Installing a working e-mail server takes a few minutes in a terminal, and you are basically ready to send and receive e-mail out-of-the-box, even from a laptop

Installing a working e-mail server takes a few minutes in a terminal, and you are basically ready to send and receive e-mail out-of-the-box, even from a laptop if you wish. Only thing you need is setup SPF records and other similar small-effort requirements, and then your e-mail should reach the inbox rather than the spam folder on must proper services. If you do have multiple users, then you also need to protect them against e-mail spoofing. This can be done by enabling SPF checks for incoming e-mail. For live servers with multiple users, you want to limit the number of e-mails being sent per minute/hour to something reasonable, because some unfortunate user is going to get their password hacked sooner or later, and then a hacker might abuse your server to send e-mail unrestricted, which can in turn get everyone else blacklisted. E-mail security measures has a lot of AoE damage, because when someone gets hacked and spam is sent, receiving servers don't just ban the offending sender e-mail address, instead they typically ban the IP of the server, which will DoS all users of the server. Extremely inappropriate, and it should be illegal, nevertheless that is what they do, and to a certain extend perhaps understandable. But, this is why you place limit on how many e-mails users can send, as it hopefully avoids that issue. Some hosting providers has insecure server images. E.g. Ubuntu where the root user has no password, since, as they might argue: "you login with key file on SSH anyway"; however, custemers might not realize or remember that anyone can login on the e-mail server with the root user if the port is opened, and the server will become an open relay, as automated tools find it with port scanning. You also need to make sure that whoever is logged in, and sending e-mail from a given e-mail address is actually the owner of the address. Postfix does not do that by default, meaning that users can just claim to be whatever@yourdomain.com, and there will be no check. Thankfully, you can not claim to be b.gates@microsoft.com, because that will be rejected due to DNS records. In the past you could because there was no check for that.. A lot of issues is of course prevented by simply limiting IP access to your own personal IP, and that's a good idea if you are the only user, but not practical when you got other users.