Running your own mail server is a well-understood project. Postfix, Dovecot, an IMAP-capable client and a spam filter are mature, documented and widely deployed. The hard part is not getting mail to flow once. It is keeping mail flowing, private and trustworthy for years, while nobody on the team thinks about it until something breaks. This article compares that work with using a small hosted provider, and it tries to be fair to both sides.
What a mail server actually includes
A working setup is more than an SMTP daemon. It typically includes a transfer agent for inbound and outbound mail, a delivery agent, an IMAP and submission service, TLS certificates with automated renewal, DNS records for SPF, DKIM, DMARC and reverse DNS, a spam and malware pipeline, backups that have been restored at least once, log handling, and monitoring for queues and certificate expiry. Each item is manageable on its own. Together they become a standing responsibility.
What self-hosting gives you
- Control over data location and retention. You decide where mail is stored, how long logs are kept, and who has shell access.
- No dependence on a provider's policy changes. You set the rules for quotas, aliases, forwarding and client compatibility.
- Full visibility. Every component is yours to inspect, which matters for some threat models.
- Freedom to design. Custom routing, unusual authentication setups and integrations are possible without asking anyone.
What it costs
The costs are mostly time and attention, and they are easy to underestimate. Patching the mail stack, the operating system and the TLS configuration is ongoing. Certificate renewal failures cause outages that look like delivery problems. Queue monitoring is needed so that deferred mail does not pile up unseen. Backups must be tested, because a backup that has never been restored is a hope rather than a plan.
Deliverability is the largest hidden cost. Receiving servers weigh the reputation of the sending IP address and its reverse DNS. A new address may have no history, and blocklists can list addresses for reasons that are slow to resolve. Your own DMARC reports will need reading. Abuse complaints from one user can affect everyone on the same address, so outbound controls, rate limits and a response process are part of the job, not an optional extra.
Security is your responsibility
A self-hosted server exposes IMAP and submission ports to the internet, which means it receives constant login attempts. Brute-force protection, two-factor authentication where the software supports it, careful relay controls, and prompt patching are all required. The same applies to any web administration panel and to SSH access.
What a hosted provider gives you
A hosted provider absorbs most of that operational load. Patching, certificate management, monitoring, abuse handling and much of the deliverability work are its job. You get a mailbox, a support path and a documented set of features. The trade-off is trust. The provider holds the mail, and you rely on its security practices, its retention policies and its willingness to notify you of problems. That reliance is reasonable when the provider documents its practices clearly and gives you tools to leave.
Good hosted providers offer a few things you should check for: two-factor authentication, encryption at rest, TLS 1.2 or later for connections, support for standard clients over IMAP and SMTP submission, export in a standard format, and a published account closure process. You should be able to answer each of these from the provider's documentation rather than from marketing copy.
A decision checklist
- Do you have someone who will keep the server patched and monitored for years, not just for the first month?
- Can you tolerate an outage caused by an expired certificate or a blocklisted address, and can you diagnose it quickly?
- Do you have a tested restore procedure and a schedule for running it?
- Do you have a credible plan for outbound abuse, including rate limits and a contact path?
- Do your legal or policy requirements actually demand that you control the hardware, or do they only require that data be protected?
- Would a hosted provider with clear documentation and an export path meet the requirement?
If the answers point to a small team without dedicated operations time, a hosted provider is often the more reliable choice. If they point to a team that already runs infrastructure and wants full control, self-hosting is a legitimate and well-supported path.
Where ITProMail fits
ITProMail is a hosted provider. It offers TOTP and FIDO2 two-factor authentication, PGP with Web Key Directory publication, encryption at rest, custom domains on the Operator and Shadow plans, and a mailbox export as mbox from Account > Export or through any IMAP tool. Those are the trade-offs described above in practical form. Registration is currently closed to new members, so the information here is most useful for existing members and for anyone comparing options. The imapsync import guide and the mailbox export guide describe how to move mail in and out, which matters for any choice you may revisit later. The security page summarizes the platform's controls.