OffshoreVps
Security26 set 20265 min readBy the OffshoreVps team

Self-Hosting Email: Do's and Don'ts

Why running your own mail server is hard, the SPF, DKIM, DMARC and reverse DNS you need, and an easier option for a domain mailbox.

Running your own mail server is one of the hardest things to self-host, and one of the most tempting. It is not impossible, but delivery is the problem: big providers distrust small servers, and a single mistake can land your mail in spam. Know what you are getting into before you start.

Shield and lock illustration with the labels SPF, DKIM, DMARC, Reverse DNS, IP reputation, representing self-hosting email
Key ideas covered in this post.

Why it is hard

  • Reputation. Major providers judge senders by IP address history. A new server starts with no reputation.
  • Authentication. Without correct SPF, DKIM and DMARC records, mail is rejected or spammed.
  • Reverse DNS. The IP must resolve back to your mail host name.
  • Ongoing care. You patch, monitor queues and handle abuse reports.

Do

  • Set SPF, DKIM and DMARC. They tell receivers that your server may send for your domain.
  • Match the reverse DNS to your mail host name, and make sure the host name resolves to the same IP.
  • Use TLS for sending and receiving.
  • Start slowly. Send low volume at first, and only to people who expect your mail.
  • Close open relay. Your server must only send for authenticated users.
  • Back up the mailboxes and the configuration. See backups with restic or borg.

Do not

  • Do not send bulk or marketing mail from a new server. Use a proper sending service for that.
  • Do not leave ports 25, 143 or 110 open without authentication and TLS.
  • Do not run mail on the same small server as everything else if you can avoid it.
  • Do not ignore bounces and abuse reports.
The steps of this guide in order: 1. Why it is hard; 2. Do; 3. Do not; 4. Records you need; 5. Tools that help; 6. Easier option: email with your hosting
The steps in this guide, in order.

Records you need

example.com.        TXT   "v=spf1 mx -all"
mail._domainkey     TXT   "v=DKIM1; k=rsa; p=PUBLIC_KEY"
_dmarc.example.com. TXT   "v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com"
example.com.        MX 10 mail.example.com.

Replace the values with your own. Test them with a mail tester before you rely on the setup.

Tools that help

Packaged mail servers such as Mailcow, Mail-in-a-Box and Stalwart handle the hard parts of setup. Compare them and read the current documentation. They still need a clean IP and the DNS records above.

Easier option: email with your hosting

If you mainly want a mailbox on your own domain, our free email hosting and web hosting plans include email with unlimited mailboxes, without running a server. That avoids the delivery problems above.