Why self-host mail again

“Don’t self-host email” is the most repeated advice in systems administration, and for about fifteen years it was correct. It is worth being precise about why, because the reasons were specific — and most of them stopped being true while the advice kept being repeated.

What actually made it hard

Three things, and only one of them was ever about the mail server.

Deliverability was an unwritten curriculum. SPF, DKIM, DMARC, reverse DNS, ARC, SRS, MTA-STS: a list that grew for twenty years, each item added because somebody was abusing the previous state of affairs, and none of it discoverable from the software you were running. You found out you had it wrong when a customer said “I never got your invoice”, which is the worst possible feedback loop.

Providers made it hard on purpose. Outbound port 25 blocked by default. Reverse DNS you could not set. IP ranges pre-poisoned by whoever had them before you.

The interfaces were from another era. You could run Postfix and Dovecot perfectly and still have users who hated their webmail, and a webmail people hate is a mail system that gets replaced.

Notice that “Postfix is hard to configure” is not on that list. Postfix has been excellent and stable for two decades. The engine was never the problem.

What changed

The standards stopped moving. SPF, DKIM and DMARC are settled. MTA-STS and TLS-RPT are the newest meaningful additions and they are both several years old. The curriculum has an end now, which it did not in 2012 — and a thing with an end can be automated.

Reputation became about behaviour, not about who you are. The large receivers publish what they want: authenticate, do not send spam, honour unsubscribes, keep complaint rates low. A small sender who does those things gets delivered. The received wisdom that “you cannot get out of the spam folder from a small IP” was never quite true and is now clearly not.

Providers got better. Most now open port 25 if you ask and let you set reverse DNS. Some still do not, and that is worth checking before you rent anything — it is the first thing our own install guide tells you to check, and it is genuinely the decision that determines whether the rest works.

What did not change

You still have to do the work, or something has to do it for you. That is the whole argument for a product like this one: not that mail is easy now, but that the hard part is a known, finite, automatable list — generate the records, verify they are published, watch for drift, read the reports, notice the blocklisting, contain the compromised mailbox.

You are still the operator. If your VPS dies at 3am, nobody else is awake. That is a real cost and no amount of software removes it. The honest comparison is against what a hosted suite costs per person per year, forever, against a server and a few hours a month — we put a calculator on the pricing page that includes your own time on our side of the sum, because leaving it out is how those calculators lie.

Who should still not do this

Somebody who does not want to operate anything. Somebody whose provider will not open port 25. Somebody who needs a name to call at 3am. We say the same on the comparison pages, where the free and hosted alternatives each win on something real.

The case for self-hosting mail in 2026 is not that it became easy. It is that it stopped being open-ended.