Don't host email yourself – your reminder in 2026

Hacker News · Feb 23, 2026 · Collected from RSS

Full Article

I wrote about building my startup on European infrastructure. One thing I mentioned in passing was using Scaleway's Transactional Email service (TEM). Mentioning a TEM generated more baffling (to me, obviously) "well actually" replies than anything else in the post.People on different platforms, some of whom had, upon closer inspection, pretty technical titles in their LinkedIn bios, suggested I should just run my own mail server. Dovecot, Postfix, a VPS, done. How hard could it be?From the bottom of my heart: do not do this... unless you enjoy pain.I don't know you, dear reader... whatever works best for you I guess? I thought this was obvious. Apparently not.Let me tell you what happened when I tried sending email from a dedicated, professionally warmed-up IP at Scaleway.What actually happenedPicture this: You buy TEM from a reputable company with a dedicated IP. SPF, DKIM, DMARC, all configured correctly. I send transactional emails only: auth codes, notifications, the boring stuff. No marketing, no newsletters. Scaleway doesn't even allow marketing email on this service.One day, emails to one of Germany's largest email providers just stopped delivering. (Note from the Editor, who is also the author: Or it never delivered in the first place, I actually have no real way of knowing...) Hard bounce. In case you don't know what a hard bounce is: the receiving server plainly rejects accepting your message. No "try again later": It is the receiving server telling you in no uncertain terms to go away.We're talking about a provider that's been in the email game since the dial-up days, one of the first to offer free email addresses to German households. If you grew up in Germany, your parents, or yourself, probably had an address there. They flagged my dedicated IP as suspicious. Not because I did anything wrong. Not because I sent spam. Because my IP hadn't sent enough email to them recently. Their system essentially reverse-greylists: if your IP goes quiet for a while, you lose your reputation and have to contact their postmaster team manually to get it reset.Read that again. You don't get blocked for bad behavior. You get blocked for inactivity.The postmaster danceWhat followed was a polite but absurd email exchange. They asked what system I was running, what domain I was sending from, what type of email I was sending. They pointed out that the reverse DNS hostname didn't have a website with a contact form on it - the hostname of Scaleway's relay infrastructure, not my domain. They suggested I should use a "mail gateway from a suitable provider," which is literally what I was already doing.After explaining all of this, they agreed to reset my IP's reputation. Up to 24 hours, they said. Problem solved, until the next time my volume dips and their system decides I'm suspicious again. This whole email exchange took about 24 hours, ending in them telling me that it might take another 24 hours after their last response to take effect across their infrastructure. Up to 48 hours hard bouncing without misbehavior on a warmed up dedicated IP. Now imagine doing this with your own serverThis happened to me while using a professional TEM. A service whose entire business model is making sure email gets delivered.Now imagine you're running Dovecot on your VPS. Your IP has zero reputation. It might actually have bad reputation from earlier misbehavior, not by you, the moment your machine spins up. You're not on any whitelist. You have no relationship with any postmaster team. You're one of millions of IPs in a cloud provider's range, indistinguishable from the botnet next door.Every major German email provider will at least grey-list you. GMX, Web.de, and that old-school provider your parents, or yourself, still use. And that's just Germany. Microsoft's SmartScreen will silently route you to spam. Gmail will look at your IP, look at your volume, and make a judgment call that you will not win.You'll spend your weekends writing postmaster requests instead of building your product."But it works for me"If you're running a self-hosted email server and it works, one of two things is true. Either you've been sending from that IP long enough to have built reputation essentially by accident, or you haven't noticed that half your emails are landing in spam folders.I send auth codes. If those don't arrive, users can't log in. Deliverability isn't a nice-to-have for me. It's the product working or not working. A conversion or a bounce.The uncomfortable truthEmail deliverability in 2026 is not a technical problem. It's a reputation and relationship problem. The big providers, Google, Microsoft, Germany's legacy email hosts, have collectively built a system where you need to be a known, trusted sender to reliably reach inboxes. The barrier to entry isn't configuring Postfix correctly. It's convincing every major email provider on earth that you're legitimate, and then continuing to convince them, forever, even during quiet periods.Professional transactional email services exist because this problem is genuinely hard. They maintain IP reputation across thousands of customers. They have existing relationships with postmaster teams. They monitor block- and greylists. They handle the weird edge cases like a major provider deciding your IP went too quiet.You, running Dovecot on a VPS, do not have this. And no amount of correct SPF records will substitute for it.What I actually recommendUse a transactional email service. Pay the money. Send your auth codes. Build your product. Self-hosting email is an anachronism of a simpler internet. The good old days. They are long over. It's 2026.Your users will rarely tell you your email landed in spam. They'll just leave and might never come back.P. S.In the aftermath of my sudden LinkedIn famousness I have received recommendations for two other European services worth checking out:AhaSend (only transactional) or Lettermint (both transactional AND marketing!). Disclaimer: I haven't tried them but the recommendations and pricing seem solid enough.