What about updating OS/packages/CVE when on holiday? Note that many CVEs are usually sent only to top-tier providers.
As a sidenote: The two RCEs this year were enough for me to judge the quality of this software.
If a whois entry of the attacker's IP/domain can RCE your intrusion blocking software, I mean...really?
Can someone please explain what this means?
Ed: as sibling correctly notes, "smart hosting" specifically referes to setting your smtp server to relay via another (eg: Gmail) - eg exim or postfix allow setting a "smart host" so that rather than looking up the receiving smtp server, all mail is shunted to the smarthost to figure out.
Added: you might get good delivery to Gmail using Gmail smarthost (requiring you to have a Gmail account) - but you might need to use outlook.com as a smarthost to get good delivery to o365 accounts... Etc.
If you're really properly securing your mail server, it would likely be isolated behind a firewall and only have a LAN ip of some kind and utilize UUCP for transport to another LAN machine that does not have WAN access, and then, only allow POP3/IMAP access to machines in the LAN or connected to the LAN via VPN tunnel. Finally, you would want to setup a backup system of some kind for this machine to periodically backup via rsync when the inotify/fswatch file modification triggers.
Next, you'd have a separate SMTP machine. For things like critical deliverability, you can't rely on SMTP to 'retry' albeit it's how they are supposed to act, so it would make sense to have multiple SMTP machines across multiple different backbones in different physical locations with backup power and the like with different MX priorities set.
The initial configuration and running a mail server are incredibly easy.
It's running it securely that increases the difficulty on order of magnitude (because you essentially have to setup a proper security protocol across multiple machines (a network) - defense in depth).
That said, it's easily doable if you're already running complex infrastructure. Hopefully, you're getting paid for your time and costs for doing so.
If not, then I hope you need to rely upon the protection of needing a home-invasion warrant vs a simple-subpoena since a machine at your home can't really just be 'subpoenad' while a machine at some datacenter business can. This of course assumes you're even running the machine at home because if you're doing all this on some VM the value of doing so diminishes ever so quickly.
EDIT: Just to be clear, you can't simply rely on fail2ban and some other on-machine script / snort / daemon / kernel feature to protect you. There are bugs in software/systems and 0days are very real (as well as the market places for them).
If other email providers are blocking you, smarthost through an email provider.
If you're getting brute forced, learn how to set up and run blocklistd or fail2ban.
Not getting 100 meg attachments is an issue that other email providers have, not people who run their own servers. If your server doesn't have any free disk space, that's on you. If it does, then set confMAX_MESSAGE_SIZE to whatever you want.
If by "standard X" you're talking about SPF or DKIM, there are lots of tutorials.
If your email software is vulnerable because of issues with your distro, you're doing things wrong.
The point is if you can't, don't. If you don't want to think about issues like these, then you shouldn't be running servers, anyway, so you're definitely not the target audience.
If you can, then these things aren't issues.