Our own setup

Self-hosted mail for three domains, with DMARC set to reject

Our own mail server, three authenticated domains and a policy that on two of them rejects anyone posing as us.

Context

Telling clients to authenticate their mail while not doing it on your own domain is a hard position to hold. We needed three live domains, the company one and two projects, with mail that arrives, senders nobody else can forge, and a way to find out when somebody tries.

What we did

A single mail server for all three domains, with the MX records pointing home.
SPF and DMARC published on each domain, with the aggregate reports all arriving at one address.
The policy tightened gradually: two domains reject, the third stays on quarantine until the reports say it is safe.

Stack

Stalwart
SMTP
IMAP
SPF
DMARC

Result

On two domains a message pretending to come from us is rejected by the recipient, not filed as spam.
The reports say every day who is sending in our name, before a client finds out.
Submission on 465 with implicit TLS and IMAP on 993; the admin panel is not exposed to the internet.