Small mail server best current practices
Ugh.<p>I have been running my own UNIX mailserver since 1997.  I have consistently and loudly evangelized this practice, especially here on HN, and pushed back against the notion that it was too difficult or too time-consuming to implement and maintain one&#x27;s own mailserver.<p>But ...<p>Having just recently made the <i>major</i> transition from relying <i>solely</i> on clean IP space and proper DNS records (which, in the last 18 months, has become increasingly untenable[1]) I have changed my mind.<p>I will continue to run my own mailserver, for activist, ideological reasons, but I must now agree that it is too difficult and complicated - and fragile.<p>In no particular order, some of the things that I find overly complex and disturbing are:<p>- The DKIM implementations are very, very over-engineered.  I understand, in principle, why we want DKIM to be a pluggable component that can be used as a general building block in various implementations, blah blah blah, but there is <i>no reason</i> that DKIM can&#x27;t just be a feature, with a corresponding blob of config lines, in sendmail or OpenSMTPd or whatever.  Having to pkg-install, and track, and maintain, whatever DKIM implementation you choose, along with all of its various dependencies, etc., is a big truckload of complexity and fragility that I just can&#x27;t see ever appreciating.  And the irony ?  A popular DKIM implementation is to use the bundled DKIM functionality built into rspamd (!) ... so it ended up being just a feature anyway.<p>- The whole SSL component ... I appreciate this, I understand this, and for many use-cases I just don&#x27;t care.  I don&#x27;t currently need encrypted email and if someone makes a decision to disallow sending to addresses&#x2F;domains that don&#x27;t support it, fine.  Of course, if <i>all of gmail</i> decides not to, now I have another giant truckload of complexity and fragility that I need to implement and maintain.  My mailserver should be an extremely tight, stripped down host with as few packages and daemons possible[2].  Instead, I am now installing a big list of packages just so that letsencrypt can fire up a <i>temporary web server to clicky click make my certificates</i>[3].<p>- Now my mailserver is running a database (Redis) which is required to run rspamd, which is required to implement DKIM, without which I cannot send mail to yahoo.com addresses.  True story.<p>So much complexity and fragility ...<p>[1] About 18 months ago yahoo.com stopped, with no errors or bounces, delivering mail from an 11 year clean IP with proper DNS&#x2F;MX entries.  I implemented DKIM and the problem is solved.<p>[2] My mailserver is a FreeBSD jail and previously ran only sendmail - and nothing else.  Now I am running OpenSMTPd, rspamd, redis ... and once in a while I am running a webserver to communicate with letsencrypt.<p>[3] Speaking of letsencrypt ... requesting, generating and implementing SSL certs (even for use on the web) is simply creating, and trading, blocks of plain old ASCII text.  I haven&#x27;t looked into this, but is there an &quot;expert mode&quot; somewhere in letsencrypt where I don&#x27;t have to run webserver instances and ... I can just run openssl command lines and cut and paste blobs of ASCII ?