Run your own mailserver - it's fun!
Freedom = run your own mail server
On my journey to get rid of $BIG-CORPORATION1 having power over my own data, and make the net de-centralized again, I finally took again a step forward running my own mail server.
I have the deep understanding, that decentralization and having standards (so that YOU can use whatever software on YOUR data) is a necessity for a free internet. Otherwise Enshittification will progress, and we are damned to serve an oligarchy of corporations in the net…2
I run my own mail server about 25 years ago the last time. Things have changed in the meanwhile, got more complicated: DMARC, DKIM, certificates, etc. Email is a rather hostile environment, always with the danger, that your mail server gets blacklisted by rather obscure services. Even misbehaving servers in your IP-neighborhood can have an impact, whether other mail servers accept you sending email to them.
But I highly object the saying "email service is so complicated, leave it to the experts like Google, Microsoft, …". Digging into the documentation, getting aware of current practices, and actual setup and configuration of my email service took me only about half a day.
And the outcome - at the one hand having a fine email setup under my own governance, on the other hand, having learned a lot, how email works today - was for sure worth the investment of half a day!
DNS
Of course the first thing you need is access to a domain (and according DNS configuration). Be aware, if this is a newly registered domain, this will already give you for the first week (up to one month) already a penalty to get blacklisted, so be patient. For DNS-hosting I am using gandi for about 20 years. I have no complains so far.
Hosting
Second - you need a physical or virtual machine running your email server 24/7. Choosing a hosting partner, be aware, not every hosting service allows you to run your own email server, they are probably afraid, that you misconfigure your email server and pollute your IP-neighborhood, as mentioned above.
I can highly recommend OpenBSD Amsterdam for a small to medium non-profit setup. You get a virtual OpenBSD3 server for a fair amount of money, Additionally, they donate a part of your rent to the OpenBSD foundation.
My tech stack
Following, you'll have to decide, how your setup will look like. For sure you need a SMTP server for receiving and sending email and a strategy to access your received email, f.e. via IMAP, POP3, or other obscure methods. F.e. simply copying your Maildir via rsync?
I chose:
- SMTP
- OpenSMTPD - part of OpenBSD. Sexy simple, easy to grok configuration. Highly recommended. Never looked back to postfix, exim, sendmail…
- IMAP
- dovecot - a package in the openbsd ports. Actually I considered simply syncing my Maildir via rsync. But considering, multiple clients, perhaps wanting to have access to my email on my mobile I chose the "classical" IMAP path.
Receiving the necessary certificates from let's encrypt for the SMTP server I handle with acme-client and httpd (also both out of the box in OpenBSD). Benefit - having set up httpd, it also serves my web page / this blog.
Regarding user management (adding users, etc) - I handle all via ordinary user management in OpenBSD with useradd, etc. If you want to prevent your users to log in to the server, just give them nologin as shell. For the typical family- or small-organization-setup that's IMHO sufficient.
For the specific configuration and setup I consulted the according man pages at OpenBSD (fabulous read as always) and the following blog posts:
Backups & redundancy
Where I haven't found a proper solution is redundancy and backup. Normally you would provide a MX entry in your DNS record with lower priority as backup, resulting in being addressed if the entry with highest priority is not reachable. But therefore - that it actually makes sense - you would need an additional server, probably on another machine or even better in another data center.
On the other side, if a sending mail server can't connect to the destination server, it should queue the message and retry lateron. Currently, I assume OpenBSD.amsterdam won't have more than 1-2 days downtime over a year - so, for a privately run mail server it seems bearable to run just with this one instance. Of course you'll still have to do ordinary backups of data and config files, for the worst case, that you have to fully reestablish the environment because of f.e. a full disaster recovery.
Finally
If you don't have the need for special spam-fighting mechanisms, that's it. Doesn't sound that complicated? I can fully recommend going that path, as mentioned, I learned a lot and it is actually a good feeling, being again in power of my own email without advertising-, AI-, or whatever-algorithm sniffing in my mails (at least on my side).