Email Self Hosters - what are you using?
68 points by vetch
68 points by vetch
At the moment I self host using maddy for a bunch of domains that need a mailbox or catch all. There are some minor issues with it - some are me, some are who knows. The biggest bug bear is that the native email client on iOS takes an age to connect and download messages which causes some issues with OTP emails.
So for those out there that do host their own email - what are you running, what would you change?
there was a similar thread a while ago here: https://lobste.rs/s/bywnqo/what_s_your_email_setup. It may have useful information in the comments
Same thing as 27 years ago: postfix + cyrus imapd. Rock solid as far as mail storage is concerned, but world wide web is in the process of enshittification and tweaking postfix to keep up with spam and filtering policies is becoming an increasing pain. Especially when your mail setup sits on a residential dsl IP with very bad reputation ... you cannot do anything for the likes of gmail to accept mail from you.
Same here: Postfix + Cyrusimapd. I have configured it for JMAP as well, and where I can, I use it (aerc in terminal; Bulwark for webmail; trialing Plume on the phone).
I do use anti spam and clamav as well, though.
OpenBSD + OpenSMTPD + Rspamd + Dovecot on an OpenBSD Amsterdam VM. I followed https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-dovecot-and-rspamd/ back in 2020 and have been running it ever since. I wouldn't change anything.
The first time I sent an email to a Microsoft server (my university email at the time) I got a reply back telling me to fill out a quick form to "prove" I was a real human, but since then I've had no delivery issues at all. Worth noting that, before self-hosting email, I had my domain for ~1.5 years and the TLD, .ca, is probably much more reputable than if you were trying to send email from a .xyz or .biz.
The NixOS Mailserver package on my personal NixOS bare metal server, german private fiber connection. SMTP2GO as an SMTP relay to not land in spam hell due to IP reputation.
Multiple Domains and users across two businesses, rspamd and its classifier trained up on everyone's spam. Pretty sweet so-far.
Biggest mistake so-far, having the default Postfix submit timeout. One user was sending 20MB worth of photos via Android Thunderbird in a factory with no wifi and a bad mobile connection. Got to 90%, timeout, repeat. Actual mail was only sent hours later.
Based off of this guide: https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-dovecot-and-rspamd/
I have a stack of OpenSMTPd + rspamd + dovecot on my Parabola GNU/Linux homeserver (yes, running off of a residential address), I am also using an SMTP proxy for some outbound destinations that are really annoyed by my server's lack of PTR record, but that isn't the end of the world since the MXs I want to reach I do reach without an issue.
freebsd + postfix + dovecot + blocklistd + spamassassin + greyfix
spamassassin is not as good as rspamd, but I sort of enjoy reading and sometimes replying to spam.
and, I have AWS SES set up as an outgoing relay (usually $0.50 a month), mainly so I can stop filling out Microsoft forms to get email accepted to Outlook.
I pay Migadu to host emails on my custom domain.
Very good customer service, does what it says on the tin and nothing more. Good value.
EDIT: reading other people's answer, I see that this might not qualify into self-hosting. I think email is worth outsourcing to someone else for the price of a coffee a month.
Running OpenSMTPD + rspamd + dovecot on multiple domains. All on OpenBSD. Runs great.
Least favorite part is rspamd. Many moving parts and while I get why the configuration is like that I still find it messy. Well, good thing is you only set it up once.
I stopped greylisting and so on, because basically all spam nowadays comes over properly configured emails servers (including the big ones like Gmail).
There were other SMTP servers in the past. Started out with exim, then did postfix for a while OpenSMTPD config just is so clean.
When I moved over to OpenSMTPD I also replaced opendkim, spamassassin, etc. with rspamd. As mentioned a bit of a love-hate there.
Migrated between providers, so IPs, domains, etc. in 20 years. Only problem I ever had was that at some point servers started demanding DMARC. So quickly set it up for Gmail to accept emails again. Wished more services were as boring as email.
postfix, dovecot, opendkim, opendmarc, all on a VPS from Scaleway.
I don't have any delivery issues with any major provider, but I have to fill in a form once a year to have my IP taken off the Spamhaus PBL. There's no manual verification on their end when the email you use with Spamhaus lives on the IP you're unblocking :)
I've directed all email to my account, regardless of the local-part (before the @). Probably wouldn't recommend it, it makes it near impossible to ever stop self-hosting.
I'm also rawdogging it without any form of spam filter on the server. Thunderbird does it on my desktop, and on my phone I just scroll past the spam. I should probably set up spamassassin to at least reject the most obvious.
Edit: One issue I've run into is that, for some reason, Tumblr wouldn't even attempt to deliver email verification to my server. Had to contact support to have my email verified!
I'm currently on DO and am very slowly moving to Scaleway - who seem to do a much better job of keeping their IPs clean from backlisting.
Same software stack, OVH as hoster, a lot of accounts under multiple subdomains. No spamfilter, and not much spam somehow.
Wildcarding all email to yourself is a great way to discover someone who had your domain before the year 2000 is on all kinds of spam lists :)
Well, I wanted a cheap domain so the gTLD involved did not exist in 2000, that helps!
(If ever deliverability penalty of cheap gTLDs gets prohibitive, well, I will see)
I've directed all email to my account, regardless of the local-part (before the @). Probably wouldn't recommend it, it makes it near impossible to ever stop self-hosting.
Hosted email providers allow that too, at least Fastmail does
I've directed all email to my account, regardless of the local-part (before the @). Probably wouldn't recommend it, it makes it near impossible to ever stop self-hosting.
I've been able to set up a catch-all/wildcard address on both Google and Fastmail now, so unless you're doing something fancier than I understood, you can definitely use other providers at some point if you stop enjoying self-hosting.
Mox, for a secondary email domain for about a month now, on a cheap VPS (binary lane).
Pros:
Cons:
I have not received any spam yet, so I have not tested its anti-spam performance.
Everything is hosted on OpenBSD at hetzner.
I love the simplicity of opensmtpd, and the fact that it all runs without a database. Emails are stored as files and accounts are created with a dedicated passwd(5) like file in /etc/mail/.
The only thing I could bother changing is spamd, because greylisting can delay emails, which is frustrating when you just wanna receive that MFA code to login. But I have a script on my phone to remotely toggle it, so it's not that bad, and I love the idea of wasting spammer's time :)
What do people use for backup MX? Synchronising spam filter state seems annoying and I don't want the backup MX to be a way past the spam filter. A lot of spammers are now apparently starting with the lower-priority MXs on the assumption that they don't do as much spam filtering.
I self host and had an issue a while ago where the incoming server died and I needed to update my DNS, but my DNS provider required sending me an email to log in. I'd like to have a backup MX to support that without so much suffering (even if I need to cat the mail spool). Ideally, I'd like the backup MX to monitor the health of the primary and not accept mail when it is working but comes online and catches incoming email when it fails.
I have my backup MX set up with a much longer greylisting period, and doesn't get skipped for aligned SPF / DMARC. They use more aggressive anti-spam blocklists, and DNS blocks are more aggressive.
This really cut down on the deliver-to-backup-MX problem, without syncing anti-spam measures.
When I was still self-hosting I had a handshake agreement with a friend who was another self-hoster. But obviously that assumes they're as into it as you are (he wasn't after a few years).
Not quite what you asked, but I have a gmail address I use for backup authority. Stuff that hits my gmail gets forwarded to my normal acct automatically, but if my mail server goes down I can still use the gmail acct to access my DNS, Hetzner console, etc. Maybe defeats some of the purpose of self-hosting a little, but it gets used rarely and I had to use it to recover my VPS for real recently and it worked fine.
About a year ago I migrated from Postfix + Cyrus + SpamAssassin to Stalwart for a ~10 user mailserver. The much larger mail servers that I have run in previous jobs (5k+ users) were Postfix+Cyrus, but I'm not so much in that business any more. I'm happy with the result of my migration, but I also don't feel that it was necessary, just "nice to have".
Here's what motivated me to make the change:
None of these are things that would have been impossible with the Postfix + Cyrus setup, but overall migrating to Stalwart was easier.
Here are my complaints about Stalwart:
Mox in a Linode VPS. Works well with almost zero effort.
Mox being mentioned in another thread is the first time I have come across it and what prompted this post. One thing I like about Maddy is that it can use rspamd which seems missing on Mox?
Yes, no milter / rspamd support, since spam hasn't really been a problem with mox https://github.com/mjl-/mox/issues/47
At the moment I'm using mailcow - but I have used docker-mailserver before, and also just OS-level postfix+dovecot+... on Debian for years. I trialed stalwart in the past and I have never heard of maddy. I had a 2nd setup with openbsd and opensmtpd as well, which was fine, but the lack of webmail and some other niceties made it a nonstarter for hosting other non-nerds' email. Would probably use that if I needed a decoupled "receive only" MFA email again.
I'm pretty happy with mailcow.
I don't generally fiddle with my email setup. I take whatever latest Debian or Ubuntu LTS as a host, then run that machine until the base OS is EOL, which is often 4-5 years, then I see if my setup on top still makes sense or if I need to switch. Last time there was some problem with docker-mailserver on the VPS I had after an OS upgrade iirc, that is why I switched, it had worked before.
You say you tried stalwart before but you're not using it currently. Any particular reason(s)?
Not the OP, but I trialed Stalwart as well. I have high expectations of it, and am following development on Github. However, I am not yet using it "in production" for my mail server.
The project has very frequent updates and bug fixes, which is great, but not mature enough yet for me to use it. I'll trial it again once it reaches v1.0.
It's been a long time, might have even been when it was very fresh, and wasn't ready - or some development lull. I faintly remember that I recent-ish rediscovered it and was happy to see it was still around...
postfix + dovecot + rspamd on a colocated linux box - has been my go to for 20 years. Email goes through it faster than any other setup I've used.
My main email client is mac mail and iOS mail.
I'd quite like an easier way to add aliases than editing a config file and running postmap... but it works, and an easier way to rotate DKIM keys.
I'm still running good old Sendmail (with procmail, milter-greylist, opendkim, imap-uw). I wrote some nice rulesets that I never replicated elsewhere, so short of some big change that would require moving, I'm sticking with it.
Once it's set up, it's surprisingly easy to maintain.
notqmail (as you might guess from the hat), Dovecot for IMAP, rspamd, DKIM, SPF, SRS, yadda. If I could change one thing, it'd be to have way more time to improve notqmail. If I could change two things, I’d wish into existence a checkpassword-shaped IMAP server that’s as production-ready as Dovecot. bincimap unfortunately isn’t it.
I've self-hosted my email for over 25 years.
Currently Debian stable with postfix + sqlgrey + postfix-policyd-spf-python + OpenDKIM and a couple of DNSRBLs, with dovecot imap.
I receive very little spam, and sometimes the big providers may filter my email as spam, and there is not much I can do about it unfortunately. I generate little traffic so it doesn't matter I that have been in the same IP for the last 12 years or so, I can't gain the reputation they want.
I started with OpenBSD and sendmail, but the Internet was a very different place back then.
I'm trialing Stalwart, but I haven't used it enough to yet to give a good evaluation. The way the settings work is quite nice. The LLM-written documentation is annoying to read, but at least it exists. I was hoping Stalwart could be a good alternative for Google Workspace's calendar features for my company, but so far the groups support is limited compared to Google Groups.
Stalwart. I use it in my homelab to receive bank statement emails that are picked up by windmill. I will soon start using it to send emails to homelab services users.
I use it from Thunderbird and looking forward to Thunderbird release on ipados/ios.
MailInABox (which runs on Ubuntu Server) on a home server. It's been great. I'm fortunate to have a good ISP who didn't blink at fixed-address/open-ports and who's IP addresses haven't been problematic.
Very happy with MIAB. It manages DKIM etc very cleanly and provides all the usual features. Can send to MS/Google fine (after following MS instructions). Only hassle is delayed sign-up emails as it uses greylisting. MIAB is aimed at virtual servers, but with a little network knowledge it runs fine on a local server.
Only things I'd change .... I'd run it on FreeBSD, and add some way to temporarily disable greylisting.
Same for a while now:
But this is new:
mailu it provides a pretty complete solution in docker containers.
My only concern is being better at security in the age where I'm sure spammers are using agents.
I was using https://mailinabox.email/
Now I am using https://nixos-mailserver.readthedocs.io/en/latest/index.html
Currently exim + dovecot + rspamd + nginx (imap proxy) + fail2ban (not technically part of the mail stack but it does a lot of work keeping it running by blocking the arseholes.)
I'd love to switch to a more modern setup but this has ~25 years of accumulated fudges and quirks on top - working out how to port those to, e.g., Postfix, is beyond me at the moment.
OpenSMTPD, rspamd and Dovecot on a linux VPS. I'm moving it to a local FreeBSD box with some very carefully exposed internet facing endpoints (via a VPS still) to allow email delivery. Access will require being connected via a wireguard VPN (this breaks IMAP IDLE on android unless you want to waste all your battery life but you can fix it with dovecot and some lua).
Main thing I would change in that transition is to use virtual users rather than OS users... That's about it.
I use p25.dev (EU sovereign, privacy focused email gateway) in front of a few different setups (Stalwart, Postfix, Postern).
Full disclosure: I created p25.dev and Postern.
I'm using Stalwart. For clients I'm using sterna on mobile and aerc on the desktop. I'm using JMAP instead of IMAP. One thing I really like about Stalwart is that is using JMAP to update its configuration. It is currently a little rough, but I do think it will much better in the end. It allows one to have a declarative configuration of resources like Folders, tags, aliases, sieve scripts, etc.
The installation recommends you to use curl | sh - (no, thanks), but the script is well written so it can be used to learn how to setup Stalwart. Given how much care went into the installation script, I really do wonder why they don't also write down a document. Their docs as another comment mentions are verbose and not very useful. I've yet to figure out how to tell its spam filter about a false positive.
Stalwart does its best to work out of the but you still need to troubleshoot things (e.j. use https://www.learndmarc.com/ to check your configuration). There are things like reverse DNS that Stalwart can't help you setup.
Updating Stalwart so far has been a breeze. Just download the new executable, unzip and restart the service. There was a big change from 0.15 to 0.16 but so far no manual upgrade process has been needed.
Besides their docs, their support portal is mostly an LLM answering questions, which as one might guess is not very useful.
Some small QoL changes I'd like to see:
So far my experience with Stalwart has positive. Its a good way to start self-hosting email, but I do worry about how much they are pushing LLMs into their main product. I may end up moving to another server later.
One thing I'd like to improve later is having a jmap based syncing tool. Similar to https://github.com/elizagamedev/mujmap. (While reading the mumap code and dependencies I was surprised to learn that notmuch is not thread safe).
I was running postfix + spamassassin + dovecot for a long time but I'm now using Stalwart (https://stalw.art/) and I'm not going back. The management interface is great. JMAP support suffers from a lack of good email clients with support.
I use postifx and dovecot with rspamd for spam filtering (and DKIM signing). I can't say I love any of the stack but it seems to work well.
I also heavily leaned on https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/ for guidance.
Was using Proton then Tuta but find them both to be walled gardens using privacy as a means to lock you I .
Now I use Mailbox.org.
Postfix + mutt over ssh. OpenDKIM for signing outgoing messages. SPF checking + a blacklist of five problematic addresses has been enough to keep spam manageable. (~ 4/week with a published contact email on my website)
Works well enough that I haven't bothered to setup IMAP or anything. Of course that only works because I don't really use my phone much (ssh from android is possible but would be a horrible experience). Probably not a viable setup for your use case.
Mailcow!
Running on my home network. Outgoing relayed thru my ISPs SMTP relay.
Only compliant is that the default soft-reject behavior of the rspamd config. It leverages that many spam bots alledgedly don't retry email sending, while legitimate MTAs do. While all legitimate email arrives within ~5m it is still annoying, so I disabled the soft reject. Haven't seen any of these spam bots yet.
Debian + Postfix + Dovecot, with account management and rather unconventional wildcard matching done in postgresql. I have spamassassin in the loop but I never got it to work properly; it assigns basically the same score to the most legitimate and the most obvious spam mails.
The crazy wildcards (for ad-hoc addresses) are super nice. The nonfunctional spam filtering is the main pain point, especially for my younger brother who used the main mail address I host for him in some Minecraft forum when he was about 13.
I'd be curious about people's take on RBLs, both from sender and receiver perspective. Do you use them? Which ones? Do they give you trouble?
I find them highly effective. When combined with using unique email addresses for each signup I get very little spam. Most of what I do get comes forwarded from my vanity gmail address.
Debian server running postfix and dovecot. Have been running this setup for about two decades now. Don't really want to change anything on my end.
OpenBSD + OpenSMTPD + Dovecot on a Raspberry Pi 5 with a NVMe HAT at home, with a openbsd.amsterdam VM as my outgoing relay.
Then the usual SPF, DKIM, DMARC setup...
There are some minor issues with it - some are me, some are who knows.
It could be worth trying to fix the minor issues.
I've had some great success with having LLMs diagnose issues for me. For email servers, I would tell the LLM the issues I have, and ask it to diagnose and reproduce the bug(s) with a reproducible test suite using the nixpkgs VM test harness.
If you do choose to find an alternative mail server, the test suite remains useful for checking they actually resolve the minor issues.
I am aware some people don't want to use LLMs, which is fair enough too.
Until a few months ago I was using Exim + Dovecot + Rspamd, then I moved over to Stalwart. I like how Stalwart integrates IMAP, SMTP and spam filtering, even though there are some rough edges and the installation documentation leads you to the wrong path more often than not.
The primary MX running Stalwart are dedicated servers at OneProvider in Paris (Scaleway) and HostDZire in Canada (Leaseweb). Until now I have been lucky enough to get relatively clean IP addresses, I also use HetrixTools to monitor various DNSBL.
For secondaries, I have a job that exports the mailbox and alias names from Stalwart to Exim running on 2 different VPS.
The me issues are 1) moving server and 2) correctly configuring the DANE/TLSA to update with each new certificate renewal. Not really an issue as I don't do too much outbound email.
Sadly LLMs don't magically give me an extra 20 hours in the day.
correctly configuring the DANE/TLSA to update with each new certificate renewal
Just in case you're not familiar with it, there is a tool called danebot that is quite useful for automating this. It's a wrapper around certbot.
And, it would be wild not to use something to continually check your tlsa / dane status. There's danecheck and also dane-smtp-verify that could be perused for this task.
None of this adds time to your day, though... :-)
I'm currently running postfix + dovecot + rspamd, and use a smarthost for outgoing mail (because some of the entities I need to communicate with would need me to be on an allowlist that costs thousands of dollars a year, and eff that). However, all three of those have various levels of slop infection, so I'm currently migrating away from them.
I will be using Aerogramme for imap & lmtp, opensmtpd (or Exim) for smtp, and my own milter instead of rspamd.
Postfix, dovecot, and that's about it. I'm sure it could be fancier if I wanted, but last time I made it fancier I forgot how it worked by the time I needed to change something again, so it's very vanilla. I should check out rspamd someday, it seems.
It's all hosted on a Hetzner VPS that somehow isn't on too many spam lists. Sometimes I can't send email to Microsoft addresses, but... that doesn't tend to come up anyway, so it's fine!
Out of curiosity, does anyone run one for small/medium size organizations?
The only holdouts I can think of are universities that have mailservers they have kept rolling forward, with decades old IPv4 blocks.
Yes, not university. It mostly works fine, we also own our own IP's(class C) which helps with reputation.
We have the never ending hiccups from Microsoft and other large email players, but generally you just follow their ever changing mess and it usually gets fixed. It's not a full-time job, but it def. takes some time. It usually comes in waves, so you have to keep on top of your mail logs to avoid users sending help request in about email being mean.
So it's just annoyance. There is a reason people outsource this all the time. MS, Google and all the other large players make being a 3rd party mail server annoying. The annoyance is ever changing and they document their crap about half the time, so you have to just plow through.
Our system is just Postfix and friends, nothing special.
Cloudron. Not much. It's really easy to set up and gives you access to many self hosted apps, including email.