Post by Jan Wildeboer 😷:krulorange:

And, as expected, the first replies by people saying that running your own email server isn't something you should do are coming in. As I said in my first post — I ignore them. I have 20 years of practical experience with that, I know what works for me and my users and they have never complained. But, as I also said, that is just me. I am not saying that everyone can or should do it. What I am saying is that it absolutely is possible and that I share what I know in the hope it helps.

@homelab

@jwildeboer @homelab ok, you did not directly, though what you have posted covers most of it manually. Nice writeup. 🙃

@jwildeboer @homelab I had this exact setup until an update broke my postfix config and smtpd failed to start. I didn't notice for almost a week since dovecot was still working and I don't receive a lot of emails each day. I'll never know how many emails I have missed during that period. I'm not saying it's impossible, but when you're new to these things it's hard to know when you've learned enough to self-host reliably enough. Now I still host my website, but I pay soverin to take care of my email. It's worth the peace of mind.

@trxxruraxvr I use the postfix and dovecot versions from the operating system (Red Hat Enterprise Linux) and in my 20 years have never experienced updates breaking my setup. But I would also get an alarm from my monitoring setup latest after 15 minutes of my mail server not accepting connections for IMAP and/or SMTP :) @homelab

@jwildeboer @trxxruraxvr @homelab

The problem isn't that selfhosting email is impossible. It's that selfhosting email requires a level of babysitting that _almost_ nobody is willing to put up with for long. People generally do not want to setup DKIM and SPF only to find out later that now they have to setup DMARC. People generally do not want to spend a couple of hours getting their mail server working again because their Dovecot v2.3 config file is totally not compatible with Dovecot v2.4. People generally do not want to run a half dozen applications pasted together with peanut butter and chewing gum for what appears to be a single service. People generally do not want to figure out what is required to make custom spam evaluation rules because 5-10 spams a month is an unacceptable level of garbage. People generally do not want to spend days or weeks trying to get Microsoft to quit flagging them as spam even after jumping through their SNDS hoops. People generally do not want to invest more time managing a protocol/service that gets slightly less relevant every year.

I selfhost email... and I also do it with Postfix and Dovecot. I just realize that compared to a relatively hands-off service such as Prosody for XMPP or nginx for http/https (hopefully without PHP) running a mail server is a big hassle that many people are just not willing to put up with. And anyone who has accidentally turned their box in to an open relay, isn't going to be very motivated to get back on the horse. Don't get me wrong, I think people SHOULD selfhost email and that people saying "selfhosting email is impossible" should shut the fuck up... I just think that anything instructing people to selfhost email should come with the disclaimer that it is more of a pain in the arse than most services.

PS: Yes, the Dovecot v2.3 to v2.4 upgrade will very likely break things unless you create a new config file in advance.

My three cents. ™️

@jmhorner I think I did all of that in my blog post series. It is littered with warnings "Here will be dragons" and that is not a simple install-and-forget thing. That it needs commitment and the willingness to learn. But I also think that making the knowledge needed accessible instead of treating it as some secret knowledge is the only way forward. @trxxruraxvr @homelab

@jwildeboer

"It easy to get from Paris to Luxor! Here, I'll show you: just take one step eastwards."

...

"Hey, it's not that easy. Go to my blog for a detailed enumeration of the remaining 1249999 steps."

@jmhorner @trxxruraxvr @homelab

@riley Now you switch to trolling. That's OK. But it also means I will stop replying here. Have a nice day! @jmhorner @trxxruraxvr @homelab

@jwildeboer @homelab I think that the main problem relates to spam.

I stopped hosting my own email a few decades ago because of it, but I am headed back that way.

Have to read your posts. I imagine you would have addressed it.

@knowprose In my experience, spam simply isn't the big problem it was anymore. Greylisting and DNS reverse lookups on connecting IPs solve it almost completely. I have blocklist that I keep current for some of the notorious sender domains, but that list has become much shorter over the years. @homelab

@jwildeboer @knowprose @homelab On greylisting, it served me really well for several years almost eliminating spam, but I've found it unusable and disabled it about 5 years ago. The problem is that there are too many services that users expect instant email for today, like all the forced 2FA login codes or magic links, where waiting 5-15min for an email is at best a big nuisance and at worst makes it impossible to login to some services (and I couldn't keep up with whitelisting for ~40 users)

@blaisealleyne Interesting. I need to check my config, because I haven't run into that problem. Greylisting only kicks in for domains my mail server has never seen before. 2FA typically means the sending domain is well-known so I guess I was lucky. Switching it off completely is also an option, as most spammers sending from botnets don't care about a second try anyway, they just try with a different IP address. Reverse lookup stops that in its tracks. @knowprose @homelab

@jwildeboer @blaisealleyne @knowprose @homelab A close friend and I have been running a mail+ server out of my basement for over 25 years, starting off on a 1U Sun Netra. The basement, the ISP, the hardware, and the daemons have changed, but it's had the same core for over a decade (exim4, dovecot, spamassassin, prosody, nginx, radicale, rsync backups).

Over the years, our most persistent headache has been poor ISP netblock reputation. For a while we had a separate outbound server, but our current static IP has been blessedly free of RBL bans, so Outlook, Gmail etc accept our messages.

We have custom exim rules to provide per-user local-part delivery filters and sender-callout/greylist whitelists, which makes on-the-fly exceptions easier, but also caused my friend to work hard to rewrite the exim4 config when an update broke it. The dovecot config migration was a lesser pain by comparison.

I would not be able to maintain this system safely without a partner who has more time than I do to attend to "bursty" maintenance problems and mitigate security vulnerabilities. It also helps to have only a half-dozen users! So for now, we keep on trucking...

@ozdreaming Thank you and your close friend for doing your part to keep the internet decentralised, the way it was designed to be :) @blaisealleyne @knowprose @homelab

@jwildeboer I run my own mail server too, but I wouldn't recommend it to anyone without solid Linux skills.

You need to really understand SMTP, DNS, DKIM and friends, and when something breaks, it's your users' mail that silently lands in spam or gets lost.

That responsibility is what most of the warnings are about, not that it's impossible.

@andre But still, there are literally thousands of outdated Exchange mail servers out there that also JustWork™. Email is quite a robust ecosystem that doesn't change all that drastically. My setup is more or less unchanged since 4 years when I finally added DKIM and DMARC.