*With ‘better’ I mean that an encrypted solution is adequate in these cases because the mails are on other servers, and the companies/servers depend on the jurisdiction where they are located. But by hosting a mail server at home, even unencrypted, we are 100% in control of our data.

PS: is there a self-hosting mail server solution that stores everything encrypted? I already self-host almost everything I use, but not email.

  • hendrik@palaver.p3x.deEnglish
    3·
    5 hours ago

    This topic always gets strong opinions on Lemmy. The truth with security is: it always depends a lot on what you’re doing and fighting against, i.e. the threat vectors. There probably are some edge cases where it’s better to have physical control over the server. And there will be other cases where it’s better to use an established solution.

    Just keep in mind, the people over at the good companies do this as a job. They probably have years of experience. Had long meetings to discuss technicalities and what might happen and how to handle it. They’ve analyzed the threat vectors and put some thought into the exact setup. And they likely constantly improve it. You need to judge by yourself if you can do it as good as them. And you obviously don’t want to make any major mistakes.

    There are several all-in-one mail solutions available. I don’t know which can do encrypt at rest. Stalwart can do it. There is autocrypt.org and some Dovecot plugins, so I guess everyone can do it.

    I like selfhosting and having control. What I host probably isn’t perfectly secure, though. Since I don’t spend all my time doing it and I also haven’t had anyone else look at the config and check for potential problems. E-Mail is one of the more complicated things. Due to abuse and spam, a bazillion things got added on top of the original protocol and the other providers are relatively strict with flagging mails as spam or straigt refusing to accept them. So there are lots of things to do, and get right. Even without encryption. And usually the needed ports are blocked on residential internet connections.

    (And ultimately, your house also is under some jurisdiction, so if you’re worried about your own government, they can come raid your house and take your server. Or bug your phone and laptop. So you need additional security like encryption. And means to ensure they can’t circumvent it. And temper-proof devices.)

  • intelisense@lemm.ee
    301·
    11 hours ago

    Hosting email is hard. Getting your reputation up to a point where emails will even be delivered is challenging, and then you have to worry about the absolute non-stop attacks on your server. Patch, patch, patch…

    • kat@orbi.camp
      2·
      6 hours ago

      What if is like to receive emails? I don’t really send emails at all lol

      • intelisense@lemm.ee
        2·
        6 hours ago

        I mean… your email client can already do that, so I’m not sure what the point would be.

    • intelisense@lemm.ee
      52·
      10 hours ago

      The fact you are asking scares me a little. If you are seriously thinking about this, please don’t - you will very likely become an open relay, which is bad for everyone. It won’t even help with your privacy concerns. Seriously. Running a mail server is a full time job.

      • Lucy :3@feddit.org
        52·
        10 hours ago

        Honestly? No. It takes a bit of reading into SPF, DMARC, DKIM etc., and you will need to set up an authentication method (using PAM means you need to cache your unix users credentials in mail clients), which is easy via the dovecot passwd driver. The problem is that some blocklists will block any residential connection per default, but mxtoolbox will search through those, and I basically only needed to fill out spamhouses unblock form, which is easy. Even my employer (major bank) seamlessly accepts any emails from my domain.
        Bruteforce attacks can be caught with fail2ban and reported to abuseIPDB

        • mox@lemmy.sdf.org
          2·
          6 hours ago

          It takes a bit of reading into SPF, DMARC, DKIM etc.,

          That alone is often (usually?) not enough. Since many IP addresses are already blackholed before you even set up a mail server on one, there is also the slow and sometimes painful process of:

          • Figuring out by trial-and-error which recipients are not receiving mail from you (or are receiving it directly into their spam folders).
          • Figuring out which email filtering services are used by those recipients’ mail providers.
          • Figuring out how to contact those filtering services.
          • Figuring out what process each filtering service uses for requesting removal from their blacklists (or adding to their whitelists).
          • Navigating each of those processes.
          • Submitting documentation of having done so.
          • Waiting and hoping for the filtering services accept your request and start allowing mail from you.

          …and then starting all over again every so often, whenever a filtering service changes their configs or a new one appears.

          It can be done, and you might get lucky, but it often requires tenacity and a lot of patience.

  • Draconic NEO@lemmy.dbzer0.com
    7·
    10 hours ago

    One thing you’ll find about self-hosting is that you find yourself on the other side of the spam shield very often, and getting your server to a point where other servers won’t block or filter you can be a challenge, especially if your IP or domain is on more aggressive lists like Spamhaus.

    Besides that it’s not really that much different from hosting another Federated service, which you seem to have experience with.

  • Shyze3D@feddit.nlDeutsch
    4·
    11 hours ago

    Self-hosting has other drawbacks. Your need to maintain your server, you need a steady internet connection and a steady power supply. These are things providers like Proton and Tuta deal with for you.