15 ms·

Self-hosting email like it's 1984

269 points by xmx98 1y ago

iwontberude 1y ago
[flagged]
- johann8384 1y ago
  Isn't that what DMARC is for?
  - iwontberude 1y ago
    DMARC is for setting policy to authenticate email which ends up becoming a requirement to even send mail to other providers, amongst an evolving set of policies which may cause your emails to be silently undelivered.
- andai 1y ago
  There was a blog posted to HN years ago describing a self hosted email setup in detail, and this was indeed the main issue. Everyone he emails is on a small number of big companies, and most of them don't like his server. Edit: "After self-hosting my email for twenty-three years I have thrown in the towel" https://news.ycombinator.com/item?id=32715437 https://news.ycombinator.com/item?id=32715437 https://cfenollosa.com/blog/after-self-hosting-my-email-for-twenty-three-years-i-have-thrown-in-the-towel-the-oligopoly-has-won.html https://cfenollosa.com/blog/after-self-hosting-my-email-for-...
  - nickdothutton 1y ago
    I remember reading this and being enraged for all of us.
- xmx98 1y ago
  I do wonder about reliability. The only things I'm missing are the PTR record and reputation from what I gathered. Even if the mail server goes down, mail gets to me because email providers attempt to deliver again. Anyway, I added a disclaimer at the top, so people don't treat this as a production ready setup.
- deadlyllama 1y ago
  I went back to self hosting when Google were going to kill free Gmail for your domain. I have no problems with deliberability. And I have tiny mail volumes. Pre Gmail I was on Exim. Now I'm on Postfix. I used the 123qwe.com tutorial as a starting point. The real problems are (1) family members just want Gmail and (2) I have to maintain an email system.
- sosborn 1y ago
  It's addressed in the article: > The elephant in the room is real-world deliverability. With self-hosting you risk not receiving mail or someone missing your mail. I accept this for my personal projects, but you may not. Keep this in mind.
  - singpolyma3 1y ago
    I've never heard of "not receiving" as a problem. Does that happen in the real world? In what cases?
  - em3rgent0rdr 1y ago
    Not self-hosting if you actually need email does not address the elephant that self-hosting email doesn't actually do email. I say this as someone who self-hosted for several years but had to give up because important emails were discarded. Until the deliverability issue is actually addressed, self-hosting is not viable for email.
    - technothrasher 1y ago
      I’ve been self hosting my email for thirty years. I don’t have any more deliverability issues than I do at work using a major provider. It is entirely viable.
- sam_lowry_ 1y ago
  I self-hosted for well over 20 years, I did not throw the towel and I do not plan to. Self-hosting is a sign of pride. Neither my government nor my Prime Minister nor even my Ministry of Interior or Foreign Ministry can host their own email. Last time I checked, only State Security self-hosted. I was probably lucky, but I rarely had delivery problems. The last one was a couple years ago with Microsoft swallowing my emails and it was due to the combination of a fairly old exim and a TLS certificate verification quirk at *.protection.outlook.com. I found a fix in the form of a configuration option somewhere on SO. In all fairness, there is very little maintenance involved, and whenever I have to do maintenance work, I take the opportunity to learn something new. Like this year, I decided to finally replace my aging Debian jessie setup by Arch Linux, and I rewrote all cron jobs as systemd timers. I must admit that when I send a really important email, I check the mail server log if it went off without errors, but this does not bother me as checking logs manually once in a while is a good thing anyway. Lastly, a piece of advice: treat self-hosting like a hobby and learn to enjoy it. Oh and the very last thing: the person who designed Exim configuration for Debian deserves a special place in hell for all the hours wasted. If you set up Exim on Debian, just figure out how to use the upstream exim config and adapt it to your needs.
  - pseudalopex 1y ago
    > Neither my government nor my Prime Minister nor even my Ministry of Interior or Foreign Ministry can host their own email. Can or wish to?
    - sam_lowry_ 1y ago
      From what I know, it's worse. They are afraid of IT departments owning their infrastructure. They'd rather have a US-based megacorp handle IT because it shield politicians from craftsmen and their realisation of power.
  - 1over137 1y ago
    The Canadian government too. They let Microsoft do it. A company headquartered in a country threatening to annex Canada, and known to collaborate with their spy agencies.
- rootnod3 1y ago
  One problem in this are bad actors. German Telecom for example (t-online.de) only accepts mails from servers it whitelists. To get whitelisted you have to apply with them and your domain HAS to have a website with an Impressum, your clear legal name AND an email that is NOT your domain for emergency contact. It is insane. If every provider would act like that, email would die in a month.
  - hmng 1y ago
    Ironic that a big telecom does not believe in decentralized protocols. Oh wait….
  - throwzasdf 1y ago
    [dead]
- hmng 1y ago
  My first email usage was at University, pre-WWW. After that I briefly used some ISP email service, but that was on a time of very limited storage and POP only accounts, so I started hosting my own email even before having an always-on internet connection, using a relay and dynamic DNS to receive email when online. Now a days, I use a small VPS to route and receive email, but final destination and storage is on my home server. Over the years, I had, like others here, to ask Outlook and other providers to unblock my IP or domain, but it has been rare. I really don’t want to live in a world where only two or three companies run email for the entire world, and this is my little act of resistance.
- throwzasdf 1y ago
  [dead]
abdullahkhalids 1y ago
Here is my advice to anyone wanting to test out self-hosting email. Start by using your self-hosted email to sign-up for accounts. You don't have to use the email address for your personal correspondence Use Mail-in-a-box to get started [1]. You can literally set it up in a couple of hours by following the instructions and everything should just work. After a few years, you can think about switching your personal correspondence to your new email. [1] https://mailinabox.email./ https://mailinabox.email./
- bonzog 1y ago
  I've been running MIAB for a few years now with generally good success as an outgoing sender using a rented cloud machine and a "clean" reputation IP. I've had to email the Microsoft postmaster on one occasion when my emails weren't reaching Outlook users, but they were surprisingly helpful and it's been working fine for years now. It's a good learning exercise in setting up stuff like DKIM/SPF/DMARC. That said - receiving account sign-up emails is the absolute biggest pain in the backside with Mailinabox! The greylisting anti-spam feature relies on bouncing unknown senders and waiting for a retry. The trouble is, many legit sites just don't bother retrying. So email verification for new accounts and 2FA-type stuff often takes ages to come through, if at all. MIAB stubbornly has no easy, mail user-facing way to temporarily disable spam filtering and it's a real PITA at times.
  - abdullahkhalids 1y ago
    Oh! That's what it is. I just thought some websites just took longer to send an email to my unknown domain. I see that the only way to disable greylisting is to configure the underlying tool [1]. But it also means that SPAM will increase a lot. [1] https://discourse.mailinabox.email/t/how-to-turn-off-edit-grelisting/4984?u=s4_hosting https://discourse.mailinabox.email/t/how-to-turn-off-edit-gr...
    - behringer 1y ago
      It's better to whitelist the domains you'll be getting mfa from.
the_gipsy 1y ago
What about mail servers generally rejecting email (or marking as spam) from residential IP ranges? Decades of malware sending spam has spoiled self hosting emails. I needed some minimal mail delivery for user registration confirmation and password recovery, and I finally caved and just use some free service. It's okay since those emails are really, really, sparse in my case. But it sucks that email, this one old and open technology, is not realistically self-hostable.
- renehsz 1y ago
  Yeah, hosting on or at least tunneling through a commercial IP address is definitely required in order not to be flagged as spam. Personally, I chose the latter option of hosting my MTA at home but tunneling its traffic through a VPS in a datacenter. It's been working pretty well ever since, although I'm not sure it's worth the effort versus just using a cheap hosted provider.
  - the_gipsy 1y ago
    Is it some kind of free VPS?
    - layer8 1y ago
      VPS are generally paid, but it's only $5 or less a month.
man8alexd 1y ago
Where is UUCP? Why are addresses not bang paths? Where is sendmail.cf?
- munchlax 1y ago
  Right. You better not self-host like it's 1984 because that would also mean you're an open relay. And vulnerable for pretty much anything you can think of.
  - xmx98 1y ago
    This config doesn’t make an open relay.
    - man8alexd 1y ago
      A typical config from 1984 is an open relay and vulnerable to the Morris Worm.
    - rascul 1y ago
      This config wasn't available in 1984.
- ajross 1y ago
  Ditto. I was sorely disappointed to click through "1984" to find a subheading on "setting up postfix".
- hmng 1y ago
  Those wore the days :-) I remember playing on a University lab with half a dozen Unix workstations, sending an email with the path of server1!server2!server3 etc and hearing the email flowing from server to server by the noise of the disks!
- reaperducer 1y ago
  Why are addresses not bang paths? That's what I thought of when I saw the title, too. Where are my ...killer!jolet! people at?
boplicity 1y ago
Modern email providers, especially ones offered by ISPs often have the same problems that people criticize self-hosted providers for. Even Google has problems. For example, I regularly order via companies that use Shopify. Now, all of the shopify emails are going straight to spam in Gmail, despite constantly marking them as not spam. (These even pass dmarc/spf/dkim etc, so who knows what's going on here.) Email delivery and receiving is not hard, but it's inevitably going to be imperfect, no matter the provider you use. There are so many bad actors out there, it's surprising that it works as well as it does.
- singpolyma3 1y ago
  That behaviour is the whole problem. If you use a self hosted or small time email provider you're much less likely to have email blocked or filtered by aggressive anti-not-gmail filters. Hilarious Gmail addresses send tonnes of spam so filtering by provider doesn't do much there days anyway. But Google insists to continue
- dataflow 1y ago
  > These even pass dmarc/spf/dkim etc, so who knows what's going on here. Those have nothing to do with being spam, right? Spam is about content, those are about authenticity. Anybody can send authentic trash, or unauthenticated gold.
  - mzhaase 1y ago
    Your spam score goes up without DKIM or SPF.
    - dataflow 1y ago
      Sure but that's just because spammers don't tend to authenticate their email. But that obviously doesn't mean they get to send spam if they do.
- pembrook 1y ago
  Bizarrely, I also find Gmail's spam algo is actually oversensitive to marketing emails from companies these days, which I never thought was something I would complain about. But like you said its super annoying when I actually want the emails. Seems like we had the opposite problem 10ish years ago. But now the pendulum has swung a bit too far in the other direction. Ultimately most of the spam I get these days is actually from individuals doing low volume cold outreach from personal email addresses...not companies sending bulk. The new gmail unsubscribe feature works great for marketing emails but is worthless against cold email spam -- which somehow rarely ever lands in spam.
bhaak 1y ago
I haven’t read the article and I am to afraid to open the link in case they are using sendmail.
- hk1337 1y ago
  How long are you going to keep the cat in the box?
  - hmng 1y ago
    Spoiler alert, it’s Postfix. So not really 1984 software. But then again, neither is Linux…
    - xmx98 1y ago
      But the experience of using mailx is close to that time, hence the title. Even though I’m too young to know for sure :)
    - man8alexd 1y ago
      Almost everything described in the article didn't exist in 1984. Postfix, OpenDKIM, TLS, SPF, DKIM, DMARC. Only very basic SMTP and DNS, but even MX records didn't exist.
      - 1over137 1y ago
        OpenDKIM seems dead: https://github.com/trusteddomainproject/OpenDKIM/issues/236 https://github.com/trusteddomainproject/OpenDKIM/issues/236
627467 1y ago
Say I want to test the waters for selfhosting email, and I already have my how domains setup with SaaS like Google workspace and equivalent. Is there a way to setup mx records so that both google and my own server gets email for a while? This would be useful to test the waters over a few months before fully migrating
- hmng 1y ago
  Not really, SMTP relays will only send messages once, to one server. But it’s not receiving that is the problem, that is generally fine, if ports are open at ISP / network level. It is the sending that is often tricky. Sending email on the other hand can be done from multiple servers (if SPF correctly configured) And nothing prevents you from sending email directly from your own relay. You could try that, and reception would not be affected.
- habibur 1y ago
  Configure google to forward mails to your self hosted server. When replying reply from your self hosted server. That way you can gradually shift over. I had been self hosting like this for years.
- man8alexd 1y ago
  You can set up a lower-priority MX to point to Google, so if your server fails, then email is delivered to Google. But if your server is misconfigured and returns permanent 5xx errors for legitimate emails, then it won't work, and the emails won't be delivered to Google.
- nzeid 1y ago
  No easy answer here. Individual MTAs or a cluster of them typically live under one unique domain. In your scenario, you'd have to point your existing records (or just MX) to your self-hosted instance, and have your self-hosted instance relay/autoforward to Gmail under a different domain. This might entail simply setting your Gmail back to @gmail.com.
- dizhn 1y ago
  Not with MX but, look at google's split domain documentation. You can either have them handle the domain and forward you a copy, or you can have your own domain be the primary and forward to google. I have been using the latter for a few years now since not all of the users in the domain are using Google Workspace. They have a special address for forwarding to so you don't get into a loop. It has been working flawlessly for us.
lifty 1y ago
Not sure why someone would go through the pain of cobbling up a self hosted solution based on Postfix when you have fully integrated solutions like https://stalw.art/ https://stalw.art/, which are a breeze to setup.
- behringer 1y ago
  Because postfix is foss, will work with everything and for all time and if there's a problem with it you'll actually be able to fix it.
  - lifty 1y ago
    I thought Stalwart’s license, AGPL is foss.
    - ptman 1y ago
      Stalwart does have limits that postfix doesn't though. https://stalw.art/compare/ https://stalw.art/compare/
- throwzasdf 1y ago
  [dead]
- drnick1 1y ago
  Postfix has been around for decades and respects the Unix philosophy of doing one thing and doing it well. It's perhaps the most widely deployed MTA, and as such it has been thoroughly field tested. Also, people in the FOSS community tend to be wary of "open source" projects primarily developed by a commercial company under dual licensing.
  - 6ak74rfy 1y ago
    As for your second paragraph - I am more worried about the project being maintained by more or less a single person.
- 1y ago
billfor 1y ago
Assuming this is not hosted on your home system, since ISPs may block the ports and also most of the dynamic ips allocated are blacklisted, the issue with postfix is that its difficult to have a single set and forget config if you intend to use it on multiple internal machines, like for getting your root email on each system to one mailbox. Ideally you want a single main.cf for all your internal machines and for the outgoing/incoming mailhost to be determined solely by your mx or internal dns alias, but this is next to impossible with a single postfix config without getting mail loops on the system that is the mailhost. Exim and sendmail at least separate out the submit config from the rest of the configuration. Also you would be insane to try this without fail2ban or something similar. Postfix does a reasonable job of handling attackers but it does so quietly -- so you may not see the activity.
johnea 1y ago
Actually, full strength virtual (multi-domain) email hosting is also quite doable. This is a great guide that's been used and updated for many years: https://www.purplehat.org/?page_id=1450 https://www.purplehat.org/?page_id=1450 Once hosting email for yourself, you may want to add new project-specific domains, or host email for friends and family. The database user accounts actually make it easier to add and remove users after the system is up and running. This Purplehat guide provides a step by step procedure that's allowed many people and orgs to bring self-hosted email online...
sam_lowry_ 1y ago
(had to dug my comment from under a flagged parent) I self-hosted for well over 20 years, I did not throw the towel and I do not plan to. Self-hosting is a sign of pride. Neither my government nor my Prime Minister nor even my Ministry of Interior or Foreign Ministry can host their own email. Last time I checked, only State Security self-hosted. I was probably lucky, but I rarely had delivery problems. The last one was a couple years ago with Microsoft swallowing my emails and it was due to the combination of a fairly old exim and a TLS certificate verification quirk at *.protection.outlook.com. I found a fix in the form of a configuration option somewhere on SO. In all fairness, there is very little maintenance involved, and whenever I have to do maintenance work, I take the opportunity to learn something new. Like this year, I decided to finally replace my aging Debian jessie setup by Arch Linux, and I rewrote all cron jobs as systemd timers. I must admit that when I send a really important email, I check the mail server log if it went off without errors, but this does not bother me as checking logs manually once in a while is a good thing anyway. Lastly, a piece of advice: treat self-hosting like a hobby and learn to enjoy it. Oh and the very last thing: the person who designed Exim configuration for Debian deserves a special place in hell for all the hours wasted. If you set up Exim on Debian, just figure out how to use the upstream exim config and adapt it to your needs.
- Xenoamorphous 1y ago
  > I decided to finally replace my aging Debian jessie setup by Arch Linux, and I rewrote all cron jobs as systemd timers. Man, I wish I had 1% of the motivation I had 20 years ago to do something like this, before all the full time job, wife and child.
  - xandrius 1y ago
    Stuff to keep you busy is always there, you can control what you spend the rest of the time on.
  - rmoriz 1y ago
    Don’t hurt me: Agentic coding tools like Claude Code or opencode helped me a lot to convert things to systemd units.
stebalien 1y ago
I used to do this. What finally killed it wasn't reputation, it was the fact that I needed 100% uptime or risk losing messages, getting my address blacklisted, etc. Email is supposed to be resilient to down time (retries, trying each MX record, etc.) but I found that large mail providers tend to just bounce and walk away. Worse, GitHub (back in 2016 and 2018) would mark a recipient as "unavailable" after a single bounce, refusing to send any more notifications to that address. They since improved the situation and their support was actually very helpful and responsive here, but it's pretty clear that modern SMTP senders have an expectation that recipients will be "always online" that didn't exist when the protocol was invented.
- logifail 1y ago
  > it was the fact that I needed 100% uptime or risk losing messages Q: If your server(s) is/are offline for a few hours, why would you "lose messages"? I've just checked my own email server -> "up 219 days" Honestly, compared with the stuff we do all day, this is not hard...
  - toast0 1y ago
    > Q: If your server(s) is/are offline for a few hours, why would you "lose messages"? They said... >> Email is supposed to be resilient to down time (retries, trying each MX record, etc.) but I found that large mail providers tend to just bounce and walk away. I take that to mean that if your server isn't availble to receive the mail at the time it is first offered, it won't be retried later. That wasn't the case (for most mail) when I gave up on self hosting 10 years ago, but it's plausible.
    - Krei-se 1y ago
      It's not reasonable. Mail not deliverable is not the same as house burned down, recipient moved unknown or sth, it simply means the letter was not received. Who and why messed up is unknown, thus NO mail server will mark you down after a single attempt. Host your own!!
pjmlp 1y ago
More like 1994 thereabouts, in 1984 most of us would be very lucky to have a dial up connection to the local BBS, under local phone call price rates.
- donio 1y ago
  Not even that, Postfix didn't exist in 1994. This is a 2025 mail server setup and about as vanilla as it gets.
- ralferoo 1y ago
  I first started maintaining a nail server in 1997. Most of the stuff in the article is newer than that. For 1984, I'd have expected UUCP and bang paths to peer mail hosts. Instead the article starts off by setting up DKIM, from over 2 decades later!
rascul 1y ago
What's the "like it's 1984" part?
- deleted 1y ago
  [deleted]
- reaperducer 1y ago
  What's the "like it's 1984" part? Maybe there's a sleep() command in there so that it takes six days to send an e-mail from upstate New York to Sweden? Because I can tell you that's how long it took in 1984.
- buttocks 1y ago
  I was hoping he’d set up Citadel! Email system and an 80s bbs platform in one. citadel.org
kinotoko 1y ago
For anyone interested in getting a mail server, I can really recommend Michael W. Lucas' Run Your Own Mail Server
pluc 1y ago
Ars wrote a pretty good series about self-hosting emails back in (gasp!) 2014: https://arstechnica.com/information-technology/2014/02/how-to-run-your-own-e-mail-server-with-your-own-domain-part-1/ https://arstechnica.com/information-technology/2014/02/how-t...
clueless 1y ago
in terms of a good self hosted email client, in this day and age, I'm looking for great AI integration. I.e. are there good open source projects that come packaged with a locally hosted LLM integration?
andai 1y ago
There was a blog posted to HN years ago describing a self hosted email setup in detail, and this was indeed the main issue. Everyone he emails is on a small number of big companies, and most of them don't like his server. "After self-hosting my email for twenty-three years I have thrown in the towel" https://news.ycombinator.com/item?id=32715437 https://news.ycombinator.com/item?id=32715437 https://cfenollosa.com/blog/after-self-hosting-my-email-for-twenty-three-years-i-have-thrown-in-the-towel-the-oligopoly-has-won.html https://cfenollosa.com/blog/after-self-hosting-my-email-for-...
supz_k 1y ago
Self Plug-in: We are currently beta testing Hyvor Relay [0], a self-hosted alternative for sending emails. We are focusing more on observability (monitoring DKIM/SPF, periodically querying DNSBLs) and DNS automation. A simple docker compose up can get a reasonably working setup [1] [0]https://github.com/hyvor/relay https://github.com/hyvor/relay [1]https://relay.hyvor.com/hosting/deploy-easy https://relay.hyvor.com/hosting/deploy-easy
Krei-se 1y ago
I have a writeup in german about self-hosting current and with debian trixie on https://krei.se/Doc https://krei.se/Doc If you do it yourself and do it correct it's a pleasure. I have automatic updates with automatic reboot, tailored systemd to make sure all is well and status reports per mail - total bliss, easy 2-3 years, with trixie now even 5 until you have to touch it again. It's mature software. Host yourself! The peace of mind and control is totally worth it.
drnick1 1y ago
I think the following is a better guide for someone looking for a complete setup that includes an IMAP server and that can be used with regular email clients like Thunderbird: https://workaround.org/ispmail-bookworm/ https://workaround.org/ispmail-bookworm/ I set up my own server more or less following the above guide, but eschewed the database in favor of plain text files. I wanted to keep things simple since I am the only user, but the above guide should scale to big enterprise setups.
- jeduardo 1y ago
  I also use this guide, but I switched it to PostgreSQL instead. The recent upgrade to Trixie brought a new Dovecot with breaking changes to its configuration. That was a bit of a pain to resolve, but everything is working fine now.
justahuman74 1y ago
What do people do about PTR records on residential addresses?
- drnick1 1y ago
  I don't think a PTR record is strictly necessary for good deliverability. In fact, I regularly receive emails from IPs with nonexistent or mistmatched PTR records.
  - man8alexd 1y ago
    A lot of small self-hosted SMTP servers bounce on missing PTR records. It is easy to configure and it filters out a lot of spam.
1-6 1y ago
I'm interested in doing something like this and connecting it to an AI agent. My autoreply to spam could either an unsubscribe or ignore.
- rmoriz 1y ago
  Don‘t. Learn about backscatter
talkingtab 1y ago
I personally believe it is worth exploring the idea of a different email realm for communities. The concept is pretty simple. Don't accept email from gmail, microsoft, hotmail or any other non-community member. Community members don't spam, don't send email in bulk and have reputation. It is funded by pay-per-transgression. If you are a community member and someone receives unwanted email your reputation suffers. If you are gmail, et al you have to pay for each email sent & received. Someone once wrote (let me know if you know the source) that users are not the customer, because they don't pay. It is advertisers who are the real email customers. This has resulted in a business model where users are prey animals. This is upside down and probably cannot be fixed without a hard fork. I don't mean this is a good idea, or implementation. But I think it is a good direction.
1vuio0pswjnm7 1y ago
IMHO, there are two components to "email" that do not necessarily need to be connected 1. receving mail 2. sending mail Only #2 became difficult Internet subscribers receive lots of email to which they never reply Sometimes "throwaway" disposable email addresses are useful^1 Various third parties offer this as a "service", i.e., #1 is disconnected from #2 Self-hosting #1 can provide an alternative to using third parties Generally, the only cost is a domain name registration 1. Also HN commenters have complained in the past that email sent via self-hosted SMTP to certain recipients, e.g., Gmail recpients, may end up stored on certain undesirable third party servers. This is because the recpient uses a third party for both #1 and #2, a so-called "email provider"
- man8alexd 1y ago
  You missed filtering spam in #1.
- 1vuio0pswjnm7 1y ago
  When "throwaway" addresses are used this is sometimes to manage receipt of unsolicted commercial email ("SPAM") But this is not the only purpose for which these disposble addresses may be used
unit149 1y ago
[dead]
spkm 1y ago
I've been selfhosting for like dunno 10-15 years. Cheap kimsufi box, opensmtp, dovecot, later then rspamd, done. Never really had a problem. At one point telekom.de blocked my mailserver. I contacted them via postmaster@telekom.de (or something) explaining that while kimsufix boxes are notorious for shady stuff, this is actually a legit mailserver and they whitelisted me shortly after (yeah I was surprised too how smooth that went). So, yeah, can't confirm all the troubles everyone seems to get on about. However I do own the kimsufi box (and the corresponding IP) for a long time now, so maybe I'm just lucky.
dugite-code 1y ago
I've been self-hosting my email for over 10 years now (I'm going to link a bunch of my old comments on old email HN threads). I have fallen back to using Amazon's SES to send because all of Digital Ocean's IP blocks suddenly got marked as bad and I don't have enough volume to improve a new IP reputation - https://news.ycombinator.com/item?id=39891262 https://news.ycombinator.com/item?id=39891262, https://news.ycombinator.com/item?id=38471262 https://news.ycombinator.com/item?id=38471262 I use Gmail as a free spam harvester to train my own spam filter - https://news.ycombinator.com/item?id=38843288 https://news.ycombinator.com/item?id=38843288. But as others here have suggested greylisting is extremely helpful in this space as legitimate servers should always retry. Well only my power company is the exception and they will fall back to sending paper bills, but even Gmail falls foul for them. It's also one big reason I'm not worried about up to a week downtime. But I have two email servers, a receiving and a storage server, the receiving is cattle and I car re-deploy in minutes if needed. - https://news.ycombinator.com/item?id=38512732 https://news.ycombinator.com/item?id=38512732 On greylisting I would say using https://github.com/stevejenkins/postwhite https://github.com/stevejenkins/postwhite (even if it's very old and not actively maintained) has proven very important for the annoying 2FA emails, I strongly contend that email isn't suitable for this use case but that's another conversation)
- privatelypublic 1y ago
  Long winded admission that you might as well pay for google's email service.
  - immibis 1y ago
    And use it only for important things that won't be delivered if you don't send them from Google. Receive only (e.g. account signup)? Use your own account. Not important anyway? Use your own account. Your recipient needs the email more than you? Use your own account. None of the above? Use a mainstream provider for that email only.
    - dugite-code 1y ago
      But this is why I'm using Amazon's SES for sending my very low volume emails now. It's never been blocked, if they ever start causing me grief I can switch to a new email relay service in a matter of minutes if necessary.
BikiniPrince 1y ago
I at least maintain administrative control while using free resources. I looked at the completely self hosted route a long time ago and didn’t want to deal with that. Fast forward to today and I’m dealing with a friend who has the polar opposite. Now their mental faculties are reduced and they lost devices. Couple this with not paying previous management entities and it’s a digital lock out. Recovering from this is a nightmare and I’m operating blind. For a normie this would be impossible.
- zrail 1y ago
  First, sorry for you and your friend. Mental decline is terrifying and I can only imagine how difficult it is to deal with like that. Could you say more about what your friend did differently than you and what makes it so difficult? Are/were they self hosting but don't remember how it all works?
qingcharles 1y ago
How big a deal is reverse DNS for this and anything else in 2025? I've not created any PTR records for anything for about 20 years now...
- rmoriz 1y ago
  No deal, even possible for ipv6 easily with eg Hetzner, Vultr
  - qingcharles 1y ago
    Thank you. I'm hosting all my boxes with Hetzner. The option is right there and I never knew. Might as well add it.
- man8alexd 1y ago
  Ironically, self-hosted mail servers are more likely to bounce incoming mail from someone without a proper PTR than the big mail service providers.
lutusp 1y ago
> "If something isn't working for you, please double-check your DNS records, and triple-check that TLS certificates are readable by the Postfix user, and that DKIM keys are readable by the OpenDKIM user. Postfix and OpenDKIM logs will also be useful. The OpenDKIM config file is especially unforgiving of typos, so watch out for small mistakes!" I tried this over a period of years, aggressively changing my email server configuration as new challenges appeared, before realizing the basic problems were (a) a server's configuration is a moving target that requires constant revision, and (b) if your ISP has ever hosted a spammer, even briefly and inadvertently, then its entire address block may be universally blacklisted and you have to change ISPs, possibly several times. So ... I gave up. If I had nothing better to do, if I just wanted to play email server whack-a-mole, that would be different, but I have a life apart from pleading with giant email recipients to trust my little server. It's not as though Google, Microsoft, et al. have an incentive to trust small email servers -- quite the opposite. They can -- and do -- make the argument that they shouldn't trust anything but another big player like themselves.
stevenjgarner 1y ago
https://www.postfix-tutorial.com/ https://www.postfix-tutorial.com/
defanor 1y ago
FWIW, some of the things I configure differently: - More of anti-UCE, with postscreen (greylisting, DNSBL and DNSWL checks), policyd-spf, body_checks, check_sender_access, check_client_access, postscreen_access_list. - Setting "home_mailbox = Maildir/", to keep mail in user directories and in the Maildir format (which seems to be less prone to corruption than mbox is, and well-supported by MUAs). - Leaving TLS defaults, except for the paths. I used to set mandatory TLS, but then ran into some servers not using it, and figured that I do not trust the involved servers more than channels between them anyway (especially the servers that do not support TLS). Being overly strict with allowed protocol versions (or even ciphers) also reduces compatibility, while for encryption it is better to rely on OpenPGP. - I do set Dovecot (for both IMAP and SMTP submission); the recent configuration change did not seem like a big deal to me, and it was documented, so I found it easy to update. It is nice to be able to use email from a server (and that ability does not go away with Dovecot), but a local MUA also has its advantages. - Registered at dnswl.org, to improve deliverability in some cases.
crossroadsguy 1y ago
Where do people self-host these emails? When email self-hosting is talked about, my thoughts wander to Fastmail, Migadu, etcetera (I use one like these), but I quickly realise that's not it. On those lines, I do not believe these mail self-hosting folks are talking about some VPS, or server from some provider, or even AWS, et al., either — not self-hosting enough. It must be a computer/server always running at their home/basement/or so (with whatever power/Internet backup setup they have—or maybe not, as they might find it acceptable if something was missed/dropped). So is it that? And if that's what it is, then what is that mail self-hosting home setup of yours? What all have you got there? Just curious, I doubt I can go through that, as my patience gives in even trying to set up a VPS for a seedbox when it is time for the first maintenance/tweak.
- Gud 1y ago
  I have a VPS at Hetzner. I pay 4 euro per month. It's inside a FreeBSD jail for separation. Keeping FreeBSD up to date is extremely simple. run pkg update && pkg upgrade. It rarely breaks. Can't remember it ever breaking. The main reason I prefer FreeBSD over Linux distros are the far superior package managers(pkg for binaries and ports for source code). I also host my own web server using nginx, and sometimes other stuff. All in separate jails. Back when I was a kid, I used to have my own servers.
- vachina 1y ago
  I host it at home.
- man8alexd 1y ago
  The problem with self-hosting is finding an IP with an clean reputation and not on any block lists, with good neighbours (people sometimes block /24), with an open outgoing port 25. Then you'll need to slowly warm up this IP for weeks or months.
aborsy 1y ago
If you host your email on a VPS, you might as well let an email provider manage it all for you. In both cases, a company has access to your emails. What you have achieved is doing the dirty job of administration for the company, while not getting the privacy benefits of self hosting. If you host it at home, can you endure uptime?
- 7bit 1y ago
  This argument is absurd. You have a trust relationship with your VPS provider. Yes, they can access it, if they want to. The difference is that with a VPS you have contractual privacy and with e.g. Gmail they outright tell you that they scan your emails. So it is a big difference. With everything, it's question of budget and what risks you accept.
xvilka 1y ago
There's a way better solution for self hosted email these days - Stalwart[1]. Supports all necessary protocols and extensions, including modern JMAP. And, of course, it's memory safe, unlike Postfix and friends. [1] https://github.com/stalwartlabs/stalwart https://github.com/stalwartlabs/stalwart
mrighele 1y ago
I would love to be able to self-host like it was 2025, and with that I mean giving a piece of software the api token to my DNS api, a database, a list of domains and having it figure everything out (certificates, MX records, DKIM etc.) by itself. It should not be impossible.
- realaaa 1y ago
  you can do SmarterMail for 1 domain for free - they are quite good, one of few decent remaining mail systems out there (of course it's commercial for business use)
illusive4080 1y ago
I’ve been running Mailcow for 5+ years. After getting over initial reputation issues, it’s been smooth sailing.
atoav 1y ago
Mailcow is pretty good actually. Setup on a virtual hetzner server took me half an hour, as it is a pretty simple docker container. What took a little longer was migrating my mails over, and setting all the needed DNS records (SPF and the likes). I had a small blacklisting issue in the beginning that could be resolved within 24 hours, since then it works flawlessly.
mustaphah 1y ago
Great post! Just wanted to add that DMARC isn't really about the DKIM signature itself; it's about whether the domain in RFC5322.From aligns with either SPF or DKIM. So if SPF is aligned, DMARC will pass even if DKIM fails.
realaaa 1y ago
ha ha indeed I wish it was like 1984 ! most of this extra stuff was not a concern back then :) > Notes from setting up a truly minimal self-hosted email server with Postfix and OpenDKIM. Covers TLS, SPF, DKIM, DMARC, DNS, reverse DNS, multiple domains, and delivering to Gmail. great article and discussion nevertheless, awesome to see people still doing it

269 points by xmx98 1y ago

iwontberude 1y ago

[flagged]

johann8384 1y ago
Isn't that what DMARC is for?
- iwontberude 1y ago
  DMARC is for setting policy to authenticate email which ends up becoming a requirement to even send mail to other providers, amongst an evolving set of policies which may cause your emails to be silently undelivered.
andai 1y ago
There was a blog posted to HN years ago describing a self hosted email setup in detail, and this was indeed the main issue. Everyone he emails is on a small number of big companies, and most of them don't like his server. Edit: "After self-hosting my email for twenty-three years I have thrown in the towel" https://news.ycombinator.com/item?id=32715437 https://news.ycombinator.com/item?id=32715437 https://cfenollosa.com/blog/after-self-hosting-my-email-for-twenty-three-years-i-have-thrown-in-the-towel-the-oligopoly-has-won.html https://cfenollosa.com/blog/after-self-hosting-my-email-for-...
- nickdothutton 1y ago
  I remember reading this and being enraged for all of us.
xmx98 1y ago
I do wonder about reliability. The only things I'm missing are the PTR record and reputation from what I gathered. Even if the mail server goes down, mail gets to me because email providers attempt to deliver again. Anyway, I added a disclaimer at the top, so people don't treat this as a production ready setup.
deadlyllama 1y ago
I went back to self hosting when Google were going to kill free Gmail for your domain. I have no problems with deliberability. And I have tiny mail volumes. Pre Gmail I was on Exim. Now I'm on Postfix. I used the 123qwe.com tutorial as a starting point. The real problems are (1) family members just want Gmail and (2) I have to maintain an email system.
sosborn 1y ago
It's addressed in the article: > The elephant in the room is real-world deliverability. With self-hosting you risk not receiving mail or someone missing your mail. I accept this for my personal projects, but you may not. Keep this in mind.
- singpolyma3 1y ago
  I've never heard of "not receiving" as a problem. Does that happen in the real world? In what cases?
- em3rgent0rdr 1y ago
  Not self-hosting if you actually need email does not address the elephant that self-hosting email doesn't actually do email. I say this as someone who self-hosted for several years but had to give up because important emails were discarded. Until the deliverability issue is actually addressed, self-hosting is not viable for email.
  - technothrasher 1y ago
    I’ve been self hosting my email for thirty years. I don’t have any more deliverability issues than I do at work using a major provider. It is entirely viable.
sam_lowry_ 1y ago
I self-hosted for well over 20 years, I did not throw the towel and I do not plan to. Self-hosting is a sign of pride. Neither my government nor my Prime Minister nor even my Ministry of Interior or Foreign Ministry can host their own email. Last time I checked, only State Security self-hosted. I was probably lucky, but I rarely had delivery problems. The last one was a couple years ago with Microsoft swallowing my emails and it was due to the combination of a fairly old exim and a TLS certificate verification quirk at *.protection.outlook.com. I found a fix in the form of a configuration option somewhere on SO. In all fairness, there is very little maintenance involved, and whenever I have to do maintenance work, I take the opportunity to learn something new. Like this year, I decided to finally replace my aging Debian jessie setup by Arch Linux, and I rewrote all cron jobs as systemd timers. I must admit that when I send a really important email, I check the mail server log if it went off without errors, but this does not bother me as checking logs manually once in a while is a good thing anyway. Lastly, a piece of advice: treat self-hosting like a hobby and learn to enjoy it. Oh and the very last thing: the person who designed Exim configuration for Debian deserves a special place in hell for all the hours wasted. If you set up Exim on Debian, just figure out how to use the upstream exim config and adapt it to your needs.
- pseudalopex 1y ago
  > Neither my government nor my Prime Minister nor even my Ministry of Interior or Foreign Ministry can host their own email. Can or wish to?
  - sam_lowry_ 1y ago
    From what I know, it's worse. They are afraid of IT departments owning their infrastructure. They'd rather have a US-based megacorp handle IT because it shield politicians from craftsmen and their realisation of power.
- 1over137 1y ago
  The Canadian government too. They let Microsoft do it. A company headquartered in a country threatening to annex Canada, and known to collaborate with their spy agencies.
rootnod3 1y ago
One problem in this are bad actors. German Telecom for example (t-online.de) only accepts mails from servers it whitelists. To get whitelisted you have to apply with them and your domain HAS to have a website with an Impressum, your clear legal name AND an email that is NOT your domain for emergency contact. It is insane. If every provider would act like that, email would die in a month.
- hmng 1y ago
  Ironic that a big telecom does not believe in decentralized protocols. Oh wait….
- throwzasdf 1y ago
  [dead]
hmng 1y ago
My first email usage was at University, pre-WWW. After that I briefly used some ISP email service, but that was on a time of very limited storage and POP only accounts, so I started hosting my own email even before having an always-on internet connection, using a relay and dynamic DNS to receive email when online. Now a days, I use a small VPS to route and receive email, but final destination and storage is on my home server. Over the years, I had, like others here, to ask Outlook and other providers to unblock my IP or domain, but it has been rare. I really don’t want to live in a world where only two or three companies run email for the entire world, and this is my little act of resistance.
throwzasdf 1y ago
[dead]

abdullahkhalids 1y ago

Here is my advice to anyone wanting to test out self-hosting email. Start by using your self-hosted email to sign-up for accounts. You don't have to use the email address for your personal correspondence Use Mail-in-a-box to get started [1]. You can literally set it up in a couple of hours by following the instructions and everything should just work. After a few years, you can think about switching your personal correspondence to your new email. [1] https://mailinabox.email./ https://mailinabox.email./

bonzog 1y ago
I've been running MIAB for a few years now with generally good success as an outgoing sender using a rented cloud machine and a "clean" reputation IP. I've had to email the Microsoft postmaster on one occasion when my emails weren't reaching Outlook users, but they were surprisingly helpful and it's been working fine for years now. It's a good learning exercise in setting up stuff like DKIM/SPF/DMARC. That said - receiving account sign-up emails is the absolute biggest pain in the backside with Mailinabox! The greylisting anti-spam feature relies on bouncing unknown senders and waiting for a retry. The trouble is, many legit sites just don't bother retrying. So email verification for new accounts and 2FA-type stuff often takes ages to come through, if at all. MIAB stubbornly has no easy, mail user-facing way to temporarily disable spam filtering and it's a real PITA at times.
- abdullahkhalids 1y ago
  Oh! That's what it is. I just thought some websites just took longer to send an email to my unknown domain. I see that the only way to disable greylisting is to configure the underlying tool [1]. But it also means that SPAM will increase a lot. [1] https://discourse.mailinabox.email/t/how-to-turn-off-edit-grelisting/4984?u=s4_hosting https://discourse.mailinabox.email/t/how-to-turn-off-edit-gr...
  - behringer 1y ago
    It's better to whitelist the domains you'll be getting mfa from.

the_gipsy 1y ago

What about mail servers generally rejecting email (or marking as spam) from residential IP ranges? Decades of malware sending spam has spoiled self hosting emails. I needed some minimal mail delivery for user registration confirmation and password recovery, and I finally caved and just use some free service. It's okay since those emails are really, really, sparse in my case. But it sucks that email, this one old and open technology, is not realistically self-hostable.

renehsz 1y ago
Yeah, hosting on or at least tunneling through a commercial IP address is definitely required in order not to be flagged as spam. Personally, I chose the latter option of hosting my MTA at home but tunneling its traffic through a VPS in a datacenter. It's been working pretty well ever since, although I'm not sure it's worth the effort versus just using a cheap hosted provider.
- the_gipsy 1y ago
  Is it some kind of free VPS?
  - layer8 1y ago
    VPS are generally paid, but it's only $5 or less a month.

man8alexd 1y ago

Where is UUCP? Why are addresses not bang paths? Where is sendmail.cf?

munchlax 1y ago
Right. You better not self-host like it's 1984 because that would also mean you're an open relay. And vulnerable for pretty much anything you can think of.
- xmx98 1y ago
  This config doesn’t make an open relay.
  - man8alexd 1y ago
    A typical config from 1984 is an open relay and vulnerable to the Morris Worm.
  - rascul 1y ago
    This config wasn't available in 1984.
ajross 1y ago
Ditto. I was sorely disappointed to click through "1984" to find a subheading on "setting up postfix".
hmng 1y ago
Those wore the days :-) I remember playing on a University lab with half a dozen Unix workstations, sending an email with the path of server1!server2!server3 etc and hearing the email flowing from server to server by the noise of the disks!
reaperducer 1y ago
Why are addresses not bang paths? That's what I thought of when I saw the title, too. Where are my ...killer!jolet! people at?

boplicity 1y ago

Modern email providers, especially ones offered by ISPs often have the same problems that people criticize self-hosted providers for. Even Google has problems. For example, I regularly order via companies that use Shopify. Now, all of the shopify emails are going straight to spam in Gmail, despite constantly marking them as not spam. (These even pass dmarc/spf/dkim etc, so who knows what's going on here.) Email delivery and receiving is not hard, but it's inevitably going to be imperfect, no matter the provider you use. There are so many bad actors out there, it's surprising that it works as well as it does.

singpolyma3 1y ago
That behaviour is the whole problem. If you use a self hosted or small time email provider you're much less likely to have email blocked or filtered by aggressive anti-not-gmail filters. Hilarious Gmail addresses send tonnes of spam so filtering by provider doesn't do much there days anyway. But Google insists to continue
dataflow 1y ago
> These even pass dmarc/spf/dkim etc, so who knows what's going on here. Those have nothing to do with being spam, right? Spam is about content, those are about authenticity. Anybody can send authentic trash, or unauthenticated gold.
- mzhaase 1y ago
  Your spam score goes up without DKIM or SPF.
  - dataflow 1y ago
    Sure but that's just because spammers don't tend to authenticate their email. But that obviously doesn't mean they get to send spam if they do.
pembrook 1y ago
Bizarrely, I also find Gmail's spam algo is actually oversensitive to marketing emails from companies these days, which I never thought was something I would complain about. But like you said its super annoying when I actually want the emails. Seems like we had the opposite problem 10ish years ago. But now the pendulum has swung a bit too far in the other direction. Ultimately most of the spam I get these days is actually from individuals doing low volume cold outreach from personal email addresses...not companies sending bulk. The new gmail unsubscribe feature works great for marketing emails but is worthless against cold email spam -- which somehow rarely ever lands in spam.

bhaak 1y ago

I haven’t read the article and I am to afraid to open the link in case they are using sendmail.

hk1337 1y ago
How long are you going to keep the cat in the box?
- hmng 1y ago
  Spoiler alert, it’s Postfix. So not really 1984 software. But then again, neither is Linux…
  - xmx98 1y ago
    But the experience of using mailx is close to that time, hence the title. Even though I’m too young to know for sure :)
  - man8alexd 1y ago
    Almost everything described in the article didn't exist in 1984. Postfix, OpenDKIM, TLS, SPF, DKIM, DMARC. Only very basic SMTP and DNS, but even MX records didn't exist.
    - 1over137 1y ago
      OpenDKIM seems dead: https://github.com/trusteddomainproject/OpenDKIM/issues/236 https://github.com/trusteddomainproject/OpenDKIM/issues/236

627467 1y ago

Say I want to test the waters for selfhosting email, and I already have my how domains setup with SaaS like Google workspace and equivalent. Is there a way to setup mx records so that both google and my own server gets email for a while? This would be useful to test the waters over a few months before fully migrating

hmng 1y ago
Not really, SMTP relays will only send messages once, to one server. But it’s not receiving that is the problem, that is generally fine, if ports are open at ISP / network level. It is the sending that is often tricky. Sending email on the other hand can be done from multiple servers (if SPF correctly configured) And nothing prevents you from sending email directly from your own relay. You could try that, and reception would not be affected.
habibur 1y ago
Configure google to forward mails to your self hosted server. When replying reply from your self hosted server. That way you can gradually shift over. I had been self hosting like this for years.
man8alexd 1y ago
You can set up a lower-priority MX to point to Google, so if your server fails, then email is delivered to Google. But if your server is misconfigured and returns permanent 5xx errors for legitimate emails, then it won't work, and the emails won't be delivered to Google.
nzeid 1y ago
No easy answer here. Individual MTAs or a cluster of them typically live under one unique domain. In your scenario, you'd have to point your existing records (or just MX) to your self-hosted instance, and have your self-hosted instance relay/autoforward to Gmail under a different domain. This might entail simply setting your Gmail back to @gmail.com.
dizhn 1y ago
Not with MX but, look at google's split domain documentation. You can either have them handle the domain and forward you a copy, or you can have your own domain be the primary and forward to google. I have been using the latter for a few years now since not all of the users in the domain are using Google Workspace. They have a special address for forwarding to so you don't get into a loop. It has been working flawlessly for us.

lifty 1y ago

Not sure why someone would go through the pain of cobbling up a self hosted solution based on Postfix when you have fully integrated solutions like https://stalw.art/ https://stalw.art/, which are a breeze to setup.

behringer 1y ago
Because postfix is foss, will work with everything and for all time and if there's a problem with it you'll actually be able to fix it.
- lifty 1y ago
  I thought Stalwart’s license, AGPL is foss.
  - ptman 1y ago
    Stalwart does have limits that postfix doesn't though. https://stalw.art/compare/ https://stalw.art/compare/
throwzasdf 1y ago
[dead]
drnick1 1y ago
Postfix has been around for decades and respects the Unix philosophy of doing one thing and doing it well. It's perhaps the most widely deployed MTA, and as such it has been thoroughly field tested. Also, people in the FOSS community tend to be wary of "open source" projects primarily developed by a commercial company under dual licensing.
- 6ak74rfy 1y ago
  As for your second paragraph - I am more worried about the project being maintained by more or less a single person.
1y ago

billfor 1y ago

Assuming this is not hosted on your home system, since ISPs may block the ports and also most of the dynamic ips allocated are blacklisted, the issue with postfix is that its difficult to have a single set and forget config if you intend to use it on multiple internal machines, like for getting your root email on each system to one mailbox. Ideally you want a single main.cf for all your internal machines and for the outgoing/incoming mailhost to be determined solely by your mx or internal dns alias, but this is next to impossible with a single postfix config without getting mail loops on the system that is the mailhost. Exim and sendmail at least separate out the submit config from the rest of the configuration. Also you would be insane to try this without fail2ban or something similar. Postfix does a reasonable job of handling attackers but it does so quietly -- so you may not see the activity.

johnea 1y ago

Actually, full strength virtual (multi-domain) email hosting is also quite doable. This is a great guide that's been used and updated for many years: https://www.purplehat.org/?page_id=1450 https://www.purplehat.org/?page_id=1450 Once hosting email for yourself, you may want to add new project-specific domains, or host email for friends and family. The database user accounts actually make it easier to add and remove users after the system is up and running. This Purplehat guide provides a step by step procedure that's allowed many people and orgs to bring self-hosted email online...

sam_lowry_ 1y ago

(had to dug my comment from under a flagged parent) I self-hosted for well over 20 years, I did not throw the towel and I do not plan to. Self-hosting is a sign of pride. Neither my government nor my Prime Minister nor even my Ministry of Interior or Foreign Ministry can host their own email. Last time I checked, only State Security self-hosted. I was probably lucky, but I rarely had delivery problems. The last one was a couple years ago with Microsoft swallowing my emails and it was due to the combination of a fairly old exim and a TLS certificate verification quirk at *.protection.outlook.com. I found a fix in the form of a configuration option somewhere on SO. In all fairness, there is very little maintenance involved, and whenever I have to do maintenance work, I take the opportunity to learn something new. Like this year, I decided to finally replace my aging Debian jessie setup by Arch Linux, and I rewrote all cron jobs as systemd timers. I must admit that when I send a really important email, I check the mail server log if it went off without errors, but this does not bother me as checking logs manually once in a while is a good thing anyway. Lastly, a piece of advice: treat self-hosting like a hobby and learn to enjoy it. Oh and the very last thing: the person who designed Exim configuration for Debian deserves a special place in hell for all the hours wasted. If you set up Exim on Debian, just figure out how to use the upstream exim config and adapt it to your needs.

Xenoamorphous 1y ago
> I decided to finally replace my aging Debian jessie setup by Arch Linux, and I rewrote all cron jobs as systemd timers. Man, I wish I had 1% of the motivation I had 20 years ago to do something like this, before all the full time job, wife and child.
- xandrius 1y ago
  Stuff to keep you busy is always there, you can control what you spend the rest of the time on.
- rmoriz 1y ago
  Don’t hurt me: Agentic coding tools like Claude Code or opencode helped me a lot to convert things to systemd units.

stebalien 1y ago

I used to do this. What finally killed it wasn't reputation, it was the fact that I needed 100% uptime or risk losing messages, getting my address blacklisted, etc. Email is supposed to be resilient to down time (retries, trying each MX record, etc.) but I found that large mail providers tend to just bounce and walk away. Worse, GitHub (back in 2016 and 2018) would mark a recipient as "unavailable" after a single bounce, refusing to send any more notifications to that address. They since improved the situation and their support was actually very helpful and responsive here, but it's pretty clear that modern SMTP senders have an expectation that recipients will be "always online" that didn't exist when the protocol was invented.

logifail 1y ago
> it was the fact that I needed 100% uptime or risk losing messages Q: If your server(s) is/are offline for a few hours, why would you "lose messages"? I've just checked my own email server -> "up 219 days" Honestly, compared with the stuff we do all day, this is not hard...
- toast0 1y ago
  > Q: If your server(s) is/are offline for a few hours, why would you "lose messages"? They said... >> Email is supposed to be resilient to down time (retries, trying each MX record, etc.) but I found that large mail providers tend to just bounce and walk away. I take that to mean that if your server isn't availble to receive the mail at the time it is first offered, it won't be retried later. That wasn't the case (for most mail) when I gave up on self hosting 10 years ago, but it's plausible.
  - Krei-se 1y ago
    It's not reasonable. Mail not deliverable is not the same as house burned down, recipient moved unknown or sth, it simply means the letter was not received. Who and why messed up is unknown, thus NO mail server will mark you down after a single attempt. Host your own!!

pjmlp 1y ago

More like 1994 thereabouts, in 1984 most of us would be very lucky to have a dial up connection to the local BBS, under local phone call price rates.

donio 1y ago
Not even that, Postfix didn't exist in 1994. This is a 2025 mail server setup and about as vanilla as it gets.
ralferoo 1y ago
I first started maintaining a nail server in 1997. Most of the stuff in the article is newer than that. For 1984, I'd have expected UUCP and bang paths to peer mail hosts. Instead the article starts off by setting up DKIM, from over 2 decades later!

rascul 1y ago

What's the "like it's 1984" part?

deleted 1y ago
[deleted]
reaperducer 1y ago
What's the "like it's 1984" part? Maybe there's a sleep() command in there so that it takes six days to send an e-mail from upstate New York to Sweden? Because I can tell you that's how long it took in 1984.
buttocks 1y ago
I was hoping he’d set up Citadel! Email system and an 80s bbs platform in one. citadel.org

kinotoko 1y ago

For anyone interested in getting a mail server, I can really recommend Michael W. Lucas' Run Your Own Mail Server

pluc 1y ago

Ars wrote a pretty good series about self-hosting emails back in (gasp!) 2014: https://arstechnica.com/information-technology/2014/02/how-to-run-your-own-e-mail-server-with-your-own-domain-part-1/ https://arstechnica.com/information-technology/2014/02/how-t...

clueless 1y ago

in terms of a good self hosted email client, in this day and age, I'm looking for great AI integration. I.e. are there good open source projects that come packaged with a locally hosted LLM integration?

andai 1y ago

There was a blog posted to HN years ago describing a self hosted email setup in detail, and this was indeed the main issue. Everyone he emails is on a small number of big companies, and most of them don't like his server. "After self-hosting my email for twenty-three years I have thrown in the towel" https://news.ycombinator.com/item?id=32715437 https://news.ycombinator.com/item?id=32715437 https://cfenollosa.com/blog/after-self-hosting-my-email-for-twenty-three-years-i-have-thrown-in-the-towel-the-oligopoly-has-won.html https://cfenollosa.com/blog/after-self-hosting-my-email-for-...

supz_k 1y ago

Self Plug-in: We are currently beta testing Hyvor Relay [0], a self-hosted alternative for sending emails. We are focusing more on observability (monitoring DKIM/SPF, periodically querying DNSBLs) and DNS automation. A simple docker compose up can get a reasonably working setup [1] [0]https://github.com/hyvor/relay https://github.com/hyvor/relay [1]https://relay.hyvor.com/hosting/deploy-easy https://relay.hyvor.com/hosting/deploy-easy

Krei-se 1y ago

I have a writeup in german about self-hosting current and with debian trixie on https://krei.se/Doc https://krei.se/Doc If you do it yourself and do it correct it's a pleasure. I have automatic updates with automatic reboot, tailored systemd to make sure all is well and status reports per mail - total bliss, easy 2-3 years, with trixie now even 5 until you have to touch it again. It's mature software. Host yourself! The peace of mind and control is totally worth it.

drnick1 1y ago

I think the following is a better guide for someone looking for a complete setup that includes an IMAP server and that can be used with regular email clients like Thunderbird: https://workaround.org/ispmail-bookworm/ https://workaround.org/ispmail-bookworm/ I set up my own server more or less following the above guide, but eschewed the database in favor of plain text files. I wanted to keep things simple since I am the only user, but the above guide should scale to big enterprise setups.

jeduardo 1y ago
I also use this guide, but I switched it to PostgreSQL instead. The recent upgrade to Trixie brought a new Dovecot with breaking changes to its configuration. That was a bit of a pain to resolve, but everything is working fine now.

justahuman74 1y ago

What do people do about PTR records on residential addresses?

drnick1 1y ago
I don't think a PTR record is strictly necessary for good deliverability. In fact, I regularly receive emails from IPs with nonexistent or mistmatched PTR records.
- man8alexd 1y ago
  A lot of small self-hosted SMTP servers bounce on missing PTR records. It is easy to configure and it filters out a lot of spam.

1-6 1y ago

I'm interested in doing something like this and connecting it to an AI agent. My autoreply to spam could either an unsubscribe or ignore.

rmoriz 1y ago
Don‘t. Learn about backscatter

talkingtab 1y ago

I personally believe it is worth exploring the idea of a different email realm for communities. The concept is pretty simple. Don't accept email from gmail, microsoft, hotmail or any other non-community member. Community members don't spam, don't send email in bulk and have reputation. It is funded by pay-per-transgression. If you are a community member and someone receives unwanted email your reputation suffers. If you are gmail, et al you have to pay for each email sent & received. Someone once wrote (let me know if you know the source) that users are not the customer, because they don't pay. It is advertisers who are the real email customers. This has resulted in a business model where users are prey animals. This is upside down and probably cannot be fixed without a hard fork. I don't mean this is a good idea, or implementation. But I think it is a good direction.

1vuio0pswjnm7 1y ago

IMHO, there are two components to "email" that do not necessarily need to be connected 1. receving mail 2. sending mail Only #2 became difficult Internet subscribers receive lots of email to which they never reply Sometimes "throwaway" disposable email addresses are useful^1 Various third parties offer this as a "service", i.e., #1 is disconnected from #2 Self-hosting #1 can provide an alternative to using third parties Generally, the only cost is a domain name registration 1. Also HN commenters have complained in the past that email sent via self-hosted SMTP to certain recipients, e.g., Gmail recpients, may end up stored on certain undesirable third party servers. This is because the recpient uses a third party for both #1 and #2, a so-called "email provider"

man8alexd 1y ago
You missed filtering spam in #1.
1vuio0pswjnm7 1y ago
When "throwaway" addresses are used this is sometimes to manage receipt of unsolicted commercial email ("SPAM") But this is not the only purpose for which these disposble addresses may be used

unit149 1y ago

[dead]

spkm 1y ago

I've been selfhosting for like dunno 10-15 years. Cheap kimsufi box, opensmtp, dovecot, later then rspamd, done. Never really had a problem. At one point telekom.de blocked my mailserver. I contacted them via postmaster@telekom.de (or something) explaining that while kimsufix boxes are notorious for shady stuff, this is actually a legit mailserver and they whitelisted me shortly after (yeah I was surprised too how smooth that went). So, yeah, can't confirm all the troubles everyone seems to get on about. However I do own the kimsufi box (and the corresponding IP) for a long time now, so maybe I'm just lucky.

dugite-code 1y ago

I've been self-hosting my email for over 10 years now (I'm going to link a bunch of my old comments on old email HN threads). I have fallen back to using Amazon's SES to send because all of Digital Ocean's IP blocks suddenly got marked as bad and I don't have enough volume to improve a new IP reputation - https://news.ycombinator.com/item?id=39891262 https://news.ycombinator.com/item?id=39891262, https://news.ycombinator.com/item?id=38471262 https://news.ycombinator.com/item?id=38471262 I use Gmail as a free spam harvester to train my own spam filter - https://news.ycombinator.com/item?id=38843288 https://news.ycombinator.com/item?id=38843288. But as others here have suggested greylisting is extremely helpful in this space as legitimate servers should always retry. Well only my power company is the exception and they will fall back to sending paper bills, but even Gmail falls foul for them. It's also one big reason I'm not worried about up to a week downtime. But I have two email servers, a receiving and a storage server, the receiving is cattle and I car re-deploy in minutes if needed. - https://news.ycombinator.com/item?id=38512732 https://news.ycombinator.com/item?id=38512732 On greylisting I would say using https://github.com/stevejenkins/postwhite https://github.com/stevejenkins/postwhite (even if it's very old and not actively maintained) has proven very important for the annoying 2FA emails, I strongly contend that email isn't suitable for this use case but that's another conversation)

privatelypublic 1y ago
Long winded admission that you might as well pay for google's email service.
- immibis 1y ago
  And use it only for important things that won't be delivered if you don't send them from Google. Receive only (e.g. account signup)? Use your own account. Not important anyway? Use your own account. Your recipient needs the email more than you? Use your own account. None of the above? Use a mainstream provider for that email only.
  - dugite-code 1y ago
    But this is why I'm using Amazon's SES for sending my very low volume emails now. It's never been blocked, if they ever start causing me grief I can switch to a new email relay service in a matter of minutes if necessary.

BikiniPrince 1y ago

I at least maintain administrative control while using free resources. I looked at the completely self hosted route a long time ago and didn’t want to deal with that. Fast forward to today and I’m dealing with a friend who has the polar opposite. Now their mental faculties are reduced and they lost devices. Couple this with not paying previous management entities and it’s a digital lock out. Recovering from this is a nightmare and I’m operating blind. For a normie this would be impossible.

zrail 1y ago
First, sorry for you and your friend. Mental decline is terrifying and I can only imagine how difficult it is to deal with like that. Could you say more about what your friend did differently than you and what makes it so difficult? Are/were they self hosting but don't remember how it all works?

qingcharles 1y ago

How big a deal is reverse DNS for this and anything else in 2025? I've not created any PTR records for anything for about 20 years now...

rmoriz 1y ago
No deal, even possible for ipv6 easily with eg Hetzner, Vultr
- qingcharles 1y ago
  Thank you. I'm hosting all my boxes with Hetzner. The option is right there and I never knew. Might as well add it.
man8alexd 1y ago
Ironically, self-hosted mail servers are more likely to bounce incoming mail from someone without a proper PTR than the big mail service providers.

lutusp 1y ago

> "If something isn't working for you, please double-check your DNS records, and triple-check that TLS certificates are readable by the Postfix user, and that DKIM keys are readable by the OpenDKIM user. Postfix and OpenDKIM logs will also be useful. The OpenDKIM config file is especially unforgiving of typos, so watch out for small mistakes!" I tried this over a period of years, aggressively changing my email server configuration as new challenges appeared, before realizing the basic problems were (a) a server's configuration is a moving target that requires constant revision, and (b) if your ISP has ever hosted a spammer, even briefly and inadvertently, then its entire address block may be universally blacklisted and you have to change ISPs, possibly several times. So ... I gave up. If I had nothing better to do, if I just wanted to play email server whack-a-mole, that would be different, but I have a life apart from pleading with giant email recipients to trust my little server. It's not as though Google, Microsoft, et al. have an incentive to trust small email servers -- quite the opposite. They can -- and do -- make the argument that they shouldn't trust anything but another big player like themselves.

stevenjgarner 1y ago

https://www.postfix-tutorial.com/ https://www.postfix-tutorial.com/

defanor 1y ago

FWIW, some of the things I configure differently: - More of anti-UCE, with postscreen (greylisting, DNSBL and DNSWL checks), policyd-spf, body_checks, check_sender_access, check_client_access, postscreen_access_list. - Setting "home_mailbox = Maildir/", to keep mail in user directories and in the Maildir format (which seems to be less prone to corruption than mbox is, and well-supported by MUAs). - Leaving TLS defaults, except for the paths. I used to set mandatory TLS, but then ran into some servers not using it, and figured that I do not trust the involved servers more than channels between them anyway (especially the servers that do not support TLS). Being overly strict with allowed protocol versions (or even ciphers) also reduces compatibility, while for encryption it is better to rely on OpenPGP. - I do set Dovecot (for both IMAP and SMTP submission); the recent configuration change did not seem like a big deal to me, and it was documented, so I found it easy to update. It is nice to be able to use email from a server (and that ability does not go away with Dovecot), but a local MUA also has its advantages. - Registered at dnswl.org, to improve deliverability in some cases.

crossroadsguy 1y ago

Where do people self-host these emails? When email self-hosting is talked about, my thoughts wander to Fastmail, Migadu, etcetera (I use one like these), but I quickly realise that's not it. On those lines, I do not believe these mail self-hosting folks are talking about some VPS, or server from some provider, or even AWS, et al., either — not self-hosting enough. It must be a computer/server always running at their home/basement/or so (with whatever power/Internet backup setup they have—or maybe not, as they might find it acceptable if something was missed/dropped). So is it that? And if that's what it is, then what is that mail self-hosting home setup of yours? What all have you got there? Just curious, I doubt I can go through that, as my patience gives in even trying to set up a VPS for a seedbox when it is time for the first maintenance/tweak.

Gud 1y ago
I have a VPS at Hetzner. I pay 4 euro per month. It's inside a FreeBSD jail for separation. Keeping FreeBSD up to date is extremely simple. run pkg update && pkg upgrade. It rarely breaks. Can't remember it ever breaking. The main reason I prefer FreeBSD over Linux distros are the far superior package managers(pkg for binaries and ports for source code). I also host my own web server using nginx, and sometimes other stuff. All in separate jails. Back when I was a kid, I used to have my own servers.
vachina 1y ago
I host it at home.
man8alexd 1y ago
The problem with self-hosting is finding an IP with an clean reputation and not on any block lists, with good neighbours (people sometimes block /24), with an open outgoing port 25. Then you'll need to slowly warm up this IP for weeks or months.

aborsy 1y ago

If you host your email on a VPS, you might as well let an email provider manage it all for you. In both cases, a company has access to your emails. What you have achieved is doing the dirty job of administration for the company, while not getting the privacy benefits of self hosting. If you host it at home, can you endure uptime?

7bit 1y ago
This argument is absurd. You have a trust relationship with your VPS provider. Yes, they can access it, if they want to. The difference is that with a VPS you have contractual privacy and with e.g. Gmail they outright tell you that they scan your emails. So it is a big difference. With everything, it's question of budget and what risks you accept.

xvilka 1y ago

There's a way better solution for self hosted email these days - Stalwart[1]. Supports all necessary protocols and extensions, including modern JMAP. And, of course, it's memory safe, unlike Postfix and friends. [1] https://github.com/stalwartlabs/stalwart https://github.com/stalwartlabs/stalwart

mrighele 1y ago

I would love to be able to self-host like it was 2025, and with that I mean giving a piece of software the api token to my DNS api, a database, a list of domains and having it figure everything out (certificates, MX records, DKIM etc.) by itself. It should not be impossible.

realaaa 1y ago
you can do SmarterMail for 1 domain for free - they are quite good, one of few decent remaining mail systems out there (of course it's commercial for business use)

illusive4080 1y ago

I’ve been running Mailcow for 5+ years. After getting over initial reputation issues, it’s been smooth sailing.

atoav 1y ago

Mailcow is pretty good actually. Setup on a virtual hetzner server took me half an hour, as it is a pretty simple docker container. What took a little longer was migrating my mails over, and setting all the needed DNS records (SPF and the likes). I had a small blacklisting issue in the beginning that could be resolved within 24 hours, since then it works flawlessly.

mustaphah 1y ago

Great post! Just wanted to add that DMARC isn't really about the DKIM signature itself; it's about whether the domain in RFC5322.From aligns with either SPF or DKIM. So if SPF is aligned, DMARC will pass even if DKIM fails.

realaaa 1y ago

ha ha indeed I wish it was like 1984 ! most of this extra stuff was not a concern back then :) > Notes from setting up a truly minimal self-hosted email server with Postfix and OpenDKIM. Covers TLS, SPF, DKIM, DMARC, DNS, reverse DNS, multiple domains, and delivering to Gmail. great article and discussion nevertheless, awesome to see people still doing it