---
title: "Choosing a self-hosted mail server in 2026: ten complete servers compared"
description: "Ten self-hosted mail servers compared: setup, groupware, security, outbound sending and a recommendation per use case, as of October 2026."
url: https://ahasend.com/blog/choosing-self-hosted-mail-server-2026-ten-complete-servers-compared
markdown_url: https://ahasend.com/blog/choosing-self-hosted-mail-server-2026-ten-complete-servers-compared.md
lang: en
type: blog_post
published: 2026-10-22
updated: 2026-10-22
author: "Mark Kraakman"
category: "Insights"
image: https://cms.ahasend.com/sites/default/files/2026-10/self-hosted-mail-servers-featured.jpg
---

# Choosing a self-hosted mail server in 2026: ten complete servers compared

_By Mark Kraakman, October 22, 2026, in Insights_

![ten complete self-hosted mail servers compared](https://cms.ahasend.com/sites/default/files/2026-10/self-hosted-mail-servers-featured.jpg)

Running a self-hosted mail server is doable in 2026: all ten projects compared here receive mail and serve mailboxes, most bundle a spam filter, nine obtain their own TLS certificates and five add calendars and contacts. The hard part is sending from your own IP addresses and keeping them warm and inbox-worthy, so every profile below notes whether the server can relay outbound mail through an ESP such as [AhaSend](https://ahasend.com/) instead.

The ten are [mailcow](https://github.com/mailcow/mailcow-dockerized), [Stalwart](https://github.com/stalwartlabs/stalwart), [mox](https://github.com/mjl-/mox), [docker-mailserver](https://github.com/docker-mailserver/docker-mailserver), [Mail-in-a-Box](https://github.com/mail-in-a-box/mailinabox), [Mailu](https://github.com/Mailu/Mailu), [Maddy](https://github.com/foxcpp/maddy), [grommunio](https://github.com/grommunio/gromox), [BillionMail](https://github.com/Billionmail/BillionMail) and [WildDuck](https://github.com/zone-eu/wildduck), compared on 45 points. MTAs such as Postfix and KumoMTA (the MTA AhaSend runs on, for full disclosure) move mail between servers but give users no mailboxes. Mailbox-only servers such as Dovecot store mail but do not route it. Self-hosted sending platforms such as Postal have no mailboxes and leave IPs, warm-up and reputation to you. Hosted ESPs are the relay alternative and are not compared.

Every fact here comes from each project's own website, documentation, repository or release notes; versions, GitHub stars and prices are as of 15 October 2026. 

## What counts as a complete self-hosted mail server

A complete mail server combines an MTA, a mailbox server, usually a spam filter and often webmail in one product. Seven of the ten are bundles of separate components, most built around Postfix and Dovecot; Stalwart, mox and Maddy are single programs. None is built for bulk outbound mail except BillionMail, which targets email marketing, and none documents automatic per-provider traffic shaping. There is no single best self-hosted email server in 2026, which is why the recommendations at the end are split by use case.

## The ten projects, one by one

### mailcow: groupware bundle on Docker Compose

mailcow bundles Postfix, Dovecot, Rspamd, SOGo, ClamAV, MariaDB, Redis and more into a complete mail and groupware server that runs only on Docker Compose. The Infrastructure Company GmbH (Servercow) in Willich, Germany develops it under GPL-3.0 and sells support contracts from €45.90 to €165.90 a month and managed hosting from €54.90 a month, VAT included. Release 2026-09a dates from 6 October 2026, with a main release about every two months; GitHub shows about 13.6k stars and 409 contributors. It includes IMAP, POP3 and ManageSieve, SOGo webmail with CalDAV, CardDAV and ActiveSync, DKIM keys managed in the web UI, outbound MTA-STS and DANE, a bundled ACME container and a REST API. It lacks clustering and native Prometheus metrics, documents no bounce classification or suppression, and needs 6 GiB of RAM plus swap. Relay through an ESP: yes, per domain.

### Stalwart: one Rust program, open core

Stalwart is a complete mail and collaboration server in one Rust program from Stalwart Labs in London, licensed AGPL-3.0 or under a proprietary SELv2 license. It is open core: multi-tenancy, archiving, the LLM spam classifier, SCIM, read replicas, sharding and live telemetry are Enterprise-only, at €2.00 down to €0.89 per mailbox a year; sponsors from $5 a month also get a license. Version 0.16.26 shipped on 11 October 2026, one of 35 releases in twelve months; 1.0 is targeted for around October 2026, and 0.16 brought breaking changes. GitHub shows about 15.1k stars and 54 contributors. It covers IMAP4rev2, POP3, JMAP, CalDAV, CardDAV and WebDAV, a built-in spam classifier, DKIM with automatic key rotation, MTA-STS, DANE, TLS-RPT and REQUIRETLS, and native clustering, from about 1 GB of RAM for 5 to 10 users. It has no webmail yet (planned after 1.0) and no suppression list; security audits ran in 2023 and 2025. Relay through an ESP: yes, by routing rules.

### mox: one Go program for low-maintenance self-hosting

mox is a complete mail server in one Go program by independent developer Mechiel Lukkien, MIT-licensed and funded by NLnet grants since 2023. It targets low-maintenance self-hosting for people and organisations running mail for their own domains, and its FAQ also covers transactional sending. It is pre-1.0: v0.0.17 dates from 19 August 2026 after two releases in twelve months; GitHub shows about 5.9k stars and 26 contributors. mox includes IMAP4rev2, early-stage webmail, built-in reputation and Bayesian spam filtering, DKIM, outgoing DMARC reports, MTA-STS, DANE, TLS-RPT and REQUIRETLS, per-account suppression lists and webhooks, a Prometheus endpoint and Let's Encrypt certificates, all from two plain-text files and 512 MB of RAM. It lacks POP3, calendars (on the roadmap), antivirus, clustering, ARC and DNS-01, and does not support Windows. Relay through an ESP: yes, per account, per domain or globally.

### docker-mailserver: everything in one container, no web UI

docker-mailserver packs Postfix, Dovecot, Rspamd or Amavis with SpamAssassin, ClamAV, OpenDKIM, OpenDMARC and Fail2ban into one container, configured through environment variables and mounted files, with no database. Created by tomav and maintained by volunteers since 2021 under the MIT license, it is the most starred project here at about 19.1k stars and 343 contributors, with no funding source stated. Their latest version is from 4 September 2026 and major versions carry breaking changes. Security fixes ship only on the edge images. It starts at 512 MB of RAM (2 GB recommended) and runs on Docker or Podman. It has no web UI, webmail, calendars or clustering and documents no metrics endpoint; spam filtering is opt-in, ClamAV is off by default, certificates come from an external ACME client or proxy, MTA-STS is opt-in and DANE is not documented. Relay through an ESP: yes, globally or per sender domain.

### Mail-in-a-Box: the appliance for individuals

Mail-in-a-Box installs Postfix, Dovecot, Roundcube, Nextcloud, Z-Push, SpamAssassin, a DNS server and its own control panel on a fresh Ubuntu 22.04 LTS machine. Joshua Tauberer in Washington DC maintains it with contributors and has dedicated it to the public domain (CC0-1.0); there is no paid offering and no formal funding. Its first release, August 2014, is the oldest verified here; v77 shipped on 26 September 2026, though the installer still pins v76, and GitHub shows about 15.4k stars. It is built for individuals taking back control of their email: easy to deploy, deliberately not customizable, with no setup options by design. It includes IMAP, POP3 and ManageSieve, Roundcube webmail, CalDAV and CardDAV through Nextcloud, ActiveSync through Z-Push, Let's Encrypt certificates renewed nightly, 2FA and automatic updates. It lacks DMARC reports, antivirus, clustering, Prometheus metrics and traffic shaping, and one DKIM key is shared by all domains. Relay through an ESP: no, not supported.

### Mailu: the lighter Docker bundle

Mailu is a complete mail server bundled as Docker images around Postfix, Dovecot, Rspamd, Unbound and an admin UI, with ClamAV, webmail (Roundcube or SnappyMail) and Radicale calendars and contacts as options. Community volunteers maintain it under the MIT license, funded by volunteer time and donations. First released in July 2016 as Freeposte.io, it now ships patches to the 2024.06 series, 20 in twelve months and the latest on 15 October 2026; only the latest version is supported, and GitHub shows about 7.5k stars. Setup starts from a generator that produces a Compose file, with 1 GB of RAM plus 1 GB of swap. It includes a web admin UI, CLI and REST API, DKIM keys generated in the admin UI, outbound MTA-STS and DANE, certbot certificates and a per-user daily send limit (default 200). It lacks built-in clustering, DMARC reports (in development) and Prometheus metrics outside its Helm chart; two 2026 security flaws, one critical, were fixed. Relay through an ESP: yes, globally.

### Maddy: one daemon, one config file, CLI only

Maddy is a complete mail server in one Go program by individual developer Max Mazurov (foxcpp), licensed GPL-3.0-or-later with no paid offering and no funding stated. Its goal is to replace Postfix, Dovecot, OpenDKIM, OpenSPF and OpenDMARC with one daemon and one text file of module blocks. It is pre-1.0 and its FAQ calls it beta: v0.9.6 shipped on 3 October 2026, one of eight releases in twelve months, and the previous incompatible release still gets security fixes; GitHub shows about 6.1k stars. Maddy includes SMTP submission and LMTP, IMAP4rev1 (storage labelled beta), DKIM with per-domain keys, outbound MTA-STS and DANE, partial REQUIRETLS handling, rate and concurrency limits, a built-in ACME client using DNS-01 and a native Prometheus endpoint. It lacks a web UI, webmail, calendars, POP3 and DMARC reports, and has no built-in spam classifier or antivirus (external Rspamd, milters or DNSBLs instead). Four advisories were fixed in 0.9.6. Relay through an ESP: yes, globally, per sender or per recipient domain.

### grommunio: the Exchange replacement

grommunio is an Exchange-compatible mail and groupware server: the C++ gromox engine with Postfix, an Rspamd-based filter, grommunio Web, ActiveSync and DAV, positioned as a drop-in Exchange replacement for organisations of about 6 to 100,000+ users. grommunio GmbH in Vienna, Austria publishes it under AGPL-3.0; the community edition is free up to 5 users without vendor support, subscriptions run €1.99 to €5.49 per user a month (VAT not stated) through 200+ partners, and Enterprise is by quote. Release 2026.06.2 dates from 30 September 2026. It is the only server here that speaks EWS, MAPI/HTTP and RPC/HTTP, next to IMAP4rev2, POP3, CalDAV, CardDAV and ActiveSync, with MFA, OIDC and SAML single sign-on, S/MIME, OpenPGP and ClamAV; the engine scales out across servers, with high availability through external Pacemaker and DRBD. It wants 4 cores, 6 GB of RAM and IPv6, and MTA-STS, DANE, TLS-RPT, DMARC reports, IP pools and bounce classification are not documented. Relay through an ESP: yes, globally.

### BillionMail: mail server plus email marketing

BillionMail is a mail server and email marketing platform in Docker: a Go console around Postfix, Dovecot, Rspamd, Roundcube, PostgreSQL and Redis. aaPanel (AAPANEL LIMITED) in Hong Kong publishes it under AGPL-3.0 and sells a deployment package at $49.90 per instance with 7 days of support; funding is not stated. First released in April 2025, it has about 15.9k stars and 15 contributors, but its latest GitHub release, v4.9, dates from 11 December 2025, with none in 2026. It advertises unlimited sending for newsletters and starts at 1 core and 1 GB of RAM. It includes IMAP and POP3, Roundcube webmail, a web console with CLI and REST API, an HTTP send API, campaigns with open and click tracking, a suspend list and unsubscribe links, a beta IP warm-up mode and one dedicated outbound IP per sending domain. It has no antivirus, webhooks or clustering, documents no calendars, MTA-STS or DANE, and its core container mounts the Docker socket. Relay through an ESP: yes, per domain.

### WildDuck: built to cluster, no admin UI

WildDuck is a scalable mail server bundle in Node.js from Zone Media OÜ (Zone.eu) in Tallinn, Estonia, created by Andris Reinman and licensed EUPL-1.2-or-later: WildDuck for IMAP, POP3 and the API, Haraka for inbound MX, ZoneMTA for outbound, plus Rspamd, MongoDB and Redis. It describes itself as IMAP and POP3 with no single point of failure, best suited for 1,000+ accounts. It ships most often of the ten, 47 releases in twelve months, with v1.52.0 on 6 October 2026, and has about 2.1k stars; a paid offering could not be confirmed because the project site did not load. Outbound is its strength: ZoneMTA runs IP pools per sending zone with ratio-based warm-up, connection and speed limits, a 6-hour back-off when an IP is blocklisted, bounce classification, a basic suppression list and Prometheus metrics. It has no official admin UI (REST API only) and only unmaintained webmail; calendars, DANE, TLS-RPT and minimum hardware are not documented. Relay through an ESP: yes, per sending zone.

## At a glance

| Project | What it is | Built for | Backed by | License |
| --- | --- | --- | --- | --- |
| mailcow | Mail and groupware bundle in Docker (Postfix, Dovecot, Rspamd, SOGo, ClamAV, MariaDB, Redis) | A complete self-hosted mail and groupware server | The Infrastructure Company GmbH (Servercow), Germany | GPL-3.0 |
| Stalwart | Mail and collaboration server, one Rust program | A few users to multi-node setups; multi-tenancy is Enterprise | Stalwart Labs, London | AGPL-3.0 or proprietary SELv2 |
| mox | Mail server, one Go program | Low-maintenance self-hosting; its FAQ covers transactional sending | Mechiel Lukkien, independent developer | MIT |
| docker-mailserver | One container (Postfix, Dovecot, Rspamd or Amavis, ClamAV, OpenDKIM, OpenDMARC, Fail2ban) | A simple, production-ready server configured with files | Volunteers since 2021; created by tomav | MIT |
| Mail-in-a-Box | Script install on Ubuntu (Postfix, Dovecot, Roundcube, Nextcloud, Z-Push, SpamAssassin, DNS, control panel) | Individuals; easy to deploy, not customizable | Joshua Tauberer, Washington DC, with contributors | CC0-1.0 |
| Mailu | Docker images (Postfix, Dovecot, Rspamd, Unbound, admin UI; optional ClamAV, webmail, Radicale) | Simple yet full-featured; free software only | Community volunteers; early versions by TeDomum | MIT |
| Maddy | Mail server, one Go program | Replacing Postfix, Dovecot, OpenDKIM, OpenSPF and OpenDMARC with one daemon | Max Mazurov (foxcpp) | GPL-3.0-or-later |
| grommunio | Exchange-compatible mail and groupware (gromox engine, Postfix, Rspamd-based filter, grommunio Web, ActiveSync, DAV) | Drop-in Exchange replacement, about 6 to 100,000+ users | grommunio GmbH, Vienna | AGPL-3.0 |
| BillionMail | Mail server and marketing platform in Docker (Go console, Postfix, Dovecot, Rspamd, Roundcube, PostgreSQL, Redis) | Newsletters and email marketing; advertises unlimited sending | aaPanel (AAPANEL LIMITED), Hong Kong | AGPL-3.0 |
| WildDuck | Node.js bundle (WildDuck, Haraka, ZoneMTA, Rspamd, MongoDB, Redis) | Scalable IMAP and POP3, no single point of failure, 1,000+ accounts | Zone Media (Zone.eu), Tallinn | EUPL-1.2-or-later |

Third-party components in the bundles keep their own licenses.

## Technical comparison

### Platform and architecture

Stalwart and WildDuck cluster natively, grommunio scales out with high availability through external tools, Mailu and Maddy can run several instances without built-in clustering, and the rest are single-server.

| Project | Language | Install methods | Minimum hardware | Clustering | Admin interface |
| --- | --- | --- | --- | --- | --- |
| mailcow | PHP, JavaScript, shell | Docker Compose only | 6 GiB RAM plus 1 GiB swap, 20 GiB disk | No; cold-standby guide | Web UI, REST API |
| Stalwart | Rust | Install script, Docker, Windows guide, Helm | About 1 GB RAM and one core for 5 to 10 users | Built in; read replicas and sharding are Enterprise | Web UI, CLI, JMAP |
| mox | Go | Binaries, go install, Docker (not recommended) | 512 MB RAM | No | Web admin UI, CLI |
| docker-mailserver | Shell scripts | Docker image with Compose; community Helm chart | 512 MB RAM; 1 core and 2 GB recommended | No | Setup CLI and config files; no web UI |
| Mail-in-a-Box | Bash, Python | Shell installer, Ubuntu 22.04 LTS only | 512 MB RAM enforced, 1 GB recommended | No | Control panel, HTTP API, CLI |
| Mailu | Python | Compose from a setup generator; Helm chart | 1 GB RAM plus 1 GB swap; 3 GB with ClamAV | No built-in; Kubernetes can scale horizontally | Web admin UI, CLI, REST API |
| Maddy | Go | Binaries, Docker, source | No formal minimum; about 1 GiB for a personal server | No; instances can share one PostgreSQL | CLI only |
| grommunio | C++ core; PHP, TypeScript, Python | Appliance images, packages with a wizard, container stack | 4 cores, 6 GB RAM, 32 GB system disk | Scales out; HA through Pacemaker and DRBD | Admin Web, REST API, CLI |
| BillionMail | Go, Vue | Install script, Docker Compose, aaPanel one-click | 1 core, 1 GB RAM, 20 GB disk | No; single-host Compose | Web console, CLI, REST API |
| WildDuck | JavaScript (Node.js 22) | Scripted installer, Docker Compose, npm | Not documented | Yes: stateless servers, MongoDB replica sets and sharding | REST API, read-only MCP; no official UI |

### Mailbox, webmail, calendar and contacts

If you want an open source mail server with webmail, seven ship one in some form; docker-mailserver, Maddy and, for now, Stalwart do not. Five handle calendars and contacts, and only grommunio speaks Outlook's Exchange protocols.

| Project | Mailbox access | Webmail | Calendars and contacts | Spam filtering | Antivirus |
| --- | --- | --- | --- | --- | --- |
| mailcow | IMAP, POP3, ManageSieve | SOGo | CalDAV, CardDAV, ActiveSync | Rspamd | ClamAV, optional |
| Stalwart | IMAP4rev2, POP3, JMAP, ManageSieve | None yet; planned after 1.0 | CalDAV, CardDAV, WebDAV | Built-in classifier, DNSBLs, reputation; LLM classifier is Enterprise | Through milter, such as ClamAV |
| mox | IMAP4rev2; no POP3 | Yes, early stage | None; on the roadmap | Built-in reputation and Bayesian | None |
| docker-mailserver | IMAP; POP3 and ManageSieve optional | None | None | Rspamd or SpamAssassin, opt-in; Postscreen on by default | ClamAV, off by default |
| Mail-in-a-Box | IMAP, POP3, ManageSieve | Roundcube | CalDAV, CardDAV (Nextcloud), ActiveSync (Z-Push) | SpamAssassin, greylisting, Spamhaus | None |
| Mailu | IMAP, POP3, ManageSieve | Roundcube or SnappyMail, optional | CalDAV, CardDAV (Radicale), optional | Rspamd | ClamAV, optional |
| Maddy | IMAP4rev1 only; storage labelled beta | None | None | None built in; external Rspamd, milters or DNSBLs | None built in |
| grommunio | IMAP4rev2, POP3, EWS, MAPI/HTTP, RPC/HTTP | grommunio Web | CalDAV, CardDAV, ActiveSync | Rspamd-based | ClamAV |
| BillionMail | IMAP, POP3 | Roundcube | None documented | Rspamd | None |
| WildDuck | IMAP4rev1, POP3 | WildDuck Webmail, no longer maintained | None documented | Rspamd | ClamAV in the scripted install, off by default |

### Authentication and transport security: SPF, DKIM, DMARC, MTA-STS and DANE

All ten sign outbound mail with DKIM and most check SPF, DKIM and DMARC on inbound mail. Only Stalwart and mox cover MTA-STS, DANE, TLS-RPT and REQUIRETLS in full; grommunio and BillionMail document none of the four.

| Project | DKIM signing | Inbound SPF, DKIM, DMARC | Sends DMARC reports | MTA-STS | DANE | TLS-RPT | REQUIRETLS |
| --- | --- | --- | --- | --- | --- | --- | --- |
| mailcow | Rspamd; keys in the UI | Rspamd | Optional | Outbound, since 2025-09 | Outbound | Not documented | Not documented |
| Stalwart | Built in; automatic rotation | SPF, DKIM, DMARC, ARC | Yes | Yes | Yes | Yes | Yes |
| mox | Built in; keys at setup | SPF, DKIM, DMARC; no ARC | Yes | Yes | Yes | Yes | Yes |
| docker-mailserver | OpenDKIM or Rspamd | SPF, DKIM, DMARC; ARC opt-in | Not documented | Outbound, opt-in | Not documented | Not documented | Not documented |
| Mail-in-a-Box | OpenDKIM; one key for all domains | SPF, DKIM, DMARC | No | Publishes its own policy; no outbound enforcement | Outbound; publishes TLSA with DNSSEC | DNS record only | Not documented |
| Mailu | Rspamd; keys in the admin UI | SPF, DKIM, DMARC | In development | Outbound, since 1.9 | Outbound, since 1.9 | Not documented | Not documented |
| Maddy | Built in; keys per domain | SPF, DKIM, DMARC; ARC not documented | No | Outbound | Outbound | Not documented | Partly (relaxed mode) |
| grommunio | Rspamd-based; keys per domain since 2026.06.1 | Checks not specified | Not documented | Not documented | Not documented | Not documented | Not documented |
| BillionMail | Rspamd; keys per domain | Checks not specified | Not documented | Not documented | Not documented | Not documented | Not documented |
| WildDuck | Keys per domain through the API; ZoneMTA signs | SPF, DKIM, DMARC, ARC | Not documented | Outbound, on by default | Not documented | Not documented | Not documented |

### Outbound sending and relaying

None of the ten documents automatic per-provider traffic shaping. BillionMail has a beta IP warm-up mode and WildDuck's ZoneMTA runs IP pools with warm-up; the rest offer rate limits or daily caps at most. Nine can relay through an ESP; Mail-in-a-Box cannot.

| Project | Traffic shaping | IP pools | Bounces and complaints | Delivery events | Relay through an ESP |
| --- | --- | --- | --- | --- | --- |
| mailcow | Rate limit per domain | No | Not documented | Logs only | Yes, per domain |
| Stalwart | Limits by MX, IP, sender or domain; no automatic adjustment | Multiple source IPs chosen by rules | DSNs, parses ARF; no suppression list | Tracing, OpenTelemetry, webhooks | Yes, by routing rules |
| mox | Per-account daily caps (default 1,000 messages, 200 new recipients) | No | Matches DSNs; per-account suppression; no ARF | Per-account webhooks | Yes, per account, per domain or globally |
| docker-mailserver | Not documented | No | Not documented | Logs; optional email reports | Yes, globally or per sender domain |
| Mail-in-a-Box | None | No; one IPv4 and one IPv6 | Standard Postfix bounces | Logs; weekly usage report | No |
| Mailu | Per-user daily limit (default 200); slower per-destination queues through overrides | No | Not documented | Logs only | Yes, globally |
| Maddy | Rate and concurrency limits per IP, sender or recipient domain; no automatic adjustment | One source IP per delivery target | DSNs; no classification or suppression | Logs; queue-length metric | Yes, globally, per sender or per recipient domain |
| grommunio | Per-mailbox limit per minute (2026.06.2) | Not documented | Non-delivery reports; no classification | Logs; queue in Admin Web | Yes, globally |
| BillionMail | Beta IP warm-up with dynamic rate adjustment; no per-destination throttling documented | One dedicated IP per sending domain | Invalid-address handling, suspend list, unsubscribe links; no ARF | Open and click tracking; no webhooks | Yes, per domain |
| WildDuck | Connection and speed limits per zone and domain; 6-hour back-off when blocklisted; 2,000 recipients a day per user | Yes, per sending zone, with ratio-based warm-up | Bounce classification, basic suppression list; no ARF | Bounce callbacks, queue API, Prometheus counters | Yes, per sending zone |

### Operations and security

Nine obtain TLS certificates themselves; docker-mailserver needs an external ACME client or proxy. Stalwart, mox, Maddy and WildDuck's ZoneMTA expose Prometheus metrics natively.

| Project | Automatic TLS certificates | Metrics and monitoring | Recent security work |
| --- | --- | --- | --- |
| mailcow | Yes; bundled ACME, DNS-01 since 2026-03 | Watchdog with alert mails; Prometheus exporter is third-party | Fixes ship as revisions citing CVEs |
| Stalwart | Yes: TLS-ALPN-01, HTTP-01, DNS-01 | OpenTelemetry, Prometheus; full metrics and alerts are Enterprise | Audits in 2023 (no vulnerabilities found) and 2025 (2 high, 5 low; all but one fixed) |
| mox | Yes; Let's Encrypt, no DNS-01 yet | Prometheus endpoint, structured logs | None in the sources read |
| docker-mailserver | No; external ACME client or proxy | Health check; no metrics endpoint | No published advisories; fixes only on the edge image |
| Mail-in-a-Box | Yes; Let's Encrypt, renewed nightly | Munin graphs and status checks with email alerts; no Prometheus | Regular Roundcube security updates; no audit or advisories |
| Mailu | Yes; Let's Encrypt through certbot | Health checks; Prometheus for Dovecot and Rspamd through the Helm chart only | 2026: critical proxy-auth bypass and token API flaw, both fixed; no audit |
| Maddy | Yes; built-in ACME with DNS-01 | Native Prometheus endpoint | 2026: LDAP-injection CVE fixed in 0.9.3; four advisories fixed in 0.9.6; no audit |
| grommunio | Yes; Let's Encrypt through the setup wizard | Admin dashboard; Prometheus exporter is third-party | Keycloak CVE fix, security policy and SBOMs in 2026.06.2; no gromox CVEs listed |
| BillionMail | Yes; Let's Encrypt per domain | Blocklist and quota alerts; no metrics endpoint | 2025: allowlist bypass and arbitrary file read fixed; no advisories |
| WildDuck | Yes; built-in ACME plus acme.sh or Traefik | Prometheus in ZoneMTA; health endpoint, Graylog | 2026 changelog lists security fixes; advisories not verified |

## Sending from your own IPs: IP reputation and warm-up

Mail leaving your own IP addresses has to satisfy the mailbox providers, and Gmail, Yahoo and Outlook.com now require SPF, DKIM and DMARC from bulk senders.

### Mailbox provider rules in force

Gmail requires SPF or DKIM, valid forward and reverse DNS, TLS and a spam rate under 0.3% from every sender to personal Gmail, enforced since February 2024 with stepped-up 4xx and 5xx rejections from November 2025. Bulk senders, around 5,000 messages a day, must add both SPF and DKIM, DMARC of at least p=none aligned with the From domain and one-click unsubscribe on marketing mail. Yahoo asks all senders for SPF or DKIM, valid forward and reverse DNS and a spam rate under 0.3%, judges bulk senders per domain with no published threshold, and has enforced one-click unsubscribe since June 2024. Outlook.com requires SPF and DKIM passes and aligned DMARC of at least p=none from domains sending over 5,000 messages a day, since 5 May 2025; non-compliant mail goes to Junk and may be rejected with 550 5.7.515. Microsoft also expects valid reverse DNS from all senders and may refuse connections from dynamic IP space. ([Gmail guidelines](https://support.google.com/mail/answer/81126?hl=en), [Gmail FAQ](https://support.google.com/mail/answer/14229414?hl=en), [Yahoo best practices](https://senders.yahooinc.com/best-practices/), [Yahoo FAQ](https://senders.yahooinc.com/faqs/), [Microsoft policies](https://substrate.office.com/ip-domain-management-snds/Postmaster/Policies))

### Warm-up and consistency

Google asks for a steady sending rate: start low with engaged recipients, ramp up gradually, avoid doubling volume, and give changed infrastructure its own ramp. It publishes no warm-up schedule and notes that on shared IPs other senders' behaviour affects your reputation. Yahoo asks senders to avoid sudden spikes, separate transactional and marketing mail by IP or DKIM domain, and limit concurrent connections; it does not whitelist. No Microsoft warm-up guidance was found. Of the ten servers, only BillionMail (in beta) and WildDuck automate any part of warm-up.

### Reputation tools

Google Postmaster Tools v2 adds a compliance dashboard and is retiring the Domain and IP Reputation dashboards. Microsoft SNDS gives free per-IP data including complaint rates, but IPs sending under about 100 messages a day may show no data, and access must be re-attested every 10 months. Yahoo's Complaint Feedback Loop works per DKIM domain only, no longer per IP. ([Postmaster Tools](https://support.google.com/mail/answer/16594218?hl=en), [SNDS FAQ](https://substrate.office.com/ip-domain-management-snds/SNDS/FAQ))

### Blocklists

The Spamhaus PBL lists end-user IP ranges that should not deliver mail directly: over 1.4 billion IPv4 addresses, about 40% of routable space, and a listing is not a spam verdict. Self-removal covers single static IPs running a mail server with matching A and reverse DNS records and lasts a year; more IPs need the network owner. ([PBL](https://www.spamhaus.org/blocklists/policy-blocklist/), [PBL FAQ](https://www.spamhaus.org/faqs/policy-blocklist-pbl/))

## Five questions about running your own mail server

### Is it worth self-hosting your own mail server in 2026?

Yes, if you want your mailboxes under your own control and will run the inbound side: all ten receive and serve mail, seven include some form of webmail, five add calendars and contacts. The deciding question is outbound. Mailbox providers require SPF, DKIM and DMARC from bulk senders, judge your IP's reputation and publish no fixed warm-up schedule, and none of the ten automates per-provider shaping. Nine of the ten can hand outbound mail to an ESP, which keeps the mailboxes self-hosted while someone else's IPs carry the sending.

### Which self-hosted mail server is easiest to set up?

This comparison records what each project does, not how long setup takes, but three designs aim at minimal setup. Mail-in-a-Box offers no setup options by design: one installer on a fresh Ubuntu 22.04 machine, with the box running your DNS. mox runs from two plain-text files on 512 MB of RAM and generates its DKIM keys at setup. For a self-hosted mail server on Docker, mailcow, docker-mailserver, Mailu and BillionMail ship Compose stacks; Mailu generates its Compose file from a setup generator, BillionMail adds an install script and aaPanel one-click, and docker-mailserver trades a web UI for a setup CLI and config files.

### Which mail servers can replace Microsoft Exchange?

Only grommunio speaks Outlook's Exchange protocols, EWS, MAPI/HTTP and RPC/HTTP, and it is positioned as a drop-in replacement for organisations from about 6 to 100,000+ users, with ActiveSync, CalDAV, CardDAV, MFA and single sign-on. If Outlook's native protocols are not required, mailcow (SOGo) and Mail-in-a-Box (Z-Push) also offer ActiveSync, and Stalwart, mailcow, Mailu and Mail-in-a-Box give you a mail server with calendar and contacts over CalDAV and CardDAV.

### How much RAM does a self-hosted mail server need?

Between 512 MB and 6 GB, depending on how much is bundled. mox, docker-mailserver and Mail-in-a-Box start at 512 MB (docker-mailserver recommends 2 GB and Mail-in-a-Box 1 GB). Stalwart states about 1 GB and one core for 5 to 10 users, BillionMail 1 GB on one core, Mailu 1 GB plus 1 GB of swap or 3 GB with ClamAV, and Maddy's FAQ says a small personal server needs little more than 1 GiB. mailcow wants 6 GiB plus 1 GiB of swap, and grommunio 4 cores and 6 GB. WildDuck does not document a minimum.

### Can a self-hosted mail server send through an external SMTP relay?

Nine of the ten can: globally (Mailu, grommunio), per domain (mailcow, BillionMail), per sender domain or globally (docker-mailserver), per account, domain or globally (mox), per sender or recipient domain (Maddy), by routing rules (Stalwart) or per sending zone (WildDuck). Mail-in-a-Box does not support a relay. Relaying keeps your mailboxes self-hosted while the ESP's IPs carry the sending and the ESP handles reputation, bounces and complaints; on shared IPs, reputation is pooled with the provider's other senders.

## Recommendations per use case

### Single-user box

mox, if you can live without POP3, calendars and antivirus: one Go program on 512 MB of RAM, two config files, the full set of MTA-STS, DANE, TLS-RPT and REQUIRETLS, per-account suppression lists and webhooks, and a per-account relay. Mail-in-a-Box, if you want webmail, calendars, contacts and DNS from one installer with no decisions to make; note that it cannot relay, so your IP has to earn its own reputation. Maddy fits if you prefer a CLI-only daemon and bring your own spam filter.

### Small company with groupware

mailcow vs Stalwart comes down to webmail and RAM. mailcow gives you SOGo webmail with CalDAV, CardDAV and ActiveSync, a web UI, paid support from Servercow and a per-domain relay, for 6 GiB of RAM. Stalwart runs on about 1 GB, covers JMAP, CalDAV, CardDAV and WebDAV and the full transport-security set, and relays by routing rules, but has no webmail until after 1.0, and 0.16 brought breaking changes. Mailu is the lighter Docker option: from 1 GB of RAM, with optional webmail and Radicale calendars and a global relay.

### Exchange replacement

grommunio, and nothing else here: it alone speaks EWS, MAPI/HTTP and RPC/HTTP, adds ActiveSync and single sign-on, is free up to 5 users and costs €1.99 to €5.49 per user a month beyond that. Budget 4 cores, 6 GB of RAM and IPv6, and note that MTA-STS, DANE and TLS-RPT are not documented; a global relay to an ESP covers outbound.

### Large scale

Stalwart or WildDuck, the two that cluster natively. Stalwart keeps read replicas and sharding in its Enterprise edition at €0.89 to €2.00 per mailbox a year and has been audited twice. WildDuck is built for 1,000+ accounts with MongoDB sharding, multiple MX and outbound nodes and ZoneMTA's IP pools with ratio-based warm-up, but it is managed through its REST API with no official admin UI.

### Email marketing

BillionMail is the only one of the ten built for it: campaigns with open and click tracking, a suspend list, unsubscribe links, a beta IP warm-up mode and one dedicated IP per sending domain, from 1 GB of RAM. Weigh that against no GitHub release since December 2025, no webhooks and a core container that mounts the Docker socket. For the sending itself, BillionMail can relay per domain through an ESP, which moves the IP reputation and warm-up work to the provider.