Self-Hosted Mail Stack

Overview

Prachyam Studios needed to run large-scale marketing email campaigns against a ~350 million record dataset — a volume that sits far above Mailchimp's 200k-contact Premium cap and lands in custom-quote enterprise territory, conservatively estimated at ~$300,000 for a 6-month campaign run. The self-hosted answer was Mailcow: a Docker Compose stack bundling Postfix, Dovecot, Rspamd, ClamAV, SOGo, and a management UI into a single deployable unit.

I proposed, built, and operated the full stack end-to-end. Six RackNerd VPS servers each running a Mailcow instance, 12 custom sending domains with full SPF/DKIM/DMARC configuration, and Postfix transport maps routing each domain's outbound mail through its designated server to preserve per-domain IP reputation. The same infrastructure absorbed all internal transactional mail and team inboxes for all 20 staff across both Pune and Varanasi offices.

The campaign delivered ~20 million emails. Total infrastructure spend for the 6-month run: ~₹9,000 (~$97) — all-in.

The Challenge

Two problems collided on the same Postfix queue. Marketing blasts were volumetrically enormous; internal transactional messages (password resets, onboarding emails, platform notifications) were operationally critical. Left unaddressed, the bulk queue starved internal mail by hours during campaign runs. Splitting onto entirely separate server sets was the obvious fix but added operational surface and cost on a shoestring infrastructure budget.

The harder constraint was operational simplicity. There was no dedicated DevOps person. The mail stack had to be self-managing enough that the rest of the team could use it without knowing it existed, while simultaneously handling campaign volumes that enterprise SaaS providers charge hundreds of thousands of dollars to process.

Architecture

The stack runs Mailcow on Docker Compose across 6 RackNerd VPS instances. Each server handles a subset of the 12 sending domains; Postfix transport maps bind each domain to its designated server and IP, keeping the domain-IP pairing stable for reputation purposes. Rotating 12 domains across 6 IPs acts as reputation insurance — a single deliverability incident cannot take down all outbound volume simultaneously.

Postfix priority queuing separates bulk and transactional mail at the transport level using transport_maps, smtp_destination_rate_delay, and custom defer_transports to guarantee internal messages skip the bulk backlog regardless of campaign depth. Both offices connect via the existing Tailscale mesh, resolving to the same mail infrastructure without public exposure. Mailcow's built-in OAuth2 endpoint serves as the SSO identity provider for all other internal tooling, including the self-hosted Nextcloud instance, eliminating the need for a separate directory service.

Key Decisions

Priority queue over separate servers. A dedicated marketing server and a dedicated internal server would have solved starvation trivially, but at the cost of double the operational surface. Keeping both traffic classes on the same server per domain with queue-level separation kept log streams unified and debugging straightforward — the trade-off was more upfront configuration in Postfix transport classes.

12 domains across 6 servers for reputation distribution. Sending reputation is a domain-IP pair reputation. Rotating sending domains distributes risk so no single blacklist event halts all outbound volume. Transport maps enforce the pairing stability that makes this strategy coherent; random assignment would defeat it.

Mailcow OAuth as team SSO. Rather than standing up Keycloak or Authentik as a separate identity layer, Mailcow's built-in OAuth2 endpoint was repurposed as the team's single sign-on. Unconventional but pragmatic for a 20-person team: one fewer service to provision and maintain, and the username is already the work email everyone knows.

Self-hosted Mailcow over AWS SES + Listmonk. SES + Listmonk was evaluated as the credible middle ground — estimated ~$7,500 for the same 6-month campaign run. Mailcow on owned VPS reduced that to ~$97 (a 98.5% reduction) because the only recurring cost is the RackNerd VPS subscription at ~$65/year.

Results

The 6-month campaign delivered ~20 million emails at a total infrastructure cost of ~₹9,000 (~$97), versus a ~$300,000 Mailchimp enterprise estimate and a ~$7,500 AWS SES + Listmonk projection — saving ~$299,900 and ~$7,400 respectively. Annual run-rate settled at ~₹14,000 (~$151/year) for VPS and domains combined. Internal mail starvation was eliminated: transactional messages delivered within normal SLA throughout every campaign run. The same stack replaced per-seat email SaaS for all 20 team members at no additional cost, and its OAuth endpoint became the shared identity layer for every subsequent internal service on the mesh.