Self-hosting a mail server: what you need to know
The core components of a self-hosted mail stack, the most common failure modes — IP reputation, PTR records, port 25 blocks, IMAP APPEND quoting — and when self-hosting is actually worth the operational cost.
Self-hosting a mail server means running Postfix, Dovecot, and associated tooling on your own hardware or VPS. You own the data and the stack entirely. The cost is operational: TLS certificates, IP reputation management, SPF/DKIM/DMARC configuration, and occasional delisting from spam blacklists. It makes sense for teams with dedicated infrastructure capacity; it is usually not the right call for a startup trying to ship product.
The core stack
| Component | Role |
|---|---|
| Postfix | SMTP: sends outbound mail and receives inbound |
| Dovecot | IMAP/POP3 server and message storage |
| rspamd / SpamAssassin | Spam and malware filtering |
| OpenDKIM | DKIM signing for outbound mail |
| Let's Encrypt | TLS certificates |
Common failure modes
IP reputation. A fresh IP is inherently suspect to large receivers like Gmail and Outlook. Start with low volume and ramp slowly. Check your IP against major blocklists (Spamhaus, Barracuda, Proofpoint) before going live, and keep monitoring.
Reverse DNS (PTR record). Receiving servers do a reverse lookup on your sending IP and check whether the PTR hostname matches your sending domain. Most VPS providers let you set PTR from the control panel. Missing or mismatched PTR is a common cause of mail being rejected or spam-folded.
IMAP APPEND date quoting. When appending messages to Dovecot, the INTERNALDATE argument must be quoted. Some IMAP client libraries (including async-imap) pass it unquoted, which causes the server to parse it as multiple tokens and stall waiting for a continuation response. The symptom looks like a hang rather than an error — easy to miss.
Port 25 blocked by the provider. Many cloud providers block outbound port 25 by default, especially in China. You may need to file a ticket to unblock it, or route outbound mail through port 465 or 587 with SMTP AUTH. Inbound mail on port 25 also needs to be open if you want to receive directly.
When self-hosting is worth it
Strong data-residency compliance requirements (finance, healthcare, government) or deep customization needs (custom anti-spam rules, tight integration with internal systems) are the realistic cases. For most teams, managed hosting delivers better reliability at lower operational cost.
Rovela's backend uses Postfix for inbound delivery and Dovecot for storage — a reasonably conventional open-source stack if you want a reference architecture.