The Dunning-Kruger paper was later discredited because, ironically, Dunning & Kruger thought they were better at statistics than they actually were!

There is a dark triad of personality disorders that often occur together: psychopathy (lack of empathy for others), Machiavellianism (manipulative) and narcissism. High narc people boast they are the greatest even if they are pretty terrible (but it’s not Dunning-Kruger because even if miraculously a high narc person became mediocre instead of poor at something they claim they are good at, they’ll still think they are good rather than reflecting on what they now know they don’t know).

If you have a VPS with a company that’s not super shady, and you don’t mind jumping through hoops for a few of the bigger providers (Microsoft + Google are the worst) and running around getting off any blocklists once when you start using the IP, it is not actually that hard to host your own.

That said, this advice probably applies more to people who, for example, already know what ssh is and already know or don’t mind learning what DMARC is, for example. Someone who isn’t technical and doesn’t want to become technical probably is better off with paying someone else to host a mailserver for them.

The quotes from the business owners in that article who feel so entitled to not pay their staff a living wage and then blame their customers for not making up the shortfall are infuriating: “If they don’t receive any tips, it’s impossible to survive in the service industry”, “It’s just to protect our staff”. Well if you really care about the waitstaff getting paid a living wage, how about this, pay them a living wage and stop trying to blame your customers for a problem you created.

Of course, part of the problem is that they don’t want to advertise the true cost - they want to advertise a price that is lower than the actual price, and then say stuff like the above to guilt their customers into paying more than the advertised price. With their competitors doing the same, it’s a race to the bottom dynamic. So the real solution is for the local government to: 1) require businesses to advertise the actual total amount of cash customers will have to hand over and not some misleading number, with enforcement if businesses mislead, 2) set a livable minimum wage, with no exceptions, and serious and well enforced penalties for employers that steal wages. If they did both of those things, then the problem would likely solve itself quickly.

I host my mail server on a VPS.

I suggest making sure you get DMARC / DKIM / SPF working, and having an anti-spam strategy (greylisting helps, but there are a few ASNs that just exist to send spam). Also make sure your IP is not on any public spam list.

The next problem you might face is that Microsoft and especially Google like to make it hard for anyone not using their services. With Microsoft, you fill in a form and jump through some hoops and they’ll start accepting your email enough to land it in spam. Unless you are regularly sending to Microsoft, it is hard to keep them accepting mail, but just sending to a free Hotmail address (owned and occasionally marked as read and deleted by you!) on cron is enough to keep occasional mail deliverable as long as none of your mail ever gets marked as spam. Google can be more of a pain to small email servers in terms of not landing in spam, but I think occasional reports of not spam will help you.

In terms of keeping down spam:

• postgrey or similar for greylisting keeps out the least serious spammers.
• The notorious spammers / bulletproof hosting is best blocked by ASN since they regularly shift IP addresses. Try a script like this on daily cron (assuming you jump to the custom BAD_AS table from your INPUT iptables rule) - please don’t run it too often since routeviews is a free public service and you should be respectful of them:

#!/bin/bash -e

TEMPDIR=$(mktemp -d)
trap 'rm -r "$TEMPDIR"' EXIT

curl https://archive.routeviews.org/oix-route-views/oix-full-snapshot-latest.dat.bz2 -Lo "$TEMPDIR/snapshot.bz2"
bzgrep -e " (15828|213035|400377|399471|210654|46573|211252|62904|135542|132372|36352|209641|7552|36352|12876|53667|138608|150393|60781|138607) i" $TEMPDIR/snapshot.bz2 | cut -d" " -f 3 | sort | uniq > $TEMPDIR/badranges

iptables -N BAD_AS || true
iptables -D INPUT -j BAD_AS || true
iptables -A INPUT -j BAD_AS
iptables -F BAD_AS

for ROUTE in $(cat "$TEMPDIR/badranges"); do
    iptables -A BAD_AS -s $ROUTE -j DROP;
done

• Despite Google being so hostile to very infrequent emails from IPs that have years of never sending spam, just because they are small, Gmail and Firebase are one of the most significant spam sources. I find client-side filtering works best for things like that which get through your other defences.
• Another spam source is Docusign. These types of companies tend to shut down individual scammer / spammer accounts, but then allow them back in for the same scam with another account.

Note that of the spam that gets through if you have the basic defences, it’s probably a similar level to big corporate hosted mail, so don’t let this deter you (I just hate spammers).