And patching on Debian is trivial. Patching is never trivial. The process itself may be trivial, but you have to actually do it. That latter part requires ongo

And patching on Debian is trivial. Patching is never trivial. The process itself may be trivial, but you have to actually do it. That latter part requires ongoing attention, which makes it non-trivial. less likely to attract the attention of someone with the means and motivation to break in That depends. Most attackers go for low hanging fruit. And the fruit hardly hangs low at google with their dedicated security team. The most juicy targets are actually those little homebrew servers that someone once setup and then mostly forgot about. The spammers can often use these servers for months before anyone (usually the ISP, not the owner) takes notice. If your server is listening on Port 25 then it's not stealth. It's very likely being scanned while I write this comment - perhaps to see if it's an exim vulnerable to the recent remote-shell exploit (http://www.debian.org/security/2010/dsa-2131 http://www.debian.org/security/2010/dsa-2131). So, to wrap this up. I also run mailservers for various companies. I also run debian. I even also run dovecot and postfix. But I'm doing this for a living, am subscribed to the relevant security mailing lists, harden the hosts before deploying them, and I monitor them. If you don't have a dedicated or hired admin to do all that then hosted e-mail usually has the better value proposition.