In a past life I ran email services for a small business, and then a medium business, it was a full time job, just keeping us out of the spam blacklists, keeping things patched up, ecosystem changes (e.g. new DNS records every few years, new security requirements, etc) and filtering incoming spam/malware/philishing attempts.
If people want to setup email for educational reasons, go ahead, but running one over a longer period isn't wise and frankly many wouldn't put enough time and effort into it to do it well. It is absolutely not set and forget, you'll need to baby it daily indefinitely.
When people ask me what I recommend? I tell them outsource email to a major provider and use your limited time/effort elsewhere. Better rate of return by far.
For managing spam, I found that the best solution when you own your own domain is to give a different alias to anyone who wants your email and keep a record of the mapping (I had to create a little website that does that for me). If you start receiving spam, then just delete that alias (this is why the "+" alias feature in gmail not really useful, plus it leaks the underlying email). I use Smartermail, which runs on windows, and allows you to reply to an email from the alias it was sent to. This is a low maintenance, zero spam solution.
For patching, windows patches itself. You need to update smatermail manually though, so it takes about 10 minutes every month or so. I automated the renewal of certificates with letsencrypt.
The only thing that has been a source of worry and requires to keep an eye on is failed login attempts (I scripted it but it is worth monitoring). Once I had created a test email account with a weak password, and some spambot got access to it by bruteforcing passwords in smtp. Then it started sending tens of thousands of spam emails from that account, which got me on gmail's blacklist for a month, even if the whole event lasted less than one hour (smatermail notified me of the suspected spam activity).
If you just want to receive emails, then it depends how long is your downtime. Smtp requires that the sending server makes several attempts if the first failed, so if you are only off for a few minutes to a few hours, you will get your emails, just delayed. If full day downtime then this is not a viable solution.
If you need to send emails, then you kind of have to host your server in a datacentre. A cheap VM should probably be a good solution for a first attempt. You will still get downtime occasionally (update OS, update mail software, problem with your hosting provider). A cheap solution is to set up a failover server at home since it is only to receive emails while the primary server is down, with a lax retry policy (up to a few days).
If you want to be sure your mail gets to someone else, things are going to be more complicated than setting up an SMTP+IMAP server combo, and after dealing with it in the past for work I'm happily outsourcing the pain to fastmail nowadays. :)
Almost every mail server retries for a few days, so you'll get your message, just late. Those few mail systems that don't retry have issues with greylisting - and unless you're fond of stories about Nigerian princes in distress, you're going to use that as the first anti-spam measure anyway.
Then you've chosen a bad service provider(s) to host/colocate/peer with.
Actually, you should notice this situation pretty much immediately you're online - because most likely your IMAP server would be down - and every single email client I've used had started to display warnings.
If you have more complex setup with separate MTA so your IMAPd may be online while your STMP service's unreachable, then you should set up monitoring system and deliver alerts either using local delivery or any out-of-band mechanisms (like SMS).
Also, you can set up a backup MX. Or two. Or more. Email has failover/HA since forever.
FastMail have been an excellent email provider, and support has always been responsive and useful.
If you can, definitely try to run your own mail server for the experience but start of gradually, e.g. relay outbound email through an smtp service, and slowly add the different layers such as spam analysis, filtering, etc.
There are /so/ many layers to email these days that if you try to do it all at once you'll spend way too much time on just keeping the wheels from turning.
Like you I ran my own stuff but possibly unlike I didn't encounter issues with recipients other than yahoo. I ran it from home from 2001 until last month and paid extra for a /29 static block from the phone company.
And that's exactly why self-hosting needs to be more dominant instead of just relinquishing power to large corporations.
Only problem I had, and still have in the short term, is that one server's IP C block has been flagged by one spam service. And even though my server's IP gets a clean bill of health from all other SPAM services, outlook.com refuses to accept mail from that server. I had them white list the IP but it reverted shortly after that.
The ISP (strato) refuses to do anything about it, and not sure if there is anything they can do, so all I can do is vote with my feet.
Otherwise, running a personal mail server is hardly any effort at all. Use Webmin for admin.
i mean that's a rather large group of people you can't communicate with right there.
and it's the only one you know about.
i say this is the exact reason running your own mail server in 2018 is problematic. you just chose to not consider it a problem.
It's a reason why allowing these fairly core services to be provided by a shrinking group of organisations is equally problematic.
Maybe one day Google will decide that they get too much spam from outlook.com (or vice versa) and cut them off too. What are you going to do about it, set up your own mail server? Vote with your feet to another provider? Start a company doing the same? Good luck with that.
>.. it's the only one you know about.
In the case of outlook.com, there's a delivery failure message. My yardstick is gmail.com. If the mail is getting to gmail accounts then I'm confident that it's as good as it is going to get.
My personal email server has been hassle free. I use https://mailinabox.email/ which you just run the setup script and tell it your domain name and everything is set up correctly. It sends me an email every now and then saying it needs updating and thats all.
Preferably just query what emails do I have coming in for local name at dev dot example dot com
Deliverability is not a problem because I don’t intend to send any mail. Just need a sinkhole I can query. How difficult is this?
It is so easy to forget how much noise and junk gets passed around via email when I've had Google doing it for me for all these years...
of course, there are a bunch of cloud/hosted/SaaS versions, usually they front-proxy your email servers via MX records [2]
[0]: https://thomas-leister.de/en/mailserver-debian-stretch/#spam... [1]: https://thomas-leister.de/en/mailserver-debian-stretch/#glob... [2] https://www.everycloudtech.com/
It depends what your focus is within the industry and how much you like to be hands on. If you are an auto mechanic you might service your own vehicle. If you sell vehicles or drive them professionally then perhaps not. It isn't like any single approach is right or any particular role is preferred.
That sounds like you were doing something very fundamentally very wrong.
I definitely don't need to touch my mail server daily, nor any of the mail servers I manage for others. It's just doing its job, security updates get installed automatically, and every few years I need to do a debian upgrade, and possibly deploy some new security/anti-spam features. In between those upgrades, it's running unattended for many months with absolutely no problems. On average, I touch my mail server maybe once a year.
As for monitoring: If you only run it for yourself or a small org, really, you can do just fine without monitoring. If the mail access side breaks, you'll notice, if the inbound side breaks, you'll probably also notice soon enough. But then, setting up a minimal monit that tells you when storage runs low or the MX is down really isn't that difficult either.
So, no, it's not a big project. It's as much of a big project as owning a car, probably less so, if you consider the amount of effort/time required (assuming you have an IT background, obviously).
It’s quite likely that other, unauthorized folks, are touching your mail system more frequently than you with such a lax attitude.
Definitely outsource your email unless you want the experience.
If you want security it seems reasonable to use ProtonMail.com instead of larger cloud providers like Google or Microsoft.
This is complete nonsense. I cannot imagine that there is anything particularly magical that requires something other than regular security updates on any server.
Manual intervention is borne of changing requirements or broken things.
Why should an email server for a handful of users require a lot of manual intervention?
Really, you sound more like someone who has read some FUD marketing material than someone who knows how to write an exploit or has any other serious IT security expertise. I am pretty sure I never had any unauthorized access to my mail server in the last ~ 20 years that I've been doing this. Obviously, my system isn't immnune from exploitation, but neither are Protonmail's, and you are massively exaggerating the risk.
I took the plunge about 4 years ago after being uncomfortable with the possibility of losing my main Gmail account. Ultimately, I decided that if I didn't own my email address, I was at the mercy of Gmail if anything went wrong. I came to the conclusion that losing my main email account would be more painful and time consuming than running my own server. At the time, I considered an alternative of owning my own domain and doing mail forwarding to Gmail or using a smaller email hosting provider, but decided there was value in learning more about how email worked.
[1] http://flurdy.com/docs/postfix/ [2] https://www.linode.com/docs/email/running-a-mail-server/
Unfortunately I know lots of people on yahoo (still) and no amount of brow beating appears to be changing that.
Paying for FastMail did the job for me in the end. It’s the least shit solution I’ve encountered so far. Note I didn’t use the word best.
Running it onPrem using the ISP the is connected to office I bet... That is a common problem with small businesses as they do not properly setup the ISP service and many SPAM lists automatically add the dynamically assigned IP ranges of most ISP has these are not setup to allow hosted services across them so by default no one expect to see a email server on that type of connection. Thus it is blocked.
Outside of that companies like MailRoute can help with routing to email traffic, and provide some level of HA for your email services.
>> ecosystem changes (e.g. new DNS records every few years, new security requirements, etc)
SPF, DKIM, DMARC are not really new, nor have they changed much in years. Thought most people still fail at getting it right. I am dealing with an issue with my bank right now where one Division is not talking to another division but they all use the same main domain for sending email so of course SPF record does not have ALL of the mail servers listed ... sigh...
>>filtering incoming spam/malware/philishing attempts.
There are many 3rd parties out there providing these types of services, I would use them. MX Gaurd Dog is probably one of more reasonably priced services but there are all kinds of other from Mimecast to Proofpoint, and many many others
>>I tell them outsource email to a major provider and use your limited time/effort elsewhere. Better rate of return by far.
I am not opposed to that persay. I also advice my clients if they are going to do that, at minimum they need a email archiving solution that is NOT with that same provider so they do not have all of their critical communications locked up in a single point of failure. For better or worse many companies live and die by email and if Email data is lost that can be DEVASTATING to a company. Having it all locked into a service you do not control is a high risk business ending decision IMO
Is there not just an open-source pre-trained spam-filtering model (using whatever is the state of the art for these—guessing classical Bayesian filtering on word-tokens is no longer at all what Gmail is doing)? It’d be a nice complement to the open RBLs, no?
There is also the benefit of the spam filter service being "live updated," e.g. if a new type of spam message comes up it will get flagged since lots of users.
It can't be completely automated, but it isn't as difficult or time-consuming as people paint it to be (especially sysadmins!). I've been doing it for nearly 18 years now, maintenance takes perhaps 30 minutes every 2 months or so. There is more to do every 8 years or so, as Linux distributions go out of date, and your providers sometimes go out of business.
I have my suspicions as to all the FUD regarding running your own E-mail server. Secure personal E-mail distributed on many independent servers with automatic in-transit encryption is not in everyone's interest.
In those cases, I found that it helps to use an obscure subdomain that doesn't have a website attached to it (e.g. mailus.example.com).
I used to have my own email server.
Having to manage yet another public server is a stress on its own. Having to worry about server backups, security, DKIM, SPF, DMARC, avoid being blacklisted, etc made it even worse. Despite all of this I couldn't shake off the feeling that my mails went directly to the recipient's spam folder.
I'm not interested in maintaining mail servers. I can certainly do it, but my spare time is scarce.
Nowadays, I periodically sync all mailboxes to my laptop, so that they enter the backup chain I already have. If GSuite goes down or Google disables my account, I'll upload my backups to Fastmail, point the MX records there and go on with my life.
I find this setup way easier to understand and maintain than a mail server.
To be honest my biggest hesitation has been settling on a domain name :)
I have ".in" (my country) and ".net" of my first name (9 chars) and and ".im" of my nick name (first 4 chars of my first name) I have not been able to decide on which one to move to. May sound silly but I would like to know if there are studies on email address length and TLD choices.
I have catch-alls set up across several domains I own, they all go into one inbox and replies etc. are sent from the same email the original was addressed to, automatically.
I usually use one domain for casual use (like games, Twitch, anonymous services), one for semi-professional stuff (with my real name), and one for actual business.
One problem I see with .im is it's from a different country than mine and they can change the rules to allow only residents or so, or they can hike the renewal cost to something really high. Also, I am from India where .in is common so some people might confuse .im for .in. I am inching towards <9 char>.in or <9 char>.net (my first name), but then I am not sure whether I should give up my <4 char>.im (my nick name).
Also, mailbox.org supports up to just two domains in the plan I am paying for.
The last thing you want is your emails going to a wrong tld:
going to
is very likely in your scenario for less tech-savvy contacts IMO.
I think I will keep first-name .in and .net and let the nick-name.im expire after a year or two and share .net email to my contacts.
On a side note, I really don't understand why people say it's hard to run a mail server, it really isn't. It can be hard if you go full postfix+spamassasin on plain config files and configure everything without any help. Since 2005, we've been running:
Exchange 2003 Exchange 2010 Exchange 2016
Watchguard smtp Proxies and antispam External provider's antispam services Cisco Ironports (first a dual node cluster with some older machines, then Cisco came and forced us to upgrade to some C170 which were slow as hell)
We've run through countless updates on the exchange servers, we have mailboxes with more than 50Gb of content, about 1Tb of database sizes, the biggest problem we had, came when we had a two node DAG in Exchange 2010 and the RPC Client Access Server didn't correctly change when Outlook 2007 was open leaving some clients trying to connect to the server that was rebooting. We've also changed IP addresses a few times, but if you change your SPF records correctly, and pay for a good IP range you won't have any problems. Sure, you can't have your mail server on an IP range flagged as spam, but you also wouldn't buy a 100.000 dollar car and put 50 dollar wheels on it!
Worth every penny.
Looking in my logs, it looks like that plus a hard block on zen.spamhaus.org would be enough to remove almost all spam, though I'm not sure what the false positive rate would be like on the latter.
Stories like these that reinforce my continual recommendation to client to maintain their own backups of all data on "cloud services"
I see a trend of people believing that once "its in the cloud" they do not have to worry about backups anymore...
This will burn alot of people and companies
Also disk encryption.
> Also disk encryption
As for DNS, I'd recommend CloudFlare's free offering.
Overall, I spend minuscule amounts of time on maintenance (a total of 30 minutes per two months, perhaps?), and I have the comfort of being indepenendent.
I think we should all value our freedom and independence more.
You can save yourself a lot of hassle by using a mail relay with a good reputation for all outgoing mail. That's what I do: I run my own mail server so I have full control about spam filtering etc, all incoming mail goes directly to my server.
When I send an email my server does the DKIM signing itself and then forwards the message to an external realy (with SMTP Auth). I use https://posteo.de/en for that because it only costs 1 € per month, doesn't require any personal data to create an account and it lets you send emails with any from address (not having from address filtering is important here). Their servers have a good reputation so I have no problems having my mail delivered.
If you just want to receive emails then it's probably fine.
On top of that, FastMail has a killer feature if you like have different addresses for different things. For example, say your email is [email protected] and somewebsite.com is asking you to provide an email address.
You can just put in [email protected] and FastMail will automatically route that to your mail email as if you had used [email protected]. You don't need to do anything beforehand and can just create these emails on the fly when you encounter a sign-up form.
It simplifies things greatly and if you start getting spam on one, you can just block it.
This is one of my favourite FastMail features.
There is a learning curve involved in running linux, you can't get away from that, but that curve would have been substantially steeper without it.
To keep your system up to date with it is trivial..
(not connected, just a fanboy)
Yeah, you better do release upgrades manually--but that is once every few years.
Latest Stable release: 1.03 / June 15, 1998
This doesn't solve any prying eyes business, but it does give you some agency over your e-mail. Meanwhile, your never have to worry about mail being marked spam. It just works.
https://www.smartertools.com/smartermail/business-email-serv...
That's way more than I need, and if I can avoid Windows I will, but...it is cool to see a competitor to Exchange.
I’ve been running my own infrastructure for years now and know various people that do this also. Not once have I heard about anyone winding up on a blacklist. The only way I could imagine that happening is either a new server inheriting a legacy IP with bad reputation, or possibly running your server inside a home ISP network, which are frequently rejected by MTAs. Is there any other way in your opinion?
1. I can only send/receive SMTP through their servers.
2. Static IPs cost a lot. When I canceled my static IP it was ~$25/mo (it was previously something like $5/mo).
I would recommend you run your own email server - it's both fun (you get to set it up yourself, add any features you want), and rewarding (you don't have to worry about the "rug being swept from under your feet"). The only caveat is time - time for SMTP servers around the world to know that your mail server's IP is not sending spam - and filling out some forms to unblock the server's IP address.
Since moving in 2014, I have had no hassles at all, and I continue to tweak things to my liking.