Post · Fedizen

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net yesterday

I #Selfhost my email server (that handles my 20+ domains) since almost 20 years now, currently on a cheap virtual machine running Linux, with 1 CPU core, 2G of RAM, 40G hard drive and unlimited network traffic which costs me less than €5/month.

Many people keep on telling me that running your own email server is more or less impossible. I simply don't listen to them.

I explained my setup in a blog series starting at https://jan.wildeboer.net/2022/08/Email-0-The-Journey-2022/

#DigitalAutonomy @homelab

Jan Wildeboer's Blog

Jan Wildeboer

Warning. This whole series is not a simple HOWTO. This series is about how I run my mail server. I go through the configuration, line by line and explain. It’s not going to be a simple Copy/Paste to run your own mail server. You have been warned.

⁂

More from

Jan Wildeboer 😷:krulorange:

#digitalautonomy #selfhost

0 Boosts

0 Likes

@Gyroplast@furry.engineer yesterday

I've been operating a tiny mail (and web) server for my family and friends for 20+ years now, from qmail on a Pentium II in the basement to a postfix/dovecot setup on a tiny VPS, similar to what @jwildeboer set up. I endorse his message whole-heartedly; If you can, roll your own, or find someone in your bubble who can, and setup a mail server for a whole group of people.

I never bothered with high-availability. Never lost an important mail.

Until spammers broke the Internet even harder.

Receiving e-mails works great, but beware of using your own mailserver to send emails. Mails coming from dynamic IPs are typically rejected, which destroyed the true self-hosting aspect for most "normal" people. Also, you must closely monitor your reputation/logs, lest you end up on e. g. T-Online's blacklist for reasons like "no direct contact information deducible from the FQDN", and t-online.de users will not receive your mails.
Running one diligently on a VPS is still worth it, though, if you're aware of the pitfalls!

#/usr/sbin/rtheren

@RTheren@social.linux.pizza yesterday

@jwildeboer @homelab Talk about timing. I got my mail server public yesterday with the only fixing needed for DKIM misconfiguration in rspamd xD
Once I get the PTR set, I should be good to go. Definitively a good learning experience.

Out of Control :laravel: 🇨🇦

@outofcontrol@phpc.social yesterday

@jwildeboer @homelab I’ve run my own email server since forever… it is not as difficult as people think, and it works when setup correctly. Sadly so many people are brain washed into thinking it is impossible or too difficult for a human. Love hearing email server success stories. Hope it convinces even one more person to drop big tech in favour of sovereignty and privacy. I admittedly don’t custom install by hand anymore, though that is certainly doable

Alba 🌸 :v_pat:

@mildsunrise@tech.lgbt yesterday

@jwildeboer can you send mail to (new) people that use outlook/office365?

Alba 🌸 :v_pat:

@mildsunrise@tech.lgbt yesterday

@jwildeboer and if so, does it land in spam? which actions did you have to take, if any, so that they trusted your emails?

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net yesterday

@mildsunrise I have never received complaints that my emails land in spam at Google, Microsoft, Yahoo, T-Online, GMX etc so I cannot tell you how to deal with that :)

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net yesterday

@mildsunrise Yes.

@d_s_e@chaos.social yesterday

@jwildeboer
Running a self hosted mail server properly is hard. I had one running for several years, but when I had to do a new setup, your blog posts really helped a lot 🙂.
@homelab

@ndonegan@mastodon.ie yesterday

@jwildeboer @homelab I've done the same since ~2005. The only "hard" part is making sure you're on a reputable hosting provider which isn't regularly listed on the various RBLs.

Graeme 🏴󠁧󠁢󠁳󠁣󠁴󠁿

@pa27@mastodon.social yesterday

@jwildeboer @homelab Me too, pretty much the same... My HDD is bigger but then, if I could get my wife and daughter to clear out their inboxes.....

@ben@social.ben.ie yesterday

@jwildeboer @homelab do your mails make it to other people's inboxes reliably or do they get flagged as spam by Google/Microsoft/Yahoo?

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net yesterday

@ben Yes, my emails are happily accepted by Google, Microsoft, T-Online, GMX, Yahoo etc.

@arazil@elvenstar.cafe yesterday

@jwildeboer @homelab Nice. I've always found it a bit weird that my ISP wants over $100/month for a static IP when I can purchase a virtual server for less than $10/month. That's the only reason why I don't host it at home (anymore).

@AndiBarth@muenchen.social yesterday

@jwildeboer @homelab (How) do you do malware checking? Clamav requires more than 2g currently

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net yesterday

@AndiBarth I simply don't. Well, not on the server. I hardly get spam/phishing/malware mails.

@AndiBarth@muenchen.social yesterday

@jwildeboer Thanks. Reason I'm asking: I think about handling mail for others (i.e. windows users), and I fear anti-malware is a requirement there (and also, with well known / published mail adresses).

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net yesterday

No webmail, only simple SMTP/IMAP with Postfix and Dovecot. All incoming mails are stored encrypted, all traffic uses TLS with a LetsEncrypt certificate. DKIM, SPF is configured. Admin work consists of keeping the OS and firewall up2date, this means maybe 1-2 hours in total per month. I am not saying you can also do that (I have a lot of experience). But I am saying that those skills can be learned and result in a lot less worries about being reachable :)

#DigitalAutonomy #SelfHost @homelab

Paul Sutton (zleap)

@zleap@techhub.social 3 hr. ago

@jwildeboer @homelab

I wonder if any barriers to doing this are confidence rather than technical skills, you're right we can learn these skills but having confidence the resulting system is safe, secure and can be maintained that way is a different thing.

@NebulaTide@mastodon.bsd.cafe 3 hr. ago

@jwildeboer @homelab

Please excuse if I missed something in your blog, but how are you encrypting incoming mails? This is something where I still struggle.

Andrea Pappacoda

@tachi@infosec.exchange 16 hr. ago

All incoming mails are stored encrypted

How? I skimmed the articles but couldn't see it mentioned :/

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net 15 hr. ago

@tachi I used the mail-crypt plugin. See https://doc.dovecot.org/main/core/plugins/mail_crypt.html However, my setup is a bit non-standard and due to the risks involved in getting it wrong, I decided to not add a blogpost for it.

mail-crypt | Dovecot CE

Dovecot CE Documentation

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net yesterday

And, as expected, the first replies by people saying that running your own email server isn't something you should do are coming in. As I said in my first post — I ignore them. I have 20 years of practical experience with that, I know what works for me and my users and they have never complained. But, as I also said, that is just me. I am not saying that everyone can or should do it. What I am saying is that it absolutely is possible and that I share what I know in the hope it helps.

@joshbuddy@sfba.social 5 hr. ago

@jwildeboer out of curiosity, what do you use for configuration management?

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net 5 hr. ago

@joshbuddy I'll be honest. Ssh and vi :). The machine itself runs Red Hat Enterprise Linux from th free developer subscription, so managing the base system itself is handled through dnf updates, I only use packages that come with RHEL, so configuration is mainly editing config files. I have a monitoring system using Uptime Kuma to check that all is working.

@joshbuddy@sfba.social 4 hr. ago

@jwildeboer its a fine approach, just thought maybe you'd be doing ansible given the color of your hat :)

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net 4 hr. ago

@joshbuddy I do use Ansible on my homelab machines 😊 But my mailserver is too critical for surprises that I didn't cause with my own fat fingers ;)

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net 5 hr. ago

After a day of replies (keep em coming!), I see three camps:

1. "I did this too, but gave up"
2. "I thought about it but it looks like too much work"
3. "Yeah, my mailserver is also running since years and JustWorks™"

In group 3 a few newcomers that just started running their own mailserver, which makes me very happy.

All 3 camps have good reasons for their decisions. I will continue to post about my setup in the hope I can move more people to the third camp :)

Thank you all!

@saustrup@mstdn.dk 25 min. ago

@jwildeboer @homelab 3. Postfix, Dovecot+Sieve, Rspamd for 25+ years. Minor adjustments on the way, including switching from MariaDB TO PostgreSQL and writing my own API for administration. Went from baremetal Linux to baremetal Kubernetes. Certificates from Cert-Manager.

@dzwiedziu@mastodon.social 3 hr. ago

@jwildeboer
I'm group 1 & 3, with more of 3.

I'm running Docker Mail Service (DMS), which was vary easy to set up, documentation contained instructions how to setup the DNS/DKIM/SPF, but I will dump them because of the slop taint.

Otherwise the only problem I have is Gmail throwing outbound mail into spam by default. If it weren't for this (and being unemployed), I'd took your inbound mail encryption and start preparing for making my main mail server.

@dzwiedziu@mastodon.social 3 hr. ago

@jwildeboer
Addendum: I didn't find the part about storing the mail encrypted. Did I miss it?

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net 2 hr. ago

@dzwiedziu See https://social.wildeboer.net/@jwildeboer/117543867155672091 @homelab

@dzwiedziu@mastodon.social 2 hr. ago

@jwildeboer
Thanks!

@frangdlt@mstdn.social 5 hr. ago

@jwildeboer @homelab I’m camp 3 and seriously considering moving into camp 4: “Moved off grid into the wilderness to never bother again about anything running on electricity”

(current server is EL7 and seriously needs to be migrated to something current. But can’t seem to muster the energy to do so, specially considering downtime and communication to users)

Dr. Christopher Kunz

@christopherkunz@chaos.social 5 hr. ago

@jwildeboer @homelab I'm firmly in camp 3, using Postfix/Dovecot since, I dunno, 2003? Don't remember.

Lately, I have been truly amazed by Stalwart. Deployed it on a fresh VM with an unused domain and it's really an eye opener how easy mail server administration can become if you leverage ACME and DNS automation. I got from zero to "deliverability into the M365 network" in about one hour.

I'm seriously considering the switch to Stalwart.

@janvenetor@mastodontti.fi 5 hr. ago

@jwildeboer @homelab do you have plans on anything high level, on bounce handling, maintaining reputation and actually delivering reliably to the big providers people have their boxes on?

Spf/dkim/dmarc obviously, but the softer process side...

Because I've never reliably cracked those, and neither have any of the smaller providers I've bought from...

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net 5 hr. ago

@janvenetor Why would I need to plan for something that works since 20 years? My mailserver happily and reliably exchanges mails with all big providers, has never been on a blocklist and I keep my setup current and clean. @homelab

@janvenetor@mastodontti.fi 5 hr. ago

@jwildeboer @homelab many people, including me, must be doing something subtly wrong, then.

Good to know it's not an impossible problem!

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net 4 hr. ago

@janvenetor Feel free to ask me questions on specific problems/failures, I will do my best to help! My setup is running smoothly since many years so I either got lucky or there is something different between our setups that we should be able to identify 😊 @homelab

GuacamOlé 🥑

@guacamole@chaos.social 5 hr. ago

@jwildeboer @homelab I am in (1) (but that is a long time ago. Might be easier now) the main reason I cannot switch is that for most part of my family I created the mails for them and configured their Mail Clients. So if I go away from the provider (ionos) none of their mails would work anymore.

Even if I manage to migrate my own mails: A different cup of tea for them. And I really despise my provider so it hurts a bit that I cannot switch

@MoepMan@social.troll.academy 21 hr. ago

@jwildeboer thank you for sharing how you run all of your setups. I do run two mail servers (one for myself and one for a local community) and can confirm: it sometimes is hard work, but it is doable.

@andre@social.andreclaassen.de yesterday

@jwildeboer I run my own mail server too, but I wouldn't recommend it to anyone without solid Linux skills.

You need to really understand SMTP, DNS, DKIM and friends, and when something breaks, it's your users' mail that silently lands in spam or gets lost.

That responsibility is what most of the warnings are about, not that it's impossible.

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net yesterday

@andre But still, there are literally thousands of outdated Exchange mail servers out there that also JustWork™. Email is quite a robust ecosystem that doesn't change all that drastically. My setup is more or less unchanged since 4 years when I finally added DKIM and DMARC.

@andre@social.andreclaassen.de 23 hr. ago

@jwildeboer True, once it runs it mostly keeps running. But the Unix tools are baroque to configure and a pain to get working together: Postfix, Dovecot, OpenDKIM, rspamd, each with its own config style and quirks. Not something I'd recommend to anyone coming from the Windows world.

Taran Rampersad

@knowprose@mastodon.social yesterday

@jwildeboer @homelab I think that the main problem relates to spam.

I stopped hosting my own email a few decades ago because of it, but I am headed back that way.

Have to read your posts. I imagine you would have addressed it.

Taran Rampersad

@knowprose@mastodon.social yesterday

@jwildeboer @homelab ok, you did not directly, though what you have posted covers most of it manually. Nice writeup. 🙃

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net yesterday

@knowprose In my experience, spam simply isn't the big problem it was anymore. Greylisting and DNS reverse lookups on connecting IPs solve it almost completely. I have blocklist that I keep current for some of the notorious sender domains, but that list has become much shorter over the years. @homelab

@blaisealleyne@mastodon.social 23 hr. ago

@jwildeboer @knowprose @homelab On greylisting, it served me really well for several years almost eliminating spam, but I've found it unusable and disabled it about 5 years ago. The problem is that there are too many services that users expect instant email for today, like all the forced 2FA login codes or magic links, where waiting 5-15min for an email is at best a big nuisance and at worst makes it impossible to login to some services (and I couldn't keep up with whitelisting for ~40 users)

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net 23 hr. ago

@blaisealleyne Interesting. I need to check my config, because I haven't run into that problem. Greylisting only kicks in for domains my mail server has never seen before. 2FA typically means the sending domain is well-known so I guess I was lucky. Switching it off completely is also an option, as most spammers sending from botnets don't care about a second try anyway, they just try with a different IP address. Reverse lookup stops that in its tracks. @knowprose @homelab

Ozzie D, NP-hard :bikepump: :vegan:

@ozdreaming@infosec.exchange 22 hr. ago

@jwildeboer @blaisealleyne @knowprose @homelab A close friend and I have been running a mail+ server out of my basement for over 25 years, starting off on a 1U Sun Netra. The basement, the ISP, the hardware, and the daemons have changed, but it's had the same core for over a decade (exim4, dovecot, spamassassin, prosody, nginx, radicale, rsync backups).

Over the years, our most persistent headache has been poor ISP netblock reputation. For a while we had a separate outbound server, but our current static IP has been blessedly free of RBL bans, so Outlook, Gmail etc accept our messages.

We have custom exim rules to provide per-user local-part delivery filters and sender-callout/greylist whitelists, which makes on-the-fly exceptions easier, but also caused my friend to work hard to rewrite the exim4 config when an update broke it. The dovecot config migration was a lesser pain by comparison.

I would not be able to maintain this system safely without a partner who has more time than I do to attend to "bursty" maintenance problems and mitigate security vulnerabilities. It also helps to have only a half-dozen users! So for now, we keep on trucking...

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net 22 hr. ago

@ozdreaming Thank you and your close friend for doing your part to keep the internet decentralised, the way it was designed to be 😊 @blaisealleyne @knowprose @homelab

@blaisealleyne@mastodon.social yesterday

@jwildeboer @knowprose @homelab i self-host email for myself and several small businesses and nonprofits. I found spam is still really bad for any publicly listed email addresses, but I wrote a little bash script for SpamAssassin's learn function so that users can just drop email into a "trainspam" folder and it gets processed with sa-learn before being deleted. That's actually helped quite a bit! There's still a steady stream of spam, but it's a slow stream now.

Taran Rampersad

@knowprose@mastodon.social yesterday

@jwildeboer @homelab cool. Knowing that makes decisions related to email a bit easier for self hosting.

@kaaswe@swecyb.com yesterday

@jwildeboer @homelab I have also for several years (not anymore) run my own mail server at home with good success. At the time I used Exim and SpamAssasin. I hardly got any spam as I used, among other things, graylisting for new unknown IP’s.

I probably did put more time than your 1-2h on the spam tuning part but not very much.

Running your own instance is perhaps not difficult. Keeping it secure is a totally different thing and because of that I don’t recommend this for everyone.

@tommi@pan.rent yesterday

@jwildeboer @homelab You are so courageous!

What is your experience with ending up in spam?

Also, the economical cost is quite cheap, but how about maintenance time?

Lastly: have you considered switching to Stalwart by @stalwartlabs?

Stalwart Labs

Open-source mail and collaboration server with JMAP, IMAP4, POP3, SMTP, CalDAV, CardDAV and WebDAV support. Written in Rust, designed to be secure, scalable, and easy to operate.

@otfrom@functional.cafe 6 hr. ago

@tommi @jwildeboer @homelab looks like @stalwartlabs have a good no LLM policy as well https://github.com/stalwartlabs/stalwart/blob/main/AGENTS.md which is better than dovecot https://github.com/dovecot/core/blob/main/AGENTS.md

core/AGENTS.md at main · dovecot/core

Dovecot mail server. Contribute to dovecot/core development by creating an account on GitHub.

stalwart/AGENTS.md at main · stalwartlabs/stalwart

All-in-one Mail & Collaboration server. Secure, scalable and fluent in every protocol (IMAP, JMAP, SMTP, CalDAV, CardDAV, WebDAV). - stalwartlabs/stalwart

Giovanni Mascellani

@giomasce@mastodon.social 19 hr. ago

@tommi @jwildeboer @homelab @stalwartlabs FWIW, I also self host my email servers for a few domains. My own approach with rejected outgoing messages is that if you, recipient, don't want to receive my email, then fine, I'm not bothering you with it. I do my best to be a good citizen (opt-in subscription, SPF, DKIM, one click unsubscribe, etc), but at the end of the day everybody is free to reject whatever they want.

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net yesterday

Spam: no problem. I get maybe 5-10/month, which result in reporting them via Spamcop or adding the sending server to my blocklist.

Maintenance time: As I explained in the first reply, maybe 1-2 hours per month.

Stalwart: No, I stick with my very basic dovecot and postfix setup. Nothing more needed and keeping it simple helps me to make sure I understand all moving parts and am not dependent on someone else.

@homelab @stalwartlabs

@FritzAdalis@infosec.exchange 23 hr. ago

@jwildeboer @tommi @stalwartlabs
You have 20-year-old email addresses that get 5-10 spam per month? How?

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net 23 hr. ago

@FritzAdalis I am not sure if there is a shortlist of reasons. Maybe I'm just lucky. Maybe the spammers know that I have working ways to report them and decided to leave me alone — I don't really know. But I am not complaining 😊 @tommi @stalwartlabs