FWIW, the first machine I ever had broken-in to was a personal box I ran outside the firewall of an employer and the vulnerability was in BIND 4. Circa 1996 probably.

I’d still run my own email if it weren’t such a pain in the ass. I’m not new to this stuff[1], but at some point you get tired of doing SA stuff at home when it’s also your day job.

1. https://duckduckgo.com/?q=qmail+jay+soffian

Yep. I've been using OpenBSD since circa 2000 and rarely deviate from the stock software and configuration. At least as important as security (and not unrelated), they ship HTTP, SMTP, and DNS services in base; services which the developers use themselves.[1]

Package management is more difficult, but if I have to install something as a package I probably don't want the headache. Upgrades are more manual as compared to Linux distros, but they're simple and consistent and well-documented so require no more than an hour every 6 months. Sysmerge (for upgrading /etc) and now syspatch (for kernel patches) have made it even simpler. The upgrades come precisely every 6 months. The system evolves incrementally so I don't need to invest much effort in keeping pace--just stay on schedule.

I only backup user data and a few key configuration files (e.g. domain specific rules for smtpd.conf and httpd.conf) as I can recreate a setup with minimal effort.

I stopped running POP and IMAP a long time ago. OpenBSD never provided native solutions. (They shipped a POP3 daemon, popa3d, for a few years but few people used it.) I use mutt, some others use alpine, and others just forward their email to somewhere else. I do greylisting with OpenBSD's native spamd and some simple RBL checks that run from the MDA, but that's it. I get more spam than I might otherwise, but it's tolerable, especially considering I don't have to maintain additional software. And most other users don't see the same spam volume--I've used my e-mail address on web pages and in public forums for nearly two decades so it's on pretty much every list traded among spammers and marketers.

[1] People criticize their "secure by default" mantra as disingenuous or misleading, but if you've been running these services for years or decades you know exactly what they mean by it.

> I’m not new to this stuff[1], but at some point you get tired of doing SA stuff at home when it’s also your day job.

Amen! Which is really sad sometimes. I really enjoyed that stuff when I was younger. Sometimes makes me wish I had picked another career so I might still enjoy fiddling with more or less trivial tech as a hobby.