Do any of you still self-host email? I am losing my mind

Which regional ISP leases the /24

V2. E5-2670. 32GB DDR3 ECC, runs fine for mail + wireguard + a few static sites. The KVM overhead is maybe 3% tops, not worth complaining about.

The brute force numbers are real, I can paste logs if anyone wants. 4000+ is a slow week. Christmas 2023 I saw 12,000 attempts in 48 hours after some list dropped. Crowsec has been solid but I still watch the logs manually every morning. Old habit.

I need to know who your regional ISP is. I have been trying to get a /24 announcement in Estonia for two years. Telia will not talk to individuals. Elisa wants a business registration with three years of filings. I am running on a single IP from Hetzner now and the reputation lottery is exhausting.

Also: do you lease the /24 as PI space or is it SWIP'd under their ASN? This matters for the RPKI route.

Cox Business, believe it or not. I know, I know. But their enterprise side in this region still has actual humans. I lease under their ASN, SWIP to me, they handle the LOA for ARIN. Not PI, too expensive for what I do. RPKI is valid through their ROA.

It took six months of emails and one site visit where a tech measured my rack with a tape measure. Very 1999. But the IP reputation was clean from day one, which is worth more than the money.

Ten minutes to running. Six months to understanding why your mail bounces. Two years to giving up.

I have seen this cycle maybe forty times on mailing lists. The docker crowd treats email like it's another web app. It is not. Email is a social protocol with technical components, and the social part is controlled by three companies who do not answer emails.

Your 95% to gmail is because you send enough volume to stay warm. Wait until you have a quiet month. See what happens.

I had a quiet month, August 2023, maybe 40 messages total. September deliverability was identical. The IP is three years old now, that matters more than weekly fluctuation.

But I hear you on the social protocol thing. I am not saying everyone should do this. I am saying the people who say "impossible" are wrong. Difficult, yes. Opaque, absolutely. But not impossible if you treat it like infrastructure instead of a weekend project.

The automated systems do not know "dinner invite." They know sender reputation, content similarity to past spam, user engagement patterns, and a hundred other signals. The "wine" keyword probably hit a fuzzy hash from some actual pharmaceutical spam. The husband and wife on the same domain actually makes it weirder to the classifier, not less.

I used to explain this to customers and they would yell at me like I designed the algorithm. I did not. I was making $22 an hour and my manager tracked bathroom breaks.

This is a valid concern, but it applies equally to any datacenter you do not physically control. My server in Frankfurt terminates TLS at the hypervisor boundary in some sense. I trust Hetzner's network because I must, not because I have audited it.

The cooperative model has different risks. I would prefer a cooperative in Germany or Netherlands with published data processing agreements and GDPR liability. At least then I have legal recourse if plaintext leaks. With self-hosted in a rented rack, I have a terms-of-service page and hope.

I am not arguing for surrender. I am arguing for realistic threat models.

This is the other thing I see. Email is not your only service, it shares a kernel with everything else. One RCE in your web app and your mail database is gone. The blast radius of "self-host everything" is underappreciated.

At my current role we run dedicated mail subnets with no other services, no outbound HTTP, update on a 48-hour lag behind upstream for stability. This is not paranoia, it is what happens when you have been breached once.

For personal use? I get the appeal. I ran the same stack. But "docker compose up" is not a security boundary.

I run my mail on Oracle Cloud free tier, AMD instance in Warsaw. Zero dollars, been up 14 months.

The IP reputation is garbage, obviously. Gmail accepts maybe 60%, Microsoft 40%. I do not use it for important things. But it works for mailing lists, notifications, stuff where delivery does not matter.

My backup MX is a 512MB ARM instance in Frankfurt, also free. I have $0 in this and it sends mail. That is enough for me.