What are the benefits and risks of self-hosting email infrastructure?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Self-hosting your own outbound email stack means you run the mail transfer agent (MTA), the IP reputation, the queues, the bounce handling, and the relationship with every inbox provider on earth. No vendor sits between you and Gmail. That is the upside and the downside in one sentence.
Here is the honest tradeoff before we get into specifics.
What you get when you self-host
Full control over the SMTP server config: TLS ciphers, queue retry intervals, header rewriting, custom Received chains, per-destination concurrency. ESPs expose maybe 5% of this. You expose all of it.
No per-message pricing. A Hetzner box with a clean /29 of IPv4 runs around $50 to $150 a month and can push millions of messages. The same volume on SendGrid or Postmark is four figures a month minimum. If you send 50 million a month and have the staff, the math gets interesting.
Data stays on your hardware. No third party stores recipient addresses, message bodies, open pixels, or click logs. For regulated industries (healthcare, finance, legal) this is sometimes the only reason self-hosting gets approved.
No platform risk. SendGrid can suspend your account for a policy violation at 2am with no human to call. Your own server cannot deplatform you.
What it actually costs you
A real engineer who understands the difference between an ESP and an MTA, can read a Postfix main.cf, knows what a 421 4.7.0 from Yahoo means, and can debug a TLS handshake against Microsoft's edge. That person costs $150K+ a year fully loaded, and you need two so one can take vacation.
The MTA software is the easy part. Postfix, Exim, and Haraka are all free, mature, and well documented. The hard part is everything around them: feedback loop processing, ARF parsing, suppression list management, bounce classification (hard vs soft vs blocked vs spam-flagged), warming schedule per destination, automated DKIM key rotation, DMARC aggregate report ingestion. Postmark and SendGrid spent a decade building this. You are rebuilding it.
Reputation is your problem. You register with Google Postmaster Tools, Microsoft SNDS, and Yahoo's complaint feedback loop. You watch Spamhaus, Spamcop, SORBS, Barracuda, and UCEPROTECT daily. When you get listed (you will, everyone does eventually), you file the delisting request yourself, prove you fixed the underlying issue, and wait. An ESP absorbs that pain because they have a team doing it. You become that team.
IP warming is on you. New IPs send a few hundred a day for week one, scaling up over 4 to 6 weeks per M3AAWG's sender best practices. Skip it and your IPs land on blocklists before you finish your first real campaign.
On-call is 24/7. Queue backs up at 3am because Gmail throttled you? Someone gets paged. Disk fills with deferred mail? Page. TLS cert expired? Page.
When self-hosting actually makes sense
Three of these four need to be true:
- You send 20M+ messages a month and ESP bills are over $10K/month.
- You already have at least one engineer who can debug SMTP at the protocol level without Googling.
- You have a hard data residency or compliance requirement an ESP cannot satisfy.
- Your sending patterns are weird enough that ESPs throttle or refuse them (heavy transactional bursts, unusual destinations, etc).
If you are under 1M messages a month, do not self-host. The math never works. Pay Postmark or SendGrid and put your engineers on the actual product. If you are over 100M and Salesforce-tier, you probably already have a hybrid: a sending pipeline where transactional goes through a vendor and bulk goes through your own MTAs on dedicated IPs.
Most senders should stay on an ESP and revisit this every 18 months as volume grows.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
