> On 18 Sep 2026, at 3:05 AM, [email protected] wrote:
>
> I am considering running my own email domain/server.
> To protect my private home IP, I was thinking of using a VPS, tunnelled back.
>
> Will the VPS "see" my email this way, relaying off the VPS server to my local
> one?
> (see diagram)
>
> Is there a better approach to retain privacy without revealing my IP?
>
> Would appreciate any input on this, as I have never run email myself before.
> Thanks for any suggestions
>
> DNS Domain VPS Host (static IP)
> ┌─────────┐ ┌──────────┐
> │MX Record┼────►│OpenSMTPD │
> └─────────┘ └────┬─────┘
> │
> │ Wireguard tunnel
> ▼
> ┌──────────┐
> │pf.conf │ (allow mail in)
> │OpenSMTPD │
> └──────────┘
>
Hi,
Is this going to be your primary email address?
tl;dr: with the proposed setup you might lose incoming emails.
-- skip it --
Let me share a story (long version):
I used to ran OpenSMTPd on a Dutch ISP VPS with a good IP
reputation for about five or six years (~2010-2016). Everything worked well
until one day I did not receive an email from my bank, which
left me with only one active credit card during a family trip abroad.
It was a pretty stressful experience. My primary credit card at
the time had never been “tested” abroad, and on my next
trip it did fail a few times (think hotel checkout, while bus to take
us to the train station is waiting outside, train leaving in ~45 minutes).
Fortunately, I had a backup card, so no harm was done.
The mail server was running on FreeBSD, using OpenSMTPd with
ospamd[^1], the tarpit system.
It wasn’t “my" fault though.When I checked the logs,
I discovered that the bank’s SMTPd server IPv4 address
wasn’t whitelisted on my system.
After the first delivery attempt failed (common for spamd),
their server simply never tried again,
effectively not respecting the expected retry behavior.
After that experience, I switched to Fastmail.
My point is that SMTP implementations and configurations
vary considerably, and I can see quite a few potential points of
failure in your setup, of the top of my head even if you don’t
use spamd:
- the SMTP daemon doing down
- PF getting overloaded LLM / AI DoS
- the WireGuard link going down
- your ISP having an outage
- a power/UPS issue
- ISP recycling your IP address
So you need to setup alerts for all these systems and alerting systems
fail in novel ways as well.
And then you have all the IP reputation dance that _might_ work for
a low traffic IPv4 sending three emails a week, but if you get
blacklisted (and happens pretty randomly), it's a PITA.
-- skip it --
Anyway, sharing my two cents here, good luck with everything!
Kind regards,
PA
[^1]: https://man.openbsd.org/spamd
