I agree that Exim doesn't seem to be a great choice, but: > Don't run your own mail server. But if you have to, don't run a C-language mail server. But if you

I agree that Exim doesn't seem to be a great choice, but: > Don't run your own mail server. But if you have to, don't run a C-language mail server. But if you have to, run Postfix. I... don't think Postfix' track record bears this out? Setting up a mailserver is quite a bit of work, but if you configure Postfix with an appropriate degree of paranoia and don't care about receiving some spam, you can leave Postfix running for years and years with zero vulnerabilities. (E.g. https://www.cvedetails.com/vulnerability-list/vendor_id-8450/Postfix.html https://www.cvedetails.com/vulnerability-list/vendor_id-8450..., as you know.) It's hard to compete against GMail's security, but if you have to run some service on your own Postfix is much less likely to get you pwned than almost any web application, or even many HTTP servers. (Postfix shares that distinction with another large-but-excellent C application, OpenSSH.) (Mind you, "appropriate degree of paranoia" includes absolutely not running anything like a virus scanner, which protects your server but leaves your mail user agents open to attack.)