6 ms·

Self-hosting email in 2025 is easy actually (apart from M365)

tsukikage 1y ago
IP reputation is a gamble, and there is no recourse. If you're lucky, awesome. But if you're unlucky and switching host isn't an option, you pretty much have to involve a large third party to act your behalf - there is zero appetite in the industry for interacting with individuals. The best solution I've been able to find is to self-host /almost/ everything, but route outgoing mail through Amazon SES. The pricing for vanity email volumes is negligible (a few cents a year), and they have people whose full time job is wrangling IP reputation / Office 365 / etc. This setup has survived several ISP/hosting switches; at times when I am lucky with IP reputation I route only mail going to Office 365 recipients via SES and deliver the rest directly; at times when I am less lucky, everything goes via SES.
- jeroenhd 1y ago
  The whole IP reputation problem seems to mostly be a Google/Microsoft problem. Unfortunately, most of the world seems to use one of those two platforms. Routing mail to those two services via a third party seems like the wisest choice. May I ask how you implemented that?
  - tsukikage 1y ago
    I use exim4. So after doing the usual SES setup, I can change the smarthost router to look like this: SMARTHOST_FOR_MS = email-smtp.us-east-2.amazonaws.com::587 smarthost: debug_print = "R: smarthost for $local_part@$domain" driver = manualroute domains = ! +local_domains transport = remote_smtp_smarthost route_list = hotmail.com SMARTHOST_FOR_MS byname ; \ live.com SMARTHOST_FOR_MS byname ; \ outlook.com SMARTHOST_FOR_MS byname ; \ msn.com SMARTHOST_FOR_MS byname ; \ live.co.uk SMARTHOST_FOR_MS byname ; \ hotmail.co.uk SMARTHOST_FOR_MS byname ; \ * DCsmarthost byname host_find_failed = defer same_domain_copy_routing = yes no_more If there was a much larger list of problem destinations I'd maybe do something nicer involving separate routers and a domainlist, but those cover all the cases that are broken right now.
    - e12e 1y ago
      How about custom domains hosted on m365?
      - tsukikage 1y ago
        Interestingly, I've not had a problem delivering directly to those (except the time I switched to an IP block with a bad rep and couldn't deliver anything anywhere directly at all); it's just the ones on the list above that don't like me. Mysterious and ineffable are the ways of Microsoft. (note that their MX record is usually a *.protection.outlook.com entry regardless of the custom domain, so I'd use that to bootstrap a rule if I had a more general problem with Microsoft)
    - jeroenhd 1y ago
      Excellent, thank you!
    - em-bee 1y ago
      how does that work with SPF, DMARC, DKIM? don't you have to authorize email-smtp.us-east-2.amazonaws.com to send email on your behalf? if you don't wouldn't every spammer use that? also, how much does that cost? i don't need to send more than a dozen email per year like that.
      - tsukikage 1y ago
        Yes, you do need to include:amazonses.com in your SPF. Amazon aren't too bad at kicking spammers off SES promptly. More importantly, Amazon doesn't sign for DKIM - your server still does that; so no-one else gets to DKIM for you; and you can set the DMARC policy to require both. SES currently charges $0.10 per 1000 outbound emails. The first 3000 mails are free. I received my first official bill for $0.02 after around two years of use. Do investigate other relay services. I only stopped at SES because I was in a mad rush and it was the first one I tried that did everything I needed, without bouncing or getting filed to trash on any services I cared about. I have done nothing like a full survey of the market, and there may well be a better option. It is the general approach I am suggesting, not trying to shill SES specifically despite what it may look like.
- graemep 1y ago
  You can usually switch host. Some have better IP reputations than others. There are quite a few other providers of email forwarding services, although I might look at SES myself if its that cheap as I have issues with hotmail (I seem to be OK with most mail to email on MS hosted email on other domains, oddly enough).
  - tsukikage 1y ago
    > You can usually switch host ...it took OP 8 months of "rolling the gacha" and waiting to get a clean IP; no mention of costs. Not really a solution in my book. If you're willing to wait 8 months for working email, I put it to you you're actually using some other provider for your life and the thing you are playing with is a toy. I've been self-hosting my email for a pretty long time. I first started down the reputation rabbit hole when a provider decided to shut up shop after a decade of operation, causing me to lose my lovely fixed IP block with its decade-old clean rep. Waiting/playing around isn't really an option when your email is broken and you need it working /today/ because it's not a throwaway toy - your digital life is tied to it. Still, as I said at the start, if you get lucky, awesome for you.
    - Bender 1y ago
      If cost is not an issue one can run standby servers in multiple locations and have backups to all of them. Just as MX records allow for multiple inbound servers one can have multiple outbound servers as well. Park a few unused or vanity domains on them and have cronjobs send automated emails to yourself. I reply to those emails so the likes of Gmail see interaction between them. With time all IP addresses get good reputation.
      - tsukikage 1y ago
        An IP laundering service certainly sounds like a potential startup opportunity. Certainly I'd have paid for a proven good IP in the past before I developed my current solution.
        1y ago
- xrisk 1y ago
  Did switching your deliverer to SES have any effect on how clients like Gmail “tagged” your email? (Promotional category or something IIRC)
  - tsukikage 1y ago
    Nope. The biggest impact on gmail was making sure I had DMARC, DKIM and SPF all set up correctly. (I tried several other relay services like mailgun and those /did/ have noticeable impact - SES was the first one I tried that didn't, so I stuck with it).
- deleted 1y ago
  [deleted]
kees99 1y ago
O365 and gmail should be honorably mentioned as places that will deliver both inbound and outbound to/from an IPv6-only MX. A lot other servers will not play ball here. Your self-hosted mail server, if it lacks IPv4, will not get inbound from mailgun, mailjet, github; neither will it be able to send outbound to cisco/iphmx, as well as about 90% of small servers from what I see in my logs.
JimDabell 1y ago
> i think the myth of "you can't self-host email" persists because while it can evidently be done, basically all of the software involved is ancient, baroque, inconsistently documented, requires a PhD in Bullshit to correctly configure, and is almost actively hostile to observation. but this is _annoying_, very different from _impossible_, and fortunately mostly solvable by delegating the annoying bits to an expert using something like NixOS to make it reliably work Why are they calling this a “myth” when they readily admit that even when you are an expert who has been doing it for years, there’s still problems sending to the biggest providers in the world? There is zero practical difference between “you need to be an expert and you will still fail to get something fundamental working” and “you can’t self-host email”. > Microsoft 365 however apparently will hate your email no matter what. you learn to live with it Or you don’t self-host but use a major email provider and don’t have the problem. > there exist several pieces of folk wisdom: > - "you cannot run your own mail server in 2025, this is too hard and time consuming" (completely false, i've done this since ~2010 with minimal ongoing maintenance) This seems completely true according to what they themselves write. It is too hard and time consuming. > I think the combo of "roll the IP gacha a few times" + "let it sit for 8 months while the VM idles" probably did me a lot of good here Is letting it sit for eight months not “time consuming”? > until I cleaned up my IP reputation (which has been awful for almost a decade) Gmail refused to deliver to anything but spam This is not in any way acceptable to the average person, and it does not meet what most people would describe as “I can self-host email”. “I can self-host email but Gmail sends me to spam” is functionally equivalent to “I cannot self-host email”.
- 1718627440 1y ago
  > Or you don’t self-host but use a major email provider and don’t have the problem. Or you just use a mail relay as most VPS providers enforce anyway.
  - pseudalopex 1y ago
    What VPS providers enforce a mail relay? Not DigitalOcean or Hetzner according to the author.
simonjgreen 1y ago
I am in favour of the middle ground. Rather than expending effort self hosting email, which while plausible is unequivocally a heavy lift for most, make use of smaller providers such as Fastmail or Protonmail. Just please stop consolidating the internet.
- prein 1y ago
  After using gmail for around a decade, I switched to fastmail a few months ago and have been extremely happy with the change. I still have a lot of accounts associated to my gmail email, but i've been slowly migrating things over when convenient. It has been a much smaller lift than I anticipated and absolutely worth it.
- general1465 1y ago
  I am also going with Protonmail, not because I can't setup my own server, but because I don't want to take care for yet another server, whose loss (be it by hacking or by my mistake) would be catastrophic for my whole digital life. I will rather pay to somebody else who know what they are doing.
comrade1234 1y ago
I've been running my own mail server with several domains for me, my now wife, and friends since 1999. It's definitely changed with time and gotten more strict with things like spf, dkim, dmarc, and reverse dns all becoming necessary over the years. But it's not that difficult to be honest. Currently my internet provider is init7 and they offer fixed ip4 and set the reverse dns for me which lets me run the server downstairs in the cellar instead of at a colo somewhere (which I was doing for maybe 15 years). Every now and then I look into moving to a paid service but we have GBs of mail since 1999 and it's just too costly when it's pretty much free for me to host it myself, even taking into account the time it takes for my effort, which is practically zero. Plus I use my server for a ton of other stuff so it will always exist so I may as well host email too.
- VladVladikoff 1y ago
  I’m surprised this works, usually residential IP blocks are in DNSBL.
  - comrade1234 1y ago
    I have no problems with my current home ip address (here in Switzerland with the provider init7) but years ago (~20) when I moved my server to a Colo the ip address was marked as a spammer because of the previous owner of the address. It didn't take long to make the ip address clean though - some online processes and also sending some emails. This was so long ago I barely remember what I had to do and I'm sure the process is different now because back then you could contact an actual human...
- comrade1234 1y ago
  Wanted to add something... the biggest issue I've had in the last few years is having to whitelist senders to skip the temporary rejection (smtp 4xx code) process to reduce spam. Basically, someone new emails me and my server responds with a temporary rejection message saying to try again later and then when their server retries the message 5 minutes later it allows it to go through. This is a standard process to block spammers. However lately when their email service resends the message it will come from a different server. Something like mailserver-1, then mailserver-2, then mailserver-3, each with a different ip address and each time it gets rejected until it reuses one of the addresses. But with apple for example they have hundreds of servers to cycle through and eventually the message times out and is rejected at their end. So I have to whitelist senders to skip the temporary rejection. It comes up every few months for me, having to whitelist someone. I think it's a result of every small- mid-size company moving to providers and not hosting their own email, and these providers having dozens of servers. The domain of the server never matches the domain of the sender...
commandersaki 1y ago
I used to host my own email until switching to Fastmail. I recall roundcube to be pretty much the best webmail offering back when I was hosting but also severely lacking two important features: 1. Fast search against mailbox folders/labels with say 100k+ messages. 2. Handling multiple aliases, both individual and catch-all, and being able to automatically respond with the correct alias if an email is received using one. Fastmail webmail handles the above two cases gracefully and its usually the benchmark I apply when evaluating other providers. My understanding is roundcube is severely lacking with search being IMAP SEARCH, and requiring you to enter multiple identities manually for each alias which doesn't permit catch-alls. But the real reason I stopped running my own mail is that I didn't trust myself with regular backups (even though I still do them via IMAP on occasion) and disaster recovery. I don't think anyone self-hosting really has this figured out.
- Bender 1y ago
  But the real reason I stopped running my own mail is that I didn't trust myself with regular backups (even though I still do them via IMAP on occasion) and disaster recovery. I don't think anyone self-hosting really has this figured out. On the server itself a cronjob calling rsnapshot [1] is a good habit in the event something gets corrupted or someone deletes mail by mistake and you want to save the day. RSnapshot uses hardlinks to avoid copying the same data to keep the size small which allows for many snapshots. Then a cronjob to call a script that uses either lftp+sftp+mirror or rsync to back up all the important things to a standby node along with a corresponding script on the standby node to quickly copy everything into place and start everything in an idempotent manor can get one back into operation quickly. All of this should be tested quarterly in the event some software update breaks any assumptions. If running this on VM's in a VPS provider there may be an option in the VPS control panel to swap IP addresses on the active and standby assuming they are in the same region. [1] - https://rsnapshot.org/rsnapshot/docs/docbook/rest.html https://rsnapshot.org/rsnapshot/docs/docbook/rest.html
  - commandersaki 1y ago
    Not that helpful if say your server has been attacked by ransomware. Happened to my friend that I was colo-ing with who was running a mailserver at the time. He didn't have proper backups and/or DR (though I think his thick mail client had a copy of most of his mail); he didn't pay and instead moved everything to Fastmail.
p0w3n3d 1y ago
My experience says quite the contrary: nowadays you have to be a mail giant to be able to send more than one mail. I.e. policy imposed by Gmail and M365 will keep you at bay from delivering the mail in more copies (e.g. to your subscribers), marking you as a potential spammer.
- Bender 1y ago
  This may be just cargo culting on my part but when I warm up a new IP for sending mail I first email my mail server from Google, then reply to myself. I do this a few times and then they accept my emails without issue provided I am not emailing many people all at once before the IP has good reputation.
- e12e 1y ago
  > will keep you at bay from delivering the mail in more copies (e.g. to your subscribers) Well, sad fact is that one person's exiting subscription email is another person's spam.
dboreham 1y ago
Actual situation: Self-hosting email is great, if you have plenty of free time to waste, and if you don't particularly care if your messages are delivered. One little thing the OP failed to mention is that even if you get a "lucky IP address" today, it can be randomly blocked (with no recourse) tomorrow by Google.
isaachinman 1y ago
Curious – for those self-hosting, what email _clients_ do you actually use on desktop/mobile?
- VladVladikoff 1y ago
  Personally apple mail. Thunderbird is also ok. Roundcube for webmail.
  - isaachinman 1y ago
    Thunderbird is an all-time legend.
- comrade1234 1y ago
  I use apple mail and iOS mail. At one point my wife was using whatever Microsoft's email/calendar/contacts app is called but she's long-switched to apple products. On the server I have sogo running so I also use iCal and the Mac and iOS contacts apps.
  - isaachinman 1y ago
    Are you happy with Apple/iOS Mail? Drives me absolutely insane.
    - comrade1234 1y ago
      Searching sucks but with Tahoe it has improved. It's funny - apples super old email client Cyberdog from the 90s had better search.
      - isaachinman 1y ago
        We built a cross-platform offline-first IMAP client: https://marcoapp.io https://marcoapp.io Search is single-digit ms. All metadata stored on the client. I built this over the course of a year, literally driven by my frustration with Apple Mail. Maybe give it a try! Edit: Also, extremely brave of you to upgrade to Tahoe. No chance for me
VladVladikoff 1y ago
There are actual reasons to self host that aren’t discussed here. 1) BEC filters. I run mail servers for several mid size companies that I am part owner of. We are constantly inundated by BEC scammers. But I now have filter lists that block it. You can’t email my staff using any manager or boss’s name and a e-mail that doesn’t match. It basically shuts down the whole BEC scam. I have one business still on Google apps, and we have now had two employees in that business get fooled by the scammers. 2) speed. Amazon AWS SES is great until you want to send 150,000 emails a day. At this point you’re running into issues with network transfer speeds for each request taking too much time, causing the full outbound send to take too long to complete.
littlecranky67 1y ago
"Microsoft 365 however apparently will hate your email no matter what. you learn to live with it" The entire thread is bullshit then, because you simply cannot learn to live without M365. M365 is one of the largest group of recipients, and especially in the business world (and business is where the money is). So I inbox my friends on GMail, but when I send my CV or an invoice to a business, my email is not received. How does that qualify as "self-hosting is easy and doable". The delusion is strong in this one.
xoa 1y ago
My biggest issue with hosted email for awhile was the disconnect that has developed between how most services now seem to bill and how over the now many decades (yeesh!) I've ended up using email. I have my own domains, on a technical level mailboxes ("accounts") are effectively free. So I've used them freely for separating usage (servers and services can all have their own accounts for emailing me notifications, I can use "accounting@mydomain.tld" for financial institutions, etc. For my own servers/services in particular it's good that they have their own isolated email accounts with their own passwords or keys and no ability to spam the world, only email me. It also makes it really easy to use white lists and ensure hard barriers and rules for important stuff so that even if an email address leaks it's irrelevant, and irrelevant in a deterministic manner. I still of course have general addresses that must accept traffic from the world and thus have to worry about spam, but a lot of the most key stuff where I never want to miss a message is from a pretty small circle. All the typical recommended services though tend to treat mailboxes as the same thing as a person, charging an entire new fee for every single one, and then have hacks like aliases or catch-alls on top. Obviously that works for most and if you're setting up a new workflow can go with that and use other mechanisms for notifications, but for me changing at this point would be brutal. Self-hosted + relay (Amazon SES) works ok though. That said, I've discovered two nice services (Migadu and MXroute, probably there are more out there somewhere) that charge along my own usage model. Migadu I think has been featured on HN before, and it seems solid. You can make arbitrary accounts under your domain as you wish, the charge is for storage and outgoing mail. So I'm now hybrid, and I could see that making me lazy enough to switch entirely. But I still think knowing how to do it yourself isn't a bad thing, there's some empowerment in having the fallback and remembering how it all works underneath. If nothing else as part of self-hosting you can run your own notifications through it.
anonymars 1y ago
"Ah, this is obviously some strange use of the word easy that I wasn't previously aware of"
dvfjsdhgfv 1y ago
With Microsoft you need to fill in a form first specifying your IP address and they will whitelist you, at least it used to work like that the last time I set up a new mail serer a few years ago.
- comrade1234 1y ago
  The only time I've had to do something like that is when I moved my server to a Colo and the previous owner of that ip address had sent spam and so that ip address was marked as a spammer. I had to go to several places to mark the address clean since there are multiple blacklists.
trilogic 1y ago
The thing about selfhosting email is that, Even after getting rated 10/10 in every mailchecker service and after a nearly 1 year service, Gmail still marks it as spam. So Gmail is basically the monopoly that undermines small startup business by marking their Email service as spam. But ofc this will happen because Europe allows it, making Europe lawmakers an inferior entity even to a private company.
- comrade1234 1y ago
  Is it from sending mass emails that look like spamming? I've never had a problem sending to Gmail but my personal server is only used by me and a few others for personal email.
  - trilogic 1y ago
    We communicate via email exclusively with our already users and clients which in 99% of the cases contact us first (from same gmail address that mark our service as a spam), we don't have time to spam which anyway will damage our reputation. The funny thing is that, All this happens mostly with traffic in our own continent in our own country (we are not even trying to get intercontinental clients)!
man8alexd 1y ago
I'm currently stuck with an awful hoster provider just because of IPs with a decade-old reputation.
crossroadsguy 1y ago
I setup dmarc and immediately had to drop ruf/rua tag from it. For a domain I barely use to send emails, others are sure trying a lot. I was getting too many/much reports and I could do nothing about those shady senders. So I chose to be not dmarc-spammed and set p=reject. Screw it. Also — I use a mail host provider and I would even think about hosting my mail from “scratch”. And I am never using my domain as a disposable address domain or email per service kinda way ever again. Hell, I might even disable catch-all. Then stick to disposable and privacy email providers like SimpleLogin for the rest.
anonymousiam 1y ago
I've hosted my own email for over 30 years. About five years ago I switched from integrating it all myself, to using "mail in a box": https://mailinabox.email/ https://mailinabox.email/ It's modern, secure, and easy to manage. It's free, but you are encouraged to donate.
akho 1y ago
There’s also https://gitlab.com/simple-nixos-mailserver/nixos-mailserver https://gitlab.com/simple-nixos-mailserver/nixos-mailserver , if you prefer to write not quite as much Nix yourself. MS365 (outlook, hotmail) bounced my emails for a while. Not “classified as spam”, but outright rejected, so you can’t even ask the person to un-spam you, add to contact list, &c. Luckily, very few people I know use those, and Gmail worked fine. MS365 also works now; I’m not sure what changed.

IP reputation is a gamble, and there is no recourse. If you're lucky, awesome. But if you're unlucky and switching host isn't an option, you pretty much have to involve a large third party to act your behalf - there is zero appetite in the industry for interacting with individuals. The best solution I've been able to find is to self-host /almost/ everything, but route outgoing mail through Amazon SES. The pricing for vanity email volumes is negligible (a few cents a year), and they have people whose full time job is wrangling IP reputation / Office 365 / etc. This setup has survived several ISP/hosting switches; at times when I am lucky with IP reputation I route only mail going to Office 365 recipients via SES and deliver the rest directly; at times when I am less lucky, everything goes via SES.

jeroenhd 1y ago
The whole IP reputation problem seems to mostly be a Google/Microsoft problem. Unfortunately, most of the world seems to use one of those two platforms. Routing mail to those two services via a third party seems like the wisest choice. May I ask how you implemented that?
- tsukikage 1y ago
  I use exim4. So after doing the usual SES setup, I can change the smarthost router to look like this: SMARTHOST_FOR_MS = email-smtp.us-east-2.amazonaws.com::587 smarthost: debug_print = "R: smarthost for $local_part@$domain" driver = manualroute domains = ! +local_domains transport = remote_smtp_smarthost route_list = hotmail.com SMARTHOST_FOR_MS byname ; \ live.com SMARTHOST_FOR_MS byname ; \ outlook.com SMARTHOST_FOR_MS byname ; \ msn.com SMARTHOST_FOR_MS byname ; \ live.co.uk SMARTHOST_FOR_MS byname ; \ hotmail.co.uk SMARTHOST_FOR_MS byname ; \ * DCsmarthost byname host_find_failed = defer same_domain_copy_routing = yes no_more If there was a much larger list of problem destinations I'd maybe do something nicer involving separate routers and a domainlist, but those cover all the cases that are broken right now.
  - e12e 1y ago
    How about custom domains hosted on m365?
    - tsukikage 1y ago
      Interestingly, I've not had a problem delivering directly to those (except the time I switched to an IP block with a bad rep and couldn't deliver anything anywhere directly at all); it's just the ones on the list above that don't like me. Mysterious and ineffable are the ways of Microsoft. (note that their MX record is usually a *.protection.outlook.com entry regardless of the custom domain, so I'd use that to bootstrap a rule if I had a more general problem with Microsoft)
  - jeroenhd 1y ago
    Excellent, thank you!
  - em-bee 1y ago
    how does that work with SPF, DMARC, DKIM? don't you have to authorize email-smtp.us-east-2.amazonaws.com to send email on your behalf? if you don't wouldn't every spammer use that? also, how much does that cost? i don't need to send more than a dozen email per year like that.
    - tsukikage 1y ago
      Yes, you do need to include:amazonses.com in your SPF. Amazon aren't too bad at kicking spammers off SES promptly. More importantly, Amazon doesn't sign for DKIM - your server still does that; so no-one else gets to DKIM for you; and you can set the DMARC policy to require both. SES currently charges $0.10 per 1000 outbound emails. The first 3000 mails are free. I received my first official bill for $0.02 after around two years of use. Do investigate other relay services. I only stopped at SES because I was in a mad rush and it was the first one I tried that did everything I needed, without bouncing or getting filed to trash on any services I cared about. I have done nothing like a full survey of the market, and there may well be a better option. It is the general approach I am suggesting, not trying to shill SES specifically despite what it may look like.
graemep 1y ago
You can usually switch host. Some have better IP reputations than others. There are quite a few other providers of email forwarding services, although I might look at SES myself if its that cheap as I have issues with hotmail (I seem to be OK with most mail to email on MS hosted email on other domains, oddly enough).
- tsukikage 1y ago
  > You can usually switch host ...it took OP 8 months of "rolling the gacha" and waiting to get a clean IP; no mention of costs. Not really a solution in my book. If you're willing to wait 8 months for working email, I put it to you you're actually using some other provider for your life and the thing you are playing with is a toy. I've been self-hosting my email for a pretty long time. I first started down the reputation rabbit hole when a provider decided to shut up shop after a decade of operation, causing me to lose my lovely fixed IP block with its decade-old clean rep. Waiting/playing around isn't really an option when your email is broken and you need it working /today/ because it's not a throwaway toy - your digital life is tied to it. Still, as I said at the start, if you get lucky, awesome for you.
  - Bender 1y ago
    If cost is not an issue one can run standby servers in multiple locations and have backups to all of them. Just as MX records allow for multiple inbound servers one can have multiple outbound servers as well. Park a few unused or vanity domains on them and have cronjobs send automated emails to yourself. I reply to those emails so the likes of Gmail see interaction between them. With time all IP addresses get good reputation.
    - tsukikage 1y ago
      An IP laundering service certainly sounds like a potential startup opportunity. Certainly I'd have paid for a proven good IP in the past before I developed my current solution.
      - 1y ago
xrisk 1y ago
Did switching your deliverer to SES have any effect on how clients like Gmail “tagged” your email? (Promotional category or something IIRC)
- tsukikage 1y ago
  Nope. The biggest impact on gmail was making sure I had DMARC, DKIM and SPF all set up correctly. (I tried several other relay services like mailgun and those /did/ have noticeable impact - SES was the first one I tried that didn't, so I stuck with it).
deleted 1y ago
[deleted]

kees99 1y ago

O365 and gmail should be honorably mentioned as places that will deliver both inbound and outbound to/from an IPv6-only MX. A lot other servers will not play ball here. Your self-hosted mail server, if it lacks IPv4, will not get inbound from mailgun, mailjet, github; neither will it be able to send outbound to cisco/iphmx, as well as about 90% of small servers from what I see in my logs.

JimDabell 1y ago

> i think the myth of "you can't self-host email" persists because while it can evidently be done, basically all of the software involved is ancient, baroque, inconsistently documented, requires a PhD in Bullshit to correctly configure, and is almost actively hostile to observation. but this is _annoying_, very different from _impossible_, and fortunately mostly solvable by delegating the annoying bits to an expert using something like NixOS to make it reliably work Why are they calling this a “myth” when they readily admit that even when you are an expert who has been doing it for years, there’s still problems sending to the biggest providers in the world? There is zero practical difference between “you need to be an expert and you will still fail to get something fundamental working” and “you can’t self-host email”. > Microsoft 365 however apparently will hate your email no matter what. you learn to live with it Or you don’t self-host but use a major email provider and don’t have the problem. > there exist several pieces of folk wisdom: > - "you cannot run your own mail server in 2025, this is too hard and time consuming" (completely false, i've done this since ~2010 with minimal ongoing maintenance) This seems completely true according to what they themselves write. It is too hard and time consuming. > I think the combo of "roll the IP gacha a few times" + "let it sit for 8 months while the VM idles" probably did me a lot of good here Is letting it sit for eight months not “time consuming”? > until I cleaned up my IP reputation (which has been awful for almost a decade) Gmail refused to deliver to anything but spam This is not in any way acceptable to the average person, and it does not meet what most people would describe as “I can self-host email”. “I can self-host email but Gmail sends me to spam” is functionally equivalent to “I cannot self-host email”.

1718627440 1y ago
> Or you don’t self-host but use a major email provider and don’t have the problem. Or you just use a mail relay as most VPS providers enforce anyway.
- pseudalopex 1y ago
  What VPS providers enforce a mail relay? Not DigitalOcean or Hetzner according to the author.

simonjgreen 1y ago

I am in favour of the middle ground. Rather than expending effort self hosting email, which while plausible is unequivocally a heavy lift for most, make use of smaller providers such as Fastmail or Protonmail. Just please stop consolidating the internet.

prein 1y ago
After using gmail for around a decade, I switched to fastmail a few months ago and have been extremely happy with the change. I still have a lot of accounts associated to my gmail email, but i've been slowly migrating things over when convenient. It has been a much smaller lift than I anticipated and absolutely worth it.
general1465 1y ago
I am also going with Protonmail, not because I can't setup my own server, but because I don't want to take care for yet another server, whose loss (be it by hacking or by my mistake) would be catastrophic for my whole digital life. I will rather pay to somebody else who know what they are doing.

comrade1234 1y ago

I've been running my own mail server with several domains for me, my now wife, and friends since 1999. It's definitely changed with time and gotten more strict with things like spf, dkim, dmarc, and reverse dns all becoming necessary over the years. But it's not that difficult to be honest. Currently my internet provider is init7 and they offer fixed ip4 and set the reverse dns for me which lets me run the server downstairs in the cellar instead of at a colo somewhere (which I was doing for maybe 15 years). Every now and then I look into moving to a paid service but we have GBs of mail since 1999 and it's just too costly when it's pretty much free for me to host it myself, even taking into account the time it takes for my effort, which is practically zero. Plus I use my server for a ton of other stuff so it will always exist so I may as well host email too.

VladVladikoff 1y ago
I’m surprised this works, usually residential IP blocks are in DNSBL.
- comrade1234 1y ago
  I have no problems with my current home ip address (here in Switzerland with the provider init7) but years ago (~20) when I moved my server to a Colo the ip address was marked as a spammer because of the previous owner of the address. It didn't take long to make the ip address clean though - some online processes and also sending some emails. This was so long ago I barely remember what I had to do and I'm sure the process is different now because back then you could contact an actual human...
comrade1234 1y ago
Wanted to add something... the biggest issue I've had in the last few years is having to whitelist senders to skip the temporary rejection (smtp 4xx code) process to reduce spam. Basically, someone new emails me and my server responds with a temporary rejection message saying to try again later and then when their server retries the message 5 minutes later it allows it to go through. This is a standard process to block spammers. However lately when their email service resends the message it will come from a different server. Something like mailserver-1, then mailserver-2, then mailserver-3, each with a different ip address and each time it gets rejected until it reuses one of the addresses. But with apple for example they have hundreds of servers to cycle through and eventually the message times out and is rejected at their end. So I have to whitelist senders to skip the temporary rejection. It comes up every few months for me, having to whitelist someone. I think it's a result of every small- mid-size company moving to providers and not hosting their own email, and these providers having dozens of servers. The domain of the server never matches the domain of the sender...

commandersaki 1y ago

I used to host my own email until switching to Fastmail. I recall roundcube to be pretty much the best webmail offering back when I was hosting but also severely lacking two important features: 1. Fast search against mailbox folders/labels with say 100k+ messages. 2. Handling multiple aliases, both individual and catch-all, and being able to automatically respond with the correct alias if an email is received using one. Fastmail webmail handles the above two cases gracefully and its usually the benchmark I apply when evaluating other providers. My understanding is roundcube is severely lacking with search being IMAP SEARCH, and requiring you to enter multiple identities manually for each alias which doesn't permit catch-alls. But the real reason I stopped running my own mail is that I didn't trust myself with regular backups (even though I still do them via IMAP on occasion) and disaster recovery. I don't think anyone self-hosting really has this figured out.

Bender 1y ago
But the real reason I stopped running my own mail is that I didn't trust myself with regular backups (even though I still do them via IMAP on occasion) and disaster recovery. I don't think anyone self-hosting really has this figured out. On the server itself a cronjob calling rsnapshot [1] is a good habit in the event something gets corrupted or someone deletes mail by mistake and you want to save the day. RSnapshot uses hardlinks to avoid copying the same data to keep the size small which allows for many snapshots. Then a cronjob to call a script that uses either lftp+sftp+mirror or rsync to back up all the important things to a standby node along with a corresponding script on the standby node to quickly copy everything into place and start everything in an idempotent manor can get one back into operation quickly. All of this should be tested quarterly in the event some software update breaks any assumptions. If running this on VM's in a VPS provider there may be an option in the VPS control panel to swap IP addresses on the active and standby assuming they are in the same region. [1] - https://rsnapshot.org/rsnapshot/docs/docbook/rest.html https://rsnapshot.org/rsnapshot/docs/docbook/rest.html
- commandersaki 1y ago
  Not that helpful if say your server has been attacked by ransomware. Happened to my friend that I was colo-ing with who was running a mailserver at the time. He didn't have proper backups and/or DR (though I think his thick mail client had a copy of most of his mail); he didn't pay and instead moved everything to Fastmail.

p0w3n3d 1y ago

My experience says quite the contrary: nowadays you have to be a mail giant to be able to send more than one mail. I.e. policy imposed by Gmail and M365 will keep you at bay from delivering the mail in more copies (e.g. to your subscribers), marking you as a potential spammer.

Bender 1y ago
This may be just cargo culting on my part but when I warm up a new IP for sending mail I first email my mail server from Google, then reply to myself. I do this a few times and then they accept my emails without issue provided I am not emailing many people all at once before the IP has good reputation.
e12e 1y ago
> will keep you at bay from delivering the mail in more copies (e.g. to your subscribers) Well, sad fact is that one person's exiting subscription email is another person's spam.

dboreham 1y ago

Actual situation: Self-hosting email is great, if you have plenty of free time to waste, and if you don't particularly care if your messages are delivered. One little thing the OP failed to mention is that even if you get a "lucky IP address" today, it can be randomly blocked (with no recourse) tomorrow by Google.

isaachinman 1y ago

Curious – for those self-hosting, what email _clients_ do you actually use on desktop/mobile?

VladVladikoff 1y ago
Personally apple mail. Thunderbird is also ok. Roundcube for webmail.
- isaachinman 1y ago
  Thunderbird is an all-time legend.
comrade1234 1y ago
I use apple mail and iOS mail. At one point my wife was using whatever Microsoft's email/calendar/contacts app is called but she's long-switched to apple products. On the server I have sogo running so I also use iCal and the Mac and iOS contacts apps.
- isaachinman 1y ago
  Are you happy with Apple/iOS Mail? Drives me absolutely insane.
  - comrade1234 1y ago
    Searching sucks but with Tahoe it has improved. It's funny - apples super old email client Cyberdog from the 90s had better search.
    - isaachinman 1y ago
      We built a cross-platform offline-first IMAP client: https://marcoapp.io https://marcoapp.io Search is single-digit ms. All metadata stored on the client. I built this over the course of a year, literally driven by my frustration with Apple Mail. Maybe give it a try! Edit: Also, extremely brave of you to upgrade to Tahoe. No chance for me

VladVladikoff 1y ago

There are actual reasons to self host that aren’t discussed here. 1) BEC filters. I run mail servers for several mid size companies that I am part owner of. We are constantly inundated by BEC scammers. But I now have filter lists that block it. You can’t email my staff using any manager or boss’s name and a e-mail that doesn’t match. It basically shuts down the whole BEC scam. I have one business still on Google apps, and we have now had two employees in that business get fooled by the scammers. 2) speed. Amazon AWS SES is great until you want to send 150,000 emails a day. At this point you’re running into issues with network transfer speeds for each request taking too much time, causing the full outbound send to take too long to complete.

littlecranky67 1y ago

"Microsoft 365 however apparently will hate your email no matter what. you learn to live with it" The entire thread is bullshit then, because you simply cannot learn to live without M365. M365 is one of the largest group of recipients, and especially in the business world (and business is where the money is). So I inbox my friends on GMail, but when I send my CV or an invoice to a business, my email is not received. How does that qualify as "self-hosting is easy and doable". The delusion is strong in this one.

xoa 1y ago

My biggest issue with hosted email for awhile was the disconnect that has developed between how most services now seem to bill and how over the now many decades (yeesh!) I've ended up using email. I have my own domains, on a technical level mailboxes ("accounts") are effectively free. So I've used them freely for separating usage (servers and services can all have their own accounts for emailing me notifications, I can use "accounting@mydomain.tld" for financial institutions, etc. For my own servers/services in particular it's good that they have their own isolated email accounts with their own passwords or keys and no ability to spam the world, only email me. It also makes it really easy to use white lists and ensure hard barriers and rules for important stuff so that even if an email address leaks it's irrelevant, and irrelevant in a deterministic manner. I still of course have general addresses that must accept traffic from the world and thus have to worry about spam, but a lot of the most key stuff where I never want to miss a message is from a pretty small circle. All the typical recommended services though tend to treat mailboxes as the same thing as a person, charging an entire new fee for every single one, and then have hacks like aliases or catch-alls on top. Obviously that works for most and if you're setting up a new workflow can go with that and use other mechanisms for notifications, but for me changing at this point would be brutal. Self-hosted + relay (Amazon SES) works ok though. That said, I've discovered two nice services (Migadu and MXroute, probably there are more out there somewhere) that charge along my own usage model. Migadu I think has been featured on HN before, and it seems solid. You can make arbitrary accounts under your domain as you wish, the charge is for storage and outgoing mail. So I'm now hybrid, and I could see that making me lazy enough to switch entirely. But I still think knowing how to do it yourself isn't a bad thing, there's some empowerment in having the fallback and remembering how it all works underneath. If nothing else as part of self-hosting you can run your own notifications through it.

anonymars 1y ago

"Ah, this is obviously some strange use of the word easy that I wasn't previously aware of"

dvfjsdhgfv 1y ago

With Microsoft you need to fill in a form first specifying your IP address and they will whitelist you, at least it used to work like that the last time I set up a new mail serer a few years ago.

comrade1234 1y ago
The only time I've had to do something like that is when I moved my server to a Colo and the previous owner of that ip address had sent spam and so that ip address was marked as a spammer. I had to go to several places to mark the address clean since there are multiple blacklists.

trilogic 1y ago

The thing about selfhosting email is that, Even after getting rated 10/10 in every mailchecker service and after a nearly 1 year service, Gmail still marks it as spam. So Gmail is basically the monopoly that undermines small startup business by marking their Email service as spam. But ofc this will happen because Europe allows it, making Europe lawmakers an inferior entity even to a private company.

comrade1234 1y ago
Is it from sending mass emails that look like spamming? I've never had a problem sending to Gmail but my personal server is only used by me and a few others for personal email.
- trilogic 1y ago
  We communicate via email exclusively with our already users and clients which in 99% of the cases contact us first (from same gmail address that mark our service as a spam), we don't have time to spam which anyway will damage our reputation. The funny thing is that, All this happens mostly with traffic in our own continent in our own country (we are not even trying to get intercontinental clients)!

man8alexd 1y ago

I'm currently stuck with an awful hoster provider just because of IPs with a decade-old reputation.

crossroadsguy 1y ago

I setup dmarc and immediately had to drop ruf/rua tag from it. For a domain I barely use to send emails, others are sure trying a lot. I was getting too many/much reports and I could do nothing about those shady senders. So I chose to be not dmarc-spammed and set p=reject. Screw it. Also — I use a mail host provider and I would even think about hosting my mail from “scratch”. And I am never using my domain as a disposable address domain or email per service kinda way ever again. Hell, I might even disable catch-all. Then stick to disposable and privacy email providers like SimpleLogin for the rest.

anonymousiam 1y ago

I've hosted my own email for over 30 years. About five years ago I switched from integrating it all myself, to using "mail in a box": https://mailinabox.email/ https://mailinabox.email/ It's modern, secure, and easy to manage. It's free, but you are encouraged to donate.

akho 1y ago

There’s also https://gitlab.com/simple-nixos-mailserver/nixos-mailserver https://gitlab.com/simple-nixos-mailserver/nixos-mailserver , if you prefer to write not quite as much Nix yourself. MS365 (outlook, hotmail) bounced my emails for a while. Not “classified as spam”, but outright rejected, so you can’t even ask the person to un-spam you, add to contact list, &c. Luckily, very few people I know use those, and Gmail worked fine. MS365 also works now; I’m not sure what changed.