So, as the topic says, I’m going to set up a self hosted email service for myself, family and friends. I know that this one is a controversial topic around here, but trust me when I say I know what I’m getting into. I’ve had a small hosting business for years and I’ve had my share of issues with microsoft and others, I know how to set things up and keep them running and so on.
However, on the business side we used both commercial solution and a dirt-cheap service with just IMAPS/SMTPS and webmail with roundcube. Commercial one (Kerio Connect, neat piece of software, check it out if you need one) is something I don’t want to pay for anymore (even if their pricing is pretty decent, it’s still money out from my pocket).
I know for sure I can rely to bog-standard postfix+dovecot+spamassassin -combo, and it will work just fine for plain email. However, I’d really like to have calendar and contacts in the mix as well and as I’ve only worked with commercial solution for the last few years I’m not up to speed on what the newest toys can offer.
I’m not that strict on anything, but the thing needs to run on linux and it must have the most basic standards supported, like messages stored on maildir-format (simplifies migration to other platform if things change), support for sieve (or other commonly supported protocol) and contacts/calendar need to work with pretty much anything (android, ios, linux, windows, mac…) without extra software on client end (*DAV excluded, those are fine in my books). And obviously the thing needs to work with imaps, smtps, dkim and other necessities, but that should be implied anyways.
I know that things like zimbra, sogo and iredmail exist, but as mentioned, it’s been a while since I’ve played with things like that, so what are your recommendations for setup like this today?
For self-hosting, be mindful IP addresses have reputation scores and your IP needs to build them up positively. You need to have reverse DNS set, DKIM, SPF records etc for a more trusted reputation, domain reputation etc to not be flagged and sent to spam folders. I just got the $1/month Proton E-Mail for 10 addresses for 1 custom domain as I didn’t feel like dealing with any of this with self hosting, but props for going the self-hosting route.
ISPs often have SMTP relay servers. If you hook into that, your mail gets instant street cred.
Amazon SES is good for this too. I use it in combination with postfix for the outbound mail. Granted it feels a bit like cheating on the whole self hosting part, at least for outbound. And I only started doing it in the past year of self hosting for 20 years. MS (Hotmail, Outlook, Office 365) was by far the biggest asshole in randomly denying delivery from my (well maintained reputation wise and well configured) outbound IP before switching to an SES relay. Fuck em, seriously. It’s not just about preventing spam, it’s clearly a strategy towards email dominance. Other big players are guilty of this too though.
Yes, you’re right. But to be honest, it only took me four weeks of perseverance and a few mails to the administrators of spam lists and I had no more problems with receiving and sending mail.
If you set up your mail server correctly and also enter a postmaster address, you will be informed of any problem, no matter how small, and can address it promptly.
I was surprised at how quickly and, above all, helpfully the staff at the spam list providers respond when you write to them politely and, if necessary, ask for more background information and best practices.
It was definitely worth it for me and I would do the work and build up the knowledge again at any time. As a result, you have maximum freedom in configuration and extensive options for customizing your own workflow in dealing with emails.
You may have already read this but I always think back to this blog post about self hosted email:
TLDR;
- Mail is not hard: people keep repeating that because they read it, not because they tried it
- Big Mailer Corps are quite happy with that myth, it keeps their userbase growing
- Big Mailer Corps control a large percentage of the e-mail address space which is good for none of us
- It’s ok that people have their e-mails hosted at Big Mailer Corps as long as there’s enough people outside too
https://poolp.org/posts/2019-08-30/you-should-not-run-your-mail-server-because-mail-is-hard/
My problem is what happens if my internet goes down when there’s an important email or something. I suppose I could run it on a VPS just in case, but that’s still not as reliable as an email service, nor is it necessarily cheaper.
So I pay for Tuta email. It’s €3/month, supports my custom domains, and generally works pretty well. My VPS costs €4.5/month, and I may get rid of it once my city finishes rolling out fiber because I only need it due to CGNAT. Neither is particularly expensive, but Tuta is really good value for what I get. If my family members want to join, costs will go up (€3/user), so I may consider switching if that happens.
SMTP retries. It’s resilient. If it fails a couple of connections it’ll even let the other side know it happened and when it’s going to retry. If it can’t get it to you in a couple of days it’ll let them know it was not able to deliver.
The rest stands true, hosted Mail is dirt cheap and is more reliable I’m trying to host it in a non-professional capacity.
Ah, interesting. I have two domains, one for personal (family and friends) and one for online crap, so maybe I’ll try moving one to be self-hosted. Or maybe use one of my other domains (I have several).
You won’t be able to host email on a residential IP - all of them are on a permanent blacklist. I understand the money argument - and it’s a real argument - but host your own email is just so cool!
Good point. Does the same hold for popular VPS services? I’m behind CGNAT so I need a VPS regardless, but others may prefer to have it at a VPS if they want to mitigate extended service disruption (i.e. equipment dies while they’re on vacation).
No, comercial IPs are fine. You’ll have trouble with some of them - Digital Ocean is a notorious example - where the provider itself blocks outbound port 25 and there’s nothing you can do. I think DO only does that for new accounts.
I myself am running it on Linode - it did get purchased by Akamai a couple of years ago, so I can no longer blindly recommend it - but so far it’s been working fine. One thing I did recently discover was the ability to request a /56 block on Linode - my pre-assigned IPv6 got blacklisted somewhere as at least the whole /64 and simply generating another IP from the same /64 did not help. Getting a fresh block solved it for me, though, and now I know that if this /56 gets blacklisted - it’s my fault. Unless, of course, I get caught up in a /48… 😳
Cool. I’m w/ Hetzner, and it seems they will unblock port 25 if you ask nicely and provide a good reason (and surely hosting your own email service is a good reason). They don’t look at those requests until after your first month, and I’ve been with them for several months now from when I ditched Vultr (had been with them for years) due to their stupid UI-blocking EULA accept popup when they added forced abitration. Hetzner also has forced arbitration, but so far I haven’t been forced to accept new terms in order to continue using services I’ve paid for, so I’m giving them a chance.
So yeah, I’ll definitely try playing with it with one of my domains. I currently use two, and I can play around with a third that’s connected to the domain I use for remote access to my self-hosted things.
And good luck! Hopefully you don’t get screwed over again.
You’re not wrong about centralization being bad, but email is a pain in the ass at scale. Reputation, block lists, any downtime, client bullshit, infrastructure costs… about a hundred things can go wrong, and any one of them is a SPOF.
Email being hard is not a myth, and saying it is dismisses a ton of legitimate concerns.
You’re right, but we’re not talking about “at scale” here if I understood OP correctly. We’re talking about considering self hosting email for those who have the technical know-how to do so and obviously not on a rickety 2010’s desktop PC in your living room on consumer broadband as another commenter hinted at. Anything online “at scale” is always going to be harder than doing it on a small scale.
Mail is freaking hard. It’s not the setup that’s the issue. It’s getting enough reputation that your emails don’t get bounced into oblivion.
Believe me, I have tried.
You run into things like registering your netblock with Microsoft so it can accept your emails. You don’t own a netblock? Didn’t think so. Do you have enough outgoing emails so your IP builds up reputation as a reliable sender, so you don’t get thrown into spam by Google? Didnt think so either. And that’s just the tip of the iceberg.
What I ended up doing is use one of the big providers (be it Google, Microsoft, Tuta, Proton or something else) and just pull the email to my server. Sending out works the same. Basically using them as proxy.
I still get to keep my email and I’m I independent from the whims of my email provider. The tradeoff being I need to shell out a few bucks per month and email still passes their servers.
Haven’t found a better solution yet, unfortunately.
I guess what I mean is that even a single user email system is a pain.
Want to send an email from one person to another? Stupid easy, I can do that with a single command.
Want to be able to send messages over long periods (years) to friends/family AND clients AND prospective employers (who are probably running their own email system) AND various businesses that you are trying to get support or services from? Well, okay, but the more messages you send, the more chances for some douche (or automated system) to report as spam because they think that anything other than @yahoo or @gmail is a hack-spam (I’ve had this happen, and had someone call me frantically telling me that my identity was stolen, and I had to tell them it was actually me; People are fucking stupid). And if you navigate all that, you still have to worry about your IP going wayward because you needed to change your infrastructure for some reason (switching regions, system types, whatever), and if that happens you basically start from scratch with an IP that might have had a shitty reputation (even if only due to range association).
And it’s not just needing to maintain your IP/domain/account reputation with dumb people/systems/lists. You also need to set up SPF and DKIM or you’ll be summarily rejected (even though SPF has fallen out of favor, some services still use it, or use both). One time config, sure, but not intuitive unless you work with systems all the time, and it’s just a matter of time before they introduce yet another secure email verification system that you need to jam into your DNS (or server, or header, or…).
So now you’re sending mail (probably), but you still have to receive it. More DNS configuration, and you have to make sure your email server never goes down, or you permanently miss any messages you might have gotten (yes, email systems are supposed to retry, but I’ve seen a LOT of admins at very recognizable names in email basically just retry for 15 minutes then dump the mail, rather than keeping their outbound queue backed up for multiple days).
And god help you if you set up multiple incoming servers, because now you have to deal with some kind of centralized storage, which itself also needs multiple nodes to avoid yet another SPOF. Again, not super hard by itself, but now you’re basically designing multi-tiered infrastructure, which you have to maintain and pay for. We’re definitely in for more than you’d end up paying for an email service, and that’s not counting your personal time at all (which even a single hour of is probably double the monthly cost of an email provider’s top tier offering, if you know how to manage all this crap).
TL;DR, you’re still not wrong that centralization is very, very bad, but if you actually care about people receiving your messages, and not missing any important incoming messages, it’s not easy to deal with. Not saying people shouldn’t try it, but they need to be ready for a mountain of headaches.
Re-reading my own post, it occurs to me that if we really want a lot of people running their own email system, someone would need to basically document/automate the whole thing, make recommendations on providers, and figure out how to do the whole thing cheap and push-button. Get huge numbers of people running a semi-standard config so email services and RBL maintainers can get used to it and build up a tolerance (and processes) for dealing with it without being blockers.
Well, from personal (professional) experience Email is hard.
I’ve been using mailcow for about a year and i am very satisfied, it checks all your boxes and is easy to configure and deploy over docker.
Just beat me to it…
The one thing that they don’t have yet last I updated, though they’ve been working on it for a while, is a prod ready LDAP/SSO connection. I had the dev branch working with Keycloak, but never got plain LDAP to function.
@ShellMonkey I use the Generic OIDC option, havent tried LDAP.
I tend to keep things simple so if I can it’s easier to not set up the separate auth middleware when there’s already an AD comparable system in place.
Another option I’ve used before is called Neth Server, but that’s more one of those SOHO all-in-one systems rather than a dedicated mail box.
Mailcow-dockerized is bulletproof. Never had a problem with it and has been rock solid.
Another container-based alternative in that space is Mailu.
I also use Mailcow with three domains (one business). No problems with it from day one. Updates run regularly and smoothly like clockwork. I am happy to recommend it to others.
I am happy to recommend it to others.
If they ever support non-Docker systems again, I might be curious. Right now, I couldn’t even use that.
Second this. Mailcow very easy to setup, though the docs could use improvement. This might have changed already.
That said, I found it easier to pay for a domain and email service where they worry about reputation and random microsoft blacklists.
Yeah, Microsoft are the worst. Even after doing all the proof of work (reverse DNS, DKIM, SPF, …) and registering for their spam prevention postmaster tools equivalent, I still found myself randomly blocked for delivery sometimes.
3 years and counting here, I host my own company email and a couple of clients, 120 email accounts and only had one issue with a compromised account, limit each domain to 100 sended emails and I can catch spam emails with enough time before my vps provider notice anything
I’ve been playing with Stalwart-Email as a combined SMTP/IMAP server. Its open source and written in rust, still pretty early in development and I haven’t played with it enough to give any real opinion on the pluses or minuses compared to other software, but its worth taking a look at.
Stalwart is 95% awesome. What holds me back is, that Mails are stored in a Database and not Maildir. Maildir is insanely trivial to backup incrementally and to restore individual mails if necessary. That currently holds me on dovecot.
Currently using Stalwart after about a decade of using iRedMail. Stalwart’s setup was such a breeze; I let out an audible laugh/noise when the install completed in the blink of an eye and had all the DKIM, DMARC, SPF, etc. settings available for config.
Making some nice improvements with each release too, proper user management, etc. Definitely a fan. Looking forward to when they support CalDAV and CardDAV.
I’m also using Stalwart! It just works!
My stack is postfix, dovecot, slapd for accounts, SoGO for web mail, calendar and task and contact management. Syncs to my phone via davx and just works out of the box. It’s multi domain and my small company even sells hosted email services.
Rspamd for anti spam and dkim. Use a free email testing service to confirm SPF etc are setup correctly.
Also make sure you have regular backups and up to date lets encrypt certificates.
Great plan! We need more independently hosted email. I’ve been self hosting email for 20 years. Still running Postfix and Dovecot, but don’t have all the features you’d like though. I just wanted to chime in that I’ve moved from spamassassin to rspamd. And I’m happy about that. Given your experience in the hosting business I think you’ll like rspamd. One thing I have changed since a few months is have outgoing mail go through Amazon SES. I moved hosting from Linode to Hetzner and that turned out to be not so great for outbound delivery reputation. I didn’t want to migrate back to Linode so I bit the bullet and compromised with SES. That has been really working well, but I admit it is a bit of a step back from fully self hosting.
What’s the benefit of rspamd over SA? I’ve used SA since I first setup my mail stack years ago, and it’s been great. Cron jobs run nightly to train based on the contents of all the mailboxes’
.spamfolders, so it’s only gotten better with time.Not judging, just curious.
I believe the ISPMail tutorials I was following during my rebuild recommended it as the successor to self hosted anti spam. Touting better performance, written in C vs. Perl for spamassassin iirc. The tutorials may have indicated that SA was no longer actively maintained, but that may be a figment of my imagination. Better fact check all of this. But I’ve been very happy with rspamd’s web interface to see what’s going on with the process. There’s a great history view in the dashboard that helps you better understand why a message got flagged as spam. It helped me better fine tune white and blacklists for example. Supposedly it also has a rich module system to enable more advanced filtering techniques like LLM’s and whatnot. But I haven’t looked into that yet. Granted rspamd is also used by ISPs that have massive throughput. I’m definitely not in that category :p
I have Dovecot and Postfix running on Debian on a server in my closet. Works great for my needs
Same (but arch btw). It uses the existing Let’s Encrypt certificate from certbot --nginx. I did everything possible advised by mxtoolbox (Blocklists, DMARC, SPF, DKIM, LIGMA and whatnot). Some things are hard or impossible, but not really needed, like reverse dns or DNS SOA.
Oh, I forgot to mention, I’m going to run the whole thing on a VPS, so I’ll have access to proper reverse dns and all, so that’s not an issue.
I like exim a bit more but yeah. The dead simple solution is my goto. It can be tricky without any experience but there’s a ton of information out there.
And once you set it up your pretty good almost indefinitely.
You can do calendar and contacts separate from email. Try Radicale. I’ve been using it for years.
Check out Mail-in-a-Box
It doesn’t answer your questions about calendar and contacts, but you might still find it interesting to take a look at this project:
I’ve been using Maddy for about a year. It’s easy to set up and has been trouble free.
I’ve stuck with iredmail for years. Spin up a VM, grab the installer, and see how it performs for you.
I have been using modoboa, my installation is fine as far as it goes, but coming up a little short technologically these days, and the upgrade path is total replace. If you have or install Docker on your server, there are poste.io and docker-mailsever,which both look good. Running your mailserver in a container or VM is almost essential, for security, and so you can blow it away and start over if you make a mistake.
Running an email server is not necessarily hard, but it is stressful: if you have other users, even family, they will take it for granted when it works, and complain loudly when it does not. Like any server that others use. But, beyond security, I have a certain stubborn geek machismo about it, it’s a level of sysadmin above basic.
@IsoKiero I don’t know about “latest and greatest”, but your bog-standard solution seems about right; just add radicale into the mix, and you’ve got calendaring and contacts.
Honestly, what I use is not what I would recommend. ;-) My own setup follows these directions (TL;DR: OpenBSD, as much OOTB OpenBSD software as possible, and Dovecot.)
this isn’t addressing the technical side per se, but consider your user’s rebelling factor, i.e. them passively resisting using the stuff you provide and sticking with corpo-crap.
not to go into details, but I’ve got a number of opensource solutions in place for various clients. we have
hugesome issues with users who need to be corralled and coerced into using the provided messengers, web portals, and such. some resist out of habit, other’s because they prefer the infinitely more polished UX of assorted spyware as opposed to the janky feel and rather rudimental features of opensource alternatives (think gmail vs roundcube).The couple of domains have been running on my company so the userbase is already there, but as I’m shutting down the business side they need to move to something else. And I don’t really care if users want to switch to something else, that’s not my problem.
