Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want a secure mail solution, as I am looking to move away from Google and other parties looking into my private data.

How much of a PITA is it to setup my own mailserver? Should I go for an external provider with a good privacy policy and encrypted data instead?

I have a VPS running Debian (with a dedicated IP + reverse DNS), and I'm a fairly capable Linux administrator, having setup a couple of webservers, home networks, and looking over the shoulder of sysadmins at work.

The security I currently have on the VPS is limited to iptables and installing/running the bare minimum of what I need (currently basically irssi and lighttpd).

When setting up a mail server, is there a lot of stuff to take into consideration? Will my outgoing mail be marked as spam on other servers if I don't implement a number of solutions? Will reliable spam filtering be difficult to setup? Can I easily encrypt the stored mail?

share|improve this question
You understand that even with your own mail server other people will still be able to read your mail by simply reading the mail from the person who send a message to you, or the mailbox of the person you sent the message to? Your ISP can simply intercept the message as it crosses the their network. Given the how many people use yahoo,gmail,hotmail accounts it is very likely someone will be able to a large majority of your mail even if your mailbox isn't hosted with them. If you are really paranoid try and get your friends to use GPG. – Zoredache Mar 23 '10 at 18:26
I receive much more mail than I send, and at least my outgoing mail will be split over several providers, lessening the implications of data mining. It's not about communicating state secrets, it's just that I don't want any third party to know everything about me. – Jacob R Mar 24 '10 at 8:50
up vote 15 down vote accepted

I run several mail servers of varying sizes ranging from my own for two users to hundreds of IMAP mailboxes. My opinion of email can be summed up by telling you that I am planning to decommission my own private mail server and move to Gmail for my domain.

The main reason why I want rid of this responsibility is spam. It is compute- and resource-expensive to filter inbound spam with any kind of effectiveness. It takes time and effort on my part to maintain the spam filtering to ensure that we are as up-to-date as possible with the techniques being used by the spammers. And then there are times when your tools seem to be actively mis-maintained by the maintainers, such as when SpamAssassin started marking up everything with a date in 2010 or later because it was impossibly far in the future.

Greylisting works much of the time too, but some relay systems just can't deal with it properly -- and even though greylisting is legal, dealing with the broken systems is your problem.

Using black-lists can skim much of it off, but inevitably someone finds a blacklisted host that they want to receive mail from.

If you run a mail server, blacklisting is always your problem. You get blacklisted so your users can't mail out? That's your problem. Especially when the blacklist is some penny-ante ISP in Southern Wisconsin which is blacklisting you because ten years ago your IP block was used by some fly-by-night DSL provider and not the backbone provider it is today. Or they insist that they have to run a "relay test" on your server before they'll de-list you, even though the IP that is in their list is an outbound-only IP and doesn't accept email from the internet at large.

Someone trying to email one of your users gets blacklisted so they can't mail you? That's your problem. The email is always of earth-shattering importance and it is up to you to create an exception to let their email in.

Secondary-MXing is broken. Spammers just beat up on that, and your system gets to accept, then scan and possibly bounce, drop, or false-negative it into your users mailbox. Frankly I never secondary-MX anymore because if my primaries are offline for longer than it takes email to die then I've got bigger problems (probably headed by the need for finding a new job).

Then there are the RFC-nazis. You'll get blacklisted if you are not strictly RFC compliant. And then you'll get shouted down by people who hate the fact that your anti-spam choses to bounce rather than just drop, meaning the innocent people used as header-forging get buried in the back-scatter.

Email used to be interesting and fun. Now it's just one long, slow, hard kick in the nuts (pardon my colloquialism).

share|improve this answer
...and yes, I'm aware that if this was /. people would be asking for a (-1, bitter) moderation option. – David Mackintosh Mar 24 '10 at 2:50

Depending on the features you demand of your mailserver solution it can be "easy" to do. If you want to have a feeling for what you are doing you need to get familiar with the terms of mailserver setup and from there decide what tradeoffs you can live with. I have no great oevrview at hand, but here is the checklist I would follow(my experience is 1-2years old):

  • Install postfix for SMTP. If i'm only handling 10-20 mailboxes I would use simple posthash files for "account management" with virtual domains.
  • Buy MXBackup solution from somewhere so when/if my server is down, my mail will be stored waiting for me to fix it
  • Setup a imap server for reading mail. Probably courier-imap again
  • Really consider if I need to be able to use my server for outgoing mail. Could my network ISP supply me with outgoing smtp? As Jeff mentioned on the podcast, it is getting increasingly harder to setup smtp so you can send to everybody. Ipranges can be blocked, reverse ip adresse must be setup properly, handling of SPF etc.
  • Setup amavisd for spam filtering

But most of all, I probably wouldnt do it all. I would "go for an external provider with a good privacy policy and encrypted data instead?"

share|improve this answer

As a start off, I found setting up my server from the HowToForge website excellent. I was setting up a full webserver and mailserver etc with little knowledge of it. It is up and running for the last year with no hiccups.

Start of tutorial:

Specific mailserver page:

share|improve this answer

If you do it yourself, I would recommend looking at Zimbra. It's a pretty hefty for a VPS, but the install does pretty much everything for you except SPF/DKIM.

To answer your other questions:

Will my outgoing mail be marked as spam on other servers if I don't implement a number of solutions?

You should, at a minimum, set up a SPF record, which is very simple. Whether or not your mail is marked as spam has a lot to do with the IP range of your host.

Will reliable spam filtering be difficult to setup?

Depends on what sort of setup you do. In Zimbra, it comes out of the box.

Can I easily encrypt the stored mail?

You could store the messages on an encrypted filesystem. Not sure if this is exactly what you want, but I wouldn't recommend another solution, due to complexity.

share|improve this answer

Setting up an Email Server locally is the simplest thing to do. There are many Email servers that are easy to setup. My personal preference would be Postfix. This is also the default in many Linux distros.

However, as others point out, the main issues will be in both Inbound and Outbound SPAM Controls. Without Inbound SPAM Controls, you will be wasting bandwidth and have inconsistent performance issues.

Without Outbound controls, you are likely to face Delivery issues.

If you want to maintain everything in-house, put in a nice SPAM filter in front of the Email Server. Otherwise, you can have a local Email server and outsource your Outbound/Inbound scanning to services like SAFENTRIX. The scanning services do not store your emails (they are just scan and forward services) and privacy issues might be less.

share|improve this answer

Gmail for your domain. The hassle out outbound SMTP is just simply not worth it anymore for a smallish <100 mailboxe server. just my two cents

share|improve this answer
Except he clearly states in the first sentence of his question that they're trying to move away from Google – Mark Henderson Mar 24 '10 at 0:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.