4 ms·

I use a mail server stack that includes Postfix + Dovecot + RoundCube; RoundCube's search function isn't as good as Gmail's, but the ability to filter messages

I use a mail server stack that includes Postfix + Dovecot + RoundCube; RoundCube's search function isn't as good as Gmail's, but the ability to filter messages by literally any part of the message content just blows Gmail's tagging out of the water, IMO. (You need managesieve + a plugin for RoundCube to do this.) I so far haven't had the mail server blacklisted even once since I started using it 18 months ago. I have a number of other customers on it, including one that sends out a 500-odd subscriber newsletter, using software I developed. I have taken a couple of precautions against spam: I use SPF records for as many domains as possible, the mail server itself is locked down tighter'n a flea's bunghole (including some proactive security measures), I have remote monitoring that keeps an eye on the server constantly, and (so far) I've had the pleasure of only doing business with people I trust. It requires a lot of effort to build a good mail server, and there isn't a single "perfect" tutorial on the web for it. So, for a lot of people, it might not be worth it. For me though, I haven't touched my Gmail account in a very long time, and I really do love the fact that I have complete control over every aspect of my email (and my customers').

windsurfer 16y ago
Hear hear! I use a similar set up, and it truly is great. It's even caused me to seriously consider a service that sets up a Linode for people that wants something as awesome.
- thaumaturgy 16y ago
  Yeah, I've been sorely tempted to make a Stackscript for this setup and make it public. There are two downsides: it's at least $20 a month to do it, and having your own mail server really isn't quite a set-it-and-forget-it deal. It requires an amount of attention that wouldn't make sense for a lot of people (or businesses).
  - mziulu 16y ago
    Still, there might be considerable interest in at least some tutorial blog posts ;-) Consider this a subtle request :-) I've been toying with this idea for a while, but haven't really started looking into it seriously, mainly because, as you said, at least at a cursory glance there are not a lot of in-depth and accurate resources for setting up a mail server with security in mind.
  - dspillett 16y ago
    > (or businesses) I'm surprised by how many businesses (even small ones) don't run their own mail server, or at least have a proper outsourcing arrangement rather than just using a public service. We run our own (well, I run our own...) because we work with banks and all contracts we sign with them have clauses regarding where information from them gets stored and who could possibly have access to it - this is to protect their data in instances where we might be sent (intentionally or otherwise) information about some of their employees or customers. I'm guessing a great many businesses work with clients who have similar concerns so those clauses will be present in contracts that have signed too, so using a "public" service like gmail or hotmail just isn't compatible with them - we can't make any demands to Google about who can access what on their servers or audit them. No business should use a public service like that and leave the mail on it. This isn't a dig at the public services like gmail, as they provide a valuable resource for those the resource is not wrong for, but they can not provide the accountability I would expect to be able to provide my clients as a business. Businesses should (IMO, and in order of preference) run their own server, use a service that has some contractually enforced security guarantee, or pull down the mail to local systems rather then leaving it on a public server - otherwise they can have no hope at all of controlling who can access their (potentially confidential and sensitive) mail. Aside from the data security issue there are other potential problems that should be concerned about. If a public services goes down there is nothing you can do to help a fast recovery and you will not be their priority: your services will be available again when it is available again. Also you need to implement a good backup system no matter what you chose - you should not (as many people do) rely on a single service for both your live mail handling and backups. The $20/month is nothing to a business (or should be), but you are right in that a mail server should never be considered a set-and-forget system so there will be technical resource cost involved with running a mail server and dealing with possible issues like "friendly fire blacklisting" so a reputable outsourcing arrangement would be more cost-/manpower- effective for many small businesses. FYI: we currently use Zimbra's "community edition", though at some point I'd like to convince the powers that be that using the paid edition would be worth it for the support (there has never been an issue I can't resolve, and there is never likely to be, but I'm not here 24/7 and don't have someone with the right skills to delegate the job to when I'm not around). It is more resource hungry than Postfix+Dovecot+RoundCube though so needs significantly more the linode's $20 VM product to be usable, but I recommend people give it a try as its single install removes the need for you to perform any integration work putting a stack together and the feature set aside from email is no unattractive either.
  - mister_m 16y ago
    Do you mean from a security perspective, such as keeping software on the stack at the latest versions? I am a linode user myself and I was interested in setting up a mail server of my own for personal use, but I will admit I don't know much about it.
    - thaumaturgy 16y ago
      Keeping most of the software reasonably up-to-date isn't too hard; on Debian, for example, just regularly use apt-get update && apt-get upgrade. (Hopefully you have backups ready in case it goes sideways.) Probably my number one time sink on the mail server is, "Where is the email from X that I've been expecting?" A close number two is, "I'm getting too much spam." If you're paying for hosted email from someone else, you can just give them a call and make it their headache. If you're doing your own, it's your own headache, and it's a headache that can easily consume a few hours at a time. You also should regularly check in with various system and software logs, to make sure that someone isn't trying a novel new attack against the mail server, or that a process isn't struggling for some reason. Most of the software does a pretty good job of being rock-solid, so I don't find myself having to tune things all the time or nudge dead processes or anything. But, I did find that if I left the mail server alone for a while, then when something did go wrong, it took me a lot longer to resolve it (I think mostly because I'd forgotten where everything was), which is not what I want in a downtime situation.
- hoggle 16y ago
  Please do! I think something like this could be valuable to a lot of small to medium companies who atm can't resist subscribing to Google Apps (50,- per user you could have instead). I think with a service like that, the main goal would be to stay as simple as possible while still offering the "Exchange" integration with people's current infrastructure. I would do the user side web frontend last and concentrate on a simple but empowering foundation plus administration interface first. Clearly with the PSN breach and all the bad press Google, Apple & Co. are getting with location/mobile I can see a shift in people's minds towards more privacy and security similar to when people started to get used to anti-virus/firewall software. 2011 - Devops galore.
  - windsurfer 16y ago
    Do you think the service would still be interesting if it didn't offer Exchange integration?
jackowayed 16y ago
How are your backups? And what happens if it goes down for a few hours? Would you not get that mail?
- ars 16y ago
  The sending mailserver will (usually) keep trying to send the email for 5 days.
- thaumaturgy 16y ago
  > How are your backups? A server in another data center does differentials of the entire mail server every hour on the hour, and weekly fulls. Differentials are stored for 14 days and weeklies are stored for 120 days. If a customer accidentally deletes an individual message, we can probably restore it; if a customer nukes their entire mailbox, we can restore it. > And what happens if it goes down for a few hours? Would you not get that mail? SMTP servers by convention are supposed to retry for at least a day if the destination server is down. A few miscreants (ahem Washington Mutual...) don't retry at all though. Worst-case scenario, I can have another mail server up and running in 20 to 30 minutes, with most of the mailboxes restored to it. Since I also admin our own name servers, and I keep a short TTL, we could update the DNS for the mail server and have most mail services back online for most customers pretty quickly. Unfortunately, true fail-over mail services is a challenging nut to crack, especially if you want duplication between distant data centers.
  - jvdh 16y ago
    I run my own mailserver too for private use. I make use of a DNS provider who also provides backup SMTP service. Basically it adds another address as alternative for delivery for your domain. That server is configured to forward the mail to your primary server or hold it until it comes up again. Works great, and you could even use it as a spam filtering option, since legitimate servers should only try the first server, but a lot of spammers use the second one thinking that it probably has less spamfiltering or something.

windsurfer 16y ago

Hear hear! I use a similar set up, and it truly is great. It's even caused me to seriously consider a service that sets up a Linode for people that wants something as awesome.

thaumaturgy 16y ago
Yeah, I've been sorely tempted to make a Stackscript for this setup and make it public. There are two downsides: it's at least $20 a month to do it, and having your own mail server really isn't quite a set-it-and-forget-it deal. It requires an amount of attention that wouldn't make sense for a lot of people (or businesses).
- mziulu 16y ago
  Still, there might be considerable interest in at least some tutorial blog posts ;-) Consider this a subtle request :-) I've been toying with this idea for a while, but haven't really started looking into it seriously, mainly because, as you said, at least at a cursory glance there are not a lot of in-depth and accurate resources for setting up a mail server with security in mind.
- dspillett 16y ago
  > (or businesses) I'm surprised by how many businesses (even small ones) don't run their own mail server, or at least have a proper outsourcing arrangement rather than just using a public service. We run our own (well, I run our own...) because we work with banks and all contracts we sign with them have clauses regarding where information from them gets stored and who could possibly have access to it - this is to protect their data in instances where we might be sent (intentionally or otherwise) information about some of their employees or customers. I'm guessing a great many businesses work with clients who have similar concerns so those clauses will be present in contracts that have signed too, so using a "public" service like gmail or hotmail just isn't compatible with them - we can't make any demands to Google about who can access what on their servers or audit them. No business should use a public service like that and leave the mail on it. This isn't a dig at the public services like gmail, as they provide a valuable resource for those the resource is not wrong for, but they can not provide the accountability I would expect to be able to provide my clients as a business. Businesses should (IMO, and in order of preference) run their own server, use a service that has some contractually enforced security guarantee, or pull down the mail to local systems rather then leaving it on a public server - otherwise they can have no hope at all of controlling who can access their (potentially confidential and sensitive) mail. Aside from the data security issue there are other potential problems that should be concerned about. If a public services goes down there is nothing you can do to help a fast recovery and you will not be their priority: your services will be available again when it is available again. Also you need to implement a good backup system no matter what you chose - you should not (as many people do) rely on a single service for both your live mail handling and backups. The $20/month is nothing to a business (or should be), but you are right in that a mail server should never be considered a set-and-forget system so there will be technical resource cost involved with running a mail server and dealing with possible issues like "friendly fire blacklisting" so a reputable outsourcing arrangement would be more cost-/manpower- effective for many small businesses. FYI: we currently use Zimbra's "community edition", though at some point I'd like to convince the powers that be that using the paid edition would be worth it for the support (there has never been an issue I can't resolve, and there is never likely to be, but I'm not here 24/7 and don't have someone with the right skills to delegate the job to when I'm not around). It is more resource hungry than Postfix+Dovecot+RoundCube though so needs significantly more the linode's $20 VM product to be usable, but I recommend people give it a try as its single install removes the need for you to perform any integration work putting a stack together and the feature set aside from email is no unattractive either.
- mister_m 16y ago
  Do you mean from a security perspective, such as keeping software on the stack at the latest versions? I am a linode user myself and I was interested in setting up a mail server of my own for personal use, but I will admit I don't know much about it.
  - thaumaturgy 16y ago
    Keeping most of the software reasonably up-to-date isn't too hard; on Debian, for example, just regularly use apt-get update && apt-get upgrade. (Hopefully you have backups ready in case it goes sideways.) Probably my number one time sink on the mail server is, "Where is the email from X that I've been expecting?" A close number two is, "I'm getting too much spam." If you're paying for hosted email from someone else, you can just give them a call and make it their headache. If you're doing your own, it's your own headache, and it's a headache that can easily consume a few hours at a time. You also should regularly check in with various system and software logs, to make sure that someone isn't trying a novel new attack against the mail server, or that a process isn't struggling for some reason. Most of the software does a pretty good job of being rock-solid, so I don't find myself having to tune things all the time or nudge dead processes or anything. But, I did find that if I left the mail server alone for a while, then when something did go wrong, it took me a lot longer to resolve it (I think mostly because I'd forgotten where everything was), which is not what I want in a downtime situation.
hoggle 16y ago
Please do! I think something like this could be valuable to a lot of small to medium companies who atm can't resist subscribing to Google Apps (50,- per user you could have instead). I think with a service like that, the main goal would be to stay as simple as possible while still offering the "Exchange" integration with people's current infrastructure. I would do the user side web frontend last and concentrate on a simple but empowering foundation plus administration interface first. Clearly with the PSN breach and all the bad press Google, Apple & Co. are getting with location/mobile I can see a shift in people's minds towards more privacy and security similar to when people started to get used to anti-virus/firewall software. 2011 - Devops galore.
- windsurfer 16y ago
  Do you think the service would still be interesting if it didn't offer Exchange integration?

jackowayed 16y ago

How are your backups? And what happens if it goes down for a few hours? Would you not get that mail?

ars 16y ago
The sending mailserver will (usually) keep trying to send the email for 5 days.
thaumaturgy 16y ago
> How are your backups? A server in another data center does differentials of the entire mail server every hour on the hour, and weekly fulls. Differentials are stored for 14 days and weeklies are stored for 120 days. If a customer accidentally deletes an individual message, we can probably restore it; if a customer nukes their entire mailbox, we can restore it. > And what happens if it goes down for a few hours? Would you not get that mail? SMTP servers by convention are supposed to retry for at least a day if the destination server is down. A few miscreants (ahem Washington Mutual...) don't retry at all though. Worst-case scenario, I can have another mail server up and running in 20 to 30 minutes, with most of the mailboxes restored to it. Since I also admin our own name servers, and I keep a short TTL, we could update the DNS for the mail server and have most mail services back online for most customers pretty quickly. Unfortunately, true fail-over mail services is a challenging nut to crack, especially if you want duplication between distant data centers.
- jvdh 16y ago
  I run my own mailserver too for private use. I make use of a DNS provider who also provides backup SMTP service. Basically it adds another address as alternative for delivery for your domain. That server is configured to forward the mail to your primary server or hold it until it comes up again. Works great, and you could even use it as a spam filtering option, since legitimate servers should only try the first server, but a lot of spammers use the second one thinking that it probably has less spamfiltering or something.