Self-hosted mail on FreeBSD: deliverability first

Running your own mail server is very doable on FreeBSD — the hard part isn't installing software, it's deliverability. Get the DNS and reverse DNS right first and the rest follows. LYLIX makes the piece most hosts don't (reverse DNS) self-service, and doesn't block outbound port 25.

The deliverability checklist — do this first

• Reverse DNS (PTR): Service → Network in the portal lets you set the PTR on every IPv4 and IPv6 address. Set it to your mail hostname, e.g. mail.example.com. Receiving servers check this.
• Forward-confirmed rDNS (FCrDNS): publish an A (and AAAA) record for that hostname pointing back at the same IP, so forward and reverse agree.
• SPF: a TXT record authorising your IP to send, e.g. v=spf1 a mx ~all.
• DKIM: sign outbound mail and publish the public key as a TXT record (Rspamd signs, below).
• DMARC: a _dmarc TXT record tying SPF and DKIM together, e.g. v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com.

Set the FreeBSD hostname

Set the hostname in /etc/rc.conf (the portal's live hostname-change tool is Linux-only — on FreeBSD you set it directly):

sysrc hostname="mail.example.com"
hostname mail.example.com

The stack

A standard, well-documented FreeBSD mail stack is three packages, each with one job:

pkg install postfix dovecot rspamd

• Postfix — the SMTP server that sends and receives mail. Enable it as the system mailer and set your hostname/domains in /usr/local/etc/postfix/main.cf.
• Dovecot — IMAP/POP3 so your mail clients can read mail, plus authenticated submission on port 587.
• Rspamd — spam filtering and DKIM signing in one modern daemon.

sysrc postfix_enable=YES dovecot_enable=YES rspamd_enable=YES
service postfix start && service dovecot start && service rspamd start

Open the mail ports

Allow SMTP in, submission, and IMAPS in your pf ruleset — and remember outbound 25 must be reachable too (LYLIX does not restrict it):

pass in on $ext_if proto tcp to port { 25 465 587 993 } keep state

See the pf firewall guide. Once you're live, test against a mail-scoring service and watch your DMARC reports for the first week — that's how you catch a missing DKIM signature or SPF typo before it costs you.