I ran my own self-hosted email server from 2008-ish to 2018, and I would highly recommend against doing it! Especially when Fastmail and Proton are so cheap.
I was running Postfix+Dovecot+Seive+SpamAssassin+Fail2ban+certbot+spf+dkim+reverse-ip+<other random crap>
It worked! Receiving email was overall pretty easy. I know I also did things the "hard way" by ad-hoccing all that together, and today there are a lot more out-of-the-box solutions that do all that for you. But still. Being a full-time email administrator is a job I will never do again unless I'm getting paid for it.
You know what really sucked? Deliverability. Frequently, emails I would send would just ... vanish ... no warnings, no errors, no failures. From my end, everything was perfect. Until days later, people would follow up with me and say, "Are you going to send that email?" ...
I had a business IP (Comcast Business). The IP address was clean, not black listed anywhere, not on SORBS or other lists. Still, successfully delivering an email was like 50/50, with no way to confirm the other party actually got it.
Had no problems at all self-hosting for two decades; then a provider went bust and I lost my static IP block, and with it its two decades of reputation.
I still self-host, but now I cheat for deliverability: route the problematic destinations (I'm looking at you, Outlook) through Amazon SES. At a few cents for five-figure numbers of emails, it's as close to free for personal/vanity email quantities as it gets to have someone whose full time job it is to make sure outgoing mail stays deliverable on your side while still keeping everything else under your control.
One thing to note is that Amazon are not very good at keeping amazonses.com up to date, so despite including it you can't set DMARC to hard-fail SPF or you will have mail bounce days.
I'm running 4 email servers, the oldest is from 2011 or so, to this day.
4 different countries, different AS.
I'm always puzzled by all the issues described by others. I had about 4 issues during these 15 years, all 4 were solved by reading the bounce message and doing what was asked in the message (contacting support of the destination).
Same. People just remember it's hard because they don't test, don't like responsibility much and esp. because they test this in production not on a spare domain. Then all you remember from it is the 10 people shouting at you and that you need to fix it NOW and it's all super stressful so they never attempt this again.
A lot has changed, in fairness. Stalwart + LLMs can help with the full-time email administrator part. It's a lot easier than it was.
And on the deliverability side, using SES for sending avoids this entirely. Yes, ok, not fully self-hosted I suppose, but it's close enough (and for most people, the bill will be pennies).
Yes, I do something similar (with Amazon SES in my case) but only for domains I know are problematic (Microsoft-hosted domains are the main difficulty - I've never had issues with eg Gmail).
Well, generally you need 2 different programs regardless. Usually an SMTP server for accepting and storing emails and a IMAP server for clients to connect to and read stored emails.
For the parent post, you configure an outgoing SMTP relay
You could do it any way you like, but it you have your own mail server, just configure it to route specific recepient domains (or all domains, this is called a "relayserver" in the postfix documentation) to a specific mail server. Just remember to flag your desired outgoing mail servers as approved for your domain (in the SPF record).
For the end-user's perspective (ie, the dude who just wants to do email stuff with a mail reader like Thunderbird): It's two separate paths, as has been a normal thing for standards-based email for an eternity.
A user's inbound mail accumulates on a mail server. One server [protocol] handles getting the user's inbound mail to that user's mail client, usually with protocols like POP or IMAP, which lets the user retrieve that accumulation.
Another server handles whatever mail the user decides to send, using SMTP. Each server is configured within the user's mail client, and that's just the normal way of doing things. It's ~always been split up like this (aside from outliers like Microsoft Exchange). :)
The user doesn't have to know anything about the existence or addition of a system like smtp2go. They just configure their client to send mail through mail.orgname.com (or whatever) like usual, and the back end handles the rest. Their pop/imap server address also stays the same.
---
Anyway, mail servers and relays. Mail servers don't talk to eachother using things like POP or IMAP. The traditional Internet way for a mail server to send mail to another is to look up the recipient domain's MX (Mail eXchanger) entry in DNS, which specifies the inbound mail server, and just send it over using SMTP.
It was thus delivered. It was all very trusting.
That trust began to break when spam became a problem that never went away. Requirements and reputation and filtering became a serious ordeal for mail servers -- both on the sending and the receiving side of things.
Services like smtp2go can handle part of the sending-side trust-wizardry in a centralized way. They do things like maintain the reputation of their IP addresses.
In using it like this, orgname's server (which might very well be under someone's desk) ceases to directly connect to each and every recipient domain's MX.
It goes through smtp2go instead: All outbound mail simply gets routed through smtp2go, as the result of a central back-end configuration thing on orgname's mail server.
In email terms this is called relaying, though smtp2go might prefer the term smarthost[1].
Meanwhile, local internal mail (from joe@orgname to jill@orgname, say) can just get delivered locally. It doesn't have to be relayed at all.
But, again: The user doesn't need to know or care that their mail is/isn't being relayed, and the concept of relays themselves is as old as the hills. The user can just be happy that their mail gets where it needs to go instead of being silently dumped into a ditch, and they don't need to do anything different on their end for this to happen.
It's moslty due to how the protocol works. Sending and Receiving are asynchronous and may or may not follow the same path.
When sending the other side is the server, when receiving, you are the one. The protocol also has the concept of relaying, where message can go trough intermediary nodes.
So you can set one server for receiving email (yours) and another one for sending (smtpgo).
For actually reading, the server for receiving need to deliver the message (either built-in feature or through a program) to the correct mailbox. That would probably means writing it on disk somewhere. And then you need to use a mail user agent (MUA) to read that file. Protocol like imaps and pop3 are for transfering your inbox to another computer, not for receiving or delivering email.
Same story. Ran a set of about 20 postfix mail servers for my company. Prided myself on being proactive, setting everything up correctly. Using things like DANE even before they were mandatory but the trouble was always random blocking which was outlook.com 90% of the time and occasionally yahoo and Deutsch telekom. At least the latter provided contact details and were helpful getting things unblocked but Microsoft had horrific support. You are blocked, we won't or can't tell you why, nothing in the mail management system shows you any problems so we can't tell you what to fix, please see this 15 year old guide as to how to setup email properly and we will tweak the setting a bit to let your mail through until the next time we decide to block it.
So frustrating because they have no legal obligation to accept our emails but our product relies on them being delivered.
There used to be some web form for msn/Hotmail/outlook you could submit your IP to and 1-6 months later it would magically start working _most of the time_
This seems to depend so much on the IP address space one is in. I have never experienced deliverability issues after the first year–and that's since the 2010s iirc. The first year I had to ask several friends to send me emails first, or dig out my email from spam and reply to it. After that it worked flawlessly for Gmail, which was hit-or-miss before. A single ISP I had to write to manually–the person responding to my mail explained that they blocked emails from my hoster's IP range wholesale but made an exception for my IP explicitly.
Never had any issues since then, though I did have to adjust to new standards such as DKIM, DMARC, SPF etc. over the years.
I think the timeline is critical here and should be highlighted. Self hosting email server was something that worked out just fine in the past (used to host until 2014), however things have changed a lot with the scale of abuse. its not worth it unless you are doing it as a business. Sending a email from your home IP to big email providers with reliability is next to impossible. Even if we discount the spam management,
1. IP reputation is a big deal, its not just about not being on some blocklist, call it a cartel at this point, its about being on the allow list for other mail providers
Yes I figure if I’m going to pay someone to resolve a domain to an IP address I might as well pay the same person to operate my mailbox. Having clients that sync the mailbox offline is “local” enough for me.
I have had my own e-mail server since 2017, and there is only one instance where I know I had a delivery problem, and in that case it was funny, because I wrote to two people who had the same e-mail server, and one got the e-mail the other did not. So probably a SPAM issue, but certainly nothing my e-mail server could have done better...
AFAIK, that case in 2019 was the only time an e-mail went missing.
That's cheaper than I can rent any mail-capable VPS for, and it's cheaper than the electricity I'd pay (80W @ $0.15/kWh = $316 over 3 years) to self-host.
And that doesn't include my personal-time hourly cost.
you can check your delivery rate with services there are lots that are free to check and they also offer to "warm" your reputation. I have not done that yet (money!) and outside this:
- Outlook.com consumer mail addresses
you can still get >99% delivery rate if you have spf, dkim and all the new cool stuff.
So no, please DO NOT recommend against doing it because ONLY if mail stays a decentralized service providers will stay forced to not blacklist everything but other large providers.
Easier to self host inbound and relay outbound. SMTP relays are effectively a commodity and pennies for personal usage. Worth <$1/yr to not screw with IP rep unless you own a /24. Less than /24 you risk some knucklehead getting the whole block listed
I used to run mail servers for a university and I also suggest that no one should do this. It's hard enough to get right when it's your full time job. No one wants that kind of headache just for an email address. Do what I do and pay for Proton and stick your domain on it.
Running your own email infra is not at the same level as the usual “self hosting”. Not to mention that email can be critical and missing an important email can burn a lot. Why put in that much effort on your free time, and take the risk?
You don’t build your own fridge. If it’s important and not your strong suit, pay someone to do it for you.
Will second this, as someone that took the same path. Alternatives like Fastmail are so, so cheap when compared to the headache of building, maintaining, and troubleshooting a DIY stack. For something as fundamental as email you really want to choose the solution that gives you NO problems, rather than some solvable but troublesome problems at regular intervals.
Just too critical of a component in most people's lives to accept any level of unknowns in.
Even in the face of all the advice on reddit and HN that says never to host your own mail server, I have been doing so successfully for at least 15 years. It helps that I have had the same spam-free IP address for most of that time. All I ever do is run `apt upgrade` approximately once a week. Costs all of $5 a month and there's just enough RAM leftover that I can also use it for wireguard tunnels or whatever if I need to.
I have decided that if my VPS provider shuts down, I can just send my outgoing mail through a cloud provider's SMTP gateway. My volume is low enough that it will be free or cost a few cents a month.
Deliverability is not a problem for me, but incoming spam does not have a great solution. Even with rspamd, a lot of crap gets through if you start spamming your email address everywhere. This is why I use a lot of throwaway and company-specific email address.
If you only have one email address, yeah Fastmail or whatever is cheap. But as soon as you want multiple users (family) and throwaway email addresses, it gets expensive in a hurry. But those are free if you self-host.
Before self-hosting your own, first get a domain and just point it at a mail
provider that allows custom domains. It will cost, but so will a VPS. I suspect
a lot of DIY homelab types would have most of their needs met with just that
setup:
- you get the vanity email address
- you can switch email providers (including self-hosting later on)
- you can have ~unlimited aliases (depends on the provider)
Most of the setup consists of steps you will have to take anyway when
self-hosting (getting a domain, changing DNS records), except for a major amount of
headaches that will be taken care of for you.
Agreed. Never use a provider-specific email domain, when for a tiny amount per year you can have an email at your own domain that stays the same no matter who your email provider is.
I ran my own mail server from 1999-2008, starting when I worked at Sendmail. I helped create SPF and DKIM.
I would never run my own mail server today. Deliverability is a nightmare, despite what this article says. Gmail/Hotmail (and all the domains they host for people, which is quite a lot) will pretty much block or silently drop any email that isn't from a large, known provider who has actually talked directly to them.
If you don't have time to be a full-time mail deliverability engineer/product manager, just pay someone to do it for you.
I guess there is the edge version and more recent commits, and overall it should be stable, but you'd think there'd be more small patch releases to decrease the eventual risk of CVEs. Either way, cool that it exists.
I do. It's nowhere as hard as everyone on here makes it out to be. And I don't even use an easy solution like Mailcow.
Spam is a solved problem with rspamd, and it's not even an llm
I’m wondering what the most fool proof way to get a message delivered to someone else is. I found out today some SMS messages I sent were silently dropped. Email doesn’t always get delivered. I would hope the closed ecosystems like Signal and Whatsapp are better at this and in any case you need both parties to agree on a channel. I just like email because my identity is maintained even when I switch providers, and nothing else quite like that exists.
That is the exact problem that got me to abandon my splendidly working, self-hosted email stack. I had so many instances of mail just not getting delivered, despite doing absolutely everything correctly, that I gave up.
Thankfully not a problem we've encountered yet. All my mail is DKIM signed, SPF aligned etc. I also registered on dnswl.org which is a signal quite a few people seem to use.
I still handle email for multiple small businesses (for over 20 years) and recently switched from the mailscanner+spamassasin to rspamd and the scanning is so much better/easier now
my backend is still dovecot+postfix, still works beautifully. I am able to run rspamd+dovecot proxy on a small vps and the storage is handled by a backend office server with dovecot. If VPS has an issue can spinup another easily/anywhere and backend is also virtualized (libvirt) so easily restored (with multiple backups in multiple places)
biggest thing to worry about with deliverability is ensuring your SPF and DKIM (opendkim) are correct, which is not too difficult and rspamd is able to handle the dkim signing/verification which is nice
Personal mailserver sorry. rspamd stops all the sent-using-my-from-address "i hacked you" emails (DMARC drops them) and all the other random spam stuff. I can imagine though a large business with thousands of email accounts it wouldn't be as easy though.
I know an old-school Linux admin who has been successfully running his own email servers for 30+ years - from small private ones to larger corporate setups. For spam detection he uses his own system, and it works surprisingly well even without any LLM (though an LLM could surely make it even better). So the "you can't self-host email" meme was never quite true - it is about willingness and ability to configure everything right.
If you are self-hosting because you care about privacy, I'm not sure why. Email requires two parties. Unless both parties are self hosting, some company has a copy of that email. Google, Microsoft, and Amazon probably see 99% of all email on the internet (ok maybe not that much but probably pretty close).
I'm not sure what privacy you gain by self hosting these days, since no one else is.
I'd run my own email server since the early 2000's - in several forms over time. A VA Linux 2U rack server that I got from work (noisy, overkill), a personal Mac Mini (Frankenstein macport upgrade-resistant), and now a single-node k8s instance with everything neatly managed (an excuse to really dive into k8s from the ground up).
I use dyndns to handle IP changes (incredibly rare with Frontier FIOS, actually).
I use mailhop.org to handle secondary MX records in case my machine is down (as well as mail filtering)
Everything else is postfix, spamassassin, dovecot imap
It's not a trivial system, and it took a while to get everything working how I wanted. It's a terrific learning opportunity, but it's by no means simple to mentally model the process of all that happens inside.
I've been self-hosting for 20 years now - a few years ago I switched to using Mail-in-a-Box (https://mailinabox.email/) which makes management a lot easier than configuring each service manually.
It definitely requires some effort but once you've got it up and running it's pretty hands off. The only issues I've ever had are expiring certs but I've fixed that by configuring auto-renewals and it's all good now.
Ensuring your source IP isn't blacklisted is probably the single most important factor. I had to request a new IP from Linode where my server runs as the one it was originally assigned had a bad reputation.
I've hosted and actively used my own email server for > 10 years and there are two things that are true at the same time:
It is absolutely possible to host, use, and achieve decent deliverability with your own server. It takes work and is a different beast than running a webserver, but that frontier is not dead (yet).
At the same time: it is an ABSOLUTELY TERRIBLE IDEA to suggest that folks operate an email server out of residential IP through your ISP. The spam prevention ecosystem is so draconian now that email traffic flowing out of address ranges belonging to residential owners is yeeted into the sun. If you've operated email infrastructure at decently large scales, you know that SPF/DKIM/DMARC are just one part of how spam is identified, and mixing in the source of email traffic into the detection heuristics is a significant part of that identification process. Achieving decent delivery can often involve "warming up" an IP over time to establish its reputation, and consumer address ranges are a hodge-podge of activity that incur very little trust about what they're doing.
I agree with some commenters that exhort the exercise of self-hosting email to prevent the venerable protocol becoming a homogeneous GMail and Outlook-only world, but there are reliable ways to do this: using a VPS, relying on a company for the sending/SMTP part, or something similar. But footguns abound, and disgorging SMTP packets from your LAN edge is one of them.
The biggest problem with self-hosting a mail server is reliably being able to send email and have it be delivered to the recipient. Something I have been thinking about setting up is self-hosting a dovecot server so that all of my emails that I receive are on my system, but using another provider for sending email. I don't send that many emails, so there is not much privacy loss in regards to a third-party being able to see my sent emails, but I still get the benefit of noone but me having access to my received emails.
> but I still get the benefit of noone but me having access to my received emails.
Other than every smtp relay hop and any network tap along the way that could keep a copy. Hope you're encrypting and not worried about the envelope. Email is fundamentally not private. Self-hosting doesn't help all that much (though it may keep it out of certain companies' hands, aside from the emails copied to or sent from that provider)
Ive self-hosted my email server since 1999. It started in a closet at home in San Francisco. As things got more restrictive (residential ips being black holes) I moved to a Colo. but now I'm back to hosting it on my server in my cellar. I have a fixed ip from my provider init7 (Switzerland) that has never been blacklisted. Reverse dns is set up. All the acronyms like spf, dkim, dmarc are set up. I have no problems sending to Microsoft and Google email addresses.
So I'm doing it now but I'm ready to switch back to one of my Colo servers at any time and I won't be surprised if I have to at some point.
I started hosting my email at home some months ago and it works great. However, my ISP blocks some ports necessary for running a mailserver (incoming SMTP), so I have to use an SMTP relay (which is on a VPS and does port 25 to some other port that is not blocked).
Additionally, to not worry about deliverability, I let my mailserver send all outgoing mail through another service.
The additional costs for this are about 2€/month.
I use Stalwart as a mail server and it was not too hard to setup (with some caveats to get it working with my SSL certs behind a reverse proxy. But nothing a bit of LLM chatting couldn't solve).
All in all, it's not 100% self hosted, but works well.
However, I don't agree with the suggestion in the article to use a self hosted LLM. My mailserver needs a few hundred MBs of RAM at max, but with the spam filter this would increase like 10x-100x.
I also run mail servers for others, mostly non-profit adjacent groups who don’t have the capital to be extorted by cloud service providers.
Sure, there are some things to learn, but like anything – if you do it properly, it’s not hard and can work properly. Never had any deliverability issues over that time (yes, even to the big providers). I also almost never touch the boxes (I do about one architectural overhaul a decade and am working on the next right now).
If you’re willing to invest the time and resources to do it properly, I agree, it works fine.
I started self-hosting my email server earlier this year. I use maddy[0] as my email server and route outgoing mail through MailPace[1] to avoid being memory-holed (despite having SPF and DKIM set up correctly).
My reason for self-hosting is control, not privacy: the fact that the cleartext of my outbound emails is visible in the MailPace UI is not a concern; the problem I'm solving is that email providers can delete your account.
> but if your home internet checks these boxes, you can 100% host your own mailserver at home:
Static IPv4 address (make sure it's not blacklisted)
Not behind a CGNAT
Ability to change the PTR record of your IP (usually though the support of your ISP)
Ability to open common mailserver Ports (25,143,465,587,993)
Because above is only needed if you want to communicate with people using Gmail, Yahoo, Outlook, Fastmail, Proton etc (The monopoly).
For normal folks, they are better off using an alternate less privileged email service like email.riamu.io.
Delivery isn't the problem, just people don't use mail as much as they used to. Most people reach for signal or whatsapp to communicate. Most mail is order confirmations. So don't really care if people can't get mail, it isn't the primary communication tool for most people like it used to me.
Every single person I know who has run their own email server has, at one point or another, either outright lost mails or had important mails delayed for days.
I was going to self host my email server, but somehow my email provider (Migadu) is cheaper than a VPS ($19 USD per year) and offers custom domains, catch-all, and unlimited addresses.
Sorry the title should have been "You should self-host your mail server" but it seems HN removes the "You should" in the beginning of a title.
I wanted to start this discussion because I think we are prime for more self hosted mail servers in 2026 and in the post I explain how to use a locally hosted LLM to nudge the spam detector rspamd to whether or not an incoming mail is spam.
Also in times where the EU can order your mail providers to scan for unwanted content [1] (currently limited to CSAM, later probably more) it does feel better to have your data at your hand.
I'd love to self-host a mailing list, or that protonmail or fastmail offered listserv like functionality. It feels fairly intimidating to hoist my own mail server and listserv on top of that. It feels like there's too much domain-specific knowledge one needs to have to reliably debug and maintain it: DKIM, spam management, certbot, fail2ban, blah blah blah.
A lot of them will let you if you ask, for instance even ionos or ovh. Digital ocean have a blanket ban on port 25 ipv6 but I haven't seen a reason to use them for a decade now. +1 for mythic beasts
I've been self hosting since 2012 or so and it is a mixed bag. Deliverability is fine provided you're on a clean IP range, which generally only reputable hosts have.
There was a moment when my son was born and he was in NICU that my mail broke. I just went without for a while. Not ideal.
Since then I've thought: self hosting is nice but hosting cooperatively is probably the best way forward. Democratic control might beat technical control. I'll do it soon, I think: I'd be fascinated to know what people think.
I’m very interested in this approach. I’ve hosted friends’ websites for decades but I’ve been the single-point of failure, so “cooperative” is very enticing.
I’m currently working on a cooperative “lights-on” solution which might be complementary.
I've tried self-hosting my mail server, but that means all my outgoing mail will go to Spam on all providers that use reputation-based filtering. In all cases I had SPF, DKIM and DMARC working perfectly, PTR records, etc. but it just doesn't matter. Even a Fastmail domain goes right to spam on my personal account, and they are very very established. It's just not worth it.
I use a dedicated server and a vps for this, so I get around the residential IP reputation issue. The rest of the problems with deliverability are overblown. In 15 years of doing it on multiple servers, I've had one 2 month period where Gmail was spamming me and one month where Yahoo spammed me. In both cases it stopped without me changing anything, I've always suspected it's brief periods of anti-competition attempts which don't last forever
I never used residential IPs. Most ISPs don't even let you set PTR records on those. My problem was that any server at practically any provider would reuse an IP that previous customers have used to send spam in the past. For example you can't hope to send mail from a DigitalOcean IPv4 address without going to spam. Nor from Kamatera. There are probably a few more providers that are basically blackholed because they're so often used for spam. (I don't have experience with providers that don't offer IPv4.) I believe some providers even attempt to block outgoing mail.
Running your own mail server is easy for receiving mail, but it is very hard to keep your IP from getting on some random blacklist that is impossible to get off.
The problem isn’t spam, the problem is you becoming the spam.
I did test email selfhosting before and there’s a substantial amount of times my emails were never seen by the recipient, sometimes it did cost me good jobs/deals.
So now I use paid email while I control the domain and everything else, so I have the portability feature if I wanted to switch providers without any efforts, but I know now my emails will be delivered whenever I hit sent.
That being said, I self host everything else in my digital life, and I believe everyone should.
I disagree with the author. If you have your own domain for e-mail, then you've already dealt with all risks and vulnerabilities. Of course you have your e-mail stored locally as well by using an e-mail client, which you would anyway.
Man these days it's nearly impossible. Even my web host has trouble hosting email, even though I use it and they do a decent job. Only medium-sized specialist companies and large ones like Gmail do it well. It's just those spammers - we could have nice things like self-hosted email if everyone were nice, but we can't.
I ran my own self-hosted email server from 2008-ish to 2018, and I would highly recommend against doing it! Especially when Fastmail and Proton are so cheap.
I was running Postfix+Dovecot+Seive+SpamAssassin+Fail2ban+certbot+spf+dkim+reverse-ip+<other random crap>
It worked! Receiving email was overall pretty easy. I know I also did things the "hard way" by ad-hoccing all that together, and today there are a lot more out-of-the-box solutions that do all that for you. But still. Being a full-time email administrator is a job I will never do again unless I'm getting paid for it.
You know what really sucked? Deliverability. Frequently, emails I would send would just ... vanish ... no warnings, no errors, no failures. From my end, everything was perfect. Until days later, people would follow up with me and say, "Are you going to send that email?" ...
I had a business IP (Comcast Business). The IP address was clean, not black listed anywhere, not on SORBS or other lists. Still, successfully delivering an email was like 50/50, with no way to confirm the other party actually got it.
Had no problems at all self-hosting for two decades; then a provider went bust and I lost my static IP block, and with it its two decades of reputation.
I still self-host, but now I cheat for deliverability: route the problematic destinations (I'm looking at you, Outlook) through Amazon SES. At a few cents for five-figure numbers of emails, it's as close to free for personal/vanity email quantities as it gets to have someone whose full time job it is to make sure outgoing mail stays deliverable on your side while still keeping everything else under your control.
One thing to note is that Amazon are not very good at keeping amazonses.com up to date, so despite including it you can't set DMARC to hard-fail SPF or you will have mail bounce days.
I'm running 4 email servers, the oldest is from 2011 or so, to this day.
4 different countries, different AS.
I'm always puzzled by all the issues described by others. I had about 4 issues during these 15 years, all 4 were solved by reading the bounce message and doing what was asked in the message (contacting support of the destination).
Same. People just remember it's hard because they don't test, don't like responsibility much and esp. because they test this in production not on a spare domain. Then all you remember from it is the 10 people shouting at you and that you need to fix it NOW and it's all super stressful so they never attempt this again.
I had a Digital Ocean VPS and it was fine about 7 years but on year 8 the entire /24 got blacklisted and it was game over
Took about 6 months initially of fiddling to get other email services to accept mail DKIM, DMARC, SPF, PTR, web form requests
A lot has changed, in fairness. Stalwart + LLMs can help with the full-time email administrator part. It's a lot easier than it was.
And on the deliverability side, using SES for sending avoids this entirely. Yes, ok, not fully self-hosted I suppose, but it's close enough (and for most people, the bill will be pennies).
I take a middle path. Self-host receiving mail, and use smtp2go.com for outgoing
Yes, I do something similar (with Amazon SES in my case) but only for domains I know are problematic (Microsoft-hosted domains are the main difficulty - I've never had issues with eg Gmail).
How do this work? Do you need to use two different programs to send and read email?
Well, generally you need 2 different programs regardless. Usually an SMTP server for accepting and storing emails and a IMAP server for clients to connect to and read stored emails.
For the parent post, you configure an outgoing SMTP relay
Iirc called smarthost in postfix
You could do it any way you like, but it you have your own mail server, just configure it to route specific recepient domains (or all domains, this is called a "relayserver" in the postfix documentation) to a specific mail server. Just remember to flag your desired outgoing mail servers as approved for your domain (in the SPF record).
For the end-user's perspective (ie, the dude who just wants to do email stuff with a mail reader like Thunderbird): It's two separate paths, as has been a normal thing for standards-based email for an eternity.
A user's inbound mail accumulates on a mail server. One server [protocol] handles getting the user's inbound mail to that user's mail client, usually with protocols like POP or IMAP, which lets the user retrieve that accumulation.
Another server handles whatever mail the user decides to send, using SMTP. Each server is configured within the user's mail client, and that's just the normal way of doing things. It's ~always been split up like this (aside from outliers like Microsoft Exchange). :)
The user doesn't have to know anything about the existence or addition of a system like smtp2go. They just configure their client to send mail through mail.orgname.com (or whatever) like usual, and the back end handles the rest. Their pop/imap server address also stays the same.
---
Anyway, mail servers and relays. Mail servers don't talk to eachother using things like POP or IMAP. The traditional Internet way for a mail server to send mail to another is to look up the recipient domain's MX (Mail eXchanger) entry in DNS, which specifies the inbound mail server, and just send it over using SMTP.
It was thus delivered. It was all very trusting.
That trust began to break when spam became a problem that never went away. Requirements and reputation and filtering became a serious ordeal for mail servers -- both on the sending and the receiving side of things.
Services like smtp2go can handle part of the sending-side trust-wizardry in a centralized way. They do things like maintain the reputation of their IP addresses.
In using it like this, orgname's server (which might very well be under someone's desk) ceases to directly connect to each and every recipient domain's MX.
It goes through smtp2go instead: All outbound mail simply gets routed through smtp2go, as the result of a central back-end configuration thing on orgname's mail server.
In email terms this is called relaying, though smtp2go might prefer the term smarthost[1].
Meanwhile, local internal mail (from joe@orgname to jill@orgname, say) can just get delivered locally. It doesn't have to be relayed at all.
But, again: The user doesn't need to know or care that their mail is/isn't being relayed, and the concept of relays themselves is as old as the hills. The user can just be happy that their mail gets where it needs to go instead of being silently dumped into a ditch, and they don't need to do anything different on their end for this to happen.
[1]: https://www.smtp2go.com/blog/what-is-a-smarthost/
It's moslty due to how the protocol works. Sending and Receiving are asynchronous and may or may not follow the same path.
When sending the other side is the server, when receiving, you are the one. The protocol also has the concept of relaying, where message can go trough intermediary nodes.
So you can set one server for receiving email (yours) and another one for sending (smtpgo).
For actually reading, the server for receiving need to deliver the message (either built-in feature or through a program) to the correct mailbox. That would probably means writing it on disk somewhere. And then you need to use a mail user agent (MUA) to read that file. Protocol like imaps and pop3 are for transfering your inbox to another computer, not for receiving or delivering email.
Same story. Ran a set of about 20 postfix mail servers for my company. Prided myself on being proactive, setting everything up correctly. Using things like DANE even before they were mandatory but the trouble was always random blocking which was outlook.com 90% of the time and occasionally yahoo and Deutsch telekom. At least the latter provided contact details and were helpful getting things unblocked but Microsoft had horrific support. You are blocked, we won't or can't tell you why, nothing in the mail management system shows you any problems so we can't tell you what to fix, please see this 15 year old guide as to how to setup email properly and we will tweak the setting a bit to let your mail through until the next time we decide to block it.
So frustrating because they have no legal obligation to accept our emails but our product relies on them being delivered.
I gave up and moved everyone over to SES instead.
There used to be some web form for msn/Hotmail/outlook you could submit your IP to and 1-6 months later it would magically start working _most of the time_
Not sure if that's still the case
This seems to depend so much on the IP address space one is in. I have never experienced deliverability issues after the first year–and that's since the 2010s iirc. The first year I had to ask several friends to send me emails first, or dig out my email from spam and reply to it. After that it worked flawlessly for Gmail, which was hit-or-miss before. A single ISP I had to write to manually–the person responding to my mail explained that they blocked emails from my hoster's IP range wholesale but made an exception for my IP explicitly.
Never had any issues since then, though I did have to adjust to new standards such as DKIM, DMARC, SPF etc. over the years.
I think the timeline is critical here and should be highlighted. Self hosting email server was something that worked out just fine in the past (used to host until 2014), however things have changed a lot with the scale of abuse. its not worth it unless you are doing it as a business. Sending a email from your home IP to big email providers with reliability is next to impossible. Even if we discount the spam management,
1. IP reputation is a big deal, its not just about not being on some blocklist, call it a cartel at this point, its about being on the allow list for other mail providers
2. Keeping it reputable is a continuous effort
The importance of IP reputation is a reason for why email isn't using IPv6 much.
Yes I figure if I’m going to pay someone to resolve a domain to an IP address I might as well pay the same person to operate my mailbox. Having clients that sync the mailbox offline is “local” enough for me.
I have had my own e-mail server since 2017, and there is only one instance where I know I had a delivery problem, and in that case it was funny, because I wrote to two people who had the same e-mail server, and one got the e-mail the other did not. So probably a SPAM issue, but certainly nothing my e-mail server could have done better...
AFAIK, that case in 2019 was the only time an e-mail went missing.
That’s something I have hard time explaining to the business.
Yea we do all the best practices but still no one can guarantee 100% deliveries. Just not possible for e-mail.
Yes we can have 100% over a year but after that it still is a lottery, can’t say anything about future not having suddenly 40% not delivered
Fastmail is not cheap...
Fastmail is like $150 for 3 years.
That's cheaper than I can rent any mail-capable VPS for, and it's cheaper than the electricity I'd pay (80W @ $0.15/kWh = $316 over 3 years) to self-host.
And that doesn't include my personal-time hourly cost.
you can check your delivery rate with services there are lots that are free to check and they also offer to "warm" your reputation. I have not done that yet (money!) and outside this:
- Outlook.com consumer mail addresses
you can still get >99% delivery rate if you have spf, dkim and all the new cool stuff.
So no, please DO NOT recommend against doing it because ONLY if mail stays a decentralized service providers will stay forced to not blacklist everything but other large providers.
Easier to self host inbound and relay outbound. SMTP relays are effectively a commodity and pennies for personal usage. Worth <$1/yr to not screw with IP rep unless you own a /24. Less than /24 you risk some knucklehead getting the whole block listed
I used to run mail servers for a university and I also suggest that no one should do this. It's hard enough to get right when it's your full time job. No one wants that kind of headache just for an email address. Do what I do and pay for Proton and stick your domain on it.
"Hacker"news: Don't actually do it yourself man, just pay someone!
Running your own email infra is not at the same level as the usual “self hosting”. Not to mention that email can be critical and missing an important email can burn a lot. Why put in that much effort on your free time, and take the risk?
You don’t build your own fridge. If it’s important and not your strong suit, pay someone to do it for you.
Have you actually measured delivery rate of some service vs. doing it yourself?
Will second this, as someone that took the same path. Alternatives like Fastmail are so, so cheap when compared to the headache of building, maintaining, and troubleshooting a DIY stack. For something as fundamental as email you really want to choose the solution that gives you NO problems, rather than some solvable but troublesome problems at regular intervals.
Just too critical of a component in most people's lives to accept any level of unknowns in.
Even in the face of all the advice on reddit and HN that says never to host your own mail server, I have been doing so successfully for at least 15 years. It helps that I have had the same spam-free IP address for most of that time. All I ever do is run `apt upgrade` approximately once a week. Costs all of $5 a month and there's just enough RAM leftover that I can also use it for wireguard tunnels or whatever if I need to.
I have decided that if my VPS provider shuts down, I can just send my outgoing mail through a cloud provider's SMTP gateway. My volume is low enough that it will be free or cost a few cents a month.
Deliverability is not a problem for me, but incoming spam does not have a great solution. Even with rspamd, a lot of crap gets through if you start spamming your email address everywhere. This is why I use a lot of throwaway and company-specific email address.
If you only have one email address, yeah Fastmail or whatever is cheap. But as soon as you want multiple users (family) and throwaway email addresses, it gets expensive in a hurry. But those are free if you self-host.
Before self-hosting your own, first get a domain and just point it at a mail provider that allows custom domains. It will cost, but so will a VPS. I suspect a lot of DIY homelab types would have most of their needs met with just that setup:
- you get the vanity email address
- you can switch email providers (including self-hosting later on)
- you can have ~unlimited aliases (depends on the provider)
Most of the setup consists of steps you will have to take anyway when self-hosting (getting a domain, changing DNS records), except for a major amount of headaches that will be taken care of for you.
Agreed. Never use a provider-specific email domain, when for a tiny amount per year you can have an email at your own domain that stays the same no matter who your email provider is.
how else can you get a cool PO Box.com email address without using fastmail though?
Agreed. Also being able to use as many aliases as you like (or a catch-all) is very nice.
I ran my own mail server from 1999-2008, starting when I worked at Sendmail. I helped create SPF and DKIM.
I would never run my own mail server today. Deliverability is a nightmare, despite what this article says. Gmail/Hotmail (and all the domains they host for people, which is quite a lot) will pretty much block or silently drop any email that isn't from a large, known provider who has actually talked directly to them.
If you don't have time to be a full-time mail deliverability engineer/product manager, just pay someone to do it for you.
> A good starting point would be docker-mailserver which is a full mailserver suite deployable via Docker with sane defaults.
I am running Docker Mailserver because it's one of the very few options that were actually easy to administer: https://docker-mailserver.github.io/docker-mailserver/latest...
But the last release was like a year ago: https://github.com/docker-mailserver/docker-mailserver/relea... and same with the container that was published: https://hub.docker.com/r/mailserver/docker-mailserver/tags
I guess there is the edge version and more recent commits, and overall it should be stable, but you'd think there'd be more small patch releases to decrease the eventual risk of CVEs. Either way, cool that it exists.
I do. It's nowhere as hard as everyone on here makes it out to be. And I don't even use an easy solution like Mailcow. Spam is a solved problem with rspamd, and it's not even an llm
It’s not hard to receive or filter mail - knowing that somebody will receive your email after you send it is another thing entirely.
I’m wondering what the most fool proof way to get a message delivered to someone else is. I found out today some SMS messages I sent were silently dropped. Email doesn’t always get delivered. I would hope the closed ecosystems like Signal and Whatsapp are better at this and in any case you need both parties to agree on a channel. I just like email because my identity is maintained even when I switch providers, and nothing else quite like that exists.
That is the exact problem that got me to abandon my splendidly working, self-hosted email stack. I had so many instances of mail just not getting delivered, despite doing absolutely everything correctly, that I gave up.
Thankfully not a problem we've encountered yet. All my mail is DKIM signed, SPF aligned etc. I also registered on dnswl.org which is a signal quite a few people seem to use.
I still handle email for multiple small businesses (for over 20 years) and recently switched from the mailscanner+spamassasin to rspamd and the scanning is so much better/easier now
my backend is still dovecot+postfix, still works beautifully. I am able to run rspamd+dovecot proxy on a small vps and the storage is handled by a backend office server with dovecot. If VPS has an issue can spinup another easily/anywhere and backend is also virtualized (libvirt) so easily restored (with multiple backups in multiple places)
biggest thing to worry about with deliverability is ensuring your SPF and DKIM (opendkim) are correct, which is not too difficult and rspamd is able to handle the dkim signing/verification which is nice
out of curiosity, are you talking about personal, small business, or corporate?
"spam is solved" looks a lot different at each of those
Personal mailserver sorry. rspamd stops all the sent-using-my-from-address "i hacked you" emails (DMARC drops them) and all the other random spam stuff. I can imagine though a large business with thousands of email accounts it wouldn't be as easy though.
I know an old-school Linux admin who has been successfully running his own email servers for 30+ years - from small private ones to larger corporate setups. For spam detection he uses his own system, and it works surprisingly well even without any LLM (though an LLM could surely make it even better). So the "you can't self-host email" meme was never quite true - it is about willingness and ability to configure everything right.
If you are self-hosting because you care about privacy, I'm not sure why. Email requires two parties. Unless both parties are self hosting, some company has a copy of that email. Google, Microsoft, and Amazon probably see 99% of all email on the internet (ok maybe not that much but probably pretty close).
I'm not sure what privacy you gain by self hosting these days, since no one else is.
I'd run my own email server since the early 2000's - in several forms over time. A VA Linux 2U rack server that I got from work (noisy, overkill), a personal Mac Mini (Frankenstein macport upgrade-resistant), and now a single-node k8s instance with everything neatly managed (an excuse to really dive into k8s from the ground up).
I use dyndns to handle IP changes (incredibly rare with Frontier FIOS, actually). I use mailhop.org to handle secondary MX records in case my machine is down (as well as mail filtering) Everything else is postfix, spamassassin, dovecot imap
It's not a trivial system, and it took a while to get everything working how I wanted. It's a terrific learning opportunity, but it's by no means simple to mentally model the process of all that happens inside.
Just document this for all, simplify the setup but keep the learning :)
I've been self-hosting for 20 years now - a few years ago I switched to using Mail-in-a-Box (https://mailinabox.email/) which makes management a lot easier than configuring each service manually.
It definitely requires some effort but once you've got it up and running it's pretty hands off. The only issues I've ever had are expiring certs but I've fixed that by configuring auto-renewals and it's all good now.
Ensuring your source IP isn't blacklisted is probably the single most important factor. I had to request a new IP from Linode where my server runs as the one it was originally assigned had a bad reputation.
I've hosted and actively used my own email server for > 10 years and there are two things that are true at the same time:
It is absolutely possible to host, use, and achieve decent deliverability with your own server. It takes work and is a different beast than running a webserver, but that frontier is not dead (yet).
At the same time: it is an ABSOLUTELY TERRIBLE IDEA to suggest that folks operate an email server out of residential IP through your ISP. The spam prevention ecosystem is so draconian now that email traffic flowing out of address ranges belonging to residential owners is yeeted into the sun. If you've operated email infrastructure at decently large scales, you know that SPF/DKIM/DMARC are just one part of how spam is identified, and mixing in the source of email traffic into the detection heuristics is a significant part of that identification process. Achieving decent delivery can often involve "warming up" an IP over time to establish its reputation, and consumer address ranges are a hodge-podge of activity that incur very little trust about what they're doing.
I agree with some commenters that exhort the exercise of self-hosting email to prevent the venerable protocol becoming a homogeneous GMail and Outlook-only world, but there are reliable ways to do this: using a VPS, relying on a company for the sending/SMTP part, or something similar. But footguns abound, and disgorging SMTP packets from your LAN edge is one of them.
The biggest problem with self-hosting a mail server is reliably being able to send email and have it be delivered to the recipient. Something I have been thinking about setting up is self-hosting a dovecot server so that all of my emails that I receive are on my system, but using another provider for sending email. I don't send that many emails, so there is not much privacy loss in regards to a third-party being able to see my sent emails, but I still get the benefit of noone but me having access to my received emails.
> but I still get the benefit of noone but me having access to my received emails.
Other than every smtp relay hop and any network tap along the way that could keep a copy. Hope you're encrypting and not worried about the envelope. Email is fundamentally not private. Self-hosting doesn't help all that much (though it may keep it out of certain companies' hands, aside from the emails copied to or sent from that provider)
Ive self-hosted my email server since 1999. It started in a closet at home in San Francisco. As things got more restrictive (residential ips being black holes) I moved to a Colo. but now I'm back to hosting it on my server in my cellar. I have a fixed ip from my provider init7 (Switzerland) that has never been blacklisted. Reverse dns is set up. All the acronyms like spf, dkim, dmarc are set up. I have no problems sending to Microsoft and Google email addresses.
So I'm doing it now but I'm ready to switch back to one of my Colo servers at any time and I won't be surprised if I have to at some point.
I started hosting my email at home some months ago and it works great. However, my ISP blocks some ports necessary for running a mailserver (incoming SMTP), so I have to use an SMTP relay (which is on a VPS and does port 25 to some other port that is not blocked). Additionally, to not worry about deliverability, I let my mailserver send all outgoing mail through another service. The additional costs for this are about 2€/month.
I use Stalwart as a mail server and it was not too hard to setup (with some caveats to get it working with my SSL certs behind a reverse proxy. But nothing a bit of LLM chatting couldn't solve). All in all, it's not 100% self hosted, but works well.
However, I don't agree with the suggestion in the article to use a self hosted LLM. My mailserver needs a few hundred MBs of RAM at max, but with the spam filter this would increase like 10x-100x.
I’ve self-hosted for 21 years.
I also run mail servers for others, mostly non-profit adjacent groups who don’t have the capital to be extorted by cloud service providers.
Sure, there are some things to learn, but like anything – if you do it properly, it’s not hard and can work properly. Never had any deliverability issues over that time (yes, even to the big providers). I also almost never touch the boxes (I do about one architectural overhaul a decade and am working on the next right now).
If you’re willing to invest the time and resources to do it properly, I agree, it works fine.
Email hosting isn't too bad. IP reputation management is a pain. Everything works perfectly until one day it doesn't.
SMTP relays are cheap--worth a few pennies a month to not deal with IP rep.
I started self-hosting my email server earlier this year. I use maddy[0] as my email server and route outgoing mail through MailPace[1] to avoid being memory-holed (despite having SPF and DKIM set up correctly).
My reason for self-hosting is control, not privacy: the fact that the cleartext of my outbound emails is visible in the MailPace UI is not a concern; the problem I'm solving is that email providers can delete your account.
[0] https://maddy.email/
[1] https://mailpace.com/
> But there are other solutions out there like: Stalwart; Mailcow ;Or if you're a purist you can set up your whole server yourself
Another good guide that uses Debian and its standard packages:
* https://workaround.org/ispmail-trixie
(Updated with every release, and upgrade/migration instructions.)
Some out of the box solutions.
https://www.iredmail.org
https://mailinabox.email/
Free iredmail version is very basic, barely useful unfortunately.
I'd recommend mailcow for regular usage, or mailinabox if you're low on RAM or configuring email for server (not for people).
I beg to differ on:
> but if your home internet checks these boxes, you can 100% host your own mailserver at home:
Because above is only needed if you want to communicate with people using Gmail, Yahoo, Outlook, Fastmail, Proton etc (The monopoly).For normal folks, they are better off using an alternate less privileged email service like email.riamu.io.
Been self-hosting my own mail since '99.
Delivery isn't the problem, just people don't use mail as much as they used to. Most people reach for signal or whatsapp to communicate. Most mail is order confirmations. So don't really care if people can't get mail, it isn't the primary communication tool for most people like it used to me.
Then when you die I'll buy your domain, setup a catch all and scoop up your accounts.
Every single person I know who has run their own email server has, at one point or another, either outright lost mails or had important mails delayed for days.
It's not worth it.
I was going to self host my email server, but somehow my email provider (Migadu) is cheaper than a VPS ($19 USD per year) and offers custom domains, catch-all, and unlimited addresses.
Sorry the title should have been "You should self-host your mail server" but it seems HN removes the "You should" in the beginning of a title.
I wanted to start this discussion because I think we are prime for more self hosted mail servers in 2026 and in the post I explain how to use a locally hosted LLM to nudge the spam detector rspamd to whether or not an incoming mail is spam.
Also in times where the EU can order your mail providers to scan for unwanted content [1] (currently limited to CSAM, later probably more) it does feel better to have your data at your hand.
[1] https://en.philenews.com/international/privacy-to-end-in-the...
I'd love to self-host a mailing list, or that protonmail or fastmail offered listserv like functionality. It feels fairly intimidating to hoist my own mail server and listserv on top of that. It feels like there's too much domain-specific knowledge one needs to have to reliably debug and maintain it: DKIM, spam management, certbot, fail2ban, blah blah blah.
I stood Stalwart up recently and it's going well so far. I opted to use an SMTP relay instead of delivering from the VPS directly.
What hosting / VPS companies do you recommend? Finding one which allows you to run a mail server is some work.
A lot of them will let you if you ask, for instance even ionos or ovh. Digital ocean have a blanket ban on port 25 ipv6 but I haven't seen a reason to use them for a decade now. +1 for mythic beasts
Mythic beasts. Their IP ranges are pretty clean and well managed. My deliverability has been fine there for years.
Michael W Lucas has a book[0] on the subject too: https://mwl.io/static/books/run-your-own-mail-server.html
I self-host with telekom business, 2 fixed ip lines fiber and vdsl at home everything from auth ns to mail and web. Its around 85€ for me.
it's still doable and you get the best feeling there is: Living in the internet.
Can recommend 100%.
Blast from the past:
https://en.wikipedia.org/wiki/Hillary_Clinton_email_controve...
Waiting for a submission of "You should run your own NNTP server" (lots of 'nostalgia' for web forums to come back, so why not this too?).
Yeah, do not do this
yeah don't do this
Absolutely not.
Why not? I have been hosting colocated email for years just fine.
I pay for a perceptual license of Zimbra.
I've been self hosting since 2012 or so and it is a mixed bag. Deliverability is fine provided you're on a clean IP range, which generally only reputable hosts have.
There was a moment when my son was born and he was in NICU that my mail broke. I just went without for a while. Not ideal.
Since then I've thought: self hosting is nice but hosting cooperatively is probably the best way forward. Democratic control might beat technical control. I'll do it soon, I think: I'd be fascinated to know what people think.
I’m very interested in this approach. I’ve hosted friends’ websites for decades but I’ve been the single-point of failure, so “cooperative” is very enticing.
I’m currently working on a cooperative “lights-on” solution which might be complementary.
I've tried self-hosting my mail server, but that means all my outgoing mail will go to Spam on all providers that use reputation-based filtering. In all cases I had SPF, DKIM and DMARC working perfectly, PTR records, etc. but it just doesn't matter. Even a Fastmail domain goes right to spam on my personal account, and they are very very established. It's just not worth it.
I use a dedicated server and a vps for this, so I get around the residential IP reputation issue. The rest of the problems with deliverability are overblown. In 15 years of doing it on multiple servers, I've had one 2 month period where Gmail was spamming me and one month where Yahoo spammed me. In both cases it stopped without me changing anything, I've always suspected it's brief periods of anti-competition attempts which don't last forever
I never used residential IPs. Most ISPs don't even let you set PTR records on those. My problem was that any server at practically any provider would reuse an IP that previous customers have used to send spam in the past. For example you can't hope to send mail from a DigitalOcean IPv4 address without going to spam. Nor from Kamatera. There are probably a few more providers that are basically blackholed because they're so often used for spam. (I don't have experience with providers that don't offer IPv4.) I believe some providers even attempt to block outgoing mail.
Running your own mail server is easy for receiving mail, but it is very hard to keep your IP from getting on some random blacklist that is impossible to get off.
The problem isn’t spam, the problem is you becoming the spam.
I did test email selfhosting before and there’s a substantial amount of times my emails were never seen by the recipient, sometimes it did cost me good jobs/deals.
So now I use paid email while I control the domain and everything else, so I have the portability feature if I wanted to switch providers without any efforts, but I know now my emails will be delivered whenever I hit sent.
That being said, I self host everything else in my digital life, and I believe everyone should.
Counterpoint: No.
I disagree with the author. If you have your own domain for e-mail, then you've already dealt with all risks and vulnerabilities. Of course you have your e-mail stored locally as well by using an e-mail client, which you would anyway.
Man these days it's nearly impossible. Even my web host has trouble hosting email, even though I use it and they do a decent job. Only medium-sized specialist companies and large ones like Gmail do it well. It's just those spammers - we could have nice things like self-hosted email if everyone were nice, but we can't.
Good luck having your emails hitting any inbox instead of ending up in spam.
Ending up in spam is not that bad, compared to emails simply dropped silently, without either party having any idea.
Thanks. 15 years of good luck so far
Awesome. Don’t ever let go of the domain name and IP!