Mail servers

Self-hosting email means assembling (or adopting) the same stack every time: MTA (SMTP), IMAP/POP3 delivery, spam/virus filtering, DKIM/SPF/DMARC, webmail, and an admin panel — the difference between projects is how much of that assembly is done for you and in what shape it ships.

The three approaches

• stalwart (OSS) — one Rust binary (14.9k★). All protocols in one process: JMAP, IMAP4, POP3, SMTP, plus CalDAV/CardDAV/WebDAV collaboration. No external database required. The “modern rewrite” bet: memory-safe single-process instead of a fleet of daemons.
• mailcow-dockerized (OSS) — a Docker Compose fleet (13.5k★): Postfix + Dovecot + Rspamd/ClamAV + SOGo + ACME + admin UI, each in its own container, glued by their compose files. The “assembly pre-done” option — you operate the same classic daemons, just containerized; updates are image pulls. Needs a dedicated host (many bound ports) and likes ≥6 GB RAM.
• iRedMail (iRedMail (OSS)) — a shell installer (GPL-3.0, since 2007, 1.8k★): a script that installs and configures classic components bare-metal on mainstream Linux/BSD — Postfix, Dovecot/Nginx, SpamAssassin + ClamAV, Roundcube/SOGo, backend of choice (OpenLDAP/MySQL/MariaDB/PostgreSQL), secure-by-default (TLS forced, SSHA512/BCRYPT). No containers — you get a conventional distro mail server you can admin with standard tooling; iRedAdmin (free) / iRedAdmin-Pro (paid) for the panel.

The pattern: stalwart collapses the stack, mailcow containers it, iRedMail installs it. Related divide — JMAP (stalwart’s native, JSON-based modern protocol) vs IMAP everywhere else.

The part nobody ships: reputation

The server software is the easy half. Self-hosted deliverability lives or dies on: PTR/rDNS matching the HELO, SPF + DKIM + DMARC alignment, a clean IP (not in Spamhaus etc.), and warm-up patience — Gmail/Outlook will junk-folder a perfect stack on a fresh IP. For a homelab behind a residential or cloud IP, this is the real decision variable: relay through a sending service (SES, Mailgun, or a trusted relay) vs accepting you mostly receive.

Fit for the homelab (doombox/n100)

• Smallest footprint / fewest moving parts: stalwart — one binary, embedded storage, JMAP + IMAP both available; good fit for a low-power node
• Want the classic stack with disposable upgrades: mailcow on a dedicated VM (its port footprint doesn’t cohabitate well)
• Want a “normal” Debian you can ssh into and repair with apt: iRedMail
• Reverse-proxy note: all three want 25/465/587/143/993 direct; the homelab *.h nginx-proxy pattern applies only to the HTTP sides (webmail/admin)

Related: Homelabs · Golden repo (backup discipline — mail is the one dataset where loss really hurts)

The other half of self-hosted mail: the archive (2026-10-09)

GithubProjects (89❤/9.2k views) → osp.fyi post → mail-archiver (OSS) (s1t5, 2,171★ C#/.NET, GPL-3.0; tweet + repo captured): not a mail server but a self-hosted archive — “self-host a searchable, exportable email archive from IMAP and Microsoft 365 accounts, with a read-only API and an MCP endpoint that lets AI agents search it.” Sync side: scheduled multi-account archiving (IMAP full-sync; M365 via Graph; personal Microsoft via OAuth2 device flow with a pre-registered shared Client ID — no Azure app registration needed; whole-tenant bulk import; mbox/EML import and migration between mailboxes; per-account retention, plus a compliance Deletion Lock that forbids manual deletion while local retention still runs). Access side — the agent-era differentiator: read-only REST API v1 with scoped per-user keys (“scripts read archived mail without ever exposing mailbox credentials”) and an MCP server at /mcp exposing the same read-only surface as discoverable tools (search_emails, get_email, list_accounts, list_folders, get_attachment). Exports as mbox/zipped EML — the archive never locks you in. Household angle: this is the receive-side complement this note’s server map never covered — the read-only-archive-with-MCP pattern is the Agent-accessible product genre applied to personal mail (and the safest possible shape for it: agents can search the archive but not the live mailbox, can’t send, can’t delete).