Back in 2001 when I was investigating the dependencies I wanted to take on for a webmail service, qmail was on my list of possible candidates, also because of t

Back in 2001 when I was investigating the dependencies I wanted to take on for a webmail service, qmail was on my list of possible candidates, also because of this security guarantee. However, I quickly learned that while that security guarantee probably was a good thing and valid, practically nobody was actually running vanilla qmail because it also had a very limited feature set. What people were running was a mixture of qmail with various patches of their own or downloaded from somewhere on the internet, none of them properly maintained and all of them likely full of security issues nobody was caring about. However, if you asked them what they were running, they were still saying qmail and they were still quoting the security guarantee which at that point was completely worthless. In my case I went with a "batteries included" solution that didn't provide a security guarantee but also came with all the features I needed built-in and which also got regular updates by its maintainer. Not needing to add third-party patches was more important than the design and guarantees of the base-product because the moment you patch the thing yourself, you own it and all the possibly given guarantees and positive aspects of the underlying architecture were null and void. The solution I went with in the end was exim and it still is the MTA on our central relay. It had more security issues than qmail or postfix over its history, but I also do not need to patch it for my solution with users-in-SQL. Meaning that whenever a security issues is found, I can rely on my distro to provide updates which will fix the issue. qmail and postfix provided a better security picture out-of-the-box but both would have needed manual patching for my needs which I deemed too risky. There is no question that the less functionality offered by a product, the more secure it is. If you don't need any features, then by all means go with a product that has no features and you'll automatically enjoy the best security: Features breed complexity. Complexity breeds security issues. But if you absolutely need a list of features that is offered by a tool, be careful in weighing up the risks of manually adding those additional, things compared to going with the full solution where somebody else is taking care of the security picture.