Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Self-hosting email in 2025 is easy actually (apart from M365)

mastodon.social

Post reply on HN
Print view View original

71–79 of 79 posts

Re: Self-hosting email in 2025 is easy actually (apart from M365)

#71

Post by tsukikage »

em-bee wrote: post #68
tsukikage wrote: post #8

Earlier quoted context omitted.

I use exim4. So after doing the usual SES setup, I can change the smarthost router to look like this: SMARTHOST_FOR_MS = email-smtp.us-east-2.amazonaws.com::587 smarthost: debug_print = "R: smarthost for $local_part@$domain" driver = manualroute domains = ! +local_domains transport = remote_smtp_smarthost route_list = hotmail.com SMARTHOST_FOR_MS byname ; \ live.com SMARTHOST_FOR_MS byname ; \ outlook.com SMARTHOST_F…

how does that work with SPF, DMARC, DKIM? don't you have to authorize email-smtp.us-east-2.amazonaws.com to send email on your behalf? if you don't wouldn't every spammer use that? also, how much does that cost? i don't need to send more than a dozen email per year like that.

Yes, you do need to include:amazonses.com in your SPF. Amazon aren't too bad at kicking spammers off SES promptly. More importantly, Amazon doesn't sign for DKIM - your server still does that; so no-one else gets to DKIM for you; and you can set the DMARC policy to require both.

SES currently charges $0.10 per 1000 outbound emails. The first 3000 mails are free. I received my first official bill for $0.02 after around two years of use.

Do investigate other relay services. I only stopped at SES because I was in a mad rush and it was the first one I tried that did everything I needed, without bouncing or getting filed to trash on any services I cared about. I have done nothing like a full survey of the market, and there may well be a better option. It is the general approach I am suggesting, not trying to shill SES specifically despite what it may look like.

Re: Self-hosting email in 2025 is easy actually (apart from M365)

#72

Post by Bender »

commandersaki wrote: post #66
Bender wrote: post #24

Earlier quoted context omitted.

But the real reason I stopped running my own mail is that I didn't trust myself with regular backups (even though I still do them via IMAP on occasion) and disaster recovery. I don't think anyone self-hosting really has this figured out. On the server itself a cronjob calling rsnapshot [1] is a good habit in the event something gets corrupted or someone deletes mail by mistake and you want to save the day . RSnapshot…

Not that helpful if say your server has been attacked by ransomware. Happened to my friend that I was colo-ing with who was running a mailserver at the time. He didn't have proper backups and/or DR (though I think his thick mail client had a copy of most of his mail); he didn't pay and instead moved everything to Fastmail.

If the server has been attacked somehow by ransomware then the sftp backups will be fine. sftp to a chroot sftp-only configuration and rsnapshot running on the remote end means one would have to not notice this for a very long time before all backups are corrupted. I am happy to demonstrate this if need be.

Adding to this time between backups can be shortened by using a different cronjob to utilize inotifywait in a loop and back up to a different or same sftp account achieving both scheduled and ad-hoc snapshots.

Re: Self-hosting email in 2025 is easy actually (apart from M365)

#73

Post by em-bee »

tsukikage wrote: post #71
em-bee wrote: post #68

Earlier quoted context omitted.

how does that work with SPF, DMARC, DKIM? don't you have to authorize email-smtp.us-east-2.amazonaws.com to send email on your behalf? if you don't wouldn't every spammer use that? also, how much does that cost? i don't need to send more than a dozen email per year like that.

Yes, you do need to include:amazonses.com in your SPF. Amazon aren't too bad at kicking spammers off SES promptly. More importantly, Amazon doesn't sign for DKIM - your server still does that; so no-one else gets to DKIM for you; and you can set the DMARC policy to require both. SES currently charges $0.10 per 1000 outbound emails. The first 3000 mails are free. I received my first official bill for $0.02 after aroun…

"not trying to shill SES specifically"

i didn't assume that. obviously you can only talk about the one that you are using, and while the general setup applies to other such services, i can now file SES as an option that works. and with that price point i am probably going to be to lazy to look for alternatives. (although i should check if the email service i am already paying can do that too without requiring me to send all emails through them)

Re: Self-hosting email in 2025 is easy actually (apart from M365)

#74

Post by 1718627440 »

pseudalopex wrote: post #58
1718627440 wrote: post #13

Earlier quoted context omitted.

> Or you don’t self-host but use a major email provider and don’t have the problem. Or you just use a mail relay as most VPS providers enforce anyway.

What VPS providers enforce a mail relay? Not DigitalOcean or Hetzner according to the author.

Mine does. I would prefer if it doesn't as that means that I can't reject SPAM that wouldn't pass address verification, but using it for sending is nice.

Re: Self-hosting email in 2025 is easy actually (apart from M365)

#75

Post by akho »

There’s also https://gitlab.com/simple-nixos-mailserver/nixos-mailserver , if you prefer to write not quite as much Nix yourself.

MS365 (outlook, hotmail) bounced my emails for a while. Not “classified as spam”, but outright rejected, so you can’t even ask the person to un-spam you, add to contact list, &c.

Luckily, very few people I know use those, and Gmail worked fine. MS365 also works now; I’m not sure what changed.

Re: Self-hosting email in 2025 is easy actually (apart from M365)

#76

Post by isaachinman »

crossroadsguy wrote: post #67
isaachinman wrote: post #36

Earlier quoted context omitted.

Are you happy with Apple/iOS Mail? Drives me absolutely insane.

It does but honestly less than those cloyingly glossy and sluggish Electron/hybrid apps out there. So it's not like we users are spoilt for choice.

Curious, which particular ones have you tried and hated?

Re: Self-hosting email in 2025 is easy actually (apart from M365)

#77

Post by isaachinman »

VladVladikoff wrote: post #31
isaachinman wrote: post #26

Curious – for those self-hosting, what email _clients_ do you actually use on desktop/mobile?

Personally apple mail. Thunderbird is also ok. Roundcube for webmail.

Thunderbird is an all-time legend.

Re: Self-hosting email in 2025 is easy actually (apart from M365)

#78

Post by commandersaki »

Bender wrote: post #72
commandersaki wrote: post #66

Earlier quoted context omitted.

Not that helpful if say your server has been attacked by ransomware. Happened to my friend that I was colo-ing with who was running a mailserver at the time. He didn't have proper backups and/or DR (though I think his thick mail client had a copy of most of his mail); he didn't pay and instead moved everything to Fastmail.

If the server has been attacked somehow by ransomware then the sftp backups will be fine. sftp to a chroot sftp-only configuration and rsnapshot running on the remote end means one would have to not notice this for a very long time before all backups are corrupted. I am happy to demonstrate this if need be. Adding to this time between backups can be shortened by using a different cronjob to utilize inotifywait in a l…

Yeah then you need a monitoring solution for your backup, another colo for your DR, etc. You end up with all this overhead that you need to always be on top of, unless you can hire someone that you trust and maintain things for you. It's just better value hosting elsewhere where all these unhappy path scenarios have been careful considered and taken care of. I'm definitely not say use free services either as they do not even come with support, but there's middle ground.

Re: Self-hosting email in 2025 is easy actually (apart from M365)

#79

Post by Bender »

commandersaki wrote: post #78
Bender wrote: post #72

Earlier quoted context omitted.

If the server has been attacked somehow by ransomware then the sftp backups will be fine. sftp to a chroot sftp-only configuration and rsnapshot running on the remote end means one would have to not notice this for a very long time before all backups are corrupted. I am happy to demonstrate this if need be. Adding to this time between backups can be shortened by using a different cronjob to utilize inotifywait in a l…

Yeah then you need a monitoring solution for your backup, another colo for your DR, etc. You end up with all this overhead that you need to always be on top of, unless you can hire someone that you trust and maintain things for you. It's just better value hosting elsewhere where all these unhappy path scenarios have been careful considered and taken care of. I'm definitely not say use free services either as they do…

In terms of monitoring I could envision this just being a section of the backup script on the primary servers that perform a dry-run backup and if the delta is massive then something has likely tampered with the files, refuses to do a real backup and sends an alert, text message or otherwise. It would have to be something that people would not ignore.

The sftp backup servers in their script that kicks off their rsnapshot could also count total vs new files and alert if nothing has changed or too much has changed. Each person/org would have to determine what is an unusual time to go without changes assuming the primary mail servers have died due to malware or the new file delta is too big due to files all being tampered with.

Post reply on HN