On Friday, September 18th, 2026 at 01:55, drango <[email protected]> wrote:
> On Fri Sep 18, 2026 at 2:40 AM BST, Eric Johnson wrote: > > On Friday, September 18th, 2026 at 00:16, [email protected] > > <[email protected]> wrote: > > > >> I am considering running my own email domain/server. > >> To protect my private home IP, I was thinking of using a VPS, tunnelled > >> back. > >> > > > >> Will the VPS "see" my email this way, relaying off the VPS server to my > >> local one? > >> (see diagram) > >> > > > >> Is there a better approach to retain privacy without revealing my IP? > >> > > > >> Would appreciate any input on this, as I have never run email myself > >> before. > >> Thanks for any suggestions > >> > > > >> DNS Domain VPS Host (static IP) > >> ┌─────────┐ ┌──────────┐ > >> │MX Record┼────►│OpenSMTPD │ > >> └─────────┘ └────┬─────┘ > >> │ > >> │ Wireguard tunnel > >> ▼ > >> ┌──────────┐ > >> │pf.conf │ (allow mail in) > >> │OpenSMTPD │ > >> └──────────┘ > >> > > > >> > > > > > > For anonymity, you might consider SimpleLogin from Proton. It allows you to > > create a new e-mail address with a SimpleLogin domain that is forwarded to > > your own domain. When you reply, it goes back to SimpleLogin who replaces > > it with the e-mail address in the SimpleLogin domains. > > > Thanks. I am familiar with SimpleLogin. I was considering using a self hosted > model with my own MTA. > I am just curious how people run OpenSMTPD, in what environments as consumer > home dynamic IP addresses > dont lend themselves to email with the IP changing, and attracting attacks. I > just presumed those who > do, host it. ¯\_(ツ)_/¯ > My main concern about e-mail privacy is in keeping the usernames private to help keep them from being harvested by spammers/scammers. Also, I try to keep as many ports closed as possible to reduce the potential for an attack on a newly discovered zero day. Currently, the only ports I have open at all to the internet are domain (53), ssh (22), and www (80). My smtp is used primarily for just local mail and to send mail out, but not receive it from the internet. The mail going out is things like the daily insecurity reports and other cron jobs from my servers. When enabled, nearly every connection I get is from scammers trying to test my mail servers to see if they can relay through them. So I blocked it with pf until I have more time to deal with it. I would make e-mail available only on IPv6, but the vast majority of servers seem to be IPv4 only. If I remember correctly, you can store a pgp key on SimpleLogin so that any incoming e-mail is encrypted with that key before forwarding it to your server. Note that I have not tried this to see if it works. The reason that we no longer host e-mail for our users is that I'm getting old (currently 72). If something should happen to me, there is nobody here to deal with any issues. It make compete sense to pay for e-mail service from companies that can handle it. Eric
signature.asc
Description: OpenPGP digital signature
