系统与基础设施c0ffee.net
如何搭建自己的邮件服务器（2017）
How to Run Your Own Mail Server (2017)
2018 — 2019，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这是一篇 2017 年的自建邮件服务器实战指南，讲解如何搭建并维护自己的邮件基础设施。文章开篇就警告：一旦开始，你就成了自己邮件服务器的全职系统管理员。围绕它的讨论呈现两极：有人痛陈自建邮件的种种坑（IP 黑名单、垃圾邮件过滤、繁琐配置），也有人分享多年稳定运行的经验。
为什么经久不衰：自建邮件服务器是'数字自主权'的标志性话题，这篇指南和评论区的正反经验至今仍是权衡要不要自托管邮件的最佳参考。
HN 评论精选
自建邮件服务器是噩梦，出问题时后果严重，但正因如此才需要更新的指南。
我自己运营邮件基础设施，毫不夸张地说，我连最恨的敌人都不推荐这么做。一切正常时还好，一旦出问题，你的邮件就发不出去，可能错过重要通信，然后你得手忙脚乱地排查垃圾邮件发送者这次又利用了你配置里的什么漏洞。你得学一大堆东西，还有无处不在的晦涩配置文件——这些配置有真实后果，会引发'幽灵般的远程作用'，很快就会被以奇怪的方式利用。上次邮件服务器宕机时我沮丧到开始用 Haskell 写一个 SMTP 协议处理器，想做一个配置最少、默认安全抗攻击的 MTA。在那之前，我们需要更多这样的指南，信息海洋里过时的指南实在太多了。
agentultra查看英文原文
I run my own mail infrastructure. To say the least I wouldn't recommend it even to my worst enemies. It's horrible. Actually it's fine until it's not. Then your email doesn't work and you could be missing out on important communications. And then you're scrambling to figure out how the spammers managed to exploit your setup this time. And you have to learn a tonne of crap in order to manage it... and the text files! Configuration... configuration everywhere. Obscure configuration. Configuration that has real consequences and causes spooky action at a distance. Configuration that will soon be exploited in strange ways. I was so frustrated the last time my mail server went down that I started writing an SMTP protocol handler in Haskell with the intent of writing a MTA with the goal of minimizing configuration and being secure and resistant to attacks by default. So that hopefully more people can run their own infrastructure without prematurely aging. I dunno how useful it will be to others but at least it will keep my gray hairs at bay, I hope, when it's ready for use. Until then though we need more guides like this for us poor souls who do go down this route. There are way too many out-dated guides awash in the sea of information.
即使是专业系统管理员也认为自建邮件的运维成本不值得，不如付费外包。
'你会成为自己邮件服务器的系统管理员'——对我这个系统管理员来说，这就是交易终结者。跑一台服务器没问题，但它出故障时你必须立刻处理。要让它不需要 7×24 支持，我就得跑一个服务器集群，还需要 salt/ansible/puppet 之类的工具来管理。还得应对 IP 因前任所有者被拉黑、或整个域名因为不用某大厂邮件服务商就拒收我邮件的问题。然后还有垃圾邮件过滤这场永无止境的战斗。或者，我也可以每月花几块钱雇人来操心这一切。
deadbunny查看英文原文
> Before we dive in, an important caveat: You will become a sysadmin of your own mail server. This for me is the deal breaker. I say this as a sysadmin. It's all well and good running a single server but if that shits the bed then you have to deal with it immediately. So to run something that doesn't require 24/7 support I now have to run a cluster of servers. I'll also need something to manage those servers like salt/ansible/puppet I also need to deal with being my IP blacklisted because of a previous owner, or just entire domains now delivering my email because they don't like the fact i'm not using $email provider Then there is spam filtering and the constant battle that is. Or I could just pay someone a couple of bucks a month to worry about all that shit and not worry about it.
用 Mail-in-a-Box 这类集成方案能大幅降低门槛，但发信到 Gmail 等仍有坑。
天哪，要涉及的东西太多了。我用 mailinabox.email 自建邮件服务器约两年，可以真心推荐。但即便如此，想让你的服务器能发信到 Google 等大厂，仍有不少坑，比如反向 DNS 记录、DKIM、SPF。不适合时间紧张的人。
notinventedhear查看英文原文
Yeesh, there's so much involved. I've been running my own mail server with https://mailinabox.email for ~2 years and can heartily recommend it. Still, even with that there are gotchas if you want to be able to send messages from your server to Google et al, eg. reverse-DNS-records, DKIM, SPF. Not for the pressed-for-time.
自建邮件最大的痛点是难以在大厂邮件服务商那里建立发信信誉。
然后你会体会到在 Gmail、Yahoo、Live 等大厂面前信誉几乎为零的真正痛苦。即使你配好了 DKIM、SPF、也没有开放中继，邮件照样进垃圾箱。如果真有人知道让自建邮件服务器的信不进这些大系统垃圾箱的秘诀，请告诉我，我 Google 了好几年都没找到。
dpcan查看英文原文
Then you realize the true pain of having a near-zero reputation when trying to email anything to people on Gmail, Yahoo, Live, etc, etc. Expect to go to spam even if you have DKIM, SPF, and no relaying. If anyone actually knows the secret to not having your own mail-server's mail go to spam on these bigger systems, please tell, I've Googled it for years with no success.
反方观点：邮件服务器一旦配置好其实很稳定，难度被夸大了。
我很惊讶这么多人觉得邮件是不可能解决的难题。邮件确实有些愚蠢之处，核心协议老旧且显而易见。但一旦跑起来，除了定期软件更新，你可以几年不管它。过去 20 年我一直在运行自己的邮件服务器（还常为其他公司/项目代管），近几年它占用我的时间少到我几乎忘了自己曾是这方面的专家。用现代 Linux 发行版的工具和软件包，你可以很快跑起来。它确实比 Web 服务器或 DNS 服务器难，但不至于让人闻风而逃。
SwellJoe查看英文原文
I'm surprised by how many people think mail is an impossibly hard problem. There some things about mail that are stupid; the core protocols are old and it shows. But, once things are working, you can leave it alone for years (aside from regular software updates) without trouble. I have. I've never not run my own mail servers (and often for several other people/companies/projects, as well) in the past 20 years. I used to consider myself an expert on the topic, but it's required so little of my time/thought in the past several years that I've forgotten most of that expertise. I think what I'm trying to say is that it's not harder than it used to be (though some problems, like spam and security requirements for safety, have gotten worse in absolute terms). With modern tools and packaging on modern Linux distributions, you can be up and running pretty quickly. My company ships a turn-key solution as part of Virtualmin, but you can build something similar without that in an afternoon or two if you're reasonably Linux-savvy and have some notion of how all the pieces fit together (maybe a couple extra afternoons if you don't know the basics; DKIM and SPF can be tricky, since you also have to know or learn you some DNS). It's harder than a web server or DNS server, but not something you should flee in terror from. Admittedly, it's gotten cheaper in recent years to outsource it...and with microservice-based architectures, maybe it makes more sense to have some other API than SMTP (though SMTP is very easy to use from every language I've ever worked in). But, there are problems and complexities with outsourcing, as well.
自建邮件曾是人人都做的事，但被淘汰是因为综合成本实在太高。
几十年前人人都在自建邮件服务器，后来所有人都停了，因为这太糟糕了。现代 ISP 不喜欢 SMTP 流量，DKIM/DMARC/SPF 长期维护很痛苦，漏洞总会出现，而现成的免费病毒和垃圾邮件过滤器和每天处理数十亿封邮件的大公司相比差得太远。
jjirsa查看英文原文
EVERYONE did this for decades. Then EVERYONE stopped because it's awful. Modern ISPs don't like SMTP floating around, (DKIM, DMARC, SPF) are a pain to maintain over time, exploits will happen, and your free off-the-shelf virus and spam filters suck compared to the big companies seeing billions of messages per day.
历次讨论
同类还值得读
TTY 揭秘（2008）
The TTY demystified (2008)
经典文章深入剖析了 Unix/Linux 中 TTY 子系统的工作原理，包括线路规程、终端驱动、信号与控制字符等机制。
系统与基础设施上首页 11 次 · 2009–2025linusakesson.net编辑精选为什么 GNU grep 这么快
Why GNU grep is Fast
FreeBSD 邮件列表上一篇广为流传的帖子，解释 GNU grep 为什么快：核心在于 Boyer-Moore 字符串搜索算法配合精心优化的内部循环和 I/O，让程序在搜索时“…
系统与基础设施上首页 9 次 · 2010–2022lists.freebsd.orgXplain：为普通人讲解 X11
Xplain – Explaining X11 for the rest of us
《Xplain》是作者（HN 用户 Jasper_）写的一系列 X11 长文，用他在浏览器中重建的 X11 绘图模型做交互演示，讲解 X11 的绘图模型与窗口系统设计。
系统与基础设施上首页 6 次 · 2013–2020magcius.github.io编辑精选旋风教程：为 Linux 创建极小 ELF 可执行文件（1999）
A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux (1999)
breadbox 写于 1999 年的经典教程，主题是如何为 Linux 手工构造并裁剪出体积极小的 ELF 可执行文件。
系统与基础设施上首页 6 次 · 2007–2025muppetlabs.comPostgreSQL 内部原理
The internals of PostgreSQL
《The Internals of PostgreSQL》是一本免费在线书籍，系统讲解 PostgreSQL 的内部实现，包括查询处理、并发控制、WAL、缓冲区管理等核心机制。
系统与基础设施上首页 5 次 · 2017–2025interdb.jp编辑精选