Ask HN: Do You Host Your Own Email?

I believe we need to keep doing this sort of thing, more.

I haven't had the same problem as people widely complain when hosting their own email. FWIW since you ask, I put this down to:

Using a quality ISP. VPS is ok, but not from widespread bulk providers. It seems to me that receivers judge quality by the network (eg. AS number) it originates from, not IP address. So you're judged by the quality of your neighbours and what those IPs are doing.

Properly set up SPF and DKIM. Someone here was recently stating how impossible it was to host your own mail, but a commentator quickly showed they had misconfigured.

Switching off IPv6. I love it in principle, but in practice there are big providers breaking IPv6. eg. Hotmail broke theirs a month or two ago. Or applying more stringent constants to IPv6 receipt.

I don't relate to people who say you need to "warm up" an IP address. It seems they might be often trying to use bulk VPS/cloud providers who probably get a lot of abuse. I don't see it's in the receiving ISPs interest to constrain IP addresses which only generate small amounts of mail (by definition this is unlikely to be spam), and it would be easy to mistake the per-network reputation for this effect. Make sure you're not on the various public spam/block lists, though.

I'm lucky enough that my ISP provides me with a fixed public ipv4.

I use postfix as an smtp server and dovecot as an imap server (pop3 is disabled). I run them on Red Hat Enterprise Linux via a developer subscription.

So here's the deal:

1) learning postfix, dovecot and general email stuff does require some time, but essentially it's an one-time effort, email protocols do not change that much over time. you might split the effort over time and configure bits part by part. needless to say, the bit to learn as soon as possible is how not to be an open relay (that is, not to relay spam).

2) deliverability is the main problem. many services (mostly gmail) blindly assume that you're a spammer because you're sending from a residential ip address block. this is a form of discrimination in my opinion. needless to say, no matter if you setup spf and dkim, gmail is still going to deliver your emails to spam folder.

personal pet peeve: whenever i open my gmail inbox (used to do that due to having an android-based phone) it was full of promo emails that google willingly delivered to my inbox. yet my legitimate email are delivered to spam folder. i hate the gmail team passionately.

3) i have an mx backup via a virtual machine on aws, the smallest cheapest instance available. it was a quick fix when power went out at home and i was on vacation, but it's been worth keeping around for the last ~3 years.

4) maintenance is effectively a non issue. i just go through the configuration file when updating the base operating system to make sure new versions of postfix and dovecot still accept my configurations

5) server-side filtering via sieve is just awesome. when i was ~16 i used to reconfigure my filters in thunderbird every time i reinstalled my laptop, nowadays my emails are always delivered by dovecot to the correct folder (i'm using maildir to store mailboxes)

6) you do need to take care of backups. but mailboxes are essentially text files, they do not require special care and their compress ratio is very good. i keep my emails on a snapshottable filesystem (zfs), and that comes in handy when doing maintenance (worst case scenario I rollback).

7) for incoming email, when you set graylisting, spf policy verification and dkim verification, 99% of the spam is rejected by the server. i actually get most of my spam from my mx backup host, which was configured in a hurry. but i add an "x-from-mxbacup: yes" header when pulling that mail from there via formail and do filtering on that via sieve in dovecot. works okay.

8) antispam servers are clunky, i decided not to run one and just reject mail on the basis of greylisting, spf and other checks. it works okay.

9) after a while i gave up with deliverability and started using amazon ses as a relayhost. Nowadays i've got a small dedicated server with a public ipv4 and a configurable reverse-ptr dns. I should be looking into that again, but nowadays i'm fairly busy.

In general I'm very satisfied.

Stories of people having domains unjustly taken from them are rare, especially on "traditional" registries like .com/.net/.org

Running BIND is very simple, and there're lots of how-tos and some excellent O'Reilly books, too.

You can run your own DNS on a VPS, on a machine on a static IP, or even on a residential address, if it doesn't change too often. If it does change, you can run your primary on your home and have a public machine be a secondary.

It opens up so many possibilities :D

I still have issues receiving emails. Especially from financial institutions. (Wells Fargo emails just... stopped. So I gave up and setup a gmail just for them.)

I have issues sending emails from my custom domain.

IRL I always have to explain that yes, my email address is YourCompany@MyDomain.com, but no, I don't actually work for YourCompany.

Over two decades, I have played whack a mole with a number of problems. Switching to a hosting provider that does not allow me to forward @customdomain.com helped. It only allows explicitly forwarded email accounts, and setting up the email address explicitly passes most email validation tests, and I suspect the underlying IP is less likely to be blacklisted by fin tech that is extra careful about who they email.