Receiving self-hosted email is a solved problem you can stand up in an afternoon. Sending is where it dies: your outbound mail is judged by IP reputation you don't have, by receivers who won't tell you why they junked it. The honest recommendation for most people is hybrid — host your mailboxes yourself with mailcow, relay outbound through an established SMTP service for roughly $0–3/month, and revisit full independence only if you control a clean datacenter IP and enjoy this specific fight. Never send directly from a residential connection; port 25 is blocked outbound by most ISPs and residential IP space is blacklisted wholesale.
Why the asymmetry exists
Inbound is just you accepting connections — Postfix and Dovecot have done that reliably for twenty years. Outbound runs through reputation systems trained by decades of spam: a receiving server scores your IP's history, your domain's history, your authentication records, and your volume patterns. A fresh IP has no history, which reads as suspicious. Google and Microsoft don't bounce suspicious mail; they accept it and silently file it to spam, so you don't even get an error to debug. Since the Gmail and Yahoo bulk-sender rules took effect in February 2024, SPF, DKIM, and DMARC went from best practice to entry requirements — and they're necessary, not sufficient. Microsoft (Outlook/Hotmail) remains the hardest grader; plenty of correctly configured small servers spend months in its junk folder.
The three postures, priced
| Posture | Monthly cost | You control | Deliverability risk | Ongoing effort |
|---|---|---|---|---|
| Managed (Fastmail, Proton, Migadu) | $3–9/user | Domain and data via export | ~None | ~None |
| Hybrid: mailcow + smart relay | $0–3 + hardware | Mailboxes, storage, filtering, archives | Low (relay's reputation) | Low |
| Full self-host on a VPS | ~$5 VPS | Everything including reputation | Real and permanent | Weekly attention at first |
Hybrid is the underrated middle. Your mail store, search, aliases, filters, and archive live on your hardware; only the last hop of outbound rides a relay like Amazon SES ($0.10 per thousand messages), SMTP2GO or Mailjet (free tiers around 200 messages/day) — a personal domain sends a few hundred a month, so this rounds to zero. You keep every property that makes self-hosting email worthwhile and outsource exactly the part that punishes individuals.
The DNS records you need in every posture
Set these before the first message leaves, then verify with a mail-tester.com score of 10/10:
; SPF — authorise your relay (SES example) and your box
example.com. TXT "v=spf1 mx include:amazonses.com ~all"
; DKIM — mailcow generates the key; publish the selector it gives you
dkim._domainkey. TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."
; DMARC — start at quarantine, with reports so you can see spoofing
_dmarc. TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"Full self-hosters additionally need reverse DNS (PTR) matching the HELO hostname — settable at any real VPS provider, impossible on residential connections, which is the technical reason home-sent mail is dead on arrival. Get the DNS fundamentals right once; the same discipline pays off across your whole setup, as covered in DNS for self-hosters.
Mailcow specifics
Mailcow is the sane default stack: Postfix, Dovecot, Rspamd spam filtering, SOGo webmail/CalDAV/CardDAV, and a genuinely good admin UI, all orchestrated in Docker. Plan for its appetite — the docs say 6GB RAM plus 20GB disk, and that's accurate, so it wants a real box or VPS, not the corner of a Pi. The two settings that implement the hybrid posture: add your relay under Configuration → Routing as a sender-dependent transport with credentials, and leave port 25 inbound open for receiving. Use the bundled backup_and_restore.sh helper nightly; a mail store is the one dataset where "I'll re-download it" is not a recovery plan. Lighter alternatives (Mailu, Stalwart) exist in the email category, but mailcow's community mass means your weird problem already has a thread.
Monitoring: the part that never ends
Full self-hosters should treat deliverability as an operated service. Concretely: parse your DMARC aggregate reports (parsedmarc plus a dashboard works), check your IP against blacklists monthly (mxtoolbox covers the major ones), register for Google Postmaster Tools to see your domain reputation, and send yourself test mail to Gmail and Outlook accounts weekly — inbox, not spam, is the test. Warm a fresh IP slowly: single-digit daily volume to major providers for the first weeks. This is the recurring tax the hybrid posture mostly cancels: your relay's reputation team does it at scale.
When full self-hosting is actually fine
It works, plenty of people run it happily, and the preconditions are specific: a VPS provider that unblocks port 25 with a real abuse desk (Hetzner opens it on request for established accounts; several big clouds never will), an IP you've checked against blacklists before committing, correct PTR/SPF/DKIM/DMARC from day one, low steady volume, and tolerance for the occasional important message landing in someone's junk folder while your reputation accrues over months. If any of those made you wince, that's your answer.
Bottom line
Host the mailboxes, rent the reputation. Mailcow on a 8GB box or VPS, SES or an equivalent relay for outbound at pocket-change prices, the DNS trio published before the first send, and a 10/10 mail-tester score as your definition of done. You get ownership of the archive, aliases without limits, and filtering you control — without gambling delivery of a job offer on whether Microsoft likes your IP this week. Full independence is a hobby worth having only when you can afford its failure mode.