7 ms·

How to run your own mail server: Don't. How to run your own mail server (for experts): Don't. I say this as someone who has run my own mail server for 20+ yea

How to run your own mail server: Don't. How to run your own mail server (for experts): Don't. I say this as someone who has run my own mail server for 20+ years. Now, if you absolutely have to get off Google, and the other available hosted options don't work for you, then this article looks like a good start. I'd add roundcube for web access and letsencrypt for SSL. One thing you'll never really get, in my experience, is good spam handling. The big providers just have so much more data to work with to prevent spam.

ams6110 9y ago
I run OpenSMTPD. It delivers my mail to a maildir. I read it in emacs. It's pretty simple. But not everyone's cup of tea. If I had to worry about IMAP, Webmail, etc. I wouldn't run my own.
- DrPhish 9y ago
  I have my opensmtpd setup relay incoming mail to a Citadel IMAP/webmail server. It works a treat. I'm paranoid, so I don't allow external IMAP, force SSL on the webmail, GeoIP block it to only 3 countries and have a simple auth prompt on it as well just in case the landing page has an exploit.
wila 9y ago
But the spam handling you can actually buy. A spamexperts (to name just one alternative) inbound filter account for 1 domain costs about 1.5 dollar per month for an unlimited number of email boxes.
cat199 9y ago
> One thing you'll never really get, in my experience, is good spam handling. Not quite the same calibre, but really, SpamAssassin+RBLs tuned a smidge too high plus a user whitelist is pretty darn good. Scripting something that auto-adds to whitelist based on sent mail would do even better (but is exactly the kind of 'fun' that people don't have to deal with using 3rd party service). I've heard you can do better with dspam.
catdog 9y ago
> One thing you'll never really get, in my experience, is good spam handling. Not in my experience. I'm in general very happy with the results of SpamAssassin. Occasionally sth. slips through but when I compare it to my gmail account it's not worse, maybe even better. The only thing I use in addition is postscreen [1] (pregreet test only) to stop the dumbest category of spam bots. [1] http://www.postfix.org/POSTSCREEN_README.html http://www.postfix.org/POSTSCREEN_README.html
- linsomniac 9y ago
  I used SpamAssassin, greylisting, SPF, a variety of RBLs, and hashcash, but never got anywhere near what my gmail experience has been. I literally almost never get spam to my main mailbox in gmail, I would get a dozen or more a day on my own server.
inferiorhuman 9y ago
> One thing you'll never really get, in my experience, is good spam handling. The big providers just have so much more data to work with to prevent spam. I've found the exact opposite. Big providers have to run more lenient rules than I'm willing to use. I can use SORBS and Spamhaus to bounce mail. Sure, both SORBS and SH suggest never ever doing this, but when you self-host you can check your logs, and over the course of a few years I've never had a false positive. Now that I'm reliant on my ISP for inbound mail I don't have that low pass filter and the amount of spam I get is staggering. Google is the worst offender in my experience. They don't take spam reports and they don't do a good job of filtering users' inboxes. Sure, there's a SORBS list to bounce mail from hosts that have bogus WHOIS info... but then you block Google... and everyone uses Google... so you just get to put up with all the spam they send out. From the other end, my gmail inbox is nothing but spam these days (the report spam link is generally useless).

ams6110 9y ago

I run OpenSMTPD. It delivers my mail to a maildir. I read it in emacs. It's pretty simple. But not everyone's cup of tea. If I had to worry about IMAP, Webmail, etc. I wouldn't run my own.

DrPhish 9y ago
I have my opensmtpd setup relay incoming mail to a Citadel IMAP/webmail server. It works a treat. I'm paranoid, so I don't allow external IMAP, force SSL on the webmail, GeoIP block it to only 3 countries and have a simple auth prompt on it as well just in case the landing page has an exploit.

wila 9y ago

But the spam handling you can actually buy. A spamexperts (to name just one alternative) inbound filter account for 1 domain costs about 1.5 dollar per month for an unlimited number of email boxes.

cat199 9y ago

> One thing you'll never really get, in my experience, is good spam handling. Not quite the same calibre, but really, SpamAssassin+RBLs tuned a smidge too high plus a user whitelist is pretty darn good. Scripting something that auto-adds to whitelist based on sent mail would do even better (but is exactly the kind of 'fun' that people don't have to deal with using 3rd party service). I've heard you can do better with dspam.

catdog 9y ago

> One thing you'll never really get, in my experience, is good spam handling. Not in my experience. I'm in general very happy with the results of SpamAssassin. Occasionally sth. slips through but when I compare it to my gmail account it's not worse, maybe even better. The only thing I use in addition is postscreen [1] (pregreet test only) to stop the dumbest category of spam bots. [1] http://www.postfix.org/POSTSCREEN_README.html http://www.postfix.org/POSTSCREEN_README.html

linsomniac 9y ago
I used SpamAssassin, greylisting, SPF, a variety of RBLs, and hashcash, but never got anywhere near what my gmail experience has been. I literally almost never get spam to my main mailbox in gmail, I would get a dozen or more a day on my own server.

inferiorhuman 9y ago

> One thing you'll never really get, in my experience, is good spam handling. The big providers just have so much more data to work with to prevent spam. I've found the exact opposite. Big providers have to run more lenient rules than I'm willing to use. I can use SORBS and Spamhaus to bounce mail. Sure, both SORBS and SH suggest never ever doing this, but when you self-host you can check your logs, and over the course of a few years I've never had a false positive. Now that I'm reliant on my ISP for inbound mail I don't have that low pass filter and the amount of spam I get is staggering. Google is the worst offender in my experience. They don't take spam reports and they don't do a good job of filtering users' inboxes. Sure, there's a SORBS list to bounce mail from hosts that have bogus WHOIS info... but then you block Google... and everyone uses Google... so you just get to put up with all the spam they send out. From the other end, my gmail inbox is nothing but spam these days (the report spam link is generally useless).