Self-hosting email
Installing a mail server takes an afternoon. Keeping your mail out of spam folders never really ends. We run one for a living, and this is what the job looks like.
Updated September 2026
Short answer
What you need
A server with a clean IP
A VPS whose provider allows outgoing mail on port 25, with an address that isn't already on a blocklist.
Reverse DNS
The IP has to point back to your mail hostname. Many large providers reject mail when it doesn't.
SPF, DKIM and DMARC
Three DNS records that prove the mail really comes from you. Gmail and Yahoo expect them from every sender.
TLS certificates
For the mail server and webmail, renewed automatically every few months.
Spam filtering
Filters, blocklist lookups and a DNS resolver of your own, because the big blocklists refuse queries from public resolvers.
Backups you've restored
Mail is the one thing a family can't recreate. A backup you've never restored is a guess.
The software is the easy part. Open-source servers like Stalwart, Mailcow and Mail-in-a-Box install in an afternoon. We run Stalwart.
What goes wrong
Your mail lands in spam
A new IP has no reputation, so your first messages often go to spam while you build one. When a large provider starts refusing your mail, nobody tells you. You find out when someone says they never got your message.
Blocklists stop answering
Spam filters ask public blocklists like Spamhaus whether a sender is known to be bad. The big lists refuse queries that come through shared resolvers such as Google's 8.8.8.8, and a refusal can look exactly like a clean answer. So the filter keeps running with its most important lists switched off, and the logs stay empty.
The fix is a resolver of your own, and on Ubuntu even that has a catch: netplan adds your nameserver to the list instead of replacing it, so the public one can still be asked first.
Two signatures instead of one
Some servers create both an RSA and an Ed25519 DKIM key by default and sign every message with both. Most receivers accept that. Amazon SES rejects it as a duplicate header, so if you relay through SES, check that each domain has exactly one signing key.
Security updates stop installing
An interrupted update can leave a lock on the package database. Automatic updates then stop quietly, and their log stays empty. Check the date of the last installed update every month instead of trusting that it runs.
What it costs
A small server costs a few dollars a month. The real cost is attention: patches, certificate renewals, a mail queue to watch, and a sender reputation to defend. If mail stops for a day, someone misses a letter from school and doesn't know why.
When self-hosting makes sense
Do it if running the server is the point: you want to learn how email works, you enjoy operations, and the mail is mainly yours. You'll learn more in a month than any guide can teach.
Don't do it to save money on your family's mail. The bill is small, the time isn't, and when something breaks, it's your family who waits.
Your domain, our server
There's a middle way. You keep your own domain and your addresses, and we run the server: the patches, the blocklists, the DKIM keys and the 2 a.m. alerts. If you ever leave, the domain goes with you. See how we compare with Gmail, iCloud+ and Google Workspace.
Keep the domain, skip the server
$19 a month for the whole family. Six mailboxes on your own domain, and we look after the rest.
Find your family's domain