Building your own mail server
Running mail yourself is entirely possible on a dedicated server. It is also a long-term commitment to a reputation system you do not control.
Read this part first
The software is the easy half. The hard half is deliverability: large providers decide whether your mail reaches the inbox, the spam folder or nowhere, and a new address with no sending history starts from nothing. You will be building that reputation for weeks, and you can lose it in a day.
If mail matters to your business and you have no particular reason to self-host, a dedicated relay service is often the right answer — and you can still run your own mailboxes while sending through it.
The components
- Postfix
- The MTA: receives and sends. Sane defaults, good documentation.
- Dovecot
- IMAP and POP3, plus authentication for submission.
- Rspamd
- Spam filtering, and it signs your outgoing mail with DKIM as well.
- A control panel
- DirectAdmin — included free with every server — configures all of this for you. Unless you have a reason to build by hand, use it. See control panels.
The records, all four
Mail will not work properly without every one of these:
- MX pointing at your host
- SPF listing who may send for your domain
- DKIM, signing on the way out, with the public key in DNS
- DMARC, telling receivers what to do when the first two fail, and where to send reports
Plus a PTR record matching the name your server uses in HELO, which must itself resolve back to the same address. See reverse DNS and sending mail from your server.
Ports and TLS
Port 25 for server-to-server, with opportunistic TLS. For your own users, submission on 587 with STARTTLS or 465 with implicit TLS, and authentication always required. An open relay is found within hours and ends with your address on every blocklist there is.
Test from outside that you are not relaying, and keep testing after every change.
Day-two work
- Watch the queue.
postqueue -p. A growing queue is the first sign of either a blocklist or a compromised account sending spam. - Read the DMARC reports. They tell you who is failing authentication, including people spoofing you.
- Rate-limit outgoing mail per account, so one stolen password does not produce fifty thousand messages before you notice.
- Back up the mail store — it is the data people miss most and notice fastest. See backups.
- Monitor blocklists for your address, and know the delisting process before you need it: getting off a blocklist.
Tell us before you start
Let support know you are going to send mail. It is in your interest and ours: we can check the address has no history attached, and we would rather know a sudden rise in port 25 traffic is you than an incident. See the acceptable use policy for where the line is.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base