generate the configuration file.
It will do a bunch of checks.
It's the environment, okay, and if not, it will tell you what's wrong and how you can figure.
It will paint all the DNS records that you have to add.
And if you do that, then you should start it and you're good to go.
You've got a functioning system.
So, that's all great and very easy, of course.
But, you know, somehow stuff goes wrong.
And why do things go wrong?
Well, I mean, this is a, yeah, this is another long time.
It's, I'm going to list some things.
It's not as bad as maybe this image makes it look.
But, some of the things I see people doing, or they get a machine.
And then the host name, the fully qualified host name, that should resolve to the public IP.
Actually, on their machine, we resolve to a loopback IP.
So, it's kind of silly, because then if you try to deliver to your own domains, that starts failing.
Because, you know, it tries to deliver to the loopback IP.
And that thing is listening there, because most of the boxes listening on the public IP.
Quick start with check for that, and we warn that, oh, this is going on.
You have to fix it this in this way.
So, that's one thing to do.
Outgoing SMTPs, often blocked on new machines.
I want to do a little bit of expectation management for users.
Like, oh, you have to fix this first and then come back.
And that's that's what's et cetera.
People want to add that decant DNS records for RSA.
These are really long.
And you have to split them up in strings of 255 bytes.
But some DNS web operator interfaces don't understand that.
They will give you a really lousy error messages.
And people all they create something that's invalid.
And then it doesn't work.
So, we check for that after you set up.
Okay.
Did you actually correctly set this?
And if not, you get to fix it.
Then there's network, ever translation issues.
Somehow people set stuff up.
So, incoming connections appear to be coming from a local IP.
And that breaks all the SPF.
So, I don't have a good way to check for that yet.
But I want to add something I got for that.
Then as a reverse DNS for that is only setable on some machines for the IP4 address.
Not the IP6.
So, when we deliver outgoing messages, we normally pick one.
But if we pick the IP6 one, then stuff breaks for that outgoing delivery.
So, we make it possible of course to set rules for that now.
I should automate some more changes to make it easier for users to find those settings.
Because now these are records.
Or issues I get reported.
How can I do this?
How can I solve this?
So, I want to make this stuff easier for them.
Then there's a whole bunch more.
Now, DNS tech and resolvers.
I don't know why we still have this by default in Linux machines.
You get your non-therfying play.
And then, of course, I tell people to install unbound.
And most of the time it works, but somehow people also can mess that up.
But be check for that and we warn that this is no working yet.
You have to fix it.
Now, DNS check on the domain.
So, please, if you register a new domain.
Check if your DNS operator already does DNS tech.
If not, go somewhere else.
How should domain that?
Because if you want to migrate your domain to a new DNS operator,
we're setting up email that's too big things that you have to do.
Then, admins want to send what sort of mocks and mocks as everything,
including web server, but they want to run engine X or some other web server in front of that.
Now, that is possible.
But with email, if that's auto configuration and points and MTS,
and points that need to do the main, that need a web server.
So, you can do all this, but then you have to set up engine X forwarding or some other web server forwarding.
And somehow, that also doesn't always work out well for people.
So, also, stuff that can go wrong.
Then, IPs can be on DNS mode, please.
We check for that and we warn about it, expectation management.
And I shoot, but we don't do that.
That's more of a newly registered domain.
Because if you get a new domain, you try to deliver something.
There's a good chance that the receiving party has a bunch of checks.
And one of these red flags for an incoming message is, like, is this from a newly registered domain.
Because that's what's spammers do with this.
The registered new domain, and it starts spamming.
Now, again, I want to do some more expectation management of users.
Watch out, this can work, but you may run into some problems at first.
Then, some plans for making this easier.
So, currently, we have this mocks quick start.
It does a bunch of checks, and it prints what's wrong, and it tells you how to fix it.
But then, there's no easy way to run the checks again.
So, people think they fix it, but somehow they're not working yet.
They continue with the setup.
They try delivering, and they're getting to weird error messages that they don't understand.
So, I want to do a bit more hand-holding with a step-by-step guidance setup.
Just to, like, if you go to some cloud-based application,
you get taken into this flow.
Step one, step two, we want to get all the green check marks.
I want to add some things that you can recheck, that it's currently working,
like, after you fix stuff, so that after all these steps,
you are pretty much guaranteed to not see any issues anymore.
I have some ideas for deliverability things, because deliverability is a big issue.
If you want to run your own mail server, then you have to get the other side to accept your email,
and sometimes they are giving you a hard time,
and sometimes they give you, sometimes they give you helpful error messages,
but sometimes they don't.
Or they get you some kind of cryptic code.
There are a few parties that are doing course in quite a bit of pain,
and I think we can maybe detect when deliverance
feel that the delivery attempts with two-dose hosts,
and then we can tell the admin, like, this is a known thing.
This is how you work around it, or this is what you can do.
So just again, to help the users set up the system,
and that they don't get the feeling that this is also very complicated,
and that they can do it themselves.
So this is why I don't have anyone's doing this, or it is a good idea,
but I think it can maybe in theory work.
So if you know of any of these patterns, or bad parties,
and talk to me, and then you can make a list of those,
and I can build it into mocks, and then the postmaster can get a messaging,
this is going on, fix it like this.
Then I also want to do one click upgrade, just to make it even a little bit easier.
Now, if you want to update mocks, you download the binary, and you restart it,
so it's not that complicated.
But sometimes I tell the users you have to run this commands,
because you want to reparsh or the messages, the message parser has changed.
This is annoying, of course.
I forget too many of those emails.
I don't want to upgrade again, but if you just make it all automatic,
just download the binary, make it back up first, you know, restart it
without any downtime, that would be a nice addition.
And then automatically you run those, you know, reparsh, and whatnot scripts,
that again, lowers the burden on an admin to run their own mail server.
Then I think I can also help with a few chores that are, you know,
you could say, out of the scope for the mail server, because you can say,
you are a system administrator, you run this software, and some stuff
are the mail system, problem, but other stuff, you know, is your problem.
But I think we can still help with that, for example, backups.
So Mox currently has a way to make, well, there's a mox backup command,
and it makes it backup of, it is a consistent snapshot of all the message files
and all the database files that are needed, it puts them in a local directory.
But then it tells the admin, there it is.
Now you make sure it goes to some off-site place to make to keep it safe.
And of course, you can tell the admin, but I can also help you,
know, do what you're probably going to do anyway, which is write it to SAP
or S3 in some remote location.
So I can, you know, why not, why not ask some for some credentials,
and write it away once a day.
Just, you know, another chore that you don't have to do when you set up a new machine.
Encryption of data addressed, so currently, all the files, all the message files,
are unencrypted on disk, and also the, for example, TLS private keys,
are unencrypted on disk, so I feel bad about it.
And I want to at least encrypt all those things.
You know, we need to figure out where to store the key and how to get to the machine,
but at least it should not be on a block store, it's unencrypted, I think.
So it should be the default, so I want to do that for files that should be too hard.
And for database files, it will be complicated because the database layer doesn't allow me to,
you know, get in there anyway, so there will be a longer term thing.
So, another thing is alerting.
If you set up a mox, now you've got, it exports prometi's metrics,
but if you're a new admin, for example, that doesn't yet have a prometi's or an alert manager,
you have to go off and install that.
It's a whole new stack, it's a whole new problem.
Well, mox already checks all these numbers, so mox can also just, you know,
by default, send you emails maybe even something is wrong.
And of course, you're still at the choice to set up prometi's and bottom of the scraping,
but it's, once you don't necessarily have to do in the beginning.
So, another chore, a roofed, and then creating DNS records.
That's this one thing we maybe can also automate.
If you set up a new domain, every domain needs about 15 DNS records.
If you want to have the fully configured set up, it's a bit annoying.
Especially if you have one of those DNS web operator web interfaces,
where you have to copy paste first, the record name, then select a type,
and then scoppy paste value, and then do that 15 times, it's a bit annoying.
So, that's part of the why, but that's only, for the domain set up.
Later on, you may want to make changes to your configuration.
And it would be nice if you do that with one click.
For example, you know, with acne to get de-lasticificates,
I would configure a lot of some clips, and that would be,
but default, but would be nice if you could just show a button,
that enables account binding in the CAA record.
So, only your machine can get certificates for your domain.
So, I can of course ask people to go to the DNS web operator and change some DNS settings,
but it would be nice if it's just one click.
More important for me is to make these automatic DNS changes as a continual operational thing.
So, you can already, I can already ask people to make some changes
if they're necessary, and go into examples of why this would be necessary in a moment.
But if you want to do that, you have to be really careful with your DNS propagation.
And oftentimes, you have to make a DNS change, and a wait for a bit,
and make a configuration change, and a wait for a bit more, and you have to do it in the right order.
You know, don't forget about it.
And practice, this is annoying so people don't do it.
Or, in practice, people make mistakes, and it certainly breaks their email.
And of course, this is one of the reasons that people don't do it,
because they don't want to break their email.
But the computers can do this automatically, pretty good.
They're pretty good at timing, and doing stuff at the right time.
So, for one example of why you would need this, is with Dane, for your key rotations.
So, Dane is a way to do decentralized telesterification,
so you don't need that single CA centralized party to verify your TLS connections,
but you put the public fingerprints of the public keys of your TLS keys in DNS.
Now, sometimes you want to rotate those things.
If you want to rotate it, you want to use a new private key.
You have to first make sure that the new public keys fingerprints are in DNS,
as well as the old ones.
Then wait for the DNS propagation, so that everyone will have the new keys.
So, the old record with only the single old key is faced out in the new record that everyone sees,
as both keys, and then you can start using your new key,
and then you can remove the old public key from the DNS.
So, those are two steps you have to do in the right order.
This is pretty strictly if you get this wrong, your meal breaks, your deliverability breaks.
So, in practice, this is not happening.
And this is what, with MOOCs, you get Dane, but there's no key rotation, private key rotation.
And I feel bad about it, so I want to fix it,
but I don't want to ask admins to make many old DNS record changes.
Another one is D-kin key rotation.
So, you can, for D-kin, for signing that the emails coming from your domain,
you can play the new key, you can publish it in DNS, the public key,
you can publish it in DNS, but you have to wait for the publication of DNS,
because they have a negative lookup results in caches.
So, if you start using that key immediately, stuff will break.
You have to first generate it, publish it, wait for the publication, then start using it.
And then you think, I can remove the old key, but you cannot do that yet,
because you have to wait for all the email that it's still out there in transit,
because they still want to be able to verify that that message is not correctly signed.
You have to wait maybe a week or two week before you remove the old key.
So, if you forget and you have this old bunch of configurations stuff laying around.
But of course, we can do it automatically.
Same goes for NTA-STS policies, when you set up a new system,
you essentially want to start with show short lifetimes of these policies,
and then when it's stable, ramp them up.
You immediately ramp up to the secure, recommend it, a default of,
I think, cachability in weeks, because if you make a mistake in the beginning,
you will suffer the consequences for a while.
So, you want to stay short, but you want to increase the lifetimes automatically after a while.
At least, I want to do it automatically, because if you ask people to do it manually,
it's a lot of work, and they don't want to do it.
So, now this is the why I think it's useful, and now the how.
And there's good news.
We've got this thing called DNS update.
You can see from the RC number that is very old, so it should be stable.
You can all do it, that's great.
I just need a little bit more, because DNS update is a very simple thing for asking a DNS server to do,
and a record or remove a record, but they also want to read all the current records.
Because I want to know about the DNS propagation, I don't need to calculate what's the state of DNS.
So, there's a thing for that as well, and it's called zone transfers, AXFR.
So, there exists, we can use it, also want to be notified, a synchronously of changes to the zone,
that's DNS notify, so it's pretty good, did it go.
But now of course not, that's bad news.
Many people have their DNS hosted at some cloud provider,
and they don't offer this DNS update zone transfer and notify protocols.
So, now the nice plan goes out of the window.
They do have, on the other hand, custom APIs.
Every DNS operator is making up their own API.
They're not very complicated, sometimes they're simple, there's JSON HTTP with an authentication token,
so that's pretty easy, but there's still a whole bunch of them.
But there's also a bigger SDK, so you have to, like a big cloud provider has many things,
and they have a big SDK that you can use.
So, I want to link all that stuff in the moops binary.
It's too much churn, too much code.
By the way, if you have your own binds or not, or something you do have access to these.
So, I think I've very limited set of people.
So, I want to have this solution work for people, and not only for myself, but also for other people.
So, I think we need a better solution of this.
So, by the way, if you are one of the cloud providers, you know, consider doing something standard.
Having all these custom APIs with silly, it doesn't skill.
So, Christmas, I can't be the first one to have this problem, right?
Someone else has solved this for me.
So, what did I do?
Well, the most common solution is, of course, to say, no, we're not doing this.
You know, we're not helping you.
It's your problem.
Yeah.
So, yeah, yeah, yeah, maybe.
Yeah.
So, that's all the solution.
Now, let's encrypt and acne.
We've got this acne challenge thing where you can use DNAs to verify or you know,
you know, identify it, but otherwise, so you can get us a certificate.
You can make it a C name to something that is more dynamic.
So, just that thing, you know, you can make the put the challenge in the dynamic thing.
So, that's good work, but for E-note, one work is if so many records that you have to change,
and it doesn't work for some records of one work.
So, I don't think that's an option.
Other software has just implemented all these APIs, custom aggregates.
Okay?
I don't like, I don't like doing that.
And there's something called domain connected.
It's a few years old, it may be standardized.
Long story short, I don't think it fits this bill.
But, you know, it is aimed to solve a somewhat similar problem.
But still, so the plan for me is to only implement the standard protocols.
Yeah?
That makes more sense to me.
Yeah.
So, in most then, when this is implemented, you know,
when you add a domain, I ask for the name server and the credentials,
and then we're good to go.
And if you are as one of those custom clouds, API providers,
I see a question already.
Oh.
If I familiar with Octadines, I know it is a project to automatically synchronize changes,
I think, to cloud operators.
Yeah.
I've heard about it, yes.
Yeah.
So, my solution to this now is to ask people to install this separate tool
that I wrote called Dines Clay, Clay for Clouds Gateway.
And it worked like this.
Dines Clay is, you know, receiving the Dines update and zone transfers
and sending the Dines notify messages.
So, it only has to speak with Dines Clay.
And then, in Dines Clay, you will configure your provider.
You know, one of the 60 currently, and your credentials,
and it will translate between those.
So, then, people say, I don't have my Dines update,
then I can say, oh, you can still do it that way.
It's not a great solution because people have to install separate tool,
so I have to make it easy to install as well.
But at least, I'm not complicating mocks too much with this, with this stuff.
And maybe other open source projects that have this problem.
Also, I have to link in all those providers and the configuration
and all the nonsense that can just use this standard approach.
So, that's my hope.
And I think it will keep all the complexity and pain of these ghost bodies,
Dines providers out of mocks.
So, this is a screenshot of adding a new domain in your zone.
You can select one of these 60 operators.
And you provide it with whatever they need.
This is input fields.
So, I didn't implement all this stuff myself.
I'm using the LipDines Project.
LipDines is a project started by the Kelly Webster for Project,
which are known for doing automatic T-lessative goods with that thing clicked.
And they had this problem as well.
And they made community provided libraries to talk to all these providers.
So, I'm just using that.
And I didn't implement any of these background things,
but you can still benefit from it.
So, concluding plans for this year to make it easier to run your mail server
and set it up and maintain it.
And finally, I want to thank all users of mocks.
Are there any users of mocks today here?
Yes.
Thank you.
So, thanks for providing feedback, code, and keep it coming.
And to an L net and the NGI and the U for funding some work on mocks.
So, that's it.
Thank you for your attention.
Thank you.
Before we start questions, I'm very quick to make help to read a read a read piece.
Yeah.
Not just for the audience, but also for the audio.
Yeah.
Audio because.
I will try it.
But remind me.
If I forget.
So, I saw already.
One.
Okay.
So many people here already have their own mail server.
How can mocks help people move from whatever they have now to mocks?
Yeah.
So, I'm sure there's professional services around that.
So, your big part here can go to come to them.
But now, that's a good question.
I would like to help with that.
And I think the normal.
So, what I want to do.
But this is maybe a little bit later the future.
If you migrate to the main.
If you want to move to the main to mocks.
That there's also a sort of guided step by step thing that says, oh, I detect that you've
currently are a disoperator.
You want to be here.
So, you need to make these the nest changes.
And also to help you.
I'm at sync your data.
Because I think that's what people most need.
I assume that much was going to be the main answer.
Yeah.
I also want to really make it easy so that you could do all the steps in the right order.
And not lose any email.
I'm not break anything in the way.
But I think it's definitely the main part.
It's missing.
But that's already, I'm applying the mocks.
So, we have.
It just needs, just need a little bit more time to implement.
If I'm aware of the DNS control project.
And I'm not sure about it.
It's a similar thing like the DNS that you can specify what your DNS settings need
to be and that you can sync it to.
Yes.
But you think that JavaScript doesn't deserve or less.
Do you use JavaScript as a?
Yes.
Okay.
Yeah.
I've looked at a few of those projects and I decided it's not going automatic enough for me.
But maybe I should check some of those solutions again.
It will be a lot of work to implement this.
More of a question regarding the structure.
Why did you decide to bundle everything together in the moment?
Because first you have the S&PPI map and everything on the way of mail clear.
It does actually chunking it out into separate projects.
Why do you think that's better?
And also why did you use already existing libraries for free?
Why?
That's not the case.
So you're most of your self.
I'm curious about your choice.
Yeah.
So the question is why did I put that?
Like all the protocols and so on in one binary in one application.
And not keep it separate or reuse and reuse more of other existing applications.
So what I don't like is when you have to mesh together a lot of components together working system.
And so that's why this is one big system.
Although I could still deliver one system in multiple components, maybe.
Though I don't think I didn't see really much of the need for that.
It's not much of an advantage in doing that because then your spits stuff that you try to put together why not put it together in the first place.
There's also interactions between incoming S&P things and a mail store that normally in classic
Milset apps you have the S&P thing and it can deliver to the mail store.
But not no much more about that mail store.
But it mocks the message classification of junk and on junk.
They influence the S&P server and if they are going to reject, if the S&P server is going to reject the message in a certain way.
So I think as advantage to having this all of this in one server that has access to all the S&P server.
Yes, it's mostly like for personal use.
Well, small use cases but I would say companies of 100 users could also easily use this.
I mean accept that the webmills a bit Spartan maybe.
So I don't think I think it currently appeals mostly to technical audience.
But I think if I touch up the UI and it may make it look a bit more like people expected to.
And it would work just as well.
But this is not meant.
It's not meant to be like a super scaling ISP that sense like 10,000 messages a second or something.
There's not all the audience.
I want people to run around Milset first and that's the, that's one goal.
We have one for the back of it.
As you already have the key to do in anything.
When it's just that it's in a server also.
Yeah, so the question is why don't it add just add a DNS server to mox instead.
Yeah, it's very tempting.
It's a bit more complicated than I want to take on at this moment.
Because yeah, I'm not going to do a non-DNS server of course.
Because I have my standard.
But yeah, true.
Yeah, it's a very appealing option.
Everything might seem there.
Yeah, it might seem there.
Yeah.
Thank you.