This project was born when our business got tired of the inadequacies of Hotmail and AOL for business email. I started looking around for a solution, and nobody had all the features we needed in cost effective form. Given a low budget (read zero) and demanding reliability requirements, I turned to open source software. After looking around I came to the realization that there is no such thing as an open source "email server" as a complete package. So even though all I knew about email was how to click the send button, I set out to piece together a total system from widely available programs. Here are my requirements in order:

1) Free (as in beer, though speech is nice too)
2) Rock solid stability
3) Paranoid security
4) Serious Anti-Spam measures
5) Maintainability

The members of OCLUG for putting up with a years worth of email related linux questions.
The members of the qmail mailing list, bless their cantankerous little hearts, for steering me in the right direction even when that required the vicious use of truncheons..
Tim Legant for his help in getting vmailmgr and tmda working together.
Charles Cazabon for his help with the local mail only problem.
The producers of all this wonderful FREE software that makes me look good for my boss.

If I used your doc, faq, program, scripts, etc. or you helped out and I forgot to give you credit, please let me know and I'll make sure to update my page.

1) Greater than less than symbols will surround key presses.  So if you are to press the carriage return it will look like: <enter>
2) Text to be actually typed will be listed in red while expected output will be listed in green.  I know this makes it harder if you print out the material but it seems like the easiest way to make it explicitly clear, I can't count the number of times when I wasn't sure if I was supposed to enter the quotes or not when reading someone else's docs.
3) Text that needs to be replaced with something that is specific to your particular installation will be shown in standard bash variable format with purple letters like this $VARIABLE.
4) Warnings will be larger and shown in yellow.
5) All instructions are to be performed as root unless otherwise specified.
6 )I personally hate vi, but I realize that it's pretty much THE universal editor for *nix based operating systems.  I used emacs to do most of my editing on this project, but you can use pretty much whatever you like.  For the remainder of this HOWTO, I'm going to assume that you're using emacs, if  you're not, then just replace the emacs commands with whatever is appropriate for your editor.  Here are a few EMACS tips in case you are a total newbie
    I) To open a file just type emacs $FILENAME replacing $FILENAME with the name of the file you want to edit or create.  (Remember to include the path if it's not in your current directory)
    II) To save the file you're working on just hold down the CTRL key and press <x> <s>
    III) To exit a file just hold down <CTRL>  and press <x> <c>
    IV) To delete an entire line press <CTRL> <k>
    V) To copy and paste go to the beginning of the region and hit <CTRL> <SPACE>, use the arrow keys to select the region, the press <CTRL> <w> to cut or <ALT> <w> to copy, go to the destination and press <CTRL> <y> to paste.

Mandrake Linux - Base operating system
REASON: I've found that Mandrake is very easy for new Linux users to install, use, and learn on. If you're reading this that probably includes you.
qmail MTA- Lets you send and recieve mail via SMTP (plus daemontools and ucspi-tcp)
REASON: I carefully examined the five big open source (I use this term loosely as they all have different licenses) mail transfer agents(sendmail,exim,courier,qmail, postfix), and qmail seemed to have the most paranoid security setup.  daemontools and ucspi-tcp are required in the standard life with qmail setup that the experts recommend.
Courier-IMAP - Allows remote mail retrieval without need for command line access
REASON: Natively supports maildirs, unlike POP it keeps all messages on the server, is faster/less complicated than both Cyrus-IMAP and UW-IMAP, the author gives excellent support on his mailing list, and it was originally designed to work with qmail so there aren't any compatibility problems or sendmailisms.
OpenSSL - Used to encrypt the communications between the mail client and the IMAP server
REASON: My policy is to encrypt everything and ask questions later, clear text transmissions are to be avoided at all costs, especially when transmitting passwords. I didn't like StartTLS because of the way it's implemented in Courier-IMAP, a compromise in the OpenSSL package would lead to root access for an attacker.
Vmailmgr - Removes the need for shell accounts.
REASON: This server is a mail hub, there are no "local" users in the old Unix sense of the word. I chose Vmailmgr over Vpopmail because it's easy to set up, more "qmailish" in design, and it was highly recommended by Charles Cazabon, the Technical Reviewer for "The qmail Handbook" one of the few offline books on qmail.
rblsmtpd - Blocks spammers using DNS lookups
REASON: Some mail admins are ignorant and/or malicious allowing all sorts of junk mail to be sent from or relayed through their systems. After carefully looking around I decided on three conservative blacklists that seemed both popular, and very concerned with accuracy. I chose sbl.spamhaus.org which maintains a list of the worst confirmed spammers, relays.ordb.org which tracks servers which are open relays (though once common, open relaying is no longer recommended due to abuse), and opm.blitzed.org which tracks servers with misconfigured proxies that allow relaying. (Originally I had chosen proxies.relays.monkeys.com for the open proxy blocking but they've been put out of action due to DDoS attacks.)  Blacklisting is only going to be a small portion of our anti-spam setup so I wanted to avoid any sort of aggressive or collateral damage lists.
Spamassassin - Analyzes email according to a list of human built rules and adds a score header
REASON: As any email admin can tell you, blacklisting hasn't been a complete solution for quite a while. This program looks at email and attempts to quantify it's "spammyness", by combining it with several other spam identifiers we can try and seperate the good from the bad.
Bayesian Filtering - Uses word frequency statistics to tell spam (bad mail) from ham (good mail)
REASON: This program allows your filters to become more efficient over time automatically by learning to recognize the difference between what consitutes good and bad mail on your system. Having multiple different ways to recognize spam helps keep down the false positives.
Vipul's Razor - An online database of known spam emails
REASON: I borrowed a concept from NASA and set up my spam identification system like the flight controllers on the space shuttle. There are three seperate filters each with an independant design, this makes the inaccuracies in any one system tend to cancel out.
TMDA - Tagged message deliver agent, a cryptographic message confirmation system
REASON: The worst problem with spam identification systems is false positives/negatives. Usually you can't crank your filters down very tight for fear that you'll reject legitimate mail, and if you loosen them up too much then all the nasty spam starts ending up in your mailbox again. TMDA can send out tagged confirmation messages which must be replied to before mail is delivered. Many users find TMDA by itself to be annoying as it interjects a new step in the email process. What I've done is to combine email filtering and TMDA in such a way that it only triggers on messages which are considered "spammy". The result is that most users mail goes through without needing confirmation, yet you can tighten down your filters without having to worry about false positives since legitimate senders can just confirm and be whitelisted.
TMDA-OFMIPD - Part of the TMDA package, this program allows you to use MUA's that don't invoke the sendmail wrapper included with qmail.  Specifically we'll be using this program to allow us to add dated reply-to addresses which will allow people we correspond with to bypass our spam filters automatically.  This is considered basic net etiquette when using a challenge/response system.
qmailqueue-patch - Allows you to have other programs called when qmail-queue is invoked.
REASON: Although it's a good idea to use a minimalist approach when it comes to patching qmail, this seemed like the best way to activate qmail-scanner so that we can scan for viruses.
qmail-scanner.pl - Can be used to block email attachments with certain file extensions, and as a hook for a virus-scanner
REASON: I liked Russell Nelson's qmail-viruscan-patch better but unfortuneately my use of mailfront precludes that because it acts as a replacement for qmail-smtpd.
Clam-AV - Open source virus scanner with auto-updating
REASON: This project is supposed to be completely free (as in beer) so this looked like the best choice. Although it's not going to catch everything, it should go a long ways towards keeping the virus population down. If you have Windows clients make sure you're running a host based virus scanner as this won't solve all your problems.
Mailfront - Used to prevent joe-jobs and reduce queue load from double bounces to invalid local addresses
REASON: qmail's default behavior is to accept all mail regardless of whether it's for a valid user. While this is polite, and was an appropriate response when qmail was written, nowadays this merely allows spammers, worms, and joe-jobbers to abuse your queue, increasing load on your server. Mailfront allows you to specify a set of rules which will prevent unauthorized smtp transactions, and that means you can use less hardware on your box, which means less money, and we all know how much managment likes that.
mailquotacheck.sh - Helps keep your disk usage reasonable by setting a limit on how much email a user can store
REASON: Many people tend to use email as an alternative to FTP nowadays, and that can take up a prohibitive amount of disk space. This script allows you to set a limit on how much people can store. I had to modify the script somewhat to work with vmailmgr and Mandrake but the changes were pretty minor.
Mozilla Email Client - Cheap, easy, crossplatform mail reading/sorting/composing
REASON: In my personal opinion Microsoft Outlook and Outlook express are poorly written, virus-laden, non-security concious pieces of bug-ridden filth, and should not be authorized in any proper mail system. Mozilla's email client provides a nice free replacement that can easily handle IMAP and the other features we need.
cdb - A simple program for creating constant databases
REASON: This package allows you to take some longer list files we'll be using and compile them into simple databases to improve lookup performance.
Relay-Ctrl - Allows remote users to relay outgoing smtp through the server so that you can support road warriors
REASON:   I like this particular solution because it's limited, temporary, and doesn't require patching qmail, in addition we're already using a bunch of Bruce Guenter's software so it keeps the number of different places to go for support down.
Maildrop - A mail delivery agent.
REASON: Basically this is a complete filtering language that allows you all kinds of custom solutions.  I like the way it works but currently the only thing we're going to be using it for is to implement the qmail-scanner.pl script which requires maildrop's reformime package.
Safecat - A safe maildir delivery program
REASON: We're not using a full fledged MDA, and TMDA  won't be used for our mailing list setup.  This program works great right out of the box.
djbdns - A security concious DNS server, written by the same author as qmail so it's little suprise that they work well together.
REASON - qmail is pretty strict about what kind of DNS replies it recieves.  Some sites nowadays will return a dns response that's greater than 512 bytes which is technically not allowed in the RFC.  When this happens qmail gives a CNAME error in the log and won't process the message.  To work around this, the best solution is to install a caching dns resolver like djbdns which understands and can properly handle those kinds of oversized messages.
ezmlm-idx (OPTIONAL) - A mailing list manager written by the auther of qmail, with some extensions added by various mailing list admins
REASON - There are many situations where it can be convenient to run your own mailing list.  This program offers a secure, low maintenance, no-nonsense way of doing that.

This will vary widely on your available resources, budget, and projected email volume.  For small to medium sized organizations pretty much any second string workstation should be able to handle the job.
Here are the specs for my email server:
    Matsonic MS7308E Motherboard
    Intel Celeron 600Mhz CPU
    512MB PC133 SDRAM
    Western Digital 120GB 7200RPM Hard Drive  (SCSI drives would be WAY better but I'm on a tight budget)
    SiS 630 PCI Graphic Adapter
    Intel Ethernet Pro 100 Network Card
    Trinitron 17" Monitor
    Keytronic 104 Keyboard
    Logitech two button mouse
    Generic 52x CD-ROM (must be El Torrito compliant)
    Sony 1.44MB Floppy Drive
    ATX Mid Tower Case w/300W Power supply
As you can see, it's not exactly a blazing inferno of speed, but for the purpose it's going to be used for that's plenty.  I highly recommend Arctic Silver III thermal grease as opposed to thermal tape or paste for your cpu cooler heat transfer material.  You should make sure that your system has been blown out with an air can and that all connections are firm before getting started.