New mail submit service for Librem One users at ms.librem.one

Services Librem One
1

We have setup a new mail submit service for Librem One users at ms.librem.one. To use this server, just replace smtp.librem.one with ms.librem.one in your mail client sending mail settings.

This server runs on latest debian gnu/linux stable version trixie, has latest postfix/opendkim and other libraries. Once more people test and confirm it is working well, we intend to point smtp.librem.one domain to the new server.

This update is part of tightening mail server configuration to prevent spoofing and spam.

This is an early call for testing the new server, so if you have a Librem.One email account, please test the new server and let us know if you find any issues.

3 Likes
2

Because of a gaming club that I belong to sends uses address lists .gt. 60+ odd recipients, it already means I can’t do reply-alls and I switch my replies to gmail.

Does this tightening of the email server lower that number again?

I haven’t seen a mass spam in years as it seems they target one addresee at a time. I think the recipient limit is a red herring now.

3

For now I have kept the maximum recipients limit same as the old server - 50. I’m discussing with the team if we can increase that limit.

4

I think you are correct. Any recipient limit should be a rate limit on total recipients regardless of whether the recipients are distributed as

  • one email sent to 60 recipients
  • 60 emails sent individually to each recipient
  • anything in between

but there should be some limit.

Regardless though the judgement call on this restriction is a difficult one. If Purism gets marked as a spammer and thereby blacklisted, it will be painful for Purism and painful for all Purism (Librem One) customers.

However

I feel as if your gaming club is not “doing it right” then.

With a mailing list, you should be replying solely to the mailing list and the mailing list host should be doing the fanout to send to every person on the mailing list. The identity (and email address) of each person on the mailing list should be secret (suppressed from view to you and to anyone else on the list). “reply-all” should not even be possible.

Unless of course you are the one managing the mailing list and the mailing list host is (or was) Librem One.

Having said that the identity should be secret, of course an individual contributor to the list may choose to include identifying information, including an email address, within the body of the contribution and in that case the identifying information would cease to be secret.

Some do. Some don’t.

I still see lame spam/scam emails addressed to “Dear Customer” or “Dear Sir/Madam”, which could well have been sent en masse.

But I also see better spam/scam emails addressed to “Dear Irvine”, where they have inferred the name from the email address, which by definition are emails sent one by one.

And the better still spam/scam emails marry up lists of email addresses with data breach material, so that the email is not only personally addressed but includes correct other personal information. (This can still be epic fail though if I am not a customer of the company that this is pretending to be from.)

1 Like
5

Unfortunately, I’m not in charge of THAT club. So I can’t go herding those cats. But I like your answer.

(There is another club I’m in charge of and I use groups.io for that, but that’s a different story.)

6

We have increased the limits now to 50 messages/hour and 100 recipients/message on ms.librem.one and smtp.librem.one.

3 Likes
7

The hourly limit has been changed to 500 recipients per day to allow for the recipients/message limit to be useful.

1 Like
8

On 25th at 7am UTC, I will make the new server the default outgoing mail server by pointing smtp.librem.one domain to ms.librem.one. Users won’t need to change anything, but domain propagation could take time. If you see problems during the transition, you can manually switch to ms.librem.one as domain. Both ms.puri.sm and smtp.puri.sm will work after the transition.

9

Looks like you’ve set the TTL to 5 minutes. So if anyone has a problem during the transition then one approach for troubleshooting can be “wait 5 minutes”.

(Except where a cache is intentionally over-caching i.e. caching a DNS entry beyond its official lifetime, which I myself do in some circumstances.)

10

This update is completed, now both servers can accept smtp.librem.one domain in tls certificate. Once the DNS propagation is done, I will remove this domain from the old server - we have time till the next domain renewal.

11

With ~/.msmtpc pointing to smtp.librem.one and sending mail,

host smtp.librem.one
port 587
tls on
tls_starttls on
auth on

On the receiving side, I can see it was sent via ms.librem.one

Received: by ms.librem.one (Postfix) id F3A3B1F576
	for <p...@puri.sm>; Tue, 24 Mar 2026 23:33:59 -0700 (PDT)
Date: Wed, 25 Mar 2026 12:03:42 +0530