Postfix, dovecot, fail2ban, spamassassin. I don't have a secondary; I just keep up to date image snapshots and regularly backup the disks. It's only for my personal communications so I try to keep things as simple as I can.