• About a year ago I migrated from Postfix + Cyrus + SpamAssassin to Stalwart for a ~10 user mailserver. The much larger mail servers that I have run in previous jobs (5k+ users) were Postfix+Cyrus, but I’m not so much in that business any more. I’m happy with the result of my migration, but I also don’t feel that it was necessary, just “nice to have”.

    Here’s what motivated me to make the change:

    • Simplified configuration: my Postfix + Cyrus configuration had been ported from machine to machine, across distros and over a decade, and had gotten to be complex and frustrating to troubleshoot. Fixing this obviously didn’t require switching to new software, but there was an aspect of “in for a penny, in for a pound.”
    • Integrated DAV: Stalwart’s DAV features are somewhat limited, but they’re built in, so I ended up with a better integrated and more feature-rich DAV setup for calendar and contact sync than what I had before.
    • JMAP: JMAP does seem to be the future and I wanted to get onto something that was built around it as closer to a first-class interface.
    • Better spam filtering: Stalwart’s spam filtering is better integrated for training and easier to configure than SpamAssassin.

    None of these are things that would have been impossible with the Postfix + Cyrus setup, but overall migrating to Stalwart was easier.

    Here are my complaints about Stalwart:

    • Documentation: Stalwart uses a configuration model that is very flexible and powerful, so many things that are not “supported” by the admin UI can still be done by manually adjusting the logic-based configuration directives. The problem is that the documentation on this is not very good, so you have to make inferences from different examples and test things out. An example of where this comes up is Postfix-style domain aliasing (entire domain aliased to a single user), which is possible (and not even very difficult!) with Stalwart but will require some real head scratching since there aren’t clear instructions and it requires making changes in several different sections of the config.
    • Authentication: this isn’t necessarily a Stalwart problem as there are fundamental aspects of email that make SSO difficult, but Stalwart was originally designed under the assumption that it would be the user directory and that shows. For the first years external user directories weren’t really supported (for most use-cases due to limitations in Stalwart’s LDAP impleemntation), that has since improved but there remain many friction points. For example, app passwords don’t work with an external user directory. The good news is that Postifx+Cyrus setups tend to have the same problems for the same reasons, it’s just that the greater configuration flexibility of those tools gives you more options to work around them. For example, I had a totally custom authentication setup with Cyrus (it passed the user-furnished credentials to a script I wrote), which I do not think is currently possible with Stalwart.
    • Developer culture: it often feels, to me, like the Stalwart developers lack experience running mailservers. They sometimes ship features that are marginally usable or totally unusable in the real world, and then express surprise when people file issues explaining things that seem obvious to me. I’m not sure how much I can complain about this because there aren’t that many people with experience running institutional mail servers these days, and one of the points of Stalwart is to be sort of a clean break. But it is annoying.

    score 1 · canonical

  • notqmail (as you might guess from the hat), Dovecot for IMAP, rspamd, DKIM, SPF, SRS, yadda. If I could change one thing, it’d be to have way more time to improve notqmail. If I could change two things, I’d wish into existence a checkpassword-shaped IMAP server that’s as production-ready as Dovecot. bincimap unfortunately isn’t it.


    score 1 · canonical

  • Mailcow!

    Running on my home network. Outgoing relayed thru my ISPs SMTP relay.

    Only compliant is that the default soft-reject behavior of the rspamd config. It leverages that many spam bots alledgedly don’t retry email sending, while legitimate MTAs do. While all legitimate email arrives within ~5m it is still annoying, so I disabled the soft reject. Haven’t seen any of these spam bots yet.


    score 1 · canonical

  • Debian + Postfix + Dovecot, with account management and rather unconventional wildcard matching done in postgresql. I have spamassassin in the loop but I never got it to work properly; it assigns basically the same score to the most legitimate and the most obvious spam mails.

    The crazy wildcards (for ad-hoc addresses) are super nice. The nonfunctional spam filtering is the main pain point, especially for my younger brother who used the main mail address I host for him in some Minecraft forum when he was about 13.


    score 1 · canonical

  • I’d be curious about people’s take on RBLs, both from sender and receiver perspective. Do you use them? Which ones? Do they give you trouble?
    I find them highly effective. When combined with using unique email addresses for each signup I get very little spam. Most of what I do get comes forwarded from my vanity gmail address.


    score 1 · canonical

    • I find them highly effective, to the extent that I don’t run a separate spam classifier and my domain is like 20 years old. My unwanted email comes in three forms:

      • Hacked residential IPs and proxies; generally either on an RBL but definitely failing to come back after any greylisting and often speaking broken SMTP or sending too many recipients on one email.
      • Hacked or cheaply-bought mail servers; again, bad reputation, and if they’re forging the From: they fail on SPF etc. pretty quickly
      • People using legitimate mail services (like Buttondown or Mailchimp) to add me to a spam “mailing list” and ride on the reputation of these services. These have been the hardest to stop and will probably drive me to set something up, but I don’t want to accidentally end up classifying like … newsletter services as spam.

      score 1 · canonical

  • Until a few months ago I was using Exim + Dovecot + Rspamd, then I moved over to Stalwart. I like how Stalwart integrates IMAP, SMTP and spam filtering, even though there are some rough edges and the installation documentation leads you to the wrong path more often than not.

    The primary MX running Stalwart are dedicated servers at OneProvider in Paris (Scaleway) and HostDZire in Canada (Leaseweb). Until now I have been lucky enough to get relatively clean IP addresses, I also use HetrixTools to monitor various DNSBL.

    For secondaries, I have a job that exports the mailbox and alias names from Stalwart to Exim running on 2 different VPS.


    score 1 · canonical

  • lobsters__reidrac@crustaceanson.theshelf.topM
    link
    fedilink
    arrow-up
    1
    ·
    edit-2
    8 days ago

    I’ve self-hosted my email for over 25 years.

    Currently Debian stable with postfix + sqlgrey + postfix-policyd-spf-python + OpenDKIM and a couple of DNSRBLs, with dovecot imap.

    I receive very little spam, and sometimes the big providers may filter my email as spam, and there is not much I can do about it unfortunately. I generate little traffic so it doesn’t matter I that have been in the same IP for the last 12 years or so, I can’t gain the reputation they want.

    I started with OpenBSD and sendmail, but the Internet was a very different place back then.


    score 2 · canonical

    • OpenDKIM has so many safety issues and no updates in a long time (almost a decade?), that I do not understand why people use it on an internet-facing server.

      Some months ago, there was a resurgence of interest from people with commit access to the repo, but as far as I can tell, it’s all still in the develop branch, with occasional mentions that a new release is planned.

      For those who use it, what are your reasons? Do you think that I’m too skeptical about a C project that hasn’t been touched in many years and that AI shows has a load of issues?

      Not to detract from the project – I did use it myself for a while until I started looking into it a bit more. I do hope that a good, new, maintained release will come, but it hasn’t yet. After a flurry of commits, it’s been quiet again for some 3 months or so. The people who pull(ed) that car are, of course, highly respected and very busy with other things. No blame there! Just wishful thinking :)


      score 1 · canonical