Self-Hosted Email: Postfix, Dovecot and OpenDKIM

Gavin Phratsachack · operator, AS218248 · Minnesota, USA - hosted in Düsseldorf, Germany

I run my own mail server for gnpk.zip on the same VPS as the rest of AS218248. Postfix handles SMTP, Dovecot handles IMAP, OpenDKIM signs outgoing mail, and the whole thing is authenticated with SPF, DKIM and DMARC. It is a one-person mail server — but it is a real one, sending to the same big providers everyone else does, and it has to earn its delivery the same way.

Why this exists

Independence from the big providers. My mail lives on my own server, under my own domain, with my own rules — no provider deciding what I can send, no account to lose, no ads in the inbox. It is also a working example of a self-hosted mail server done properly: authentication, TLS, reputation work, and the deliverability fight documented honestly, so anyone else considering it can see what it actually takes.

The stack

Dovecot listens on localhost only, so mail is read on the VPS itself with mutt — there is no public IMAP. DKIM signs mail sent as me@gnpk.zip; mail originating as root goes unsigned, and a sender-canonical fix for that was prepared but is unconfirmed as applied.

Authentication

Postfix is hardened (TLS 1.2+ only, high ciphers, ECDSA-first), and the mail certificate is pinned in DNS with DANE/TLSA — see the DNS page. internet.nl mail TLS tests are all green. The standard aliases are all in place: postmaster, abuse, noc, tech and root all point to me@gnpk.zip (added Nov 10, 2026; a test to abuse@gnpk.zip was confirmed working).

The Microsoft S3150 saga

The hardest part of self-hosting mail is not the software — it is reputation. Microsoft blocked the VPS IP (45.154.99.220) with error S3150, a hard 550 5.7.1 rejection on every message to Hotmail/Outlook. The timeline:

• Nov 8, 2026 — delist request submitted (case 01M6YX3RY8CBS87BCCWR2BCXTN). Microsoft mitigated the IP the same evening (~20:08 CST), conditionally, with low daily limits until reputation builds.
• Nov 9 and Nov 10 (~20:44 CST) — retests bounced with S3150 again. The mitigation had not lifted the block.
• Nov 10 (~20:47 CST) — re-escalation sent on the delist case.
• Nov 11 (~12:10 CST) — Microsoft replied (Abhishek, Outlook.com Deliverability Support): mitigation implemented for the IP, 24–48 hours to replicate, test due around Nov 13.
• Nov 11 (~12:15 CST) — an early test was deferred with 451 4.7.650 (“temporarily rate limited due to IP reputation”) — not the 550 S3150. Progress: Microsoft was no longer hard-blocking, just rate-limiting.
• Nov 11 (~12:53 CST) — resolved. A test mail from me@gnpk.zip to my personal Microsoft email (subject “test once again and again”) was delivered to the Hotmail inbox — not spam. The S3150 block is fully lifted, well ahead of the replication estimate.

The authentication was never the problem: a Microsoft DMARC aggregate report covering Nov 9 showed SPF pass, DKIM pass, disposition none — the block was purely IP reputation. That is the part of self-hosted mail no configuration can fix by itself; it takes a delist request, an escalation, and patience.

Reputation work

Watching the queue

Postfix logs on Debian 13 are journald-only — there is no /var/log/mail.log; read them with journalctl -u postfix. The queue is watched with a pretty-printer: postqueue -j (NDJSON — one JSON object per line, not an array) piped through jq, using a filter at ~/.tmux/mailq.jq, usually under watch -n 1 in the mail tmux window. It extracts the readable reason after said: and strips the boilerplate. jq was installed Nov 11, 2026 for this. (pfqueue is not in Debian 13 trixie — do not look for it.)

Find AS218248 around the internet: PeeringDB · bgp.tools · RIPEstat · Hurricane Electric · Network · Peering policy