6 ms·

There really needs to be a) a docker container (or other standardized, easy to deploy technology) with a "mail server in a box implementing best practices" b)

There really needs to be a) a docker container (or other standardized, easy to deploy technology) with a "mail server in a box implementing best practices" b) a test for the stuff that Docker can't cover like DNS config, ideally with scripts to set it up on the most popular providers and clear copy&paste instructions for the rest. People shouldn't need to fully understand DKIM, SPF, etc. - they should just be able to click a button, copy&paste generated DNS records, and be up and running. Otherwise, commercial providers are just the only option that makes operational sense for most cases, _even if you know how to do it right_, because doing everything right manually step by step is still to much work to be worth it in many cases. None of this seems _hard_, it's just tedious.

pbhjpbhj 6y ago
Agreed. A few years back when moving my personal domain from a failing provider I considered running my own email server on Digital Ocean; they had some great tutorials on setting up various parts and I followed a HN recommended tutorial. I was already happy setting up LAMP with a nginx reverse proxy, how hard could it be - I got it setup, and realised two things: Keeping everything running without getting compromised was going to take way too long compared to the benefit. Two, Google and MS wouldn't accept my email - not even to myself when I whitelisted it - it's a crap shoot. Email has serious economies of scale and keeping such a critical system operational, on a small scale, was going to be some deal of stress. So I just went with my hosting providers Plesk-fronted setup, which matches your para.3 description.
gsich 6y ago
>People shouldn't need to fully understand DKIM, SPF, etc. - they should just be able to click a button, copy&paste generated DNS records, and be up and running. I oppose this. People should know what they are configuring. This applies to all stuff related to mailservers. You probably learn more by setting it up the "hard" way (without containers) so that in case of failure you at least have a little insight in how the components work.
- im3w1l 6y ago
  There are many more people who want to drive a car, than people who want to learn the minutiae of how it works. If it breaks, then you get someone else to fix it / get a better product is all they need to know.
  - gsich 6y ago
    Not everything is a car analogy. But if you want ... it's like having a drivers license. Or: you only "drive" self-driving cars. In case of emergency you don't know what to do. Perhaps an even better analogy.
    - lanstin 6y ago
      I have my own domain, my own bind and my own mail servers. I forward all the mail to google for reading and searching and the main value I get out of it is I actually understand how DNS and SMTP work. Which comes in handy once a quarter at work. I book marked TFA because I never got the newer (!) stuff setup like proper TLS and DKIM. It is very old setup from like 2005 or so and I think is grandfathered into Gmail somehow. At least my newest domain I treated worst than my older ones.
gboss 6y ago
For A) I believe that is what https://mailinabox.email/ https://mailinabox.email/ is trying to achieve
- martinmunk 6y ago
  In search of self hosting email I tried out both MailInABox and Mailcow. MailInABox wanted to control DNS records which was a no-go. The primary driver behind the project seems to have arrogant attitude towards having users do DNS records themselves. Mailcow seemed nice but was guzzling up ram for seemingly no good reason. Finally tried out Mailu a few days ago which seems to work nice, albeit with limited testing.
  - mustardo 6y ago
    Mail in a box suggests being the DNS server in an attempt to be more user friendly, there are a lot of DNS records to setup for mail. How ever external DNS is supported (see "System status & DNS" in https://mailinabox.email/guide.html https://mailinabox.email/guide.html)
  - mawalu 6y ago
    The RAM intensive elements of mailcow are search and clamav, you can disable them both if you don't need them
- codethief 6y ago
  If only it didn't come with so many things (Roundcube, NextCloud) I don't need.
  - gertrunde 6y ago
    I thought the same thing, but then I ended up using roundcube as my default non-mobile device mail client. And I just ignore the nextcloud bit. (This is admittedly a very small deployment for two users and 3-4 domains on a $5/month VPS). A lot of the other stuff I evaluated at the time (3-4 years ago) came with yet more stuff.
mihaifm 6y ago
Try https://github.com/tomav/docker-mailserver https://github.com/tomav/docker-mailserver It’s pretty good, I use it for my own server. It still requires some config, but better than running all the services from scratch.
lifty 6y ago
A very promising project is https://github.com/foxcpp/maddy https://github.com/foxcpp/maddy. It is an all in one server that can both receive and send email.
- s_gourichon 6y ago
  As mentioned in https://news.ycombinator.com/item?id=23960831 https://news.ycombinator.com/item?id=23960831 it's good for security to have SMTP server and IMAP server segregated, even separate physical machines, which you'll have a hard time doing when everything runs in the same process. What happens when maddy gets a security hole discovered. To me maddy would feel like sleeping on live electrical wires, only they are insulated by a thin layer of paper. Hope the isolation does not get scratched anywhere while you sleep. Even a non-dockerized, traditional setup like postfix+dovecot has better isolation.
  - foxcpp 6y ago
    I believe a server wriiten in a memory safe language greatly reduces the risk of running such setup. To the point where it is an acceptable trade-off to get simpler maintenance. Depending on how many targeted attacks you get in a day, you may pull apart the monlithic server and run inbound processing, filtering, IMAP access and outbound queueing as separate processes or even on separate systems. (Probably i should put a better wording on https://foxcpp.dev/maddy/faq/ https://foxcpp.dev/maddy/faq/)
    - BookHeretykow 6y ago
      You sir, created in me hope for mail server in Rust. But this is just a Go Lang
      - foxcpp 6y ago
        If I had an infinite amount if time, I would sure write maddy in Rust. But as practice shows, there are only around 24 hours in a day. That being said, my project greatly benefits from Go concurrency features and simple I/O primitives. Also there are libraries written by emersion for nearly everything.
mawalu 6y ago
I use mailcow and it does both a) and b) very well. You can either selfhost or pay the developer to host it for you: https://github.com/mailcow/mailcow-dockerized https://github.com/mailcow/mailcow-dockerized
- Faaak 6y ago
  +1 For mailcow ! A simple `docker-compose up -d` does the job. Then you just have to configure your records (SPF, MX, DMARC, ...) and it's all set. A really nice work from the mailcow's team !
mjsir911 6y ago
The push for me to use nixos was simple-nixos-mailserver which does exactly this while being fully configurable & extensible. https://gitlab.com/simple-nixos-mailserver/nixos-mailserver https://gitlab.com/simple-nixos-mailserver/nixos-mailserver
- mekster 6y ago
  Doesn't seem to have external user auth mechanism than "declarative user management"?
bpfrh 6y ago
There is: mailcow https://mailcow.email/ https://mailcow.email/ Automatically checks DKIM, SPF and DMARC settings for your domain, comes with docker and can be upgraded by running a single script, and has a webgui and spam protection.

pbhjpbhj 6y ago

Agreed. A few years back when moving my personal domain from a failing provider I considered running my own email server on Digital Ocean; they had some great tutorials on setting up various parts and I followed a HN recommended tutorial. I was already happy setting up LAMP with a nginx reverse proxy, how hard could it be - I got it setup, and realised two things: Keeping everything running without getting compromised was going to take way too long compared to the benefit. Two, Google and MS wouldn't accept my email - not even to myself when I whitelisted it - it's a crap shoot. Email has serious economies of scale and keeping such a critical system operational, on a small scale, was going to be some deal of stress. So I just went with my hosting providers Plesk-fronted setup, which matches your para.3 description.

gsich 6y ago

>People shouldn't need to fully understand DKIM, SPF, etc. - they should just be able to click a button, copy&paste generated DNS records, and be up and running. I oppose this. People should know what they are configuring. This applies to all stuff related to mailservers. You probably learn more by setting it up the "hard" way (without containers) so that in case of failure you at least have a little insight in how the components work.

im3w1l 6y ago
There are many more people who want to drive a car, than people who want to learn the minutiae of how it works. If it breaks, then you get someone else to fix it / get a better product is all they need to know.
- gsich 6y ago
  Not everything is a car analogy. But if you want ... it's like having a drivers license. Or: you only "drive" self-driving cars. In case of emergency you don't know what to do. Perhaps an even better analogy.
  - lanstin 6y ago
    I have my own domain, my own bind and my own mail servers. I forward all the mail to google for reading and searching and the main value I get out of it is I actually understand how DNS and SMTP work. Which comes in handy once a quarter at work. I book marked TFA because I never got the newer (!) stuff setup like proper TLS and DKIM. It is very old setup from like 2005 or so and I think is grandfathered into Gmail somehow. At least my newest domain I treated worst than my older ones.

gboss 6y ago

For A) I believe that is what https://mailinabox.email/ https://mailinabox.email/ is trying to achieve

martinmunk 6y ago
In search of self hosting email I tried out both MailInABox and Mailcow. MailInABox wanted to control DNS records which was a no-go. The primary driver behind the project seems to have arrogant attitude towards having users do DNS records themselves. Mailcow seemed nice but was guzzling up ram for seemingly no good reason. Finally tried out Mailu a few days ago which seems to work nice, albeit with limited testing.
- mustardo 6y ago
  Mail in a box suggests being the DNS server in an attempt to be more user friendly, there are a lot of DNS records to setup for mail. How ever external DNS is supported (see "System status & DNS" in https://mailinabox.email/guide.html https://mailinabox.email/guide.html)
- mawalu 6y ago
  The RAM intensive elements of mailcow are search and clamav, you can disable them both if you don't need them
codethief 6y ago
If only it didn't come with so many things (Roundcube, NextCloud) I don't need.
- gertrunde 6y ago
  I thought the same thing, but then I ended up using roundcube as my default non-mobile device mail client. And I just ignore the nextcloud bit. (This is admittedly a very small deployment for two users and 3-4 domains on a $5/month VPS). A lot of the other stuff I evaluated at the time (3-4 years ago) came with yet more stuff.

mihaifm 6y ago

Try https://github.com/tomav/docker-mailserver https://github.com/tomav/docker-mailserver It’s pretty good, I use it for my own server. It still requires some config, but better than running all the services from scratch.

lifty 6y ago

A very promising project is https://github.com/foxcpp/maddy https://github.com/foxcpp/maddy. It is an all in one server that can both receive and send email.

s_gourichon 6y ago
As mentioned in https://news.ycombinator.com/item?id=23960831 https://news.ycombinator.com/item?id=23960831 it's good for security to have SMTP server and IMAP server segregated, even separate physical machines, which you'll have a hard time doing when everything runs in the same process. What happens when maddy gets a security hole discovered. To me maddy would feel like sleeping on live electrical wires, only they are insulated by a thin layer of paper. Hope the isolation does not get scratched anywhere while you sleep. Even a non-dockerized, traditional setup like postfix+dovecot has better isolation.
- foxcpp 6y ago
  I believe a server wriiten in a memory safe language greatly reduces the risk of running such setup. To the point where it is an acceptable trade-off to get simpler maintenance. Depending on how many targeted attacks you get in a day, you may pull apart the monlithic server and run inbound processing, filtering, IMAP access and outbound queueing as separate processes or even on separate systems. (Probably i should put a better wording on https://foxcpp.dev/maddy/faq/ https://foxcpp.dev/maddy/faq/)
  - BookHeretykow 6y ago
    You sir, created in me hope for mail server in Rust. But this is just a Go Lang
    - foxcpp 6y ago
      If I had an infinite amount if time, I would sure write maddy in Rust. But as practice shows, there are only around 24 hours in a day. That being said, my project greatly benefits from Go concurrency features and simple I/O primitives. Also there are libraries written by emersion for nearly everything.

mawalu 6y ago

I use mailcow and it does both a) and b) very well. You can either selfhost or pay the developer to host it for you: https://github.com/mailcow/mailcow-dockerized https://github.com/mailcow/mailcow-dockerized

Faaak 6y ago
+1 For mailcow ! A simple `docker-compose up -d` does the job. Then you just have to configure your records (SPF, MX, DMARC, ...) and it's all set. A really nice work from the mailcow's team !

mjsir911 6y ago

The push for me to use nixos was simple-nixos-mailserver which does exactly this while being fully configurable & extensible. https://gitlab.com/simple-nixos-mailserver/nixos-mailserver https://gitlab.com/simple-nixos-mailserver/nixos-mailserver

mekster 6y ago
Doesn't seem to have external user auth mechanism than "declarative user management"?

bpfrh 6y ago

There is: mailcow https://mailcow.email/ https://mailcow.email/ Automatically checks DKIM, SPF and DMARC settings for your domain, comes with docker and can be upgraded by running a single script, and has a webgui and spam protection.