Email server requirements checklist

No single figure applies, because the total depends on the mailbox count, the storage profile, the platform you choose and how much of the work is done in-house. The main cost components are the servers or cluster capacity in your own cloud or data center, the storage for mail and attachments, an outbound relay or clean sending IP addresses if your own addresses cannot build reputation, spam and malware filtering, archiving, backup, migration of existing mailboxes and the administration time that deliverability and monitoring take after go-live. Open-source platforms carry no license fee in the base case, but OX App Suite licensing may be subject to custom packaging, limitations or separate fees set in the license agreement. Ask any implementation partner for a written, fixed-scope quote that lists each component, marks which costs are one-time (build, migration, integration) and which recur (hosting, support, upgrades, relay and filtering subscriptions), and states your assumptions about mailbox count and retention.

Many teams can run a small mail server with existing staff, but the work is more than installing software. Operating a mail platform requires skills in DNS, TLS certificates, SMTP routing, IMAP or JMAP access, spam and antivirus tuning, backup and restore testing, and patching on a fixed schedule. Deliverability also needs ongoing attention: SPF, DKIM and DMARC records must stay aligned, reverse DNS must match, and blocklist and reputation signals must be watched. Regulated firms add retention, audit logging and access review. Before deciding, ask who will own the on-call rota, who reviews DMARC reports, and who tests restores. A partner can cover the build, hardening and documentation, and then support you through a retainer, so your team keeps control of the operation.

The timeline depends on the scope you agree in writing, not on a fixed template. The main drivers are the number of domains and mailboxes, the size of the existing mail estate and how much history must move, the directory and identity integration you require, whether a separate archive is needed, the number of test users and decision owners available, and the change windows for DNS and mail routing. Parallel-run and coexistence periods add time but reduce cutover risk. Ask any partner to break the plan into phases with named deliverables, sign-off points and a cutover plan, and to state which items depend on your teams, such as DNS changes or identity access. Avoid any plan that promises a date without first reviewing your domains, mailboxes and retention policy.

Preparation shortens the discovery phase and reduces the risk of surprises at cutover. Typically you need administrative access to the DNS zones for every domain, read access or an export plan for the current mail provider, and a list of directory sources and groups if mailboxes will sync with your identity system. You also need a written retention policy, including which mail must be kept and for how long, and a decision on who owns legal hold and eDiscovery requests. Name test users from several departments, plus a technical owner for mail flow, a security owner for filtering and logging, and an executive sponsor who can approve cutover. Confirm these items with your legal, records and security teams early, because retention and archiving requirements often change the architecture.

The choice depends on your scale, your need for a groupware suite, and your licensing position. Stalwart is an all-in-one mail and collaboration server that supports IMAP, JMAP, SMTP, CalDAV, CardDAV and WebDAV. It is licensed under AGPL-3.0 with an optional Enterprise License from Stalwart Labs. mailcow-dockerized is licensed under GPL-3.0 and packages a Docker-based mail stack. OX App Suite v8 is designed to run on Kubernetes, is delivered as Helm charts, requires Istio or a basic ingress-nginx option, uses Redis and MariaDB, and stores files on NFS or object storage. Its support follows a commitment with defined release lifetimes, and some features may be subject to separate fees. Ask each vendor which edition you would license, what support is included, and how upgrades are handled. Our team can compare these options against your written requirements.

In many regulated cases, yes. Rules such as SEC Rule 17a-4(b)(4) require broker-dealers to preserve originals of business communications received and copies sent for not less than three years, including inter-office messages. A mailbox server is built for delivery and access, not for long-term preservation with legal hold and search, so most designs journal messages into a separate archive. The HIPAA Security Rule, at 45 CFR 164.312, adds transmission security and audit controls for ePHI, which affects logging and encryption design. Confirm with your compliance and legal teams which records apply to you, how long they must be kept, and whether journaling, legal hold and eDiscovery are required before choosing the archive product.

Deliverability depends on several controls working together. Publish SPF records that list your sending sources, sign outgoing mail with DKIM, and set a DMARC policy that you move toward enforcement only after reviewing aggregate reports. Reverse DNS should match the sending hostname, TLS should be enforced for transport, and the sending IP address reputation must be monitored. If your own address space is new or shared, a smarthost relay may be needed, which adds a recurring cost. After cutover, watch DMARC reports, postmaster tools from major providers, blocklist status and bounce rates for at least the first several weeks. Ask any partner how they will test sender authentication before cutover and who responds to a blocklisting.

A fixed-scope engagement starts with discovery, then a written scope that lists the platform, domains, mailbox count, integrations, migration approach, archiving design, testing, cutover and handover deliverables. The agreement should also name assumptions, client dependencies such as DNS access and decision owners, out-of-scope items and change control. DeployOpen plans, implements, integrates, hardens, backs up, documents and supports self-hosted platforms in your own infrastructure, and prepares evidence for compliance assessments, but does not issue audit reports or certifications. DeployOpen does not publish a price list, so a quote follows from the written scope. Ongoing support, upgrades and continuous testing can be added as a retainer once the project closes.