Email Infrastructure

Self-Hosted Mail

Control Without a Black Box

Hosting your own email is more straightforward than most providers imply. I set up the complete path — submission, delivery, authentication, filtering, webmail, and the operational checks that keep each one working.

What I set up:

• Postfix, Dovecot and the rest of a maintained mail stack, managed declaratively
• SPF, DKIM and DMARC — plus BIMI where the domain and mailbox provider support it
• Submission on TLS with authentication, and no unauthenticated relay path
• Bounce handling, quota policies, aliases and sender-login maps
• Rspamd filtering, virus scanning and abuse controls
• Webmail, or a documented path for the client you already use

The mailbox data stays on infrastructure you control, and there is no per-user licence layered on top of it. Deliverability is a measurement rather than a promise, and I treat it as one.

The Mail Path, End to End

Email only works when every hand-off works. I treat the stack as a sequence and test the complete path from a signed message submitted by an authenticated user to its delivery and quarantine decisions.

Submission

• Submission is offered on port 587 with STARTTLS required.
• Users authenticate before the relay will accept a message.
• The open port 25 service relays only where it must and rejects spoofed or unauthenticated senders.
• Message size and connection limits are explicit to reduce abuse and resource exhaustion.

Authentication

• SPF lists the systems permitted to send for the domain.
• DKIM signs message content and headers so receiving systems can verify that they were not changed in transit.
• DMARC declares what receivers should do when SPF or DKIM fails, then collects reports so the policy can be tightened from evidence.
• BIMI, where available, points receivers to the domain’s verified brand mark.

Filtering & Quarantine

Rspamd handles scoring, bayes learning, rate limits, and abuse rules. Messages above the action threshold are rejected or quarantined rather than silently entering every mailbox. Users get a recoverable quarantine path instead of losing legitimate mail.

Deliverability Is a Measurement

SPF, DKIM, and DMARC only establish identity. Placement in a recipient’s inbox also depends on the sending reputation, complaint rate, message content, reverse DNS, and the receiving provider’s decisions.

I establish and monitor the authentication path, then test real outbound mail against major receivers. That means measuring what the receiving systems report, not treating a valid configuration file as proof of inbox delivery.

What the Service Covers

For the network controls around the mail host and the evidence trail, pair this with Security Engineering and Monitoring & Observability.