On Fri, 18 Sep 2026 00:05:57 +0000 [email protected] wrote: > I am considering running my own email domain/server. > To protect my private home IP, I was thinking of using a VPS, > tunnelled back. > > Will the VPS "see" my email this way, relaying off the VPS server to > my local one? > (see diagram) > > Is there a better approach to retain privacy without revealing my IP? > > Would appreciate any input on this, as I have never run email myself > before. > Thanks for any suggestions > > DNS Domain VPS Host (static IP) > ┌─────────┐ ┌──────────┐ > │MX Record┼────►│OpenSMTPD │ > └─────────┘ └────┬─────┘ > │ > │ Wireguard tunnel > ▼ > ┌──────────┐ > │pf.conf │ (allow mail in) > │OpenSMTPD │ > └──────────┘ >
This is almost exactly a network configuration that I ran for a couple of years for mail services. I had a VPS that was the Internet connected, external MTA, then an internal MTA at my location. They were connected by a point-to-point Wireguard connection. I did not however do any IP forwarding. My internal MTA had a published DKIM record, but it's IP address was not in DNS, just its MX record, which pointed to the external MTA, so sending mail servers would send email there. The external MTA smtpd.conf had match rules to forward mail across the Wireguard link via an action statement in the smtpd.conf, which would deliver email to the internal MTA. The internal MTA used the external MTA as its "smart host" in its smptd.conf to send outbound email. I went through this so I could read mail directly from a local disk, instead of storing it on the cloud. It also eliminated the need to run an IMAP daemon on the external mail host, reducing the services on the external MTA. If I recall correctly, the resulting headers on outbound mail only contained the Wireguard addresses, obscuring the IP address of my Internet connection. I no longer run this configuration because I changed jobs, and started to travel extensively. I wound up moving to a single host for external MTA services, and added Dovecot to the mix so I could use both my workstation and laptop for email via IMAP. It's much simpler that way. If you're new to email, you'll have to learn SPF, DMARC, and DKIM records in DNS. The PTR record for your host is also important. It has the match the forward address. Verify your VPS IP is not black listed before doing anything else. Those are the key areas to know. Reputable SMTP services are kind of tricky. Good luck!
