If you have spent a few days online in self-hosting or data-sovereignty communities there is one advice that always pops up:

I do understand where they are coming from since there are horror stories around about blocklists and delivery problems but today I want to show you that it is in fact possible in 2026 and you might even be able to host it from home! By design email is an open system and we should not accept that a few big corporations have all our mail and the internet to become less decentralized in the process.

Since my small MSP company helps people and corporations on a daily basis to switch from Gmail and Microsoft to cloud alternatives or self-hosted solutions I thought I should put my money where my mouth is and also move away from Google Workspace.

The small subset of self-hosters that are willing to self-host their mailserver is again divided between those who dare to host their mailservers at home and those, who will only use a VPS. Usually I'd suggest using a VPS but if your home internet checks these boxes, you can 100% host your own mailserver at home:

If you checked all of these, then you are ready to host at home!

But what about internet outages? If my modem goes down I'll lose incoming mails, right?

Depends on how long your outage is but usually: No! EMails are very robust as in if your mail server is down, the sender will retry to deliver the mail because in the early internet, outages were plentiful.

If your internet is down less than 40% on any given day, it will still work fine.

So this depends on your needs really. There are multiple mailserver solutions out there with different ways to host it.

A good starting point would be docker-mailserver which is a full mailserver suite deployable via Docker with sane defaults.

But there are other solutions out there like:

Personally my mail is on my ISPConfig Server which I have maintained for years for legacy reasons. If I would set up a mail server from scratch today I'd go for docker-mailserver.

As with your IP you should check if your domain is listed on any spam list but you also need a few DNS records so you don't run into delivery troubles.

Your Mailserver software will probably guide you through all that but just for completeness you'll need these records:

Also as mentioned before the IP address you use for your mailserver should have a PTR Record which can only be set by your ISP or the VPS provider. It allows the IP of the server to resolve to a domain (usually it's the other way around) and it must show to the hostname you use for your mailserver. eg mail.yourdomain.com

Some mailservers also encourage you to add a few more records for automatic service detection but these are the core settings you need to get going.

After you have set up your domain and server I highly recommend to test mail delivery with https://www.mail-tester.com/ which checks if all the records are correct and your server is behaving the way it should. That tool saved me lots of times.

Here comes the fun part! Spam used to be the biggest issue with self-hosted mailservers. It was so bad that I'd say it was the biggest reason people moved away from self-hosted or even (externally) hosted webmail that usually came free when you bought a web space or domain.

The open source anti spam solutions relied on IP blacklists, domainlists, external anti-spam services like spamhaus or keyword searches - which were all very ineffective which caused your inbox look like this every day:

Word on the street was if you don't want spam, you have to use Gmail or any of the other big cloud providers that can detect spam mail by processing millions of their clients mails every day.

But something has changed in the last 2 years that solved the spam problem for self-hosters and allowed us to host our own mailservers again without being flooded by spam on a daily basis:

Using local llms to fight the spam

My selfhosted antispam service of choice is rspamd. It starts out as any other antispam system by having blacklists, ip checks, dns checks and keyword lookouts but there is one plugin in particular that completely fixed my spam problem: The GPT plugin

This little plugin allows you to classify an email using a large language model to determine if a mail is spam or not.

Since we're self-hosters and we do this also for privacy it would not make any sense to use an external LLM API to analyze all of our private emails - this is where local models come in.

My model of choice for email classification is Gemma 4 12B QAT which can run on a GPU or on CPU with as little as 7GB of RAM or VRAM and is a very capable multilingual model that fits this project perfectly.

If you have never set up a local llm before I'd recommed this guide from unsloth which will work on Windows, Linux and Mac. But in a nutshell you just need to run curl -LsSf https://llama.app/install.sh | sh if you're on Linux or MacOS, or run winget install llama.cpp if you're on Windows.

Once installed you can expose your LLM to the world using llama serve -hf unsloth/gemma-4-12B-it-qat-GGUF:UD-Q4_K_XL --reasoning off -fa on -c 16000 --temp 0.7 and then open a browser and go to http://localhost:8080 and you should see a chat interface

Once that's working all you need to do is tell rspamd to use your local llm to judge emails. For example this is my /etc/rspamd/local.d/gpt.conf on my mailserver:

allow_ham = true;
allow_passthrough = true;
enabled = true;

type = "openai";
url = "http://192.168.1.5/v1";
model = "unsloth/gemma-4-12B-it-qat-GGUF:UD-Q4_K_XL";
api_key = "this-is-ignored-on-llama.cpp";

max_tokens = 100;
temperature = 0.1;
# if your llm server doesn't have a GPU, you might want to increase the timeout
timeout = 30.0;

# Parse LLM reply as JSON (module expects key "probability", not "spam")
json = true;

prompt = "You are an expert email spam classifier. Analyze the following email headers, subject, and body. Respond with a JSON object containing two keys: 'probability' (a floating point number between 0.0 and 1.0 indicating spam probability) and 'reason' (a short sentence explaining why). Output only the raw JSON object, no markdown code fences.";

# Per-recipient conversation context: keeps a compact digest of recent mail
# (labels, top senders, 512-char summaries) in redis and injects it into the
# LLM prompt once 5+ messages are collected, so classification can use the
# recipient's mail history. Local feature, redis-backed, no external calls.
context {
  enabled = true;
  level = "user";          # scope digest per recipient mailbox
  min_messages = 5;        # warm-up before injection starts
  message_ttl = 1209600;   # 14d message digests
  ttl = 2592000;           # 30d redis key lifetime
}

That's all it needs to have a Gmail-class local antispam engine. Incoming mail will be sent to the LLM for evaluation and it will answer with something like this for spam:

{
  "probability": 0.85,
  "reason": "The email uses fear-based marketing tactics, unsolicited commercial content for a product (window cleaning robot), and contains a suspicious international Punycode URL."
}

And this for valid mails:

{
  "probability": 0.1,
  "reason": "The content appears to be a technical test message regarding DNS resolution with no suspicious links or promotional language."
}

Keeping an eye on spam

Rspamd also ships with a webinterface which will show some graphs and data but also allows you to paste mails and see how it would have classified that mail.

One of my biggest concerns when I moved from Google Worspace to my selfhosted mail was the UI. Besides Gmail I only knew Outlook but nobody outside of a corporate setting should ever be using Outlook if they have a choice.

On my Laptop and PC I'm using Thunderbird which is the most capable open-source competitor to Outlook. It comes with all the things you need and they even have a mobile app for Android. The search function is good (enough) and I didn't have any issues with it over the last 3 years.

If webmail is more your thing there are also a few options

Todays mail server solutions like the previously mentioned docker-mailserver are built with security fixes in mind and usually have an auto update feature that won't break anything in production. But as with all self hosted solutions you are in control but also responsible for your own data.

This also means that you have to think about things like backups, recovery, remote access and updates and if you don't at least have backups it means that you can lose all your data. Have a good backup plan and test the recovery at least once.

It can be done, it works great, it doesn't matter if your server is down for a short time and you should probably give it a try if you care about data sovereignty.

ssh [email protected]

Comments