Hacker News Reader

> postfix & dovecot's 20+ years of legacy cruft

That's not my experince - I use postfix and dovecot for years and they are rare examples of high quality software to me. I don't see any cruft. They are flexible which make learning and configuration harder compare to opinionated software where most decisions made for you by a developer and you have not choice but to accept them. I myself view sometimes see flexibility as a disadvantage but IMHO they strike a good balance. Postix often criticized by Exim user for not being flexible/configurable enough. And they don't force to use unix accounts, it's just one of options.

Having said that I would agree that using a mail server which combines all in one package is easier than unix way with multiple specialized parts combined. For a novice it could be a challenge to stichs (configure) multiple parts together, especially if you don't know how to test each part separately and blidnly follow some how-to.

Where you can find plenty of legacy cruft is mail standards and implmenting them correctly is not an esty task that's why I trust Postfix and wary of anything new until it battle tested on a large number of servers.

You may have just forgotten the pain of the learning curve? Admittedly postfix & dovecot are way more sane than rspamd. But their whole default config (and something like 50% of the options and documentation) are oriented around UNIX system accounts for each of your mail users, which seems insane and 80s-era to me (let's go dial up to the mainframe at 300 baud and see if we have any mail). It takes dozens of pages of documentation to orient yourself away from all that, understand Postfix's "address classes", that you generally want "virtual mailboxes", etc. No support for DKIM, except through sendmail-invented "milters", of which Postfix heartily recommends you to OpenDKIM, a project which hasn't been touched in 10+ years, doesn't support EC signing, is not packaged on most distros, is documented on a outdated non-https site with sparse even more out-of-date plaintext documentation, referring you to a defunct FTP site to download the code, etc. And milter requires setting up a UNIX or inet socket and tedious configuration, etc. etc.

Poor support for SASL, at least for mail users looking to god forbid send an email and relay it to the internet, and password-protect against random spammers doing the same, referring you instead to Dovecot SASL - also legacy cruft (partly the SASL protocol designers' fault), SASL has numerous "mechanisms" but nearly everybody uses just the PLAIN mechanism, ensuring a TLS channel is established first, which is about 10 lines of code to implement.

Just a ton of unnecessary legacy cruft IMHO.

> No support for DKIM, except through sendmail-invented "milters", of which Postfix heartily recommends you to OpenDKIM, a project which hasn't been touched in 10+ years, doesn't support EC signing, is not packaged on most distros, is documented on a outdated non-https site with sparse even more out-of-date plaintext documentation, referring you to a defunct FTP site to download the code, etc. And milter requires setting up a UNIX or inet socket and tedious configuration, etc. etc.

OpenDKIM has been working fine for me for the last 10+ years. It's also in the default repos of my distro.

> Poor support for SASL, at least for mail users looking to god forbid send an email and relay it to the internet, and password-protect against random spammers doing the same, referring you instead to Dovecot SASL - also legacy cruft (partly the SASL protocol designers' fault), SASL has numerous "mechanisms" but nearly everybody uses just the PLAIN mechanism, ensuring a TLS channel is established first, which is about 10 lines of code to implement.

SASL works fine for me with Postfix and Dovecot, including sending restricted to authenticated users. Also CRAM-MD5 was recommended over PLAIN everywhere even back when I set this up.

Took me weeks to perfect our own setup based on Postfix, Dovecot, Roundcube with some patches, rspamd with attachment-type whitelisting and a bazillion other features, clamav with extra patterns, plus the many tweaks and enhancements you need to dig out from obscure places.

Like fts-flatcurve, an archive plugin for dovecot that can find stuff in 30 years worth of mails in a second, over IMAP in Roundcube. Or rspamd settings to blacklist not a single IP but an entire ASN of misbehaving colo clients. IMAP with namespaces is also a true pain to configure. Or setting bzip2 compression for an auto-expunged journal for spam, and archive without expunge. Painful.

If you made it this far, you will find that your IP address is tainted. So choosing a hoster that keeps his backyard clean from spammers is necessary, otherwise you will suffer by association. Did I mention SPF records in DNS.

So I consider our server a piece of art. 30 years in operating systems certainly helped.

There is also https://github.com/stalwartlabs/mail-server

Using this now, and love it. For easy mail reception and sending, mail-in-a-box does it all for you (if you don't mind opinionated, but stable) and Stalwart does it all for you and is highly configurable, including an oauth2 server and more. Keen to try Mox, but I think it went viral and their website accidentally got ddos'ed.

I've been using mail-in-a-box for 5 years and I couldn't be happier. For me, stability is the #1 concern for an email server, and mail-in-a-box is really set it and forget it. I also like that it includes CalDAV and CardDAV, so it served as a complete substitute to Google Mail+Contacts+Calendar.

Is it known to be compatible with OpenBSD as-is, or with minimal tweaking?

OpenDKIM works fine, and is easy to configure. My first time config was like 30 mins following the guide here: https://wiki.debian.org/opendkim

And postfix is exceptionally well documented software. One of the best. It's easy to script config modifications thanks to `postconf` and do all kinds of interesting stuff with milters or policy servers, etc.

OpenDKIM is unmaintained and does not support Ed25519 signatures.

It does in my Linux distro for the last 4.5 years.

https://github.com/trusteddomainproject/OpenDKIM/commits/7c7...

Auch. Now that you say... last commit in 2018 and last release in 2014. And a couple beta releases in 2018.

> Wow... having just gone through a 20+ hour byzantine nightmare of setting up postfix & dovecot

Did you do this by hand / manually, or use a 'pre-canned' solution like:

* https://mailcow.email

* https://workaround.org

Comparison between Mailcow and Mox:

Mailcow (from https://docs.mailcow.email/getstarted/prerequisite-system/#m...):

  A single SOGo worker can acquire ~350 MiB RAM before it gets purged. The more ActiveSync connections you plan to use, the more RAM you will need. A default configuration spawns 20 workers.
  *RAM usage examples*
  A company with 15 phones (EAS enabled) and about 50 concurrent IMAP connections should plan 16 GiB RAM.
  6 GiB RAM + 1 GiB swap are fine for most private installations while 8 GiB RAM are recommended for ~5 to 10 users.

Mox:

I checked with htop, and my Mox process currently takes <100 MB.

Manually - I want as slim/minimal/resource-efficient a setup as I can, and to understand what I'm configuring.

https://workaround.org has pretty good instructions for each component that allows one to understand things: very little magic involved.

* https://workaround.org/ispmail-bookworm/big-picture/

I just gave up and now use https://github.com/docker-mailserver/docker-mailserver

It hasn’t given me many issues so far! Nice to see new options popping up, though!

I once set up qmail on a home server. Looking back, I have no idea how I managed.

It is a rite of passage. That config system…

It's a lot better than sendmail.cf, which I had to use in a previous job.

    # handle "from:<>" special case
    R$*<>$*                 $@@                    turn into magic token
    
    # basic textual canonicalization
    R<$*<@$+>>              $@$1<@$2>
    R$*<$+>$*               $2                     basic RFC822 parsing
    
    # make sure <@a,@b,@c:user@d> syntax is easy to parse -- undone later
    R@$+,$+:$+              @$1:$2:$3              change all "," to ":"
    R@$+:$+                 $@$>6<@$1>:$2          src route canonical
    
    R$+:$*;@$+              $@$1:$2;@$3            list syntax
    R$+@$+                  $:$1<@$2>              focus on domain
    R$+<$+@$+>              $1$2<@$3>              move gaze right
    R$+<@$+>                $@$>6$1<@$2>           already canonical

I ended up changing to mailu recently, very happy with it. https://mailu.io

Btw, I ended up disabling webmail. I don't the users really need it. Nothing will compare to the Gmail experience anyway, so might as well just encourage people to use proper Mail clients like Mail.app or Mail on iOS.

> Nothing will compare to the Gmail experience

I think this might be a matter of personal preferences. Personally I find GMail very confusing, and not that user friendly.

FastMail UI is so much more intuitive. For me.

I used to think Gmail’s interface was excellent until I moved to Fastmail.

Seconding for mailu. I've had a mailu server running for at least a couple of years that requires very little on-going maintenance, but I don't use it daily or for anything personally mission critical.

When I do need it, however, it's there, humming away happily.

One does not simply send mail these days

Or receive.. depends how you look at it. Big players like Microsoft and Google defines what goes into spam box.

And in the case of Microsoft: often the invoices, expired credit card notification from Microsoft itself are considered spam in o365... Had some inconveniences because of this.

But hey, at least it has a Copilot bar thoughtfully filling that useless vertical space on my screen!

This isn't a project unique in his genre. There are also others like Mailu[0] that, although different in the implementation (Docker containers abstracting away the hard parts of deploying "traditional" components) share the spirit of having a self-contained project that is easy to deploy. Are there some specific reasons why you didn't go the Mailu (or some similar project) way? I'm asking because, every now and then, I have the itch of deploying my own mail server to be used for my side projects (nothing commercial), so if you have an opinion on those projects I would be curious to hear it.

[0] mailu.io

I did that a few years ago too. Then decided to just use OpenSMTPD instead of Postfix, keep Dovecot for IMAP and rspamd for signing DKIM. I followed the guide at https://prefetch.eu/blog/2020/email-server/ and got it running relatively smoothly. However, Microsoft (and sometimes Google) kept blocking emails coming from my server's IP, so I just decided to stop messing around and pay migadu 19€ a year for dealing with that stuff for me.

Maddy did it for me. Pretty awesome.

IME postfix + dovecot + opendkim were pretty easy to set up. No idea why you'd need to go through a "20+ hour byzantine nightmare" for that.

I gave up and started self-hosting Mailcow. It’s worth paying the support fee to free yourself to do other more productive things. Let them manage the complexities.

Check out mailcow

I use this for one of my domains, had it running for over a year and it's been rock solid

I’ll never understand why postfix is so popular given how hated it is. OpenSMTPd has worked wonders for many years and in much easier to set up.

I have no idea how/why it is hated. For me it is one of the best open source server packages. For instance if you have a specific problem you will find some configuration directives on the Internet and they will actually work.

OpenSMTPd seems easier superficially but it's not particularly well-documented. I don't remember the details but I remember struggling with setting it up because certain config flags were not documented and I had to guess their exact meaning from the few blog posts out there that discuss OpenSMTPd. (It also didn't help that there were slight changes in the config format at some point in the past.)

if you started with sendmail (and sendmail.cf) then postfix was alright

That's it, also Qmail was a nightmare (still is?) Perspective most of times is everything.

Oh I miss qmail, felt much easier to deal with than the alternatives.

I’ve been using it for a decade without issue. Only problems I’ve ever had self-hosting were related to being randomly junk-black-holed by the big three independently of each other for 1~30 days for seemingly no reason, but no software is going to fix that.

User experience with it, and opinions on it, seem to vary. I, for one, rather like both postfix and dovecot: both are well-documented, maintained, lightweight, reliable, yet configurable and feature-rich software, with few dependencies and good track records.

haters gonna hate

Probably popular because it’s the default mta in Debian-based installs.

Hey it could be worse, at least it’s not sendmail.

Dealing with Linux email servers and related things is easily the worst experiences I have ever had working in IT. Just miserable.

You are probably on Debian, this adds a lot of complexity.

My exim config became10x smaller after I started using upstream directly.