Spam, hackers, and other bedtime stories

Yesterday’s message about running your own email server triggered a few questions. It turns out quite a few of you have been thinking about this.

How about spam? Does a self-hosted email server not drown in it?

It actually works better than my previous email hosted by a large commercial service. That was quite a surprise for me, I was expecting something equivalent at best.

I won’t drag you through the technical details, it’s not the place, but you do need to make some tweaks to the service configuration and to your domain setup for it to work properly, particularly so it talks to spamhaus and gets all the blacklists. Definitely feasible.

Aren’t you scared of getting hacked?

Yes, it can be an issue. And I don’t have Google’s security team. But I also don’t have a Google-shaped target on my back. That will depend on your own threat assessment and who you are.

But I’ve also hardened the server that hosts the email, gone through the usual security checklists, implemented tools like crowdsec, setup offsite backups, and so on. It’s not arcane knowledge.

How about migrating old emails into the new server?

There’s no friendly built-in migration tool like you get at some commercial email services. I used a tool called imapsync, but, honestly, in many cases you could probably just connect your email client to old and new servers at the same time and drag the mail across like it’s 2004.

What happens if the server falls down?

Nothing, really. Email was designed by people who assumed servers would break. Unless your server is down for weeks, sending servers will just queue the email and try sending again later at different intervals. You can also setup a backup mail exchanger (fancy name for server) that will hold email until your main server is up. It’s not the recommended path anymore, but it can be done, even for free.

Colin