11 ms·

I run my own mail infrastructure. To say the least I wouldn't recommend it even to my worst enemies. It's horrible. Actually it's fine until it's not. Then you

I run my own mail infrastructure. To say the least I wouldn't recommend it even to my worst enemies. It's horrible. Actually it's fine until it's not. Then your email doesn't work and you could be missing out on important communications. And then you're scrambling to figure out how the spammers managed to exploit your setup this time. And you have to learn a tonne of crap in order to manage it... and the text files! Configuration... configuration everywhere. Obscure configuration. Configuration that has real consequences and causes spooky action at a distance. Configuration that will soon be exploited in strange ways. I was so frustrated the last time my mail server went down that I started writing an SMTP protocol handler in Haskell with the intent of writing a MTA with the goal of minimizing configuration and being secure and resistant to attacks by default. So that hopefully more people can run their own infrastructure without prematurely aging. I dunno how useful it will be to others but at least it will keep my gray hairs at bay, I hope, when it's ready for use. Until then though we need more guides like this for us poor souls who do go down this route. There are way too many out-dated guides awash in the sea of information.

ericcholis 9y ago
Same experience here. Previously I maintained a Merak/IceWarp mail server. The "idea" was great, they provided a nice interface for a small organization (15ish people). But, it became an uphill battle very quickly.
mozumder 9y ago
I run my own mail server, for several years now. A Mac Mini on Mac OS Server on a static IP address. It's been great, literally zero maintenance, but it completely hides everything about the underlying architecture.
lisper 9y ago
Heh, I have had the exact opposite experience. My mail setup has been stable and reliable for years. (I'm a little bit afraid to report this because one possible explanation is that I simply have not been on any serious hacker's radar screen.) I'm not doing anything fancy: just postfix+dovecot, gray listing using a custom milter I wrote in Python, and Spam Sieve running client-side on my Mac.
- deleted 9y ago
  [deleted]
ams6110 9y ago
OpenBSD's smtpd has worked well for me. It's also available in a portable version. https://www.opensmtpd.org/ https://www.opensmtpd.org/ Configuration is one file, very simple. It won't do everything a sendmail does, but it's never had me pulling my hair out.
- DrPhish 9y ago
  I also am using opensmtpd, and have been for years. Even setting up starttls encryption and a DKIM proxy were simple. I have never had an issue with accidentally setting it up as an open relay or anything else that would place me on a blacklist.
- dbolgheroni 9y ago
  Of course, no MTA is as easy as creating a GMail account, but OpenBSD's smtpd is a lot clearer than any of the alternatives.
StavrosK 9y ago
I'm entertaining the idea of running my own SMTP server for Spamnesty (https://spa.mnesty.com/ https://spa.mnesty.com/) so I can at least cut down on some of the Mailgun invoice items. Would you still not recommend this if I were just sending mail to spammers?
Jaruzel 9y ago
My use case is different, as I'm a Windows guy, but this is what I've got: 1. Custom MTA that handles incoming SMTP. 2. SpamAssassin that is called by the above MTA which flags email as spam/not-spam. 3. Custom MTA forwards not-spam to the users inbox. 4. Custom MTA forwards SPAM to postmaster (this bit needs significant re-working) 5. Main Mailserver is Microsoft Exchange run On-Premises. 6. All Mail clients are Outlook 2016, or Android Phones. The reason I had to write my own MTA was so that I could leverage a 3rd party anti-spam solution, as Exchange doesn't come with one, and add-ons for Exchange are quite expensive. Running your own mailserver is a complete nightmare. If I knew it would end up this complex 20+ years on, I'd have never done it in the first place.
- rkagerer 9y ago
  Your custom MTA is impressive, but if you want to reduce the amount of custom code you need to maintain (and don't mind one third party service in the mix), you could use something like SpamHero. It's reasonably effective and fairly cheap. Postini was even better, before Google bought them and bastardized the product.
  - Jaruzel 9y ago
    Agreed. I would love to ditch the customisations and run something standard!
    - MartijnBraam 9y ago
      Can't you just replace the custom MTA with postfix? That's what the previous company I worked at did
      - Jaruzel 9y ago
        Yeah, I asked about that elsewhere in this thread... https://news.ycombinator.com/item?id=16239809 https://news.ycombinator.com/item?id=16239809
ryandrake 9y ago
I recently moved off of Gmail and now run my own personal/family E-mail server, and I have to say so far it has been pretty pain free. I probably just haven't been doing it for long enough to run into trouble yet. Bog standard Debian install, Exim4 + dovecot + SpamAssassin. TLS, SPF, DKIM, and other acronyms all set up and working. The initial setup was a few days config file tweaking (why don't these things come working and secured out of the box?), but since then no issues--knock on wood. My only complaint is the spam filtering so far is not as good as Gmail's was, but I probably just need to better configure things. Bookmarking this guide for later!
- nerpderp83 9y ago
  Having run both Exim and Postfix, I would highly recommend you run Postfix, if not for the security for the configuration. If you can't run Postfix, run Exim in a container.
  - ekiara 9y ago
    Could you expand on this? What security vulnerabilities does Exim4 have that you'd avoid just by choosing Postfix as an alternative?
    - nerpderp83 9y ago
      Postfix has a very clear separation of concerns and least privledge in the use of lots of helper daemons. Exim4 doesn't not have this architecture and is less secure because of it. http://www.postfix.org/OVERVIEW.html http://www.postfix.org/OVERVIEW.html
ivm 9y ago
Absolutely horrible – I tried to setup Postfix for my friends to hide Gmail behind their organization's domain. Configurations were incredibly unfriendly and tedious. Despite all anti-spam measures, Microsoft was blocking their IP according to some private spam blacklists. Then they couldn't send emails to some ancient government server in Guatemala because of encoding incompatibilities. I ended up moving them to the free MailGun plan. It took me 2 hours instead of 2 days.
gexcolo 9y ago
I run an E-mail server with over 250,000 users. I started by following some generic "dovecot+postfix+mysql" tutorial on howtoforge and I'm still using mostly the same setup over 4 years later. >Then your email doesn't work and you could be missing out on important communications Pretty much every E-mail server will retry sending your E-mail for a long time (like 2 days is default on postfix). Once your mail server comes back up all of your E-mail you missed during the downtime will come in slowly as messages are retried >you're scrambling to figure out how the spammers managed to exploit your setup this time Any tutorial should point you in the right direction restricting open relay on your mail server, just basically requiring authentication to send E-mail outside of your server. >I started writing an SMTP protocol handler in Haskell Do you have any link to your progress? Postfix's configuration definitely shows age, but all of the options do important things that you could actually want to change. It seems other MTAs either have just as complicated configuration (to do the same things), or have stunted functionality. >being secure and resistant to attacks by default I agree about sensible and more secure defaults in configuration. But the application security of postfix and dovecot are both pretty robust[0][1]. Considering they are 19 and 15 years old, both applications have seen several developer-lifetimes of effort. >we need more guides like this for us poor souls who do go down this route I agree, though mediocre howtoforge tutorials seem to have worked fine for this poor soul. [0] https://www.cvedetails.com/product/14794/Postfix-Postfix.html?vendor_id=8450 https://www.cvedetails.com/product/14794/Postfix-Postfix.htm... [1] https://www.cvedetails.com/vendor/6485/Dovecot.html https://www.cvedetails.com/vendor/6485/Dovecot.html
- andris9 9y ago
  Would you be able to share some stats, like how much disk space these accounts take up and such? For larger scale e-mail sending I built my own MTA (https://github.com/zone-eu/zone-mta https://github.com/zone-eu/zone-mta), our main instance sends about 750k emails a day (mostly normal ISP traffic, maybe 25% marketing emails) and its most valuable feature is juggling with IP addresses and blacklist detection, so if some mailbox gets hacked, starts sending out spam and the IP ends up in Spamhaus et al then this IP is removed from the list for other users automatically. Has saved us a ton of time.
rsync 9y ago
"And then you're scrambling to figure out how the spammers managed to exploit your setup this time." ... " ... writing a MTA with the goal of minimizing configuration and being secure and resistant to attacks by default. " As a 20+ year UNIX sysadmin and fellow owner of my own email infrastructure for 18 of those, I am surprised to read this and am not even sure what you are talking about. Can you explain what you mean by attacks and exploits from spammers ? Other than accidentally running as a relay or actually having a remote exploit in your server(s), what are the attacks that you have in mind ? "Configuration that will soon be exploited in strange ways." Again, am genuinely interested in an explanation ... other than running as a relay, and maybe handling backscatter (but that's not really config, it's just a blacklist) what are you referring to ?
- drdaeman 9y ago
  Besides accidentally allowing relay, it could be a backscatter spam.
- Clubber 9y ago
  I've run my own mail server since probably 1998 or so. I have had a few problems here and there, but nothing major. The worst is when the power goes out, but smtp has a wonderful resend feature when the destination server isn't responding. I know my emails aren't being farmed from the NSA (at least from my side). I know Google isn't scanning all my emails to sell me garbage. I know it won't be shut down because of some errant algorithm. I have a really short email address. I can setup family and friends easily. I can send newsletters without having to deal with someone else's policies (on my side anyway). I love it.
  - z3t4 9y ago
    You can have a backup server that holds your e-mail until your main server goes back up. You configure priority in DNS zone file.
    - rhizome 9y ago
      Backup MX is usually not necessary, especially for home setups. Anything RFC-compliant will retry sending its email to you for days after being rejected.
inferiorhuman 9y ago
My experience was quite the opposite (granted I'm an ops guy these days anyhow). I've been self-hosting mail for ages with a postfix + dovecot + cyrus + spamassassin + opendkim + dkimproxy + lets encrypt stack. Everything just works, although I'm going to move it into a jail sooner than later so I can rebuild it more easily. The biggest pain is no longer having a static IP or reverse DNS (thanks Sonic!). Having reverse DNS setup and an IP address that doesn't map to a pool of dynamic IPs are the big things that will keep you off of spam lists. Coming from sendmail I think postfix and dovecot have been a breath of fresh air. The defaults generally just work. Getting inbound (so spamassassin can check) and outbound dkim to work were the trickiest part. Aside from regular OS updates it's largely hands off.
- nmjenkins 9y ago
  Do you really use both Dovecot and Cyrus? Which one do you use for what?
  - inferiorhuman 9y ago
    Not Cyrus IMAP, but their SASL library. Actually, I just looked. Cyrus-sasl was pulled in as a dependency for mutt. I'm using Dovecot for postfix's SASL backend these days. This allows relaying mail for authenticated users only. Dovecot uses PAM for authentication, and so any user with an account can log in and access their own mailbox and send mail out. The biggest downside is that because I'm deviating from the default FreeBSD configuration for postfix I'm on my own in terms of updates. I should also clarify the above statement about moving it all into a jail -- I mean a jail managed by (in this case) ansible. Yes, if you just slap something together it will be brittle no matter what stack you choose. Ansible + Jenkins + Jails make it much easier to manage changes. Edit: Oh yeah, and I've thrown procmail in there for good measure.
- okket 9y ago
  'since ages' with Let's Encrypt?
  - inferiorhuman 9y ago
rebootthesystem 9y ago
I have to say, I've been running my own mail server without a single problem for years. OK, the way I do it is a stretch of the definition of "running my own web server" but I have full control. What do I do? Get a nice VPS from a company like GoDaddy. Setup whatever domains you need. Setup as many email accounts as needed. And off you go. No problem. I don't even have to think about email. I thought about rolling my own on one of our Linode servers but every time I compare the no-brainer of doing the above to what it would take to run this ourselves on Linodes I can't justify the pain and aggravation. What I don't like about the Gmail approach (other than it is Gmail and I do not trust Google to not shut down all of our accounts for some stupid reason) is the cost. I can spend a few bucks a month on a VPS and have a hundred email addresses. The same on Gmail would cost significantly more and you would be under their irrational thumb. A few years ago I looked into running Zimbra on Linode. Back then it was so resource hungry it just didn't make any sense. I wonder if it has gotten any better over time? I really like the concept.
natbobc 9y ago
What stack are you using for SMTP and POP/IMAP? Do you use a secondary relay to hold you e-mail in case it goes down?
- agentultra 9y ago
  Postfix, dovecot, fail2ban, spamassassin. I don't have a secondary; I just keep up to date image snapshots and regularly backup the disks. It's only for my personal communications so I try to keep things as simple as I can.
smolsky 9y ago
I ran my own mail server (a few VMs in the cloud) for about five years. It's fun as you have control over accounts, aliases, forwarding, sieve tricks as well as backups. It's good to know that your broker and doctor's mail is delivered directly to your server and not Google. It sucks ass when your mail does not get through as GMail/Hotmail rejects a connection from the IP address your cloud company allocated for you, in spite of DKIM etc. Or they decide to mark your mail is "suspicious" and it goes into the recipient's Spam folder. Fighting these huge hosting companies is impossible as they don't want to talk to you. Also constant tweaking Spamassassin is not fun. My setup worked well for for the first four years but then started letting more crafty junk through... So, I had to compromise by moving the mail to Fastmail.
- old-gregg 9y ago
  Actually one fun way of doing it is to run your own email setup using one of the big ESPs as a "proxy". You can do it for both inbound and outbound. You can have a domain registered with Gmail or Rackspace Mail or whatever, and use the SMTP credentials they give you for outbound, while keeping MX records point to your own SMTP for inbound. Or you can let them process the inbound as well (fighting spam for you) and you just forward everything (or sweep via IMAP) and put it into your own Dovecot. This way you control what's important to you (email storage/backups/etc) but outsource delivery and spam filtering.
  - dtech 9y ago
    But then they can already read everything you send and receive. At that point it's better to just use IMAP if you want to have all the e-mails local and backupped...
  - ryan-c 9y ago
    > Actually one fun way of doing it is to run your own email setup using one of the big ESPs as a "proxy". I tried this with Mailgun, and it caused my mail to be marked as spam.
- techsupporter 9y ago
  > It sucks ass when your mail does not get through as GMail/Hotmail rejects a connection from the IP address your cloud company allocated for you, in spite of DKIM etc. God, yes. Gmail, in particular, really enjoyed just dropping connections from my IPv6 addresses every few months. Sometimes it would return an error, something obtuse and wrong like maybe, "your forward and reverse DNS records do not match" even though they absolutely did and hadn't changed in years. Outlook/Hotmail was far better and would always return a sane, yet sometimes inscrutable, error that bore some resemblance to reality. It still took them a week to get me off the hit list that I got dropped on for no discernible reason. > Or they decide to mark your mail is "suspicious" and it goes into the recipient's Spam folder. Gmail was the ABSOLUTE FUCKING WORST about this. My spouse's e-mail to Etsy customers who used Gmail--not spam, not newsletters, person-to-person e-mails INITIATED BY THE CUSTOMER--would work for the first couple of e-mails in a thread and then start going into spam. Or, even more fun, friends with whom either of us had e-mailed would send us a mail and then we'd reply and nope, into spam. Gmail would do this for WEEKS and no amount of poking or begging or pleading would make it stop. And then it spontaneously would. So maybe the begging did work but was just delayed. I dunno. I tried signing up for Gmail's "Postmaster Tools" but no data was ever reported because "your mail volume is too low." The ultimate ignominy? The final humiliation that sent me to Fastmail? I finally, through a couple of professional contacts, got to actually e-mail (via Gmail, of course, because they were blocking my personal domain again) with a real, live Gmail SMTP admin to ask why my latest round of e-mails were going into the bit bucket. Know what he said, even though my domain has been hosted on a server in the same colo facility with the same IP addresses for a decade? Something along the lines of "your domain reputation is coming back as too new." Ladies and gentlemen, I give you whois: google.com - Creation Date: 1997-09-15T04:00:00Z mypersonaldomain-notreallythisvalue.org - Creation Date: 1997-03-10T05:00:00Z
jandrese 9y ago
See, for me running my own mailserver removes one of the biggest weaknesses with third party mail servers: the helpdesk. How many mail exploits are simple social engineering attacks against the service provider? Probably more than half. Of course I still have to worry about attacks at my domain provider level, but at least it removes one weak point. I'm waiting for the day that someone pretended to be me calls me to get me to reset my mail account password.
efficax 9y ago
I've been running postfix+dovecot for years on a virtual server and have never not once had to do anything to administer it once I got it up and running. Edit: it's been so long that i forgot it was in fact postfix.
jarvuschris 9y ago
There's no reason it _has_ to be like this. I feel like it became common wisdom that you just shouldn't run a mail server too early and the cool kids all gave up working on mail servers. The author is right though about how terrifying it is that we've ceded running email to an advertising company All the things that make running your own server hard are software problems, the protocol itself lends itself very well to running your own. We just need someone to build the [Caddy](https://caddyserver.com/ https://caddyserver.com/) of mail servers. You have the right idea with your Haskell server, though I think in this day a Go project might be more successful.
- mholt 9y ago
  The "Caddy of mail servers" should be a plugin to Caddy, since server types are pluggable. Caddy's HTTP, DNS, and TCP+UDP servers are all just plugins. I typically don't recommend someone running their own mail server, but if they do, I wish there'd be a good one they can use, and that one would definitely be a Caddy plugin.
scottmsul 9y ago
I wonder if cryptocurrencies could be used as an anti-spam prevention measure. In order to send you an email, maybe I have to send you 2 cents worth of cryptocurrency.
- grib 9y ago
  Everything old is new again, the bitcoin proof of work mining began life as a way to require people sending email to burn a second or two of cpu time see: http://www.hashcash.org/ http://www.hashcash.org/

ericcholis 9y ago

Same experience here. Previously I maintained a Merak/IceWarp mail server. The "idea" was great, they provided a nice interface for a small organization (15ish people). But, it became an uphill battle very quickly.

mozumder 9y ago

I run my own mail server, for several years now. A Mac Mini on Mac OS Server on a static IP address. It's been great, literally zero maintenance, but it completely hides everything about the underlying architecture.

lisper 9y ago

Heh, I have had the exact opposite experience. My mail setup has been stable and reliable for years. (I'm a little bit afraid to report this because one possible explanation is that I simply have not been on any serious hacker's radar screen.) I'm not doing anything fancy: just postfix+dovecot, gray listing using a custom milter I wrote in Python, and Spam Sieve running client-side on my Mac.

deleted 9y ago
[deleted]

ams6110 9y ago

OpenBSD's smtpd has worked well for me. It's also available in a portable version. https://www.opensmtpd.org/ https://www.opensmtpd.org/ Configuration is one file, very simple. It won't do everything a sendmail does, but it's never had me pulling my hair out.

DrPhish 9y ago
I also am using opensmtpd, and have been for years. Even setting up starttls encryption and a DKIM proxy were simple. I have never had an issue with accidentally setting it up as an open relay or anything else that would place me on a blacklist.
dbolgheroni 9y ago
Of course, no MTA is as easy as creating a GMail account, but OpenBSD's smtpd is a lot clearer than any of the alternatives.

StavrosK 9y ago

I'm entertaining the idea of running my own SMTP server for Spamnesty (https://spa.mnesty.com/ https://spa.mnesty.com/) so I can at least cut down on some of the Mailgun invoice items. Would you still not recommend this if I were just sending mail to spammers?

Jaruzel 9y ago

My use case is different, as I'm a Windows guy, but this is what I've got: 1. Custom MTA that handles incoming SMTP. 2. SpamAssassin that is called by the above MTA which flags email as spam/not-spam. 3. Custom MTA forwards not-spam to the users inbox. 4. Custom MTA forwards SPAM to postmaster (this bit needs significant re-working) 5. Main Mailserver is Microsoft Exchange run On-Premises. 6. All Mail clients are Outlook 2016, or Android Phones. The reason I had to write my own MTA was so that I could leverage a 3rd party anti-spam solution, as Exchange doesn't come with one, and add-ons for Exchange are quite expensive. Running your own mailserver is a complete nightmare. If I knew it would end up this complex 20+ years on, I'd have never done it in the first place.

rkagerer 9y ago
Your custom MTA is impressive, but if you want to reduce the amount of custom code you need to maintain (and don't mind one third party service in the mix), you could use something like SpamHero. It's reasonably effective and fairly cheap. Postini was even better, before Google bought them and bastardized the product.
- Jaruzel 9y ago
  Agreed. I would love to ditch the customisations and run something standard!
  - MartijnBraam 9y ago
    Can't you just replace the custom MTA with postfix? That's what the previous company I worked at did
    - Jaruzel 9y ago
      Yeah, I asked about that elsewhere in this thread... https://news.ycombinator.com/item?id=16239809 https://news.ycombinator.com/item?id=16239809

ryandrake 9y ago

I recently moved off of Gmail and now run my own personal/family E-mail server, and I have to say so far it has been pretty pain free. I probably just haven't been doing it for long enough to run into trouble yet. Bog standard Debian install, Exim4 + dovecot + SpamAssassin. TLS, SPF, DKIM, and other acronyms all set up and working. The initial setup was a few days config file tweaking (why don't these things come working and secured out of the box?), but since then no issues--knock on wood. My only complaint is the spam filtering so far is not as good as Gmail's was, but I probably just need to better configure things. Bookmarking this guide for later!

nerpderp83 9y ago
Having run both Exim and Postfix, I would highly recommend you run Postfix, if not for the security for the configuration. If you can't run Postfix, run Exim in a container.
- ekiara 9y ago
  Could you expand on this? What security vulnerabilities does Exim4 have that you'd avoid just by choosing Postfix as an alternative?
  - nerpderp83 9y ago
    Postfix has a very clear separation of concerns and least privledge in the use of lots of helper daemons. Exim4 doesn't not have this architecture and is less secure because of it. http://www.postfix.org/OVERVIEW.html http://www.postfix.org/OVERVIEW.html

ivm 9y ago

Absolutely horrible – I tried to setup Postfix for my friends to hide Gmail behind their organization's domain. Configurations were incredibly unfriendly and tedious. Despite all anti-spam measures, Microsoft was blocking their IP according to some private spam blacklists. Then they couldn't send emails to some ancient government server in Guatemala because of encoding incompatibilities. I ended up moving them to the free MailGun plan. It took me 2 hours instead of 2 days.

gexcolo 9y ago

I run an E-mail server with over 250,000 users. I started by following some generic "dovecot+postfix+mysql" tutorial on howtoforge and I'm still using mostly the same setup over 4 years later. >Then your email doesn't work and you could be missing out on important communications Pretty much every E-mail server will retry sending your E-mail for a long time (like 2 days is default on postfix). Once your mail server comes back up all of your E-mail you missed during the downtime will come in slowly as messages are retried >you're scrambling to figure out how the spammers managed to exploit your setup this time Any tutorial should point you in the right direction restricting open relay on your mail server, just basically requiring authentication to send E-mail outside of your server. >I started writing an SMTP protocol handler in Haskell Do you have any link to your progress? Postfix's configuration definitely shows age, but all of the options do important things that you could actually want to change. It seems other MTAs either have just as complicated configuration (to do the same things), or have stunted functionality. >being secure and resistant to attacks by default I agree about sensible and more secure defaults in configuration. But the application security of postfix and dovecot are both pretty robust[0][1]. Considering they are 19 and 15 years old, both applications have seen several developer-lifetimes of effort. >we need more guides like this for us poor souls who do go down this route I agree, though mediocre howtoforge tutorials seem to have worked fine for this poor soul. [0] https://www.cvedetails.com/product/14794/Postfix-Postfix.html?vendor_id=8450 https://www.cvedetails.com/product/14794/Postfix-Postfix.htm... [1] https://www.cvedetails.com/vendor/6485/Dovecot.html https://www.cvedetails.com/vendor/6485/Dovecot.html

andris9 9y ago
Would you be able to share some stats, like how much disk space these accounts take up and such? For larger scale e-mail sending I built my own MTA (https://github.com/zone-eu/zone-mta https://github.com/zone-eu/zone-mta), our main instance sends about 750k emails a day (mostly normal ISP traffic, maybe 25% marketing emails) and its most valuable feature is juggling with IP addresses and blacklist detection, so if some mailbox gets hacked, starts sending out spam and the IP ends up in Spamhaus et al then this IP is removed from the list for other users automatically. Has saved us a ton of time.

rsync 9y ago

"And then you're scrambling to figure out how the spammers managed to exploit your setup this time." ... " ... writing a MTA with the goal of minimizing configuration and being secure and resistant to attacks by default. " As a 20+ year UNIX sysadmin and fellow owner of my own email infrastructure for 18 of those, I am surprised to read this and am not even sure what you are talking about. Can you explain what you mean by attacks and exploits from spammers ? Other than accidentally running as a relay or actually having a remote exploit in your server(s), what are the attacks that you have in mind ? "Configuration that will soon be exploited in strange ways." Again, am genuinely interested in an explanation ... other than running as a relay, and maybe handling backscatter (but that's not really config, it's just a blacklist) what are you referring to ?

drdaeman 9y ago
Besides accidentally allowing relay, it could be a backscatter spam.
Clubber 9y ago
I've run my own mail server since probably 1998 or so. I have had a few problems here and there, but nothing major. The worst is when the power goes out, but smtp has a wonderful resend feature when the destination server isn't responding. I know my emails aren't being farmed from the NSA (at least from my side). I know Google isn't scanning all my emails to sell me garbage. I know it won't be shut down because of some errant algorithm. I have a really short email address. I can setup family and friends easily. I can send newsletters without having to deal with someone else's policies (on my side anyway). I love it.
- z3t4 9y ago
  You can have a backup server that holds your e-mail until your main server goes back up. You configure priority in DNS zone file.
  - rhizome 9y ago
    Backup MX is usually not necessary, especially for home setups. Anything RFC-compliant will retry sending its email to you for days after being rejected.

inferiorhuman 9y ago

My experience was quite the opposite (granted I'm an ops guy these days anyhow). I've been self-hosting mail for ages with a postfix + dovecot + cyrus + spamassassin + opendkim + dkimproxy + lets encrypt stack. Everything just works, although I'm going to move it into a jail sooner than later so I can rebuild it more easily. The biggest pain is no longer having a static IP or reverse DNS (thanks Sonic!). Having reverse DNS setup and an IP address that doesn't map to a pool of dynamic IPs are the big things that will keep you off of spam lists. Coming from sendmail I think postfix and dovecot have been a breath of fresh air. The defaults generally just work. Getting inbound (so spamassassin can check) and outbound dkim to work were the trickiest part. Aside from regular OS updates it's largely hands off.

nmjenkins 9y ago
Do you really use both Dovecot and Cyrus? Which one do you use for what?
- inferiorhuman 9y ago
  Not Cyrus IMAP, but their SASL library. Actually, I just looked. Cyrus-sasl was pulled in as a dependency for mutt. I'm using Dovecot for postfix's SASL backend these days. This allows relaying mail for authenticated users only. Dovecot uses PAM for authentication, and so any user with an account can log in and access their own mailbox and send mail out. The biggest downside is that because I'm deviating from the default FreeBSD configuration for postfix I'm on my own in terms of updates. I should also clarify the above statement about moving it all into a jail -- I mean a jail managed by (in this case) ansible. Yes, if you just slap something together it will be brittle no matter what stack you choose. Ansible + Jenkins + Jails make it much easier to manage changes. Edit: Oh yeah, and I've thrown procmail in there for good measure.
okket 9y ago
'since ages' with Let's Encrypt?
- inferiorhuman 9y ago

rebootthesystem 9y ago

I have to say, I've been running my own mail server without a single problem for years. OK, the way I do it is a stretch of the definition of "running my own web server" but I have full control. What do I do? Get a nice VPS from a company like GoDaddy. Setup whatever domains you need. Setup as many email accounts as needed. And off you go. No problem. I don't even have to think about email. I thought about rolling my own on one of our Linode servers but every time I compare the no-brainer of doing the above to what it would take to run this ourselves on Linodes I can't justify the pain and aggravation. What I don't like about the Gmail approach (other than it is Gmail and I do not trust Google to not shut down all of our accounts for some stupid reason) is the cost. I can spend a few bucks a month on a VPS and have a hundred email addresses. The same on Gmail would cost significantly more and you would be under their irrational thumb. A few years ago I looked into running Zimbra on Linode. Back then it was so resource hungry it just didn't make any sense. I wonder if it has gotten any better over time? I really like the concept.

natbobc 9y ago

What stack are you using for SMTP and POP/IMAP? Do you use a secondary relay to hold you e-mail in case it goes down?

agentultra 9y ago
Postfix, dovecot, fail2ban, spamassassin. I don't have a secondary; I just keep up to date image snapshots and regularly backup the disks. It's only for my personal communications so I try to keep things as simple as I can.

smolsky 9y ago

I ran my own mail server (a few VMs in the cloud) for about five years. It's fun as you have control over accounts, aliases, forwarding, sieve tricks as well as backups. It's good to know that your broker and doctor's mail is delivered directly to your server and not Google. It sucks ass when your mail does not get through as GMail/Hotmail rejects a connection from the IP address your cloud company allocated for you, in spite of DKIM etc. Or they decide to mark your mail is "suspicious" and it goes into the recipient's Spam folder. Fighting these huge hosting companies is impossible as they don't want to talk to you. Also constant tweaking Spamassassin is not fun. My setup worked well for for the first four years but then started letting more crafty junk through... So, I had to compromise by moving the mail to Fastmail.

old-gregg 9y ago
Actually one fun way of doing it is to run your own email setup using one of the big ESPs as a "proxy". You can do it for both inbound and outbound. You can have a domain registered with Gmail or Rackspace Mail or whatever, and use the SMTP credentials they give you for outbound, while keeping MX records point to your own SMTP for inbound. Or you can let them process the inbound as well (fighting spam for you) and you just forward everything (or sweep via IMAP) and put it into your own Dovecot. This way you control what's important to you (email storage/backups/etc) but outsource delivery and spam filtering.
- dtech 9y ago
  But then they can already read everything you send and receive. At that point it's better to just use IMAP if you want to have all the e-mails local and backupped...
- ryan-c 9y ago
  > Actually one fun way of doing it is to run your own email setup using one of the big ESPs as a "proxy". I tried this with Mailgun, and it caused my mail to be marked as spam.
techsupporter 9y ago
> It sucks ass when your mail does not get through as GMail/Hotmail rejects a connection from the IP address your cloud company allocated for you, in spite of DKIM etc. God, yes. Gmail, in particular, really enjoyed just dropping connections from my IPv6 addresses every few months. Sometimes it would return an error, something obtuse and wrong like maybe, "your forward and reverse DNS records do not match" even though they absolutely did and hadn't changed in years. Outlook/Hotmail was far better and would always return a sane, yet sometimes inscrutable, error that bore some resemblance to reality. It still took them a week to get me off the hit list that I got dropped on for no discernible reason. > Or they decide to mark your mail is "suspicious" and it goes into the recipient's Spam folder. Gmail was the ABSOLUTE FUCKING WORST about this. My spouse's e-mail to Etsy customers who used Gmail--not spam, not newsletters, person-to-person e-mails INITIATED BY THE CUSTOMER--would work for the first couple of e-mails in a thread and then start going into spam. Or, even more fun, friends with whom either of us had e-mailed would send us a mail and then we'd reply and nope, into spam. Gmail would do this for WEEKS and no amount of poking or begging or pleading would make it stop. And then it spontaneously would. So maybe the begging did work but was just delayed. I dunno. I tried signing up for Gmail's "Postmaster Tools" but no data was ever reported because "your mail volume is too low." The ultimate ignominy? The final humiliation that sent me to Fastmail? I finally, through a couple of professional contacts, got to actually e-mail (via Gmail, of course, because they were blocking my personal domain again) with a real, live Gmail SMTP admin to ask why my latest round of e-mails were going into the bit bucket. Know what he said, even though my domain has been hosted on a server in the same colo facility with the same IP addresses for a decade? Something along the lines of "your domain reputation is coming back as too new." Ladies and gentlemen, I give you whois: google.com - Creation Date: 1997-09-15T04:00:00Z mypersonaldomain-notreallythisvalue.org - Creation Date: 1997-03-10T05:00:00Z

jandrese 9y ago

See, for me running my own mailserver removes one of the biggest weaknesses with third party mail servers: the helpdesk. How many mail exploits are simple social engineering attacks against the service provider? Probably more than half. Of course I still have to worry about attacks at my domain provider level, but at least it removes one weak point. I'm waiting for the day that someone pretended to be me calls me to get me to reset my mail account password.

efficax 9y ago

I've been running postfix+dovecot for years on a virtual server and have never not once had to do anything to administer it once I got it up and running. Edit: it's been so long that i forgot it was in fact postfix.

jarvuschris 9y ago

There's no reason it _has_ to be like this. I feel like it became common wisdom that you just shouldn't run a mail server too early and the cool kids all gave up working on mail servers. The author is right though about how terrifying it is that we've ceded running email to an advertising company All the things that make running your own server hard are software problems, the protocol itself lends itself very well to running your own. We just need someone to build the [Caddy](https://caddyserver.com/ https://caddyserver.com/) of mail servers. You have the right idea with your Haskell server, though I think in this day a Go project might be more successful.

mholt 9y ago
The "Caddy of mail servers" should be a plugin to Caddy, since server types are pluggable. Caddy's HTTP, DNS, and TCP+UDP servers are all just plugins. I typically don't recommend someone running their own mail server, but if they do, I wish there'd be a good one they can use, and that one would definitely be a Caddy plugin.

scottmsul 9y ago

I wonder if cryptocurrencies could be used as an anti-spam prevention measure. In order to send you an email, maybe I have to send you 2 cents worth of cryptocurrency.

grib 9y ago
Everything old is new again, the bitcoin proof of work mining began life as a way to require people sending email to burn a second or two of cpu time see: http://www.hashcash.org/ http://www.hashcash.org/