Skip Navigation

Does anyone run their own email server?

All this new excitement with Lemmy and federation has got me thinking that maybe I should learn to run my own instance. What always comes up though is how email is the orginal federated technology.

I am looking at proxmox and see that is has a built in email server, so now I am wondering if it is time to role my own.

I stopped using gmail a long time ago, and right now I use ProtonMail, but I am super frustrated with the dumb limitation of only having a single account for the app. I get why they do it, and I am willing to pay, but it is pricey and I don't know if that is my best option. I guess it is worth it since ProtonVPN is included. It looks like they are expanding their suite.

Is it worth it? Can I make it secure? Is it stupid to run it off a local computer on my home network?

65 comments
  • Yes, I still run my own email server. It is not for the faint of heart, but once it's configured and your IP reputation is clean, it's mostly smooth sailing. I have not had any deliverability problems to date, initial setup/learning period notwithstanding.

    If you're not scared away yet, here are some specific challenges you'll face:

    • SMTP ports are typically blocked by many providers as a spam prevention measure. Hosting on a residential connection is often a complete non-starter and is becoming more difficult on business class connections as well (at least in the US, anyway).
    • If you plan to host in a VPS, good luck getting a clean IPv4 address. Most are on one or more public blacklists and likely several company-specific ones (cough Microsoft cough). I spent about 2 weeks getting my new VPS's IP reputation cleaned up before I migrated from the old VPS.
    • Uptime: You need to have a reliable hosting solution with minimal power/server/network downtime.
    • Learning Curve: Email is not just one technology; it's several that work together. So in a very basic email server, you will have Postfix as your MTA, Dovecot as your MDA, some kind of spam detection and filtering (e.g. SpamAssassin), some kind of antivirus to scan messages/attachments (e.g. Clamd), message signing (DKIM), user administration/management, webmail, etc. You'll need to get all of these configured and operating in harmony.
    • Spam prevention standards: You'll need to know how to work with DNS and create/manage all of the appropriate records on your domain (MX, SPF, DMARC, DKIM records, etc). All of these are pretty much required in 2023 in order for messages from your server to reach your recipient.
    • Keeping your IP reputation clean: This is an ongoing challenge if you host for a lot of people. It can only take one or two compromised accounts to send a LOT of spam and land your IP/IP block on a blacklist.
    • Keeping up with new standards: When I set my mail server up, DMARC and DKIM weren't required by most recipient servers. Around 2016, I had to bolt on OpenDKIM to my email stack otherwise my messages ended up in the recipient's spam folder. -Contingency Plan: One day you may just wake up and decide it's too much to keep managing your own email server. I'm not there yet, but I've already got a plan in place to let a bigger player take over when the time comes.
  • It’s a great learning exercise but challenging to get right and ensure your deliverability and basically impossible from a residential-grade IP address (if you have a business class static IP at home you could pull it off).

    I ran an email server for decades but gave in and pay to host my email now.

    If google decides you’re a bad guy it’s such a pain to crawl back from that and I prefer my email to just work.

  • Just take a look at https://docs.mailcow.email/

    This runs from a small box with everything included. It gives you all the tools and config needed for running a secure and feature rich email service. Webmail, some sort of exchange emulation, webcalender on top of a solid postfix/dovecot install with rspamd as spam filter. Everything is configurable via a nice web UI.

    After 15y running my own mail service and editing a lot of config files, I use this piece of free and open software and find it very good. All you need is a box somewhere in the internet. Running from a homelab will instantly fail, expect you have a static ip.

    • Neato! There seems to be a lot of solutions for running a mail server.

      Yeah, I think it is time, I need to get familiar with Docker.

      Yeah, I was clueless thinking I could run it from my home. Hah. I just wanted to avoid paying for a VPS. Which is silly because I buy too much crap all the the time and have multiple subscriptions.

      This is actually valauable.

      • mailcow lists a small german vps hoster with a fair price and the right sizing. It's not a big hoster, gmail and microsoft are not blocking the ip-range and the ASN is not listed on any blacklist.

        The support is quick and helpful, rDNS was a matter of minutes to set up. You don't need any deeper knowlegde of docker, since it is a one-time job to set the things up und get the stack running. The documentation of mailcow is very good.

        You can run it from home, but you will need a forward host like sendgrid and maybe a backup mx. You can set a primary ip and a backup ip wich will get all the mails when the primary host is down. I guess, there a comercial or free backup-mx services out there. No problem. If you have a static ip for your homelab or at least a dynamic dns-name, it will work. Recieving is easy. But you will need a good forward-service for sending.

  • Nope. It can’t really be self hosted anymore, as having a residential IP is a straight track to the spam folder. It can be done if you also pay for a mail relay service, but then what’s the point of self hosting when you need to rely on a cloud service anyways.

  • Obligatory PSA: ProtonMail isn't any more secure than Gmail and is likely a honeypot scheme crafted by government agencies: https://encryp.ch/blog/disturbing-facts-about-protonmail/

    I know the title of that sounds clickbaity, but they cite their sources. It's worth the read for those curious about ProtonMail's history and their CEOs.

    • Tbh, that document reads like a discovery channel 2am aliens documentary, but it's not completely without merit.

      There are a couple line items about software services they're using that are shitty that sound pretty legit. The fact that they're operating in locations where they might have to hand over data sounds pretty legit. Their warrant compliance and logging/handing over a person's IP address is legit.

      The CIA honeypot stuff is all really circumstantial. If the CIA was in as deep as is claimed, a lot of the real evidence people are turning up that they're not a secure as they could be would be unnecessary.

      My best guess is they decided to make an email company based in Switzerland with the schtick that they're secure (banks amirite?) They're doing what they can to appear secure without spending too much money. They're not going to have legal battles to keep your data private, and they are going to comply with agencies request for data. Even if they support end-to-end encryption if they are required by an agency to turn that encryption off for you, they're going to do it.

      They're probably less likely than Google or Microsoft to sell all of your data to the highest bidder, but realistically there's no such thing as secure email.

  • Your own email server requires near 100% uptime or you risk not receiving critical emails. If a remote email server is trying to contact your email server and it can't it's only going to retry a few times and then give up. Hosting this yourself sounds great until you realize high uptime is not cheap and requires constant attention.

    Setting it up securely can be difficult depending on your understanding of server infrastructure as well as protocols like DNS. You need to set up SPF, DKIM, DMARC, etc in order to prevent someone from faking an email from your server.

    Of course, federated email does not use SPF/DKIM/DMARC because the whole point is that someone from another server could use your server to send an email (hence the federation). Open email servers were common 20 years ago but very rare today. That makes setup easier, but the main caveat is that most known non-federated email servers will reject email from servers that don't have SPF/DKIM/DMARC because they generally end up being havens for bots and spam since there is no verification or authenticity of the sender.

    As someone who self hosts a lot of things, I would never self host my email. If i did I would be paying for two boxes in different parts of the world on different ISPs to provide that uptime. I would definitely set it up securely and not as a federated server otherwise it would be practically unusable for day to day emails.

    • Your own email server requires near 100% uptime or you risk not receiving critical emails.

      I disagree. You can take some amount of downtime without issue.

      https://wpmailsmtp.com/docs/how-to-automatically-resend-a-failed-email/ as an example for some services.

      Many services (including postfix by default) will attempt a number of resend operations before it gives up.

      Of course, federated email does not use SPF/DKIM/DMARC because the whole point is that someone from another server could use your server to send an email (hence the federation).

      What? All email is federated. What are you talking about here? SPF/DKIM/DMARC are on top of email... and have nothing to do with the federated property of email. Federation does not mean that you login or use another server. But that you have your instance, and the servers hash out the cross communication amongst themselves. That's EXACTLY what email servers do using SMTP.

      I would definitely set it up securely and not as a federated server otherwise it would be practically unusable for day to day emails.

      If your email wasn't federated then you would get emails from anyone outside of your own instance. That would make email useless for 99% of the world.

      • I take "federated email" to refer to a juxtaposition with normal email implementation which harkens back to how it was in the 90s or early 00s where you didn't need to be registered on many SMTP servers in order to use it and it's stripped of server-side validation. There's some discussion on this topic in the fediverse.

        You're right that the default current implementation is already federated.

  • E-mail was the first "thing" that got me off of Google (to Proton & then currently Tutanota) but is really the last remaining service I not have self hosted.

    I have always read about how difficult and time consuimg it was to run your own mail server, but I felt like I needed to experience it myself. So I purchased another domain and followed the instructions on https://mailinabox.email/.

    I am using a small VPS on Hetzner and I have to say the experience has been almost flawless so far. I did need to have my new domain taken off the Domain Block List, but Hetzner gave me a clean IP and defaults to blocking port 25 outbound to prevent spam (simple ticket to open, once account is 30 days old and paid).

    I know I'm still early into this journey so far, but it has been really simple and I plan to test this secondary domain for a few months before moving onto it full time.

    As an avid self hosted of literally everything else, I can say it has been a lot of fun learning so far!

65 comments