Did it for years. Loved it. The only problem? Hosting providers and colos often reuse IPs that have been blacklisted because of spammers, so one day you realize some folks just haven't been getting your mail. I use a leased server and would switch back from GMail to Zimbra in a heartbeat if I thought I could reliably insure my email would not get blacklisted. There are services out there you can pay for that offer smtp gateways, but they often charge on a per domain basis, and I need to send/receive email for 50+ domains. Pretty expensive.

If anyone has any suggestions to get around this sort of limitation, I'm all ears and will be back on Zimbra before the weekend is out ;-)

We use SendGrid: http://sendgrid.com/

They've got a free account for up to 200 mails a day.

I've set up a number of mail servers for myself and clients. I've always asked providers upfront to guarantee that I can get assigned to a new netblock if any of the IP addresses they give me show up on any blacklists. In some cases, just asking resulted in getting clean IPs from previously unused netblocks. In the few cases where the IPs were blacklisted, I got new ones without any problems.

Nearly all providers will give you a new IP if your old one got blacklisted before it was assigned to you.

Note; 'clean IPs from unassigned netblocks' are not necessarily good. see bogon filtering[1] - still, running your own mailserver is not an impossibly difficult task.

[1]http://en.wikipedia.org/wiki/Bogon_filtering

AuthSMTP is priced with a fixed number of "email From: addresses", but what they don't tell you on the pricing page is that you can add a whole domain (wildcard *@domain.com) and it just counts as one address.

Looking at their pricing page it looks like you'd be out about $150-160 bucks per year. Up to you to decide if it's worth it, but hardly expensive in the normal sense of the word.

That works great until a spambot decides to start spamming <1000 common usernames>@yourdomain.com

Isn't that what SPF is designed to protect? They'll never get through if you have a strict SPF record that lists AuthSMTP as the only email server for your domain.

I haven't experienced getting added back to a blacklist off a significant webmail host after being taken off one. Once your IP is in the clear, it'd take some abuse to be put back (anecdotal). These 3 steps usually get me unblocked if starting with a bad IP:

1. Set up reverse DNS for your IP address

2. Publish an SPF record

3. Check the Spamhaus lists http://www.spamhaus.org/query/bl?ip=1.2.3.4 and request removal if your IP address is on them.

As an addendum to grandparent: extremely comprehensive guide to postfix + dovecot here: http://workaround.org/ispmail

Spamhaus is one list. There are hundreds. (See http://www.dnsbl.info/dnsbl-list.php for starters) Some are nearly impossible to get off of.

Been there, done that, didn't work. We don't even know why GMail was black-holing our mails, but we did everything on their suggested list for getting out of the world-o-pain and still often our mails were landing in the spam folder, hence the switch to SendGrid.

I think the bigger question is if there are any open source webmail apps that can support Gmail-like usage.

Setting up your own mailserver is easy. But getting a gmail-like experience is pretty hard. For example, I tried Roundcube a while back with my full Gmail mail dump. It tried to keep up, but there was just no way it was going to handle 2gb of mail going back years.

I'd love to see something that either ran off of a standard imap server or that was a mail-delivery agent (MDA) that had a gmail-like web interface, complete with full text search.

I haven't found anything like that yet.

http://www.zimbra.com. Better in some ways, worse in others, but by far the most capable open source webmail available. I used it for a few years and loved it.

I always see Zimbra mentioned as a good open-source alternative to Gmail. But the demo always made me feel like it was a web-based Outlook UI-wise.

Like mbreese, I have wondered for some years if an open-source version of Gmail existed, and also what would be necessary to reproduce the Gmail experience (on the backend side for example, to get to the same speed in search). But I always hear Zimbra which doesn't seem to be the right answer to me.

> But the demo always made me feel like it was a web-based Outlook UI-wise.

My experience too, after using it for about a year. It's OK, but it's nowhere near as good as gmail.

I'm curious...what do you find Gmail does better than Zimbra?

As an alternate opinion, I have RoundCube set up as a webmail option for my IMAP server, and have about 2GB of stuff in about 20 different folders, a few folders have 5000 or more messages in them, and RC seems perfectly performant, almost as quick as my native IMAP client.

My biggest complaint with it is that doesn't have a threaded view for mailing lists, but I haven't found a webmail yet with proper threaded view either. Other than that, I think it's a great substitute for a native client when I'm not at home and don't feel like using my phone, or don't have a good data connection.

There's nothing especially secret or noteworthy in my inbox, so I don't really mind if the admin of the server it's stored on can read it. Go ahead, knock yourself out. What I do mind is Google coming up with new features, connect email with social networking, and in the process expose incidental information to my peers; eg. Maro knows X, X said Y on Twitter, how does that reflect on Maro?

so, here's my issues with hosting your own mail. it's probably the most difficult common internet service in the world to maintain. there are a litany of sysadmin tasks you must take care of before you even begin with the really tricky problems. the main reason is that e-mail is arguably the most critical of services. you can't afford to miss a critical e-mail, so its imperative it be incredibly robust and fault tolerant.

first you have to set up redundant hosts. preferably on different backbones in different colos, unless a majority of your gear is in one place. next you set up the software as secure as you can so there is a minimum window for 0-days and patching can be done in scheduled maintenance windows. then you set up your monitoring to notify you when something goes south, on both hosts. things like queue size checkers and threshold-based statistic alerts are handy.

next you set up your spam filtering. THIS IS HARD. i don't care what any old salty dog mail admin tells you, it is an arduous process to properly manage the filtering and blocking and unblocking etc of mail. for a small site, getting aol or yahoo to unblock your ip range may be a great feat. for a large site, 90% of your traffic will be spam and getting every legitimate mail is nearly impossible without subjecting your users to tons of crap.

the cost in money and time just to host some free webmail yourself is astronomical in comparison to putting up with an ad and a possible privacy violation from a free provider like yahoo or gmail. if you want your mail handled properly, pay a big e-mail provider to host it for you, or spend a lot moree time and money to do the same thing yourself.

One big downside is that spam filters are very agressive these days. It can be a huge PITA getting your mail through, even when you've gone through the trouble of setting up domain keys and spf records and submitting the appropriate forms. Some providers, like hotmail, will silently drop emails, too.

Any recommendations for open-source webmail?

I use RoundCube, and I'm very happy with it so far. It has a very active developer base, and it offers the closest thing to an email client experience. I'm currently working on an "Outlook" theme for it, which should be done soon.

My mail server stack looks like:

Linode + Postfix + Dovecot (w/mySQL & imap) + RoundCube + SpamAssassin + managesieve.

With this setup, I get more powerful mail filters than Gmail, a better webmail client than most ISPs, and spam controls that I can access directly from my webmail client.

It's not the easiest setup to pull off, though. I'll need to roll out a second one of these before long, and I'll try to write it up next time.

EDIT: Or for $5/month/domain (the same deal I give my clients), I'll give anyone unlimited domain email hosting, unlimited accounts, (practically) unlimited storage.

It would be great if you created a Linode StackScript. This would allow anyone to replicate your configuration on their own Linode easily.

OK. I'll think about that -- my desire to "share and share alike" is struggling a bit with my desire to differentiate from other mail hosting services.

http://squirrelmail.org/ is out there. Can't personally recommend, since I've used gmail exclusively since I got an invite, and desktop mail apps (plus hotmail) before that. My college used squirrelmail before they switched to http://www.horde.org/webmail/.

Compared to the GMail UI, SquirrelMail is pretty terrible.

Yeah it's REALLY bad. Funny thing is, and I don't know if this is store-specific or what but as an Apple employee working at the retail store, I got access to all of my email thru squirrelmail. You could only hit it from behind their firewall, but it's http://webmail.apple.com (it will fwd to https://webmail.apple.com/src/login.php if you cancel out of the login prompt, which for anyone who's used squirrelmail, is the standard login page)

Of course I was also given a mobileme account (which uses a pretty slick desktop-like web UI for mail) but I was shocked that they didn't do like a Google-Apps style rebrand of MobileMe email for their own @apple.com accounts. Pretty sad if you ask me.

Already mentioned by sucuri2 in another thread, but roundcube (http://roundcube.net/) looks much more attractive. Still not GMail, but much nicer than squirrelmail.

If you pull down devel-threads from svn, add a couple of plugins, and tweak a few things, RoundCube IMO actually gets better than Gmail.

Interesting. I've liked Roundcube enough to use as a backup way to access mail, but I've never looked at the plugins.

What are some of the plugins that you find useful?

The spamassassin plugin lets you control your spam settings from your webmail account.

I also have managesieve installed, and there's a plugin for it too, so with imap, inbound email gets automatically sorted into folders for me, and I can control that from RoundCube. The filtering is actually way more powerful than anything Gmail can do (last time I checked).

Those are the two "must-haves" IMO.

I agree, it used to use frames, which was rather annoying. But if you don't need too many features, it works.

I've been really happy with Claros Mail: http://www.claros.org/web/showProduct.do?id=1

Way nicer than SquirrelMail.

postfix + squrrelmail

there's also this - http://lmgtfy.com/?q=open-source+webmail

I upvoted you because you have a really cool link up there.

-4 for this?!! what a bunch of pussies.

There are also plenty of open source desktop IMAP clients; I personally strongly prefer clients like mutt or sylpheed over webmail interfaces. with ssh, I can even look at my mail from anywhere.

> with ssh, I can even look at my mail from anywhere.

That's assuming you can get access to PuTTY and/or ssh from anywhere. :-P

I use a laptop with a EVDO modem; totally worth the $70/month to not have to trust whatever virus-infested windows box I happen to be near when I am out of the house.

deal with spamming sucks.

There is a high possibility that Google's server is 10 times more secure than any average Joe's mail server. Even more secure than a security expert's server as well: http://www.darknet.org.uk/2009/08/dan-kaminsky-kevin-mitnick...

Do you have time to manage and keep your server secure? Can you patch a new 0day in an hour, possibly not.

On the other hand when men-in-black asks to Google yes they might give it away, which is another story.

I think fewer people are worried about their mail server being hacked as they are about Google deciding on their own initiative to release info willy-nilly, as they did with Buzz.

Absolutely, I use Google for pretty much everything and trust them implicitly. I don't believe that Google will leak anything that matters and think that the whole buzz furore is nonsense whipped up by people who had assumed privacy where there was little reasonable expectation of it.

However, if, like the OP, you do not trust a major corporation with a near-immaculate record on data integrity and an industry-leading stance on LEA disclosure, why trust any corporation?

Hosting your own server is inherently risky, but it is a different sort of risk with different mitigations. As you allude to in your post, the question is whether you fear malicious individuals, the workings of the state or corporate incompetence.

your contact list doesn't matter? it was leaked via buzz.

What exactly is the danger of people having my email address(substitute me with you if it helps)?

my contact list was not leaked. i think at most the list of people you were auto-following was made public if/when you created a public profile and did not set this information to private

Google's server may be 10 times more secure, but it's probably targeted about 10000 times as much as my own server.

Well even in that case attackers won't touch your data (since you aren't targeted), so you'll be still safe. If they are targeting you then it's the same thing.

In addition, I know of no company who provides better spam and malware filtering.

Postini did, but they were bought out by google :)