> Bullshit. There's troubleshooting when things go wrong, patching, maintenance, etc.
In over 10 years of hosting my own email I've never had a problem that needed troubleshooting after getting the initial installation sorted out. And patching on Debian is trivial.
> Your single server is much easier to target and break into than Google's.
"Stealth" does not mean "harder to break into", it means "less likely to attract the attention of someone with the means and motivation to break in." Google may be harder to break into, but it's a much bigger target.
My house is easier to break into than, say, Bagram air force base. That doesn't mean that I'm safer in Bagram.
Patching is never trivial. The process itself may be trivial, but you have to actually do it. That latter part requires ongoing attention, which makes it non-trivial.
less likely to attract the attention of someone with the means and motivation to break in
That depends. Most attackers go for low hanging fruit. And the fruit hardly hangs low at google with their dedicated security team.
The most juicy targets are actually those little homebrew servers that someone once setup and then mostly forgot about. The spammers can often use these servers for months before anyone (usually the ISP, not the owner) takes notice.
If your server is listening on Port 25 then it's not stealth. It's very likely being scanned while I write this comment - perhaps to see if it's an exim vulnerable to the recent remote-shell exploit (http://www.debian.org/security/2010/dsa-2131).
So, to wrap this up. I also run mailservers for various companies. I also run debian. I even also run dovecot and postfix. But I'm doing this for a living, am subscribed to the relevant security mailing lists, harden the hosts before deploying them, and I monitor them.
If you don't have a dedicated or hired admin to do all that then hosted e-mail usually has the better value proposition.
In over 10 years of hosting my own email I've never had a problem that needed troubleshooting after getting the initial installation sorted out. And patching on Debian is trivial.
> Your single server is much easier to target and break into than Google's.
"Stealth" does not mean "harder to break into", it means "less likely to attract the attention of someone with the means and motivation to break in." Google may be harder to break into, but it's a much bigger target.
My house is easier to break into than, say, Bagram air force base. That doesn't mean that I'm safer in Bagram.