You should not run your mail server because mail is hard.

[poolpOrg]

[goloroden]

Hey there 😊

First of all, thanks for your article, and thanks for cleaning up with a few myths! That's a good thing, and please don't take what follows as criticism on your article, but rather as some further thoughts on it…

As you said, running the mail server itself actually isn't that hard. What is hard is all the things around it:

• You have to backup it regularly.
• You have to care about updates and security updates.
• You have to run two servers for failover and keep them in sync.
• You have to care about updates and security updates for the underlying OS.
• And so on…

As long as running a mail server is not your core business, I would avoid doing all that on my own. I'm happily paying for Office 365 (or any other hosted solution out there) that let's me focus on my actual job, which I get paid for.

Because, running your own git server isn't hard, too. Or running your own messaging service. Or running … but it all sums up.

And if in the end I have to spend hours per month or per week to manage my infrastructure, I'd rather pay for it – as said, unless it's my core competency.

So yes, running a mail server isn't hard. Anyway, it's nothing I would want to do if I can avoid it.

Just my 2 cents 😉

Golo

[mmoyles87]

I 100% agree with @goloroden. I worked for a company previously with an IT admin who thought he can run our email in house. Our email server would go down at least once a month and on the outside it just seemed like he was incompetent. I knew better (that email is hard), but the CEO just fired the guy. The next guy, who wasn't nearly as knowledgeable just bought O365 and everyone was happy to not have emails sent to them bounced.

Also you never touched on reputation. Without it most of your mail will end up in receivers spam folders. Good luck figuring out why outlook SMTP servers are not accepting your mail. Did someone somewhere in the world flag an email from your IP as spam?

I'm not convinced. Sure it's easy to actually install postfix. Howver, not being able to provide 99.9999% uptime on email could be your ass. Why risk it?

[cayblood]

I care enough about decentralization, data privacy and sovereignty, that I would gladly pay for a turnkey self-deployed solution in the form of an AWS marketplace offering or DigitalOcean droplet. BUT it seems to me that an even bigger problem than hosting mail is the lack of clients with Gmail's capabilities. If someone developed a Gmail clone frontend for such a solution, I would gladly pay a hefty monthly fee for it. So much of my life is on Gmail, and Google is so secretive about when and how they suddenly shut off accounts, that I would much rather manage my own email, but the alternatives lack feature parity.

[myfirstnameispaul]

@cayblood What feature of GMail has keeps you tethered to their service? Is it just the webmail interface?

[poolpOrg]

@golorden

Hey there 😊

Hey,

First of all, thanks for your article, and thanks for cleaning up with a few myths! That's a good thing, and please don't take what follows as criticism on your article, but rather as some further thoughts on it…

Thanks, and don't worry, I wouldn't write and allow comments if I didn't want people to interact and contradict :-)

As you said, running the mail server itself actually isn't that hard. What is hard is all the things around it:

• You have to backup it regularly.
• You have to care about updates and security updates.
• You have to run two servers for failover and keep them in sync.
• You have to care about updates and security updates for the underlying OS.
• And so on…

Yes, however backups, updates, failover, these are all not mail specific and you supposedly have to handle them for any service you run.

I'm not saying mail is easy, I'm saying it's not hard, it's not harder than running other services, it's just... work.

I have daily backups, they cover user home directories, mail, websites, databases, etc... mail is not handled any different. I monitor all services equally when it comes to updates and security, mail does not get a more special treatment than my web server which people will never mention as being "hard".

Yes it is harder to maintain your services and ensure they are up than to outsource them, but harder doesn't equate to hard in my opinion.

As long as running a mail server is not your core business, I would avoid doing all that on my own. I'm happily paying for Office 365 (or any other hosted solution out there) that let's me focus on my actual job, which I get paid for.

I'm not saying you shouldn't, if this is the best option to you then go for it, I'm not against Big Mailer Corps.

What I'm against is the trend that because mail is considered something hard, the immediate solution is to move everyone to Big Mailer Corps without assessing if they would be just fine part of a smaller provider, hosted on a shared server, self-hosted on the family server, etc...

This gives them so much power that it's akin to giving them the power to decide what they want to do with that protocol disregarding what's in the interest of the community.

Because, running your own git server isn't hard, too. Or running your own messaging service. Or running … but it all sums up.

Yes, people have to make choice, some would rather outsource everything, others will want to host everything, and others will want to pick what they will work on, but my point remains:

By claiming that it's hard, which it is not, people are discouraging others from even attempting and seeing by themselves, and what bothers me is when this is done by hearsay.

And if in the end I have to spend hours per month or per week to manage my infrastructure, I'd rather pay for it – as said, unless it's my core competency.

There are also many reasons that aren't technical, why this isn't a good thing for all.

I'm sure the Iranians that got kicked out of Github because US decided that sanctions should apply aren't that thrilled about a world where e-mail is fully controlled by 3 or 4 US companies that could essentially not only kill their e-mail but also prevent them from communicating with most of the world.

I dislike that idea profoundly and it's not far fetched.

So yes, running a mail server isn't hard. Anyway, it's nothing I would want to do if I can avoid it.

Just my 2 cents 😉

Well, thanks for your comment :-)

[poolpOrg]

@dubvfan87

I 100% agree with @goloroden. I worked for a company previously with an IT admin who thought he can run our email in house. Our email server would go down at least once a month and on the outside it just seemed like he was incompetent. I knew better (that email is hard), but the CEO just fired the guy. The next guy, who wasn't nearly as knowledgeable just bought O365 and everyone was happy to not have emails sent to them bounced.

On the other end of the spectrum is a company I worked for who bought O365 and switched to Gmail, and another who bought Gmail and switch to self-hosting.

Heck, a month or so ago I helped a team unbreak their mail setup which was broken by proofpoint in front of O365, I got all of the pain from third-party hosting without any of the benefits.

Different experiences, but in all of them I still don't thing mail is hard: it is work, yes, but work is not necessarily hard, it is not necessarily constant and it is not necessarily time consuming on the long run once you know what you're doing.

Also you never touched on reputation. Without it most of your mail will end up in receivers spam folders. Good luck figuring out why outlook SMTP servers are not accepting your mail. Did someone somewhere in the world flag an email from your IP as spam?

I didn't touch on reputation because by experience it is irrelevant to most people, reputation is only an issue when you send mail to larger volumes of people and my post wasn't about bulk sending.

Outlook is a different beast, I accepted that it takes time to inbox from them.

It is when you try hard to work around their spam that you actually make things worse, once you accept that for some time you're going to warn people about looking in their spam folders, it'll eventually get better.

Other Big Mailer Corps are essentially no problem for small senders, I can inbox any Big Mailer Corps with a basic setup and, to be transparent, when I used to work in a borderline industry, I could easily inbox pretty much any Big Mailer Corps with not so much work even if they were actively blocking me. If I could do that with the volumes and kind of trafic I was sending, I think most people should easily inbox everywhere (but outlook, who will spambox for a while) given they do the minimum work.

I'm not convinced. Sure it's easy to actually install postfix. Howver, not being able to provide 99.9999% uptime on email could be your ass. Why risk it?

Because I don't have uptime issues and I'd really rather have control over my mail and not depend on a company that can terminate my account the next day if they so wanted.

[gwlperl]

First, thank you poolpOrg for you contribution to the open source internet.

I ran my own mail system from 2002-2015. Started out with just my own domains and then hosted domains for friends and family. Variations of Qmail plus postfix plus ASSP plus custom scripts and DoveCot IMAP etc. Ya'll know the drill. I've a few friends that have done the same thing over the years, and all of them have quit as well. They all say the same thing -- it got to be more work that it was worth. And as the base price of email is "zero" (even though we're now finding out that "free" isn't so "free) it's hard to make money on it.

Then came protonmail. They do everything better (and I mean everything) than I could ever and for not much $ at all. Do I regret all those years of running an email system? No, the experience of keeping up with the technology and the internet kept me on my technical toes, a constant learning experience. That experience helped my career.

So yes, you can run an email system. If you don't know how, but are interested in it, then by all means set one up. (The cloud is cheap). I have no regrets.

[poolpOrg]

@gwlperl

First, thank you poolOrg for you contribution to the open source internet.

Thanks for reading and commenting ;-)

I ran my own mail system from 2002-2015. Started out with just my own domains and then hosted domains for friends and family. Variations of Qmail plus postfix plus ASSP plus custom scripts and DoveCot IMAP etc. Ya'll know the drill. I've a few friends that have done the same thing over the years, and all of them have quit as well. They all say the same thing -- it got to be more work that it was worth. And as the base price of email is "zero" (even though we're now finding out that "free" isn't so "free) it's hard to make money on it.

We should wonder if people are quitting because they're missing a bit of information that would help them understand why they find it hard. Like the fact that SPF/DKIM are mandatory, like the fact that you should have a valid rDNS + FCrDNS and in a ideal world a matching HELO name.

How comes a lot of us, postmasters, manage to handle their mails for decades with minimum maintenance (the last time I had to deal with a block for my own server was over two years ago, otherwise I don't think I ever do mail stuff ... outside deploying new code for testing), while others seem to hit pretty much any blocklist, get blocked at every major host, etc...

MOST blocks and junking come from a mistake to start with, something that degraded reputation or that you were not allowed to do (like contacting a spam trap). The way mail works requires a bit of doing something bad over and over again to actually be punished.

Sometimes you are a collateral damage, like my block from two years ago, but this gets fixed easily and doesn't happen every two days.

Then came protonmail. They do everything better (and I mean everything) than I could ever and for not much $ at all. Do I regret all those years of running an email system? No, the experience of keeping up with the technology and the internet kept me on my technical toes, a constant learning experience. That experience helped my career.

If you feel like protonmail is the proper choice for you, then you made the good choice :-)

I don't advocate for everyone to self-host, I advocate for people to give it a try if they want to do it rather than give up because others told them it's hard, and I advocate for people to spread across multiple hosts and not concentrate in the three or four top hosts that are all known for their monopolies in other areas.

So yes, you can run an email system. If you don't know how, but are interested in it, then by all means set one up. (The cloud is cheap). I have no regrets.

I have a self-hosted address, I have addresses at various hosts, we need them all !

[gwlperl]

PoolpOrg writes: We should wonder if people are quitting because they're missing a bit of information that would help them understand why they find it hard. Like the fact that SPF/DKIM are mandatory, like the fact that you should have a valid rDNS + FCrDNS and in a ideal world a matching HELO name.

I remember over the years, learning some new things the "hard way". (SPF record? What's that?) For me the learning part was the reward, for others it's independence and freedom from the "big mailcorps". And I think we agree - for whatever reason you decide to run one, actually running your own email server helps keep us all independent and free, so I salute all of you. It's not for everyone, but everyone benefits (except big mail corps :-)

[dm17]

It would be great if a bunch of mail server experts got together and put together a docker-compose or swarm that is well-refined! It would also help pool optimizations & recommended documentation between mail server tooling. I would be happy to help test it :)

[GaryGapinski]

@poolpOrg : very nice article. I agree with your assessments.

With one minor difference: I'd rather deflect bad actors than see them continually show up in logs. This is one of the things I use (just updated to add explanatory comments).

[poolpOrg]

@GaryGapinski

@poolpOrg : very nice article. I agree with your assessments.

Thanks !

With one minor difference: I'd rather deflect bad actors than see them continually show up in logs. This is one of the things I use (just updated to add explanatory comments).

I like seeing them in my logs myself because I test filters on them, they're my tamagotchi :-p

[christhomas]

ok, so maybe this is a stupid thing to ask, but where are the installation instructions? https://www.opensmtpd.org/

Having built a mail server which runs on kubernetes (https://github.com/kubernetes-mail-server) I can say the biggest problem that I had was that there are so many working parts and none of them are really explained very well.

The man-pages are either 90% of what you need and the 10% that's missing is what you really need, but nobody thought it was important to write down. Or that options are described in very technical terms, but that doesn't mean anything to you specifically, so you google around for weeks trying to find out, how this option affects me, what does it do which I can't glean from reading a highly technical explanation.

Then you have all the programs, and ports, and pipes and files everywhere, written in different formats, each multiplying the problem of bad documentation (even after 20 years) that explains only the bare minimum.

Then you have the problem of IP addresses, mail servers are quite sensitive to them and resolving to the correct one isn't necessarily so easy if you try to run behind a firewall or a proxy, then you have to take care that you accept email where the SOURCE IP and not the FIREWALL IP, that bit me a few times before I realised what was happening. But not because it was explained. But because I sat down and really drove into the problem of why spam was happening.

Then you have the problem of restrictions, in postfix, which is the correct set of restrictions. Is there a page on postfix.org which says "PUT THESE RESTRICTIONS AND YOU'RE GOLDEN". Nope! It doesn't. But it does have a man page going into several hundred words explaining each option and what it does. But do you and have you the confidence to put them together in the right order and get it right? This also bit me in the ass a few times before I realised there is actually a right way and a wrong way.

I think the problem comes that nobody wants to tell you what a good "policy" is because this is open source, here are a bunch of engine parts. Go make a sports car! Don't ask me the right way to build it. You do you and you'll be fine. Except this isn't true. There are sometimes right ways and wrong ways and sometimes making decisions which cover 90% of the situations is better than not doing this in the spirit of "not dictating to others what or how to do things".

Does anybody know how to host multiple websites, with multiple SSL certificates per domain? Postfix says to run postfix-multi, but did you know that dovecot supports submission now? But have you configured it before? It has very little docs on it, but when it works, it's great. Then you can add as many domains as you want with as many SSL certs as you want without all the complexity of running one MTA per SSL cert. But I might be out of date cause I'm not certain whether it's the only way to do it. It even works nicely with LetsEncrypt certs that you can reuse for the domain website if you configure it properly.

Then when I managed to finalise a working mail server from all of these engine parts. I encoded it and allowed you to change a few of the options, many others you can only change if you edit the code. I'm dictating policy because I know that other people can't and other people don't have 1000 hours to read every single page on postfix or dovecots website.

So I don't entirely agree that mail isn't hard. I think it gets easier when you spend time with it. But if you try with zero experience to set-up a mail server. You'll fail for weeks before you succeed. Either that or you use somebody else's preconfigured solution and that solves your problem and you never really built it yourself in the first place.

[christhomas]

@dm17 checkout: https://github.com/kubernetes-mail-server