5 ms·

I've been hosting my own mail since 1996. It's actually one of the easier services to self-host: 1) SMTP was developed for unreliable environments. If you ha

by moxie 13y ago

I've been hosting my own mail since 1996. It's actually one of the easier services to self-host: 1) SMTP was developed for unreliable environments. If you have problems with uptime, your incoming email will bounce around for 5 days before it gets dropped. So assuming you can get your SMTP server running one day out of five, you shouldn't be in danger of losing anything. 2) Contemporary daemons like postfix and dovecot have sane defaults, so even a naive default install should be mostly secure. They're also extremely low velocity, so once you set it up there's not a lot of ongoing maintenance.

chj 13y ago
What do you use for spam filtering? Another problem is you will have to use a third party smtp server, otherwise your mail will be rejected by a lot of email providers.
- spudlyo 13y ago
  SpamAssassin and friends still do a reasonable job for me, and have for years. I delete a handful every day, but like the parent I've had my email address since 1996, and I haven't been too careful about using it. If I had to do it over again today, I'd look at rspamd. Getting people to accept your mail can be a pain in the ass, yes, but it's not impossible. * Get a "clean" statically allocated IP address. * Control your forward and reverse DNS and make them match. * Set up SPF/DKIM. * Fill out the Yahoo Bulk Email sender form That last one probably isn't really necessary, depending on how much email you send to Yahoo.com addresses.
  - ciniglio 13y ago
    Do you have any tips on testing for deliverability? I have a hunch that if I try to send something, say to my gmail or one of my close friends' email, that the spam filter will allow it because it's a familiar name/domain, but I would expect that if I email a stranger's gmail, it might get flagged...
    - SmokyBorbon 13y ago
      You can use http://www.mxtoolbox.com/ http://www.mxtoolbox.com/ to see if your domain or IP have been blacklisted by any ofthr public lists. Also, if you get blacklisted you should receive a bounceback email telling you who blacklisted you and where to go to get yourself removed.m
  - chalst 13y ago
    I've been running my own mail server since 2006 and have never had a problem with being rejected. I've run a fairly tight ship: 1. Only allow email locally (i.e., via webmail and ssh) - which many would regard as a real pain, but I and the few people who use my server have been OK with. IMAP is very useful with this policy, for batch move/send from outbox folders. 2. Set up TLS to only deliver via SSL 3. Advertise both these facts via SPF (I haven't bothered with DKIM)
- Nux 13y ago
  That's bollocks. I have my own email server on some random Hetzner IP address and have never had email rejected; and do note my domain TLD is .ro which tends to get higher spam scores.
spudlyo 13y ago
Hats off to ya. I used to view setting up your own email services as a rite of passage for any UNIX admin worth their salt. SMTP was one of the first services I ever got working on my home Linux box, and I had to do it with Sendmail and the goddamn Bat book. Nowadays it's a bit easier.
- cbr 13y ago
  It's easier now, in that we have good well-documented software, but the external environment has changed. While other servers used to just accept the email you sent, spam countermeasures have gotten complex enough that if you just follow the postfix installation guide you're going to have a lot of your outbound smtp filtered.
  - old-gregg 13y ago
    Grab a free account at mailgun.com and configure it as your outgoing SMTP relay. You'll get an IP address for your outbound traffic which is "clean", monitored and registered with a ton of ESPs. You can also use Mailgun as a proxy for your incoming mails as well, for spam filtering or custom routing purposes.
    - dfc 13y ago
      Full-Disclosure: The comment above was made by the co-founder / CEO of mailgun.
    - junto 13y ago
      Out of interest, how would you go about doing this, especially interested on the inbound?
    - furyg3 13y ago
      Is mailgun a US-based company that would comply with a national security letter if faced with one?
      - cakeface 13y ago
dobbsbob 13y ago
Try OpenSMTPD its now ready for production use http://www.opensmtpd.org http://www.opensmtpd.org
kansface 13y ago
Sure, it takes 30 seconds to install postfix, but in practice, email is stupidly hard to admin because of spam. You may be able to send email easily, but a large percentage will be blocked as spam unless you use a well know relay even if you do everything right. Similarly, you will also be fighting a flood of spam in the other direction.
- eps 13y ago
  > but a large percentage will be blocked as spam unless you use a well know relay even if you do everything right That's hardly a rule. You clearly will end up on a blacklist if you host from home or if your IP is already on a list due to previous spam activity, but of you run off a static IP in a decent colo and have a proper PTR record, it is more likely than not to be all OK. The 90% of inbound spam is still very effectively trimmed off by greylisting, i.e. postgrey if you are in postfix. I've been running my own mail server for close to 10 years now and it's really not a big deal.
- mhurron 13y ago
  Inbound spam : greylisting as stated elsewhere. Outbound : Use a smarthost. I host my own mail. I use OpenBSD as my Firewall/Router so it was a simple decision to use the spamd daemon on it for greylisting. The SMTP destination sits on a CentOS machine behind the OpenBSD gateway. I see a spam message maybe once every week or two. I have also used MailScanner to do SpamAssassin and virus scanning of received mail at places I have worked. The spam count went down so far I had people ask me if the mail server was down. A little bit of verification showed we weren't loosing legitimate mail, users were just getting so much spam they thought that was normal. A smarthost solves your outgoing problem. I can't send direct from my home connection because it is a residential IP and that is going to be blacklisted all over the place. I could use my IPS's SMTP server, hell you could use GMail if you wanted. I however, use a VPS I pay for. My SMTP server logs in (password) over a TLS connection (preshared certificates). It only relays for my mail server because of that. You don't need to use a well known relay, you just don't relay from a blacklisted IP. Don't leave an open relay and don't send directly from a residential IP block and you probably don't have to worry, unless you start sending spam. http://www.mxtoolbox.com/blacklists.aspx http://www.mxtoolbox.com/blacklists.aspx has various tools to give you a view into how other mail servers will view your hosts.
homeomorphic 13y ago
I've been meaning to finally get around to doing this myself, so I'll shoot you a question: Do you have a fallback MX? I'm thinking of getting a super-cheap VPS running only Postfix as a mail fallback in case my primary host goes down for an extended period. How is accessing mail on the fallback host (when primary is down) usually handled? An IMAP daemon running there as well? Should the fallback just wait for the main one to come back and then send all the waiting mail there?
- gog 13y ago
  Usually, the backup MX just gathers email (so that the email does not bounce to the sender) and delivers it to the primary MX when it gets online and then the primary delivers emails to the server that is going to expose it via IMAP or POP3. But this is just for receiving emails (from the outside world), if your IMAP/POP3 server is on the same server as your primary MX you will not have access to emails on the server while the primary is down. You have to find a way to sync your received mail (maildir/mailbox) to two or more servers. If you decide to implement a backup MX, try to sync your allowed recipients list from the primary because spammers often try to send emails to an MX with a lower priority, and if it accepts all emails for the domain without checking if that mailbox actually exists you could became a source of back-scatter.
  - homeomorphic 13y ago
    Thanks.

by moxie 13y ago

chj 13y ago

What do you use for spam filtering? Another problem is you will have to use a third party smtp server, otherwise your mail will be rejected by a lot of email providers.

spudlyo 13y ago
SpamAssassin and friends still do a reasonable job for me, and have for years. I delete a handful every day, but like the parent I've had my email address since 1996, and I haven't been too careful about using it. If I had to do it over again today, I'd look at rspamd. Getting people to accept your mail can be a pain in the ass, yes, but it's not impossible. * Get a "clean" statically allocated IP address. * Control your forward and reverse DNS and make them match. * Set up SPF/DKIM. * Fill out the Yahoo Bulk Email sender form That last one probably isn't really necessary, depending on how much email you send to Yahoo.com addresses.
- ciniglio 13y ago
  Do you have any tips on testing for deliverability? I have a hunch that if I try to send something, say to my gmail or one of my close friends' email, that the spam filter will allow it because it's a familiar name/domain, but I would expect that if I email a stranger's gmail, it might get flagged...
  - SmokyBorbon 13y ago
    You can use http://www.mxtoolbox.com/ http://www.mxtoolbox.com/ to see if your domain or IP have been blacklisted by any ofthr public lists. Also, if you get blacklisted you should receive a bounceback email telling you who blacklisted you and where to go to get yourself removed.m
- chalst 13y ago
  I've been running my own mail server since 2006 and have never had a problem with being rejected. I've run a fairly tight ship: 1. Only allow email locally (i.e., via webmail and ssh) - which many would regard as a real pain, but I and the few people who use my server have been OK with. IMAP is very useful with this policy, for batch move/send from outbox folders. 2. Set up TLS to only deliver via SSL 3. Advertise both these facts via SPF (I haven't bothered with DKIM)
Nux 13y ago
That's bollocks. I have my own email server on some random Hetzner IP address and have never had email rejected; and do note my domain TLD is .ro which tends to get higher spam scores.

spudlyo 13y ago

Hats off to ya. I used to view setting up your own email services as a rite of passage for any UNIX admin worth their salt. SMTP was one of the first services I ever got working on my home Linux box, and I had to do it with Sendmail and the goddamn Bat book. Nowadays it's a bit easier.

cbr 13y ago
It's easier now, in that we have good well-documented software, but the external environment has changed. While other servers used to just accept the email you sent, spam countermeasures have gotten complex enough that if you just follow the postfix installation guide you're going to have a lot of your outbound smtp filtered.
- old-gregg 13y ago
  Grab a free account at mailgun.com and configure it as your outgoing SMTP relay. You'll get an IP address for your outbound traffic which is "clean", monitored and registered with a ton of ESPs. You can also use Mailgun as a proxy for your incoming mails as well, for spam filtering or custom routing purposes.
  - dfc 13y ago
    Full-Disclosure: The comment above was made by the co-founder / CEO of mailgun.
  - junto 13y ago
    Out of interest, how would you go about doing this, especially interested on the inbound?
  - furyg3 13y ago
    Is mailgun a US-based company that would comply with a national security letter if faced with one?
    - cakeface 13y ago

dobbsbob 13y ago

Try OpenSMTPD its now ready for production use http://www.opensmtpd.org http://www.opensmtpd.org

kansface 13y ago

Sure, it takes 30 seconds to install postfix, but in practice, email is stupidly hard to admin because of spam. You may be able to send email easily, but a large percentage will be blocked as spam unless you use a well know relay even if you do everything right. Similarly, you will also be fighting a flood of spam in the other direction.

eps 13y ago
> but a large percentage will be blocked as spam unless you use a well know relay even if you do everything right That's hardly a rule. You clearly will end up on a blacklist if you host from home or if your IP is already on a list due to previous spam activity, but of you run off a static IP in a decent colo and have a proper PTR record, it is more likely than not to be all OK. The 90% of inbound spam is still very effectively trimmed off by greylisting, i.e. postgrey if you are in postfix. I've been running my own mail server for close to 10 years now and it's really not a big deal.
mhurron 13y ago
Inbound spam : greylisting as stated elsewhere. Outbound : Use a smarthost. I host my own mail. I use OpenBSD as my Firewall/Router so it was a simple decision to use the spamd daemon on it for greylisting. The SMTP destination sits on a CentOS machine behind the OpenBSD gateway. I see a spam message maybe once every week or two. I have also used MailScanner to do SpamAssassin and virus scanning of received mail at places I have worked. The spam count went down so far I had people ask me if the mail server was down. A little bit of verification showed we weren't loosing legitimate mail, users were just getting so much spam they thought that was normal. A smarthost solves your outgoing problem. I can't send direct from my home connection because it is a residential IP and that is going to be blacklisted all over the place. I could use my IPS's SMTP server, hell you could use GMail if you wanted. I however, use a VPS I pay for. My SMTP server logs in (password) over a TLS connection (preshared certificates). It only relays for my mail server because of that. You don't need to use a well known relay, you just don't relay from a blacklisted IP. Don't leave an open relay and don't send directly from a residential IP block and you probably don't have to worry, unless you start sending spam. http://www.mxtoolbox.com/blacklists.aspx http://www.mxtoolbox.com/blacklists.aspx has various tools to give you a view into how other mail servers will view your hosts.

homeomorphic 13y ago

I've been meaning to finally get around to doing this myself, so I'll shoot you a question: Do you have a fallback MX? I'm thinking of getting a super-cheap VPS running only Postfix as a mail fallback in case my primary host goes down for an extended period. How is accessing mail on the fallback host (when primary is down) usually handled? An IMAP daemon running there as well? Should the fallback just wait for the main one to come back and then send all the waiting mail there?

gog 13y ago
Usually, the backup MX just gathers email (so that the email does not bounce to the sender) and delivers it to the primary MX when it gets online and then the primary delivers emails to the server that is going to expose it via IMAP or POP3. But this is just for receiving emails (from the outside world), if your IMAP/POP3 server is on the same server as your primary MX you will not have access to emails on the server while the primary is down. You have to find a way to sync your received mail (maildir/mailbox) to two or more servers. If you decide to implement a backup MX, try to sync your allowed recipients list from the primary because spammers often try to send emails to an MX with a lower priority, and if it accepts all emails for the domain without checking if that mailbox actually exists you could became a source of back-scatter.
- homeomorphic 13y ago
  Thanks.