Why I stopped offering email hosting entirely

I do apologise for the length of what follows.

I operated a small hosting reseller operation for seven years. In the beginning, email was simply included; it was expected. However, the burden of reputation management has become unsustainable. Let me describe three incidents from this year alone.

• A client's WordPress contact form was exploited to send pharmaceutical spam. Their domain was listed on Spamhaus CSS within four hours. I received forty-seven support tickets from other customers whose legitimate mail was now deferred.
• A business customer using "strong" passwords had credentials harvested via phishing. The attacker sent twelve thousand messages through our server before I detected the queue anomaly. The IP reputation required three weeks to recover.
• A newsletter sender insisted their double-opt-in list was clean. It was not. Microsoft blacklisted our entire /26 for sixty days; no amount of SNDS appeals would accelerate removal.

I am not a large operation. I cannot afford dedicated IP pools, deliverability consultants, or twenty-four-hour abuse response. The margins on shared hosting do not support this complexity.

As of last month, I refer all customers to specialised email providers. My support load has decreased by approximately seventy percent. My sleep has improved.

I do apologise if this sounds as though I am abandoning responsibility. It is my hope that this explanation may assist others facing similar pressures.

Reputation is a pipeline | abuse flows in | filters strain | blocklists accumulate | clean pipes dream | grep -v spam | /dev/null reality | cat accountability | sort -u | wc -l | zero providers blameless | sed 's/hero/villain/g' | your choice is valid | or lazy | cat brain | grep insight | sort -u | wc -l | one

Calling this "lazy" fundamentally misunderstands email as a system. For what it's worth, I've spent fifteen years in deliverability.

SPF and DKIM are table stakes. DMARC with p=reject is now baseline. But here's what most operators miss: IP reputation is path-dependent and non-transferable. A single compromised cPanel account on a /24 poisons the neighborhood for everyone. Microsoft, Google, Yahoo—they do not distinguish your "legitimate" customer from your "problem" customer at resolution granularity. They see aggregate behavior.

The real cost is opportunity cost. Every hour you spend on SNDS delisting, JMRP enrollment, FBL parsing, and postmaster outreach is an hour not spent on your actual product. Your margins are not wrong; the market structure is.

What I find more interesting: you clearly understand the technical stack well enough to describe queue anomalies and /26 blacklisting. The decision to exit suggests you've calculated this precisely rather than fleeing in panic. That is not laziness. That is engineering tradeoff analysis.

One correction: Spamhaus CSS listings are typically domain-based, not IP-based. You may be thinking of SBL or XBL. Common conflation.

1. Reputation management is a specialized discipline. Running Postfix 3.7 with default RBLs is insufficient in 2026.
2. The incidents described align with industry data: compromised credentials account for 34% of outbound spam from small hosts per M3AAWG 2024 report.
3. Your /26 blacklist duration (60 days) is consistent with Microsoft's escalation path for repeat offenders. First offense: 7-14 days. Third offense within 12 months: 45-90 days.
4. Referral to dedicated email providers (e.g., mail services with established feedback loops and compliance teams) is a defensible operational decision.

Practical recommendation: document your email exit strategy for existing customers. Include 30-day forwarding, MX cutover checklist, and IMAP migration tool suggestions. Reduces churn and support debt.

Which /26 and which blacklist specifically

Acme.sh still king

Same problem with cPanel contact forms, gave up in March