Seems a bit overcomplicated. I am using self-configured Postfix, PostfixAdmin, Dovecot (with xaps daemon for apple push), SpamAssassin, Rainloop (webmail). Everything works on a tiny DigitalOcean VM serving tens of domains, hundereds of mailboxes and millions of emails on daily basis for already more than 10 years. Using any "package" with require unnecessary management, updates, etc. Surely there are fancy bells and…
so it is download source tar balls and build your own for ultimate stability? what do you do when a vulnerability has been posted and impacts you?
Not to this extend, installing things from packages are okay.
> what do you do when a vulnerability has been posted and impacts you?
There were no substantial vulnerabilities for those packages in years, if my memory doesn't fail me. But even is something comes up, there are additional measures like fail2ban on open ports.