I've run my own mail server for 15 years, since I got my first permanent connection. I host on the end of it as I have a large distrust of "the cloud".

It is cost effective for me as it has increased my merchantable skill portfolio. I've ended up designing some mail systems (50k+ users) for some large ISPs in the past thanks to my accumulated knowledge.

Debian is probably the easiest to get off the ground - it's pretty much "sudo aptitude install postfix dovecot" and follow the instructions. I was a FreeBSD user but primarily due to apathy, I tend to use Debian.

This is about to change however, when FreeBSD supports the raspberry pi as it's a much lower memory and power footprint device so some of FreeBSD's simplifications and optimisations will assist there.

For me, a Raspberry Pi with a 32 gig SD card plugged into my 12Mbit connection will suffice for the 18 users and 5 domains via IMAP that are currently being hosted on a much larger machine. Cost to me: $40-50. No brainer.

People use e-mail constantly. It's important. $50 per person per year isn't a blip on the radar. Do you know how much money you'll lose if your 18 users can't access their mail for an hour? Now consider how much time they'll spend setting up their own mail clients instead of using Gmail. Think of the increased time and frustration waiting for searches to finish. Think of the extra time they'll spend deleting spam. You're paying a lot more than $40-50 for that mail server, but the real cost is obscured from you.

It's a no-brainer: skimping on email hosting is simply not worthwhile.

Backups: tar and gzip daily, then scp to a friend's server in another country. Also take manual backups to encrypted USB stick weekly which I carry around on me at all times.

Searching: you only have to search it if you have lots of it. I have 9 messages in my maildir. I receive perhaps 20-30 messages a day. No problems - they all fit on the screen. If it's worth keeping, it goes as a ticket/wiki entry or in the hg repo as a document.

Spam: get one or two a week per user. Just delete by hand at the moment. People who use imap use their mail client's spam filtering stuff. If it gets problematic I'll probably install a filter.

Calendars/contacts: both in mercurial in agenda format (plain text, one line per event or contact). Very easy to manage and share. Have you tried keeping a central address book/calendar accurate using any other method?

I know how much we'll lose without email which is why it is where it is :) About 2m from me most of the time.

Cost? I've spent 20 minutes on admin this year. Everything is automated..

I'm not skimping, I'm making sure we do it right so we don't need all the tooling and features. To be honest, google is too cheap to be good if you ask me and their reputation shows regulalrly with outages and problems.

There are lots of reasons to not use Gmail. Maybe $50/year is a lot for you. Maybe your needs are modest. Maybe you want the knowledge and experience of running mail. Maybe you want or need to interface your other components with mail. Maybe you don't like the rest of Google Apps. Maybe you hate the Gmail interface. Ultimately, most people will choose Gmail despite whichever of those reasons might apply. There's no need to turn a technical decision into a dogmatic one.

Regardless, one's privacy is already compromised the moment they sign up for Internet service; that information can be made available to the right people after one subpoena.

http://searchengineland.com/google-fired-two-employees-for-b...

http://www.wired.com/threatlevel/2010/01/operation-aurora/

http://readwrite.com/2010/09/27/googles_second_transparency_...

Google read your email and use it to throw targeted ads at you.

There is a fine line between profiling, tracking and analysing communications and utilising that data for something nefarious. The only deciding factor on how far it goes is cash.

- I kept a mostly "if it works don't break it" approach, but about once a year there'd be some alert about security issues with some specific software and I'd run a "aptitude update". Invariably it'd update the packages out of order, libc would get screwed up, and I'd have to reinstall the whole server.

- I could never get the spam filtering up to snuff. I had daily auto-training spam+ham folders etc set up, the works, but I'd always get a a few spam messages in my inbox, and a handful of false positives. Used SPF but it had to be softfail since someone I visit friends/relatives who's ISPs have blocked SMTP ports aside from their own relay.

- My fault, but I ran a forwarding address for a friend, and I got blocked by my ISP since it forwarded some spam messages that got flagged.

- I don't feel properly equipped to deal with backups. (sure you can set up an rsync to somewhere else [that you have to pay for], but you also want to keep monitoring that they're good, test restores, etc)

Easily worth $50/year for me to not have to think about it.

edit: forgot the biggest reason I switched: I got an iPhone, and iOS doesn't do push email over IMAP. Gmail supports Exchange, and there's no way I'm going to be hosting that myself...

I earn more than $25 per day, therefore $50 per year for mail hosting is worth it!

What distribution are you using? I've never had this happen, though for important servers I tend to use Debian stable. I would be shocked if it happened on stable.

I ran a linksys NSLU2 as my mail server for a few years, with a USB stick as its storage. With Debian linux with Dovecot, Postfix, spamassassin, and the Spamhaus DNSBLs set up I managed to keep the signal to noise ratio pretty damn high too.

It was fun, and remarkably not hard.

http://www.codinghorror.com/blog/2010/04/so-youd-like-to-sen...

(I ask because I'm still trying to get an idea of just how vulnerable your garden-variety server is, user stupidity aside)

If you've got a "garden variety" server with a strong password, I wouldn't worry.

I've got a laptop slung on the end of my ADSL line that has had literally millions of attempts.

If you are worried, you can install fail2ban which will block repeated attacks at the firewall level.

And if you use SSH keys you should be totally safe.

Remember to apply security fixes though since the automatic attacks also probe for ancient versions of SSH servers.

One easy way to manage it is make a folder for each hostname, and add things like mysql root password, ssh port, public IP, pivate IP as different entries relating to the all aspects of managing the host.