4

I've set up Mailcow on a server that has dedicated ipv4 but not /64 ipv6. I'm not quite sure how the reputation of the mail server is calculated. But I know that usually a device should get a /64 block, and cloudflare's ratelimit is also treating the /64 block as an single ipv4. Mailcow seems to be encouraging to use ipv6, from Disable IPv6 doc "This is ONLY recommended if you do not have an IPv6 enabled network on your host!" Should mail servers avoid sharing /64 ipv6 with others for reputation?

4
  • I don't see why they should or shouldn't share /64. After all it is easy to get your hands on a /48 subnet - like say through for instance Tunnelbroker.net. If anything the same argument for or against sharing /64 subnet, can be said for /48 subnet. Jun 23, 2022 at 21:04
  • @LasseMichaelMølgaard If the tech giant treats /64 as one's own, others sending spam mail on a shared /64 block will cause my mail to be unreachable. tunnelbroker blocks the mail port
    – maP1E bluE
    Jun 23, 2022 at 21:44
  • 2
    "But I know that usually a device should get a /64 block" No, a standard IPv6 network is /64. Each device is assigned an address in the network, the way a device gets an IPv4 address in a network. IPv6 makes it much easier to have multiple networks on a single device interface. Typically, you get a /48 prefix (or smaller) from which you get 65,536 standard /64 networks. It is very easy for a business to get such a prefix from the RIR (/48 is the longest IPv6 prefix that can be advertised on the public Internet).
    – Ron Maupin
    Jun 23, 2022 at 21:52
  • Well personally I will not make rules to block out a single /64, since getting a /48 is easy and my list with blocked subnets would get rather long. Instead I would summarize and block the entire /48 or at least the /56 subnet containing said offending /64 subnet. Which is why I am currently blocking 50% of all available ipv4 addresses for 2 Chinese, 1 iranian, and 1 russian ISP. Simply because my server has logged that many login attempts or received that many spam mails from hosts belonging to those networks. Jun 23, 2022 at 23:59

1 Answer 1

6

No, you should not go out of your way to make servers controlled by the same entity look less so. If systems can automatically make the connection that you are responsible for multiple addresses, that is a good thing.

Yes, many organisations will aggregate IPv6 addresses and treat all addresses with certain prefixes (very commonly <=64, often 56) as controlled by the same entity. This works to your advantage:

  • If one already received high volumes from some block of addresses, one has to be less suspicious of a sudden increase in volume, because it is not as much in relative terms.
  • If one has already logged a reasonable past resolution to an abuse complaint for a block, one does not need to apply the less nice mitigations otherwise reserved for unresponsive senders.

The fact that some of the less side-effect-free ways of dealing with rampant spam may lead to loss of communication for related servers should not worry you, because if you do not spam and do not associate with those enabling them, such actions will only affect you with extremely wrong configuration or compromised hosts.


Also yes, IPv6 should definitely be enabled now that the older protocol is increasingly broken by operating it beyond its design limitations. I tend to extend a higher credit of trust towards mail coming in via IPv6 because my experience so far is that many of the worst (in terms of allowing people to be bad netizens) providers simply do not offer IPv6 connectivity yet. Incidentally, Google has the reputation to do the opposite. YMMV.

1
  • Not sure how to put it in proper words, but there is a bit of a comparison with history that goes into my reasoning here. There used to be a time when the median mail was not utter garbage, so there once was a point in worrying about the consequences of standing out negatively. This is simply not among the important considerations for most internet mail servers any more: Now that you would have to make an effort to achieve a worse than average performance.
    – anx
    Jun 24, 2022 at 0:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .