Why self-host email at all
Hosted email is convenient and completely legible: the provider stores and can scan every message, and the account can be suspended with your entire history inside it. Self-hosting flips that — the mailboxes live on a server you control, in a jurisdiction you chose. Paired with a no-KYC offshore VPS paid in crypto, the mail and the machine under it are not tied to your legal identity. The trade is real work for real control.
SP·02The one hard part: deliverability
Sending mail that actually lands is the real challenge, and it is not about the software — it is about reputation. You need a clean IP (ask the host whether the range has a good sending history), correct SPF, DKIM and DMARC records, a matching reverse DNS (PTR) record on your IP, and an unblocked port 25. An offshore host that supports mail will let you set rDNS and will not throttle SMTP — both are essential and both are things mainstream clouds often refuse.
SP·03What to run
Two paths. A mail-in-a-box style stack (Mailcow, Mailu, Mail-in-a-Box) bundles Postfix, Dovecot, spam filtering and webmail with sane defaults and is the fastest route to a working server. A hand-rolled Postfix + Dovecot setup gives full control and is what most hardening guides assume. Either way, budget 2 GB RAM and put the server on its own domain.
SP·04Keeping the stack private
Register the mail domain anonymously, pay for the VPS in Monero, and administer over Tor or a VPN. Encrypt the mail store at rest if the box is shared, keep backups off-box, and minimise logs. The server holds your correspondence, so its security posture is your privacy posture — treat hardening as part of the setup, not an afterthought.
SP·05Step by step
-
01
Deploy a no-KYC VPS with clean IP and open port 25
Pick a 2 GB+ plan, confirm the host allows SMTP and lets you set rDNS, and pay in crypto. A clean sending IP is worth more than raw specs here.
-
02
Point a domain and set DNS
Register the domain anonymously, add MX, and create SPF, DKIM and DMARC records. Set the PTR (rDNS) on your IP to match the mail hostname.
-
03
Install the mail stack
Deploy Mailcow/Mailu for the batteries-included route, or Postfix + Dovecot by hand for full control. Issue a TLS certificate for SMTP and IMAP.
-
04
Test deliverability and harden
Send to a mail-tester service and fix anything below a perfect score. Then keys-only SSH, a firewall, fail2ban, and off-box backups.
