11 ms·

Show HN: Mox - Modern full-featured low-maintenance self-hosted mail server

471 points by mjl- 4y ago

c0l0 4y ago
This project's scope is rather impressive, and from what I've gleaned from skimming its docs, it might be the perfect solution for people who want to self-host email. It tries to have most of the advanced/difficult things (like getting DKIM set up right) taken care of for the postmaster, as far as that is possible within a single application. I love that it will print the DNS records you'll need to set up in your zone during setup. If I were to start over my personal email setup (postfix with postscreen, dovecot with fts, opendkim, amavis/spamassassin), I sure would try it with this.
- creshal 4y ago
  Yeah, that's my impression as well. I've been wondering about this sort of setup for a while – there's a lot of moving parts in traditional email servers, and projects like poste or univention/zimbra/… that just try to glue these massive stacks together have always been far too fragile and involved for any setup that's smaller than "we can afford a dedicated sysadmin for emailling". The only feature I'd still want is Sieve, then it'd be good enough for not just home setups, but probably also SMBs.
  - mjrpes 4y ago
    It doesn't look like it supports mailbox sharing or public folders, which are very helpful for collaborating in a SMB, especially with shared email addresses (e.g., sales@business.com).
    - mjl- 4y ago
      Do you know how this is typically used/configured? Do accounts get this shared account (mailbox(es)/folders with messages) as folders in their own account? So next to your own Inbox and Trash, you would have Sales/Inbox and Sales/Trash? If you delete a message from Sales/Inbox, does it automatically go to Sales/Trash? How is that done? Perhaps IMAP namespaces? I have figured folks can just add another account (IMAP connection) to their mail client. Either a shared account (e.g. sales@), or account of a colleague. And then the account (mailbox) is shared. Perhaps it's because webmails are just for a single account and folks would have to have multiple mail browser windows open? Or business folks are just not used to this approach? Or perhaps they want an admin to inject some shared mailbox into an existing account without requiring any user action? Public folders sound a bit like a mailing list, from what I just skimmed from Exchange documentation. I presume the message flags (Seen/Read) are per-user? So it's more like delivery to each members copy of the public folder, instead of an actual shared folder?
      - mjrpes 4y ago
        I use dovecot and there is a lot of configurability for shared and public folders. Public folders are much nicer than having to add separate IMAP accounts; users can subscribe to whatever public folders they want/need from a list. All subscribed folders show up underneath the root namespace folder. I have about 6 types of inboxes based on business roles (sales, pr, hr, it, etc). I have many more folders, beyond general inboxes, that get filled based on sieve filter rules. For example, voicemail alerts get filtered into a special voicemail folder. Dovecot lets you configure whether the read state is shared or per user. We use a system where people can flag messages as to whether they are taken for action, are critical, or are completed. These show up in Thunderbird/Roundcube mailbox list as color coded, and this aids in people knowing if emails have been dealt with. You still have strict control for access/permissions on a per-mailbox basis, with ACL. All of this could have been done with shared folders under a "shared" user account (either one or multiple shared account, such as sales, hr, etc) with similar results. Exchange also has shared/public folder support, but it looks like permissions aren't (maybe?) as fine grained as IMAP/Dovecot/etc? https://learn.microsoft.com/en-us/exchange/collaboration-exo/collaboration-exo?redirectedfrom=MSDN https://learn.microsoft.com/en-us/exchange/collaboration-exo...
- mattbee 4y ago
  The scope isn't revolutionary - I've used https://mailu.io/ https://mailu.io/ for years for a few 10s of users, and I really like it. I've heard similar good stories from Mailcow users. On a quick skim I couldn't tell what was new relative to these older compose-based solutions but (as co-author of similar solution 10-15 years ago) I'm interested to know!
  - creshal 4y ago
    What's revolutionary is that mox implements the entire stack itself as tightly coupled monolith. With mailu and everything else you get a gargantuan stack of half a dozen massive, enterprise scale servers that are held together with duct tape and prayers. They can scale out to hundreds of thousands of users, but if anything breaks they expect there to be dedicated sysadmin staff to fix it, and gluing leaky abstractions on top doesn't really solve these fundamental architectural challenges.
    - mattbee 4y ago
      Ooo that's really cool and I'd like an excuse to try it. I had a career in duct tape and prayers so very comfortable in that domain :)
      - nixgeek 4y ago
        “Duct tape and prayers” is a fantastic description that scales well from tiny shop through to 10000+ engineers!
  - mjl- 4y ago
    I suppose it's mostly from a technical perspective: Single code-base, single binary, written in modern language (Go). There are advantages to an integrated solution: The junk/nonjunk flags you set in your mail client are used to assess incoming email (based on full sender/domain/orgdomain/spf/dkim/ip/ipsubnets). I'm not sure how common/feasible that is with solutions that combine mail server components. I've used postfix & dovecot before mox, I admittedly didn't closely look into it but assumed that combo cannot do that.
- liotier 4y ago
  > If I were to start over my personal email setup (postfix with postscreen, dovecot with fts, opendkim, amavis/spamassassin), I sure would try it with this. I am tempted to give that sort of thing a try, as successor to the franken-"postfix with postscreen, dovecot with fts, opendkim, amavis/spamassassin" contraption (actually Courier, not to mention LDAP, greylisting, a couple webmails, OCR, blacklists etc.) that we have been maintaining for two decades in service of friends & family. But, for all its flaws, once put in production that setup on Debian packages Just Works - with upgrades and distribution version jumps handled almost flawlessly. I doubt that any of the new generation of integrated "mail things in a box" products that pop up since a couple of years have anywhere near that staying power. Does someone here know some that put long-term maintainability at the top of their priorities ? It seems to me that they all optimize for quick onboarding.
  - fmajid 4y ago
    https://en.wikipedia.org/wiki/Lindy_effect https://en.wikipedia.org/wiki/Lindy_effect
  - bityard 4y ago
    Same. There is a large vocal contingent who confidently declare in any online space that hosting your own email is impossible these days. And yet, those of us who have been for years are managing it just fine. Yes, it takes some understanding of how things work. Mine has been chugging along for longer than I can actually remember with very little maintenance needed, aside from regular package upgrades. The only time I ever had an issue with mail providers rejecting mail from my domain was when my wife started sending out school newsletters containing links to a shady URL shortener, but that was fixed pretty easily.
- abdullahkhalids 4y ago
  I have used https://mailinabox.email/ https://mailinabox.email/ for about 1.5 years. Installation was dead simple, and no technical problems after.
  - myaccountonhn 4y ago
    I've heard that using your own mail server can give issues with your email ending up in spam. Is that the case if you use this?
    - oskapt 4y ago
      That is most often caused by reputation issues around the IP where your mail server lives. If you host it at home or in any “residential” block of addresses, then most definitely. Same if hosted on a VPS or with a provider whose address space may have been burned by spammers spinning up machines and then redeploying them when they start getting blocked. As someone said further down below, you can still host at home and use Amazon SES as your verified outbound relay. I do that with the Axigen free email server, and I have no issues with reputation.
    - abdullahkhalids 4y ago
      1. I was very careful to make sure that the IP address I was assigned was not on any blacklists. 2. I don't know if it actually helped. But after setting it up, I got a whole bunch of family/friends to email me from their gmail/hotmail/o365 addresses first, and then I replied to them. The theory was that gmail/hotmail wouldn't mark me as spam if their own addresses were initiating the conversation. Seemed to have worked well. I have had only one case of my email getting completely blackholed (not put in spam, just rejected outright) is when I emailed a friend with a @amd.com address. Right now, I am still using gmail for essential professional emails, but slowly getting all my online-services converted to the new email address.
- ilyt 4y ago
  Only thing I see that would really be missing is Sieve, it's soo much nicer to have server side filtering/categorizing
  - mjl- 4y ago
    Sieve is becoming a commonly requested feature. (; For now, mox supports delivering to mailboxes with configurable rules, search for "Rulesets:" on https://pkg.go.dev/github.com/mjl-/mox/config https://pkg.go.dev/github.com/mjl-/mox/config. You can edit the config file (if you're the admin), or use the account web interface to add/remove/edit rules. I use it to get mail from mailing lists to the right mailbox.
- obituary_latte 4y ago
  Just throwing my 2c in the ring: I've been using iRedMail for I want to say 10+ years now. Just simple linux no-frills webmail with nice admin and default webmail. Best part is it is dead simple to set up, the developer is very nice and responsive on his forum and it has been rock-solid. Granted, I don't send a lot of mail from it but it has been running as a journal for many years without issue. I do send some mail from it--mostly from devices--to my gmail and have never had a problem with blacklisting. I think this mostly depends on your IP reputation so your host and how you host it is important.
- ranger207 4y ago
  I set up docker-mailserver[0] Monday in ~6 hours, most of which were me trying to be fancy using podman instead of docker and dealing with SELinux. But then again I did choose it over mail-in-a-box for just that level of customization. Obviously I can't tell how reliable it will be in the long run yet, but since it's using the classic Postfix/Dovecot stack I expect it'll be pretty stable [0] https://github.com/docker-mailserver/docker-mailserver https://github.com/docker-mailserver/docker-mailserver
GTP 4y ago
Looks good, but since it's a young project I would suggest to anyone interested to consider Mailu [1], which is a mature project and looks easier to configure. [1] https://mailu.io https://mailu.io
- creshal 4y ago
  Mailu, like poste, zimbra, univention, and a dozen other projects like it, suffers from being just a layer of glue scripts and leaky abstractions on top of very complicated dedicated software stacks – dovecot, postfix, rspamd, etc. are all complex beasts on their own, and have 30 years worth of accumulated configuration knobs to fiddle with. Postfix and dovecot in particular are also service orchestration frameworks of their own and don't reaaaally mesh well with docker, nor do the authors care about "this silly new fad". Don't dare asking about help with it on the postfix mailing list e.g., Wietse will rip your head off and beat you with it. So, no, after messing around with these sorts of stacks for over a decade now, I can't in good faith recommend it to anyone. Sooner or later the leaky abstractions flood your basement and you have to clean up the mess on your own. Mox's approach of cutting out 95% of the complexity by rolling their own good enough solutions into one monolith is far saner for small setups.
  - dspillett 4y ago
    > nor do the authors care about "this silly new fad" In fairness, if you have chosen a platform that potentially introduces its own issues that isn't their problem unless they want it to be. A friend of mine has a project out there that only has official builds and build instructions for plain debian-based Linux, and he finds demands for direct docker support to be irritating (far worse than demands for a supported native Windows build ever were). And demand is the right word: many don't just ask, and some seem to get personally offended when he responds that he doesn't use docker much himself so wouldn't be comfortable offering support for it directly.
    - creshal 4y ago
      Sure, it's the author's right to choose what to support and what not. But I'd argue that software openly hostile to docker is probably not the best choice as central piece of your docker-compose based emailling setup, if the alternative is a single golang binary designed for use with docker.
Lucasoato 4y ago
When I tried a similar project, every email I sent from a self-hosted email server were considered spam from Gmail. In some cases, websites weren't even allowing email registration with a self-hosted email. Is there any general advice about avoiding such problems?
- mjl- 4y ago
  Get a machine/VM at a hosting provider that takes their network seriously. Typically not the cheapest you can find. And make sure all the DNS config is set correctly. Mox helps you with that. I've done a few mox quickstarts at fresh VM's, and mail was accepted by gmail just fine.
- creshal 4y ago
  Email reputation is a complex topic, but generally as long as you • don't use an IP range classified as "consumer" (known dynamic IP DSL/cable ranges) • set up SPF • set up DKIM • don't send actual spam …it generally gets through. Mox is so far the easiest solution for SPF/DKIM I've seen, but if you don't mind spending a weekend tinkering, it should be solveable with any email stack. > In some cases, websites weren't even allowing email registration with a self-hosted email. I never ran into that issue. Not much you can do there, other than writing the owner angry emails via gmail.
  - danpalmer 4y ago
    I did all of this when self hosting for a few years. It was mostly fine, but for a couple of undelivered emails. Those were just enough that I lost trust in the system and eventually stopped running my own email. People mostly expect email to be fully reliable. It’s not, but that doesn’t stop people treating it like that. As a result, even if you only fail to deliver 1 in 1000 emails, that could have significant consequences. Gmail et. al have a high enough deliverability rate that most people can get away with treating it as reliable. I’m not saying people shouldn’t self host, but I think they need to be very aware of how it will change their trust of email.
    - 4y ago
networked 4y ago
Very interesting project. This should be a "Show HN", since the submitter is apparently the developer.
- mjl- 4y ago
  Thanks, added the prefix.
p4bl0 4y ago
The project looks cool! However, I think the hard part of self-hosting email is not the tech stack, it's getting email delivered to your recipients using Google or Microsoft severe email servers. It's hard to rent a server that IP address is not in a block that big email providers consider suspicious already or will soon. And any mishaps can get you locked out and you need manual intervention to be allowed again. I used to self-host years ago but I've abandoned the idea now.
- tinus_hn 4y ago
  If you’re not sending a very large amount of mail you can just get an AWS account and send through them for almost no money.
  - robertlagrant 4y ago
    I wonder if another alternative would be SendGrid. You can send 100 emails/day with them for no money[0]. [0] https://sendgrid.com/pricing https://sendgrid.com/pricing
    - chiefalchemist 4y ago
      It's also transactional emails, but Send In Blue has a free tier with 300 per day. https://www.sendinblue.com/pricing/ https://www.sendinblue.com/pricing/
    - chefandy 4y ago
      I use sendgrid to send mail I host on Linode I manage with Cloudron which works with sendgrid and others out of the box. Cloudron is a cool paid server management app but their free tier includes email. Literally give the app your DNS provider details and API key, your sending service details (or internal smtp if you hate it when people actually recieve your email) and the rest is 100% automatic. The free tier limits how many one-button-press apps you can install. They're all regular open source apps, but they nicely maintain docket images for them all and the setup, including DNS for subdomains, is automatic and really smooth. I havr nothing to do with them but I was surprised by how smooth it was.
yamrzou 4y ago
I wonder how does it compare to Maddy mail server: https://github.com/foxcpp/maddy https://github.com/foxcpp/maddy
- mjl- 4y ago
  We have largely the same goals, see the first issue on the tracker with the same question. (:
  - mariusor 4y ago
    Link for the lazy: https://github.com/mjl-/mox/issues/1 https://github.com/mjl-/mox/issues/1 My own question is similar to one of the comments on the issue, how likely is it to have integrations with other authentication services? SSO was mentioned there, but I'm looking more specifically for integration on top of Ory products.
    - mjl- 4y ago
      I added "implement oauth2 support" to the todo list from that comment. Shouldn't be too hard. If anyone has tips for simple-to-setup-oauth2 setups to test against, let me know. Is oauth2 support enough to get SSO covered? SASL (as used by SMTP/submission and IMAP) supports other methods (openid, saml), but I don't know clients that support that.
      - mariusor 4y ago
        For my own server I used the osin[1] library. [1] https://github.com/openshift/osin https://github.com/openshift/osin
nubinetwork 4y ago
The readme mentions spam filtering, but I don't see any mention of virus scanning... does it do that too?
- mjl- 4y ago
  No. I'm not sure, but it feels not feasible to implement that inside mox, so would have to be checked with an external tool. ClamAV springs to mind, but I haven't looked into that topic. If anyone knows what the options are, and how one would integrate, I'm intrested in hearing about it. In the past decade, I think I've received maybe a handful emails with dodgy attachments. Obiously malicious. It never occurred to me I should implement support in mox. Probably different for settings with non-technical users.
psic4t 4y ago
Looks really nice! Even though I'm a SMTP/IMAP admin since ages I feel the need for easy-to-use mail solutions.
mjl- 4y ago
If you find mox interesting, you may also enjoy this interactive mox code review with Jonathan on his Boldly Go channel, https://www.youtube.com/watch?v=z6pGvbGXo38 https://www.youtube.com/watch?v=z6pGvbGXo38.
hansr 4y ago
I like the sound of this. The last time I set up my own email server, it was a nightmare.
solarkraft 4y ago
Looks very nice! But are there any good (modern) web clients (see Outlook Web)? E-Mail, in my experience as a light user, involves a lot of client side configuration (filters, sender names, ...) that I can't stand being tied to a single client device. IO.OX (used at mailbox.org and strato, among others) is "alright", but I haven't seen much material about self hosting it.
- mjl- 4y ago
  > But are there any good (modern) web clients (see Outlook Web)? E-Mail, in my experience as a light user, involves a lot of client side configuration (filters, sender names, ...) that I can't stand being tied to a single client device. I use thunderbird and iOS mail. With thunderbird, configuring an account is trivial with mox using autoconfig. Needs just an email address and password, the config is found automatically. I haven't gotten auto configuration to work with iOS/macOS mail or Outlook (with thunderbird-style autoconfig, microsoft-style autodiscover, or SRV-record style). Don't know what I'm doing wrong. I've seen apple products make requests to apple servers when trying to autoconfigure an account, but no requests from apple to me. I presume you they have some kind of allowlist. From Outlook I get some connection attempts from Microsoft, but they can't seem to set up a TLS connection (connection setup fails during negotiating; I've also seen them send invalid SNI names (trailing dots)). This shouldn't be hard... If anyone knows how to autoconfigure accounts with the mail clients that most of the world uses, let me know. (: I'm wondering what kind of filters and settings you would configure on the client side. I would think you would do most on the server side. That doesn't mean it has to be integrated into a web client. Mox has an account web page where you can configure mailbox routing. Once more urgent features/omissions are taken care of, I want to add a web mail client to mox (optional of course). A basic one should be doable.
- ZWoz 4y ago
  Open-Xchange documentation is sometimes little bit fragmented, but Installation guides are available, example for Debian 11: https://oxpedia.org/wiki/index.php?title=AppSuite:Open-Xchange_Installation_Guide_for_Debian_11.0 https://oxpedia.org/wiki/index.php?title=AppSuite:Open-Xchan... Now, those mailbox.org and others use (probably) commercial version. which comes with additional functionality (like document converters for preview) and providers make their own customizations top of that anyway.
upofadown 4y ago
>Not supported (but perhaps in the future): >... >* PGP or S/MIME Would this mean integrated WKD (Web Key Directory) support for PGP?
- mjl- 4y ago
  > Would this mean integrated WKD (Web Key Directory) support for PGP? Didn't know of that, thanks. I think this could be used to encrypt submitted messages before trying to deliver them? What I had in mind when I wrote that line, was server-side signing. But I don't think it's such a great idea to have private keys on a server. It would be convenient for use with email clients that don't support signing themselves. But I don't use PGP or S/MIME myself at the moment. So my messages get stored in plaintext, are typically transferred over TLS (might want to start enforcing that!). With SPF/DKIM/DMARC and with SMTP (submission) authentication, sender addresses aren't typically forgable anymore, so signing is perhaps less important than it once was.
igtztorrero 4y ago
Very Good GoLang code, I Will take some lines. Please use a VPS with your own IP clean checked. Register on Microsoft Mail Program to pass Hotmail, Outlook and other MS domains. SPF and DKim are mandatories !!! Postal Server has a Good interface to configure and check SPF and DKim records.
develatio 4y ago
Mailcow is another option. I’ve been using it for a few years without any problems.
oron 4y ago
Can this scale to 10's of 1000's of users on a big server? I wanted to open an alternative to gmail where users can use their domains and open several mailboxes for a small fee but when searching for solutions I always end up with dovcot scaling which is hard or expansive. What I am searching for is some solution where the mailbox can store large attachments on S3 / b2 and maybe also email content and just index the inbox on a local DB / Redis. Is there something like this available open source?
- mjl- 4y ago
  > Can this scale to 10's of 1000's of users on a big server? No, probably not. Indeed disk space may become an issue (though you can get large disks nowadays; also, if you want to be that big, modifying the code to storage the raw emails (or only the large ones) externally should be worth the time). And if you are that big, you probably want a backup mx, which pretty much requires replicating the index database to another place, which isn't supported yet. But more importantly, mox doesn't have a spam filter or rate limiter for submitted (outbound) email. So it will currently take 1 compromised account to damage your IP's reputation. It's on my todo list. I heard dovecot has an option to store messages to s3. It seems to be part of a paid variant.
  - oron 4y ago
    Not sure I need to be in that scale , I can leave with some downtime , I am not Google, and it's a low cost solution , re outgoing emails I can rate limit with some Redis counters and maybe ratio limits on send / received emails.
theK 4y ago
Wow, impressive feature set! How long was the incubation time of this project? I see that the initial git commit already contains quite a lot :-) I think this server hits a very interesting market segment of the users that want to self host a mail server but do not want to be locked in to the (some times opinionated and difficult to integrate with other infra) docker based turnkey options like mailcow or mailu.io. I certainly would take a look at it for my next iteration, even though I'm kinda very comfortable with my existing setup which is based on mailcow. One key aspect with self hosting is how to keep the end system upgradeable. And this is where mailcow and mailu shine because internally evenrything has been worked out already. Still crossing fingers though, this looks promising!
- mjl- 4y ago
  > How long was the incubation time of this project? I see that the initial git commit already contains quite a lot :-) I started prototyping about 1.5 years ago. Then work took over. But managed to work on this for the past ~6 months nearly full-time. I worked from git staging, keeping it all working with tests. > One key aspect with self hosting is how to keep the end system upgradeable. And this is where mailcow and mailu shine because internally evenrything has been worked out already. Still crossing fingers though, this looks promising! Mox is still very young. I think updates will probably require some admin intervention until the dust settles. But I typically build some support in my applications for automatically upgrading data to keep manual intervention to a minimum.
thunderbong 4y ago
I've set up my email using Mail-in-a-box [0] and it's worked wonderfully. How does this compare with Mail-in-a-box? Also, webmail, calendaring are future features in this product. I wonder how critical are those for people setting up their own email. [0]: https://mailinabox.email https://mailinabox.email
- mjl- 4y ago
  > Also, webmail, calendaring are future features in this product. I wonder how critical are those for people setting up their own email. I wonder the same. (: I would personally use the calendaring. One of the goals of mox is to make it easy to host mail yourself instead of go to/stay at one of the few large providers. I think folks commonly use the calendaring that comes with their free email address. And it seems many people enjoy their webmail over locally installed mail clients.
  - glacials 4y ago
    As anecdotal personal experience, I switched off Google Calendar for a couple of years and couldn’t do it. There were too many missing conveniences that weren’t handled by the generic protocol. Invitations and RSVPs frequently got lost, updates to existing events weren’t really recognized, and invited mailing lists didn’t unfurl into individuals. I switched back to using Google Calendar as a backend. It would take a lot for me to try a switch again.
- ajdude 4y ago
  Also if you visit box.yourserver.tld/cloud do you have a fully working Nextcloud instance.
superkuh 4y ago
I highly suggest that technical people like HN readers use the https://workaround.org/ispmail https://workaround.org/ispmail tutorials instead and set up postfix/dovecot from their OS repos. You'll learn enough on the way to fix things when they do go wrong rather than relying on some turnkey stuff who's internals are obscure and hard to fix when the inevitable problems happen. Setting up a proper mailserver this way does take a few hours (from VPS setup to sending mail) but once it's set up it's good to go for a decade. And when the time comes to update the distro you're running it on you'll know how to port your data/config to the next VPS.
- aareet 4y ago
  I’ve actually found that this is not the case and that while the learning is enjoyable, it’s very difficult to retain, especially if the result is a low maintenance server. A decade after I set it up, I will most certainly have forgotten how I set it up in the first place (speaking from experience).
  - navigate8310 4y ago
    This is generally true. Patiently documenting steps as well as logging any corrective and preventive actions (something that I learnt when studying for ISO 9001) is prudent.
    - groestl 4y ago
      I (mostly) stopped documenting in prose and used ansible instead. It's a bit more work, but it paid off numerous times since then. The prose that's still left, because it's really really to cumbersome to implement, is left in the comments of ansible files.
- mjl- 4y ago
  It's certainly a good idea to understand how email works when you are running your own email server. I don't think setting up half a dozen services is the best way to get that knowledge though. Ideally, mox will explain some of it on its admin pages in the future. But I understand your point. Existing mail server components are long-lived, battle-tested, high-quality. I wouldn't say internals of mox are obscure, it's all open source and relatively lean code (but clearly I'm biased). But indeed, if something goes wrong, you may not currently be able to google-search your way out of it. Mox is very young. The FAQ suggests first installing it a subdomain to gain experience, instead of switching your email over immediately. FWIW, I implemented the mail export functionality before import functionality. You can easily get a tgz or zip with all maildirs or mbox files out of mox.
jstummbillig 4y ago
It's not even written in Rust
itslennysfault 4y ago
Second self-hosted mail server in 2 days. Are people really hosting their own mail servers? Why? I did this for about 10 years and mostly it was uneventful and worked fine. HOWEVER, a little less than once a year it would break and I would suddenly not be receiving emails and would have to scramble to fix me mail server when literally anything else would be a better use of my time. It was a good learning experience, but kinda pointless tbh. There are so many free/cheap very reliable maintenance free (for me) options for email that I can't for one second understand why anyone would host their own (even as someone that did for years).
- pas 4y ago
  For me it's path-dependence ... we're already hosting a few sites, used to host stuff for a foundation, plus their site sent a lot of newsletters. Nowadays I can wholeheartedly recommend Mailgun for outgoing mail. For personal/incoming ... well, Proton seems okay-ish.
Tepix 4y ago
Very cool features! I hope SIEVE filtering is coming also, i consider it essential.
hknmtt 4y ago
this is great. i'll be needing mailserver to send out a lot of emails so self-hosted makes only financial sense. was pondering of making my own but didn't got to it yet. great that this is in Go as well.
- bityard 4y ago
  I wrote earlier that I don't have any issues self-hosting my own mail server. But this is most likely an exception that. If your plan is to send out newsletters and other marketing content, you are really better off going through a company that specializes in that. Self-hosting email is really only practical for individuals hosting their own personal/family mail, or for small companies who have the resources to hire someone to manage the mail system for their own domain. The TL;DR here is, if you _look_ like a spammer (lots of identical/similar messages from one domain to lots of recipients), other mail systems will probably treat you like a spammer.
dblitt 4y ago
I'd love the ability to send mail through a public SMTP relay, such as Amazon SES or Sendgrid, so the server could be hosted on "untrusted" IP space and send outbound mail through a trusted relay.
- mjl- 4y ago
  Wouldn't it make more sense to just configure an AWS SES submission account as outgoing mail server, instead of trying to send it through a mail server like mox, only to have it forwarded again. I think you need to verify addresses with AWS SES anyway if you want to send from them (or perhaps it's only per domain?). Don't know if other mail service providers have a similar requirement.
  - dblitt 4y ago
    My use case would be creating one AWS SES or Sendgrid credential that is authorized to sending mail for an entire domain, and then a mail server like mox would then further authorize which users could send emails as who (and probably filter by only allowing the correct email in the From: header for example)
greenthrow 4y ago
There's lots of hosting providers who will sell you a managed VPS that includes your own mail server among other things. That seems like a better solution to me, for someone who doesn't want to get into the guts of it.
- scooke 4y ago
  If it's managed, isn't it their mail server? I mean, I can use my own domain and such, but as posters above said, "data independence" is important.
  - greenthrow 4y ago
    Hard to have true data independence and also have it be "turnkey". At some point you have to pick who to trust. Beyond that, unless you're exchanging only encrypted emails, there's no such thing as data independence with email.
quyse 4y ago
If you are familiar with NixOS, and like to have everything declared in Nix configuration, Simple NixOS Mailserver is very robust and easy to use. Have been using it for ~2 years. https://gitlab.com/simple-nixos-mailserver/nixos-mailserver https://gitlab.com/simple-nixos-mailserver/nixos-mailserver
- chalst 4y ago
  Checking the Gitlab summary, this is a wrapper around Postfix+Dovecot, with support for DKIM/SPF/DMarc authentication and rspamd spam filtering.
TheMagicHorsey 4y ago
Nice project. But I was always nervous about running my own mail server for reasons outside the server itself. I mean things like deliverability, security, uptime, patching.
throwaway67743 4y ago
I'm in two minds about this sort of things while it's nice that it makes it accessible, mail should be hard as it means that responsibility is taken - a bunch of mail servers run by people without any experience or knowledge is a bad thing for all of us
francois_h 4y ago
I’ve set up and ran my zimbra server for a long time too. It was a pain to set up initially, but once it’s running, you rarely have to make changes. The only bugbear I have is to update the letsencrypt ssl cert for secure connection and https access. But a cronjob automates that for me.
berjin 4y ago
How does it handle spam filtering? Surely the big mail providers have a network effect going on when one person marks an email as spam it's applied to similar emails.
- mjl- 4y ago
  All per account. If account 1 marks a message (sender) as spam, account 2 is not affected. I am blocking at least one otherwise legitimate company that is incapable of unsubscribing me from the marketing mails (despite talking to their helpdesk). I block them now. But other accounts may want to still see their emails. If you want to learn who the real bad spammers are, I think you need larger volumes of mail than a self-hoster will gather. The network effect that mox can use is through a RBL/DNSBL, but then an external DNSBL is doing the learning/analysis and mox just uses it.
infogulch 4y ago
Email servers are notoriously difficult to configure, hence all these solutions ranging from tutorials to "everything included" systems. Recent activity on HN about mail servers: Mox, Poste.io from yesterday [1], Mailinabox, mailcow, ispmail, maddy, stalwart jmap, etc. Many of these systems keep redoing the same work over and over which seems wasteful. What I'd like is a "mail reverse proxy" that does all the work to manage DNS, SPF, DKIM, DMARC, etc and handles sending and receiving emails, but doesn't do any storage or user management. Instead it forwards mail from/to the "real" mailserver sitting somewhere in a private network. (Maybe using LMTP [2]?) This way you could roll the dice until you get a $5 VPS with a clean static IP and just park it there permanently, where it does nothing but sends and receives emails from your real mail server wherever you want to host it. Kinda like a PO box. You never have to worry about upgrading it to get more storage, or switching providers and losing your IP, if it gets hacked the worst it can do is spy on live email traffic and send spam until its patched. Why doesn't this exist already? [1]: https://news.ycombinator.com/item?id=34901703 https://news.ycombinator.com/item?id=34901703 [2]: https://datatracker.ietf.org/doc/html/rfc2033 https://datatracker.ietf.org/doc/html/rfc2033
- mjl- 4y ago
  > Many of these systems keep redoing the same work over and over which seems wasteful. There certainly is duplication of effort, but all these systems try to bring something new to the table. > Why doesn't this exist already? Because you haven't written it yet? (; But seriously, I've had a somewhat similar thought. But instead of running a "reverse mail proxy" on a VPS, I was hoping to take a VPS, set up some tunnel magic (with wireguard probably) that forwards all traffic coming in from the internet, intact with original IPs, to my local side of the tunnel, and vice versa. So my local machine just has the same public internet IPs configured as the VPS and all internet traffic is going through the tunnel. So just use a VPS for its IPs. That way my data is not stored at my hosting party. If anyone has set this up already, or thinks this is a bad/good idea, I'd like to hear.
  - infogulch 4y ago
    > all these systems try to bring something new to the table That's great, I just wish that they all didn't have to hurdle the same (very high) bar before they can get to the "something new" part. > some tunnel magic that forwards all traffic coming in from the internet ... to my local side of the tunnel, and vice versa Yes! I considered that too. It'd kinda be like tailscale funnel, which mostly targets web hosting scenarios. Hilariously, they poked fun at the $5/mo vps idea in their article about funnel back in November [1]: > Yes, you could spin up a $5/month VM somewhere and forward a port from its public internet IP to your tailnet with one line in your rinetd.conf file. But is that fun? Do you really need a(nother) Linux VM in your life? (we're definitely being called out here lol) Sadly, funnel wouldn't work in our case because we need an unshared static IP. But that hint about rinetd could help, from the man page [2]: > it is able to redirect a large number of connections without a severe impact on the machine. This makes it practical to run services on machines inside an IP masquerading firewall. [1]: https://tailscale.com/blog/introducing-tailscale-funnel/ https://tailscale.com/blog/introducing-tailscale-funnel/ [2]: https://manpages.debian.org/unstable/rinetd/rinetd.8.en.html https://manpages.debian.org/unstable/rinetd/rinetd.8.en.html

471 points by mjl- 4y ago

c0l0 4y ago

This project's scope is rather impressive, and from what I've gleaned from skimming its docs, it might be the perfect solution for people who want to self-host email. It tries to have most of the advanced/difficult things (like getting DKIM set up right) taken care of for the postmaster, as far as that is possible within a single application. I love that it will print the DNS records you'll need to set up in your zone during setup. If I were to start over my personal email setup (postfix with postscreen, dovecot with fts, opendkim, amavis/spamassassin), I sure would try it with this.

creshal 4y ago
Yeah, that's my impression as well. I've been wondering about this sort of setup for a while – there's a lot of moving parts in traditional email servers, and projects like poste or univention/zimbra/… that just try to glue these massive stacks together have always been far too fragile and involved for any setup that's smaller than "we can afford a dedicated sysadmin for emailling". The only feature I'd still want is Sieve, then it'd be good enough for not just home setups, but probably also SMBs.
- mjrpes 4y ago
  It doesn't look like it supports mailbox sharing or public folders, which are very helpful for collaborating in a SMB, especially with shared email addresses (e.g., sales@business.com).
  - mjl- 4y ago
    Do you know how this is typically used/configured? Do accounts get this shared account (mailbox(es)/folders with messages) as folders in their own account? So next to your own Inbox and Trash, you would have Sales/Inbox and Sales/Trash? If you delete a message from Sales/Inbox, does it automatically go to Sales/Trash? How is that done? Perhaps IMAP namespaces? I have figured folks can just add another account (IMAP connection) to their mail client. Either a shared account (e.g. sales@), or account of a colleague. And then the account (mailbox) is shared. Perhaps it's because webmails are just for a single account and folks would have to have multiple mail browser windows open? Or business folks are just not used to this approach? Or perhaps they want an admin to inject some shared mailbox into an existing account without requiring any user action? Public folders sound a bit like a mailing list, from what I just skimmed from Exchange documentation. I presume the message flags (Seen/Read) are per-user? So it's more like delivery to each members copy of the public folder, instead of an actual shared folder?
    - mjrpes 4y ago
      I use dovecot and there is a lot of configurability for shared and public folders. Public folders are much nicer than having to add separate IMAP accounts; users can subscribe to whatever public folders they want/need from a list. All subscribed folders show up underneath the root namespace folder. I have about 6 types of inboxes based on business roles (sales, pr, hr, it, etc). I have many more folders, beyond general inboxes, that get filled based on sieve filter rules. For example, voicemail alerts get filtered into a special voicemail folder. Dovecot lets you configure whether the read state is shared or per user. We use a system where people can flag messages as to whether they are taken for action, are critical, or are completed. These show up in Thunderbird/Roundcube mailbox list as color coded, and this aids in people knowing if emails have been dealt with. You still have strict control for access/permissions on a per-mailbox basis, with ACL. All of this could have been done with shared folders under a "shared" user account (either one or multiple shared account, such as sales, hr, etc) with similar results. Exchange also has shared/public folder support, but it looks like permissions aren't (maybe?) as fine grained as IMAP/Dovecot/etc? https://learn.microsoft.com/en-us/exchange/collaboration-exo/collaboration-exo?redirectedfrom=MSDN https://learn.microsoft.com/en-us/exchange/collaboration-exo...
mattbee 4y ago
The scope isn't revolutionary - I've used https://mailu.io/ https://mailu.io/ for years for a few 10s of users, and I really like it. I've heard similar good stories from Mailcow users. On a quick skim I couldn't tell what was new relative to these older compose-based solutions but (as co-author of similar solution 10-15 years ago) I'm interested to know!
- creshal 4y ago
  What's revolutionary is that mox implements the entire stack itself as tightly coupled monolith. With mailu and everything else you get a gargantuan stack of half a dozen massive, enterprise scale servers that are held together with duct tape and prayers. They can scale out to hundreds of thousands of users, but if anything breaks they expect there to be dedicated sysadmin staff to fix it, and gluing leaky abstractions on top doesn't really solve these fundamental architectural challenges.
  - mattbee 4y ago
    Ooo that's really cool and I'd like an excuse to try it. I had a career in duct tape and prayers so very comfortable in that domain :)
    - nixgeek 4y ago
      “Duct tape and prayers” is a fantastic description that scales well from tiny shop through to 10000+ engineers!
- mjl- 4y ago
  I suppose it's mostly from a technical perspective: Single code-base, single binary, written in modern language (Go). There are advantages to an integrated solution: The junk/nonjunk flags you set in your mail client are used to assess incoming email (based on full sender/domain/orgdomain/spf/dkim/ip/ipsubnets). I'm not sure how common/feasible that is with solutions that combine mail server components. I've used postfix & dovecot before mox, I admittedly didn't closely look into it but assumed that combo cannot do that.
liotier 4y ago
> If I were to start over my personal email setup (postfix with postscreen, dovecot with fts, opendkim, amavis/spamassassin), I sure would try it with this. I am tempted to give that sort of thing a try, as successor to the franken-"postfix with postscreen, dovecot with fts, opendkim, amavis/spamassassin" contraption (actually Courier, not to mention LDAP, greylisting, a couple webmails, OCR, blacklists etc.) that we have been maintaining for two decades in service of friends & family. But, for all its flaws, once put in production that setup on Debian packages Just Works - with upgrades and distribution version jumps handled almost flawlessly. I doubt that any of the new generation of integrated "mail things in a box" products that pop up since a couple of years have anywhere near that staying power. Does someone here know some that put long-term maintainability at the top of their priorities ? It seems to me that they all optimize for quick onboarding.
- fmajid 4y ago
  https://en.wikipedia.org/wiki/Lindy_effect https://en.wikipedia.org/wiki/Lindy_effect
- bityard 4y ago
  Same. There is a large vocal contingent who confidently declare in any online space that hosting your own email is impossible these days. And yet, those of us who have been for years are managing it just fine. Yes, it takes some understanding of how things work. Mine has been chugging along for longer than I can actually remember with very little maintenance needed, aside from regular package upgrades. The only time I ever had an issue with mail providers rejecting mail from my domain was when my wife started sending out school newsletters containing links to a shady URL shortener, but that was fixed pretty easily.
abdullahkhalids 4y ago
I have used https://mailinabox.email/ https://mailinabox.email/ for about 1.5 years. Installation was dead simple, and no technical problems after.
- myaccountonhn 4y ago
  I've heard that using your own mail server can give issues with your email ending up in spam. Is that the case if you use this?
  - oskapt 4y ago
    That is most often caused by reputation issues around the IP where your mail server lives. If you host it at home or in any “residential” block of addresses, then most definitely. Same if hosted on a VPS or with a provider whose address space may have been burned by spammers spinning up machines and then redeploying them when they start getting blocked. As someone said further down below, you can still host at home and use Amazon SES as your verified outbound relay. I do that with the Axigen free email server, and I have no issues with reputation.
  - abdullahkhalids 4y ago
    1. I was very careful to make sure that the IP address I was assigned was not on any blacklists. 2. I don't know if it actually helped. But after setting it up, I got a whole bunch of family/friends to email me from their gmail/hotmail/o365 addresses first, and then I replied to them. The theory was that gmail/hotmail wouldn't mark me as spam if their own addresses were initiating the conversation. Seemed to have worked well. I have had only one case of my email getting completely blackholed (not put in spam, just rejected outright) is when I emailed a friend with a @amd.com address. Right now, I am still using gmail for essential professional emails, but slowly getting all my online-services converted to the new email address.
ilyt 4y ago
Only thing I see that would really be missing is Sieve, it's soo much nicer to have server side filtering/categorizing
- mjl- 4y ago
  Sieve is becoming a commonly requested feature. (; For now, mox supports delivering to mailboxes with configurable rules, search for "Rulesets:" on https://pkg.go.dev/github.com/mjl-/mox/config https://pkg.go.dev/github.com/mjl-/mox/config. You can edit the config file (if you're the admin), or use the account web interface to add/remove/edit rules. I use it to get mail from mailing lists to the right mailbox.
obituary_latte 4y ago
Just throwing my 2c in the ring: I've been using iRedMail for I want to say 10+ years now. Just simple linux no-frills webmail with nice admin and default webmail. Best part is it is dead simple to set up, the developer is very nice and responsive on his forum and it has been rock-solid. Granted, I don't send a lot of mail from it but it has been running as a journal for many years without issue. I do send some mail from it--mostly from devices--to my gmail and have never had a problem with blacklisting. I think this mostly depends on your IP reputation so your host and how you host it is important.
ranger207 4y ago
I set up docker-mailserver[0] Monday in ~6 hours, most of which were me trying to be fancy using podman instead of docker and dealing with SELinux. But then again I did choose it over mail-in-a-box for just that level of customization. Obviously I can't tell how reliable it will be in the long run yet, but since it's using the classic Postfix/Dovecot stack I expect it'll be pretty stable [0] https://github.com/docker-mailserver/docker-mailserver https://github.com/docker-mailserver/docker-mailserver

GTP 4y ago

Looks good, but since it's a young project I would suggest to anyone interested to consider Mailu [1], which is a mature project and looks easier to configure. [1] https://mailu.io https://mailu.io

creshal 4y ago
Mailu, like poste, zimbra, univention, and a dozen other projects like it, suffers from being just a layer of glue scripts and leaky abstractions on top of very complicated dedicated software stacks – dovecot, postfix, rspamd, etc. are all complex beasts on their own, and have 30 years worth of accumulated configuration knobs to fiddle with. Postfix and dovecot in particular are also service orchestration frameworks of their own and don't reaaaally mesh well with docker, nor do the authors care about "this silly new fad". Don't dare asking about help with it on the postfix mailing list e.g., Wietse will rip your head off and beat you with it. So, no, after messing around with these sorts of stacks for over a decade now, I can't in good faith recommend it to anyone. Sooner or later the leaky abstractions flood your basement and you have to clean up the mess on your own. Mox's approach of cutting out 95% of the complexity by rolling their own good enough solutions into one monolith is far saner for small setups.
- dspillett 4y ago
  > nor do the authors care about "this silly new fad" In fairness, if you have chosen a platform that potentially introduces its own issues that isn't their problem unless they want it to be. A friend of mine has a project out there that only has official builds and build instructions for plain debian-based Linux, and he finds demands for direct docker support to be irritating (far worse than demands for a supported native Windows build ever were). And demand is the right word: many don't just ask, and some seem to get personally offended when he responds that he doesn't use docker much himself so wouldn't be comfortable offering support for it directly.
  - creshal 4y ago
    Sure, it's the author's right to choose what to support and what not. But I'd argue that software openly hostile to docker is probably not the best choice as central piece of your docker-compose based emailling setup, if the alternative is a single golang binary designed for use with docker.

Lucasoato 4y ago

When I tried a similar project, every email I sent from a self-hosted email server were considered spam from Gmail. In some cases, websites weren't even allowing email registration with a self-hosted email. Is there any general advice about avoiding such problems?

mjl- 4y ago
Get a machine/VM at a hosting provider that takes their network seriously. Typically not the cheapest you can find. And make sure all the DNS config is set correctly. Mox helps you with that. I've done a few mox quickstarts at fresh VM's, and mail was accepted by gmail just fine.
creshal 4y ago
Email reputation is a complex topic, but generally as long as you • don't use an IP range classified as "consumer" (known dynamic IP DSL/cable ranges) • set up SPF • set up DKIM • don't send actual spam …it generally gets through. Mox is so far the easiest solution for SPF/DKIM I've seen, but if you don't mind spending a weekend tinkering, it should be solveable with any email stack. > In some cases, websites weren't even allowing email registration with a self-hosted email. I never ran into that issue. Not much you can do there, other than writing the owner angry emails via gmail.
- danpalmer 4y ago
  I did all of this when self hosting for a few years. It was mostly fine, but for a couple of undelivered emails. Those were just enough that I lost trust in the system and eventually stopped running my own email. People mostly expect email to be fully reliable. It’s not, but that doesn’t stop people treating it like that. As a result, even if you only fail to deliver 1 in 1000 emails, that could have significant consequences. Gmail et. al have a high enough deliverability rate that most people can get away with treating it as reliable. I’m not saying people shouldn’t self host, but I think they need to be very aware of how it will change their trust of email.
  - 4y ago

networked 4y ago

Very interesting project. This should be a "Show HN", since the submitter is apparently the developer.

mjl- 4y ago
Thanks, added the prefix.

p4bl0 4y ago

The project looks cool! However, I think the hard part of self-hosting email is not the tech stack, it's getting email delivered to your recipients using Google or Microsoft severe email servers. It's hard to rent a server that IP address is not in a block that big email providers consider suspicious already or will soon. And any mishaps can get you locked out and you need manual intervention to be allowed again. I used to self-host years ago but I've abandoned the idea now.

tinus_hn 4y ago
If you’re not sending a very large amount of mail you can just get an AWS account and send through them for almost no money.
- robertlagrant 4y ago
  I wonder if another alternative would be SendGrid. You can send 100 emails/day with them for no money[0]. [0] https://sendgrid.com/pricing https://sendgrid.com/pricing
  - chiefalchemist 4y ago
    It's also transactional emails, but Send In Blue has a free tier with 300 per day. https://www.sendinblue.com/pricing/ https://www.sendinblue.com/pricing/
  - chefandy 4y ago
    I use sendgrid to send mail I host on Linode I manage with Cloudron which works with sendgrid and others out of the box. Cloudron is a cool paid server management app but their free tier includes email. Literally give the app your DNS provider details and API key, your sending service details (or internal smtp if you hate it when people actually recieve your email) and the rest is 100% automatic. The free tier limits how many one-button-press apps you can install. They're all regular open source apps, but they nicely maintain docket images for them all and the setup, including DNS for subdomains, is automatic and really smooth. I havr nothing to do with them but I was surprised by how smooth it was.

yamrzou 4y ago

I wonder how does it compare to Maddy mail server: https://github.com/foxcpp/maddy https://github.com/foxcpp/maddy

mjl- 4y ago
We have largely the same goals, see the first issue on the tracker with the same question. (:
- mariusor 4y ago
  Link for the lazy: https://github.com/mjl-/mox/issues/1 https://github.com/mjl-/mox/issues/1 My own question is similar to one of the comments on the issue, how likely is it to have integrations with other authentication services? SSO was mentioned there, but I'm looking more specifically for integration on top of Ory products.
  - mjl- 4y ago
    I added "implement oauth2 support" to the todo list from that comment. Shouldn't be too hard. If anyone has tips for simple-to-setup-oauth2 setups to test against, let me know. Is oauth2 support enough to get SSO covered? SASL (as used by SMTP/submission and IMAP) supports other methods (openid, saml), but I don't know clients that support that.
    - mariusor 4y ago
      For my own server I used the osin[1] library. [1] https://github.com/openshift/osin https://github.com/openshift/osin

nubinetwork 4y ago

The readme mentions spam filtering, but I don't see any mention of virus scanning... does it do that too?

mjl- 4y ago
No. I'm not sure, but it feels not feasible to implement that inside mox, so would have to be checked with an external tool. ClamAV springs to mind, but I haven't looked into that topic. If anyone knows what the options are, and how one would integrate, I'm intrested in hearing about it. In the past decade, I think I've received maybe a handful emails with dodgy attachments. Obiously malicious. It never occurred to me I should implement support in mox. Probably different for settings with non-technical users.

psic4t 4y ago

Looks really nice! Even though I'm a SMTP/IMAP admin since ages I feel the need for easy-to-use mail solutions.

mjl- 4y ago

If you find mox interesting, you may also enjoy this interactive mox code review with Jonathan on his Boldly Go channel, https://www.youtube.com/watch?v=z6pGvbGXo38 https://www.youtube.com/watch?v=z6pGvbGXo38.

hansr 4y ago

I like the sound of this. The last time I set up my own email server, it was a nightmare.

solarkraft 4y ago

Looks very nice! But are there any good (modern) web clients (see Outlook Web)? E-Mail, in my experience as a light user, involves a lot of client side configuration (filters, sender names, ...) that I can't stand being tied to a single client device. IO.OX (used at mailbox.org and strato, among others) is "alright", but I haven't seen much material about self hosting it.

mjl- 4y ago
> But are there any good (modern) web clients (see Outlook Web)? E-Mail, in my experience as a light user, involves a lot of client side configuration (filters, sender names, ...) that I can't stand being tied to a single client device. I use thunderbird and iOS mail. With thunderbird, configuring an account is trivial with mox using autoconfig. Needs just an email address and password, the config is found automatically. I haven't gotten auto configuration to work with iOS/macOS mail or Outlook (with thunderbird-style autoconfig, microsoft-style autodiscover, or SRV-record style). Don't know what I'm doing wrong. I've seen apple products make requests to apple servers when trying to autoconfigure an account, but no requests from apple to me. I presume you they have some kind of allowlist. From Outlook I get some connection attempts from Microsoft, but they can't seem to set up a TLS connection (connection setup fails during negotiating; I've also seen them send invalid SNI names (trailing dots)). This shouldn't be hard... If anyone knows how to autoconfigure accounts with the mail clients that most of the world uses, let me know. (: I'm wondering what kind of filters and settings you would configure on the client side. I would think you would do most on the server side. That doesn't mean it has to be integrated into a web client. Mox has an account web page where you can configure mailbox routing. Once more urgent features/omissions are taken care of, I want to add a web mail client to mox (optional of course). A basic one should be doable.
ZWoz 4y ago
Open-Xchange documentation is sometimes little bit fragmented, but Installation guides are available, example for Debian 11: https://oxpedia.org/wiki/index.php?title=AppSuite:Open-Xchange_Installation_Guide_for_Debian_11.0 https://oxpedia.org/wiki/index.php?title=AppSuite:Open-Xchan... Now, those mailbox.org and others use (probably) commercial version. which comes with additional functionality (like document converters for preview) and providers make their own customizations top of that anyway.

upofadown 4y ago

>Not supported (but perhaps in the future): >... >* PGP or S/MIME Would this mean integrated WKD (Web Key Directory) support for PGP?

mjl- 4y ago
> Would this mean integrated WKD (Web Key Directory) support for PGP? Didn't know of that, thanks. I think this could be used to encrypt submitted messages before trying to deliver them? What I had in mind when I wrote that line, was server-side signing. But I don't think it's such a great idea to have private keys on a server. It would be convenient for use with email clients that don't support signing themselves. But I don't use PGP or S/MIME myself at the moment. So my messages get stored in plaintext, are typically transferred over TLS (might want to start enforcing that!). With SPF/DKIM/DMARC and with SMTP (submission) authentication, sender addresses aren't typically forgable anymore, so signing is perhaps less important than it once was.

igtztorrero 4y ago

Very Good GoLang code, I Will take some lines. Please use a VPS with your own IP clean checked. Register on Microsoft Mail Program to pass Hotmail, Outlook and other MS domains. SPF and DKim are mandatories !!! Postal Server has a Good interface to configure and check SPF and DKim records.

develatio 4y ago

Mailcow is another option. I’ve been using it for a few years without any problems.

oron 4y ago

Can this scale to 10's of 1000's of users on a big server? I wanted to open an alternative to gmail where users can use their domains and open several mailboxes for a small fee but when searching for solutions I always end up with dovcot scaling which is hard or expansive. What I am searching for is some solution where the mailbox can store large attachments on S3 / b2 and maybe also email content and just index the inbox on a local DB / Redis. Is there something like this available open source?

mjl- 4y ago
> Can this scale to 10's of 1000's of users on a big server? No, probably not. Indeed disk space may become an issue (though you can get large disks nowadays; also, if you want to be that big, modifying the code to storage the raw emails (or only the large ones) externally should be worth the time). And if you are that big, you probably want a backup mx, which pretty much requires replicating the index database to another place, which isn't supported yet. But more importantly, mox doesn't have a spam filter or rate limiter for submitted (outbound) email. So it will currently take 1 compromised account to damage your IP's reputation. It's on my todo list. I heard dovecot has an option to store messages to s3. It seems to be part of a paid variant.
- oron 4y ago
  Not sure I need to be in that scale , I can leave with some downtime , I am not Google, and it's a low cost solution , re outgoing emails I can rate limit with some Redis counters and maybe ratio limits on send / received emails.

theK 4y ago

Wow, impressive feature set! How long was the incubation time of this project? I see that the initial git commit already contains quite a lot :-) I think this server hits a very interesting market segment of the users that want to self host a mail server but do not want to be locked in to the (some times opinionated and difficult to integrate with other infra) docker based turnkey options like mailcow or mailu.io. I certainly would take a look at it for my next iteration, even though I'm kinda very comfortable with my existing setup which is based on mailcow. One key aspect with self hosting is how to keep the end system upgradeable. And this is where mailcow and mailu shine because internally evenrything has been worked out already. Still crossing fingers though, this looks promising!

mjl- 4y ago
> How long was the incubation time of this project? I see that the initial git commit already contains quite a lot :-) I started prototyping about 1.5 years ago. Then work took over. But managed to work on this for the past ~6 months nearly full-time. I worked from git staging, keeping it all working with tests. > One key aspect with self hosting is how to keep the end system upgradeable. And this is where mailcow and mailu shine because internally evenrything has been worked out already. Still crossing fingers though, this looks promising! Mox is still very young. I think updates will probably require some admin intervention until the dust settles. But I typically build some support in my applications for automatically upgrading data to keep manual intervention to a minimum.

thunderbong 4y ago

I've set up my email using Mail-in-a-box [0] and it's worked wonderfully. How does this compare with Mail-in-a-box? Also, webmail, calendaring are future features in this product. I wonder how critical are those for people setting up their own email. [0]: https://mailinabox.email https://mailinabox.email

mjl- 4y ago
> Also, webmail, calendaring are future features in this product. I wonder how critical are those for people setting up their own email. I wonder the same. (: I would personally use the calendaring. One of the goals of mox is to make it easy to host mail yourself instead of go to/stay at one of the few large providers. I think folks commonly use the calendaring that comes with their free email address. And it seems many people enjoy their webmail over locally installed mail clients.
- glacials 4y ago
  As anecdotal personal experience, I switched off Google Calendar for a couple of years and couldn’t do it. There were too many missing conveniences that weren’t handled by the generic protocol. Invitations and RSVPs frequently got lost, updates to existing events weren’t really recognized, and invited mailing lists didn’t unfurl into individuals. I switched back to using Google Calendar as a backend. It would take a lot for me to try a switch again.
ajdude 4y ago
Also if you visit box.yourserver.tld/cloud do you have a fully working Nextcloud instance.

superkuh 4y ago

I highly suggest that technical people like HN readers use the https://workaround.org/ispmail https://workaround.org/ispmail tutorials instead and set up postfix/dovecot from their OS repos. You'll learn enough on the way to fix things when they do go wrong rather than relying on some turnkey stuff who's internals are obscure and hard to fix when the inevitable problems happen. Setting up a proper mailserver this way does take a few hours (from VPS setup to sending mail) but once it's set up it's good to go for a decade. And when the time comes to update the distro you're running it on you'll know how to port your data/config to the next VPS.

aareet 4y ago
I’ve actually found that this is not the case and that while the learning is enjoyable, it’s very difficult to retain, especially if the result is a low maintenance server. A decade after I set it up, I will most certainly have forgotten how I set it up in the first place (speaking from experience).
- navigate8310 4y ago
  This is generally true. Patiently documenting steps as well as logging any corrective and preventive actions (something that I learnt when studying for ISO 9001) is prudent.
  - groestl 4y ago
    I (mostly) stopped documenting in prose and used ansible instead. It's a bit more work, but it paid off numerous times since then. The prose that's still left, because it's really really to cumbersome to implement, is left in the comments of ansible files.
mjl- 4y ago
It's certainly a good idea to understand how email works when you are running your own email server. I don't think setting up half a dozen services is the best way to get that knowledge though. Ideally, mox will explain some of it on its admin pages in the future. But I understand your point. Existing mail server components are long-lived, battle-tested, high-quality. I wouldn't say internals of mox are obscure, it's all open source and relatively lean code (but clearly I'm biased). But indeed, if something goes wrong, you may not currently be able to google-search your way out of it. Mox is very young. The FAQ suggests first installing it a subdomain to gain experience, instead of switching your email over immediately. FWIW, I implemented the mail export functionality before import functionality. You can easily get a tgz or zip with all maildirs or mbox files out of mox.

jstummbillig 4y ago

It's not even written in Rust

itslennysfault 4y ago

Second self-hosted mail server in 2 days. Are people really hosting their own mail servers? Why? I did this for about 10 years and mostly it was uneventful and worked fine. HOWEVER, a little less than once a year it would break and I would suddenly not be receiving emails and would have to scramble to fix me mail server when literally anything else would be a better use of my time. It was a good learning experience, but kinda pointless tbh. There are so many free/cheap very reliable maintenance free (for me) options for email that I can't for one second understand why anyone would host their own (even as someone that did for years).

pas 4y ago
For me it's path-dependence ... we're already hosting a few sites, used to host stuff for a foundation, plus their site sent a lot of newsletters. Nowadays I can wholeheartedly recommend Mailgun for outgoing mail. For personal/incoming ... well, Proton seems okay-ish.

Tepix 4y ago

Very cool features! I hope SIEVE filtering is coming also, i consider it essential.

hknmtt 4y ago

this is great. i'll be needing mailserver to send out a lot of emails so self-hosted makes only financial sense. was pondering of making my own but didn't got to it yet. great that this is in Go as well.

bityard 4y ago
I wrote earlier that I don't have any issues self-hosting my own mail server. But this is most likely an exception that. If your plan is to send out newsletters and other marketing content, you are really better off going through a company that specializes in that. Self-hosting email is really only practical for individuals hosting their own personal/family mail, or for small companies who have the resources to hire someone to manage the mail system for their own domain. The TL;DR here is, if you _look_ like a spammer (lots of identical/similar messages from one domain to lots of recipients), other mail systems will probably treat you like a spammer.

dblitt 4y ago

I'd love the ability to send mail through a public SMTP relay, such as Amazon SES or Sendgrid, so the server could be hosted on "untrusted" IP space and send outbound mail through a trusted relay.

mjl- 4y ago
Wouldn't it make more sense to just configure an AWS SES submission account as outgoing mail server, instead of trying to send it through a mail server like mox, only to have it forwarded again. I think you need to verify addresses with AWS SES anyway if you want to send from them (or perhaps it's only per domain?). Don't know if other mail service providers have a similar requirement.
- dblitt 4y ago
  My use case would be creating one AWS SES or Sendgrid credential that is authorized to sending mail for an entire domain, and then a mail server like mox would then further authorize which users could send emails as who (and probably filter by only allowing the correct email in the From: header for example)

greenthrow 4y ago

There's lots of hosting providers who will sell you a managed VPS that includes your own mail server among other things. That seems like a better solution to me, for someone who doesn't want to get into the guts of it.

scooke 4y ago
If it's managed, isn't it their mail server? I mean, I can use my own domain and such, but as posters above said, "data independence" is important.
- greenthrow 4y ago
  Hard to have true data independence and also have it be "turnkey". At some point you have to pick who to trust. Beyond that, unless you're exchanging only encrypted emails, there's no such thing as data independence with email.

quyse 4y ago

If you are familiar with NixOS, and like to have everything declared in Nix configuration, Simple NixOS Mailserver is very robust and easy to use. Have been using it for ~2 years. https://gitlab.com/simple-nixos-mailserver/nixos-mailserver https://gitlab.com/simple-nixos-mailserver/nixos-mailserver

chalst 4y ago
Checking the Gitlab summary, this is a wrapper around Postfix+Dovecot, with support for DKIM/SPF/DMarc authentication and rspamd spam filtering.

TheMagicHorsey 4y ago

Nice project. But I was always nervous about running my own mail server for reasons outside the server itself. I mean things like deliverability, security, uptime, patching.

throwaway67743 4y ago

I'm in two minds about this sort of things while it's nice that it makes it accessible, mail should be hard as it means that responsibility is taken - a bunch of mail servers run by people without any experience or knowledge is a bad thing for all of us

francois_h 4y ago

I’ve set up and ran my zimbra server for a long time too. It was a pain to set up initially, but once it’s running, you rarely have to make changes. The only bugbear I have is to update the letsencrypt ssl cert for secure connection and https access. But a cronjob automates that for me.

berjin 4y ago

How does it handle spam filtering? Surely the big mail providers have a network effect going on when one person marks an email as spam it's applied to similar emails.

mjl- 4y ago
All per account. If account 1 marks a message (sender) as spam, account 2 is not affected. I am blocking at least one otherwise legitimate company that is incapable of unsubscribing me from the marketing mails (despite talking to their helpdesk). I block them now. But other accounts may want to still see their emails. If you want to learn who the real bad spammers are, I think you need larger volumes of mail than a self-hoster will gather. The network effect that mox can use is through a RBL/DNSBL, but then an external DNSBL is doing the learning/analysis and mox just uses it.

infogulch 4y ago

Email servers are notoriously difficult to configure, hence all these solutions ranging from tutorials to "everything included" systems. Recent activity on HN about mail servers: Mox, Poste.io from yesterday [1], Mailinabox, mailcow, ispmail, maddy, stalwart jmap, etc. Many of these systems keep redoing the same work over and over which seems wasteful. What I'd like is a "mail reverse proxy" that does all the work to manage DNS, SPF, DKIM, DMARC, etc and handles sending and receiving emails, but doesn't do any storage or user management. Instead it forwards mail from/to the "real" mailserver sitting somewhere in a private network. (Maybe using LMTP [2]?) This way you could roll the dice until you get a $5 VPS with a clean static IP and just park it there permanently, where it does nothing but sends and receives emails from your real mail server wherever you want to host it. Kinda like a PO box. You never have to worry about upgrading it to get more storage, or switching providers and losing your IP, if it gets hacked the worst it can do is spy on live email traffic and send spam until its patched. Why doesn't this exist already? [1]: https://news.ycombinator.com/item?id=34901703 https://news.ycombinator.com/item?id=34901703 [2]: https://datatracker.ietf.org/doc/html/rfc2033 https://datatracker.ietf.org/doc/html/rfc2033

mjl- 4y ago
> Many of these systems keep redoing the same work over and over which seems wasteful. There certainly is duplication of effort, but all these systems try to bring something new to the table. > Why doesn't this exist already? Because you haven't written it yet? (; But seriously, I've had a somewhat similar thought. But instead of running a "reverse mail proxy" on a VPS, I was hoping to take a VPS, set up some tunnel magic (with wireguard probably) that forwards all traffic coming in from the internet, intact with original IPs, to my local side of the tunnel, and vice versa. So my local machine just has the same public internet IPs configured as the VPS and all internet traffic is going through the tunnel. So just use a VPS for its IPs. That way my data is not stored at my hosting party. If anyone has set this up already, or thinks this is a bad/good idea, I'd like to hear.
- infogulch 4y ago
  > all these systems try to bring something new to the table That's great, I just wish that they all didn't have to hurdle the same (very high) bar before they can get to the "something new" part. > some tunnel magic that forwards all traffic coming in from the internet ... to my local side of the tunnel, and vice versa Yes! I considered that too. It'd kinda be like tailscale funnel, which mostly targets web hosting scenarios. Hilariously, they poked fun at the $5/mo vps idea in their article about funnel back in November [1]: > Yes, you could spin up a $5/month VM somewhere and forward a port from its public internet IP to your tailnet with one line in your rinetd.conf file. But is that fun? Do you really need a(nother) Linux VM in your life? (we're definitely being called out here lol) Sadly, funnel wouldn't work in our case because we need an unshared static IP. But that hint about rinetd could help, from the man page [2]: > it is able to redirect a large number of connections without a severe impact on the machine. This makes it practical to run services on machines inside an IP masquerading firewall. [1]: https://tailscale.com/blog/introducing-tailscale-funnel/ https://tailscale.com/blog/introducing-tailscale-funnel/ [2]: https://manpages.debian.org/unstable/rinetd/rinetd.8.en.html https://manpages.debian.org/unstable/rinetd/rinetd.8.en.html