Building a professional grade mail server on Linode

Postfix + Dovecot on Squeeze is a good choice. Staying with the Debian current versions has always served us well. StartCom is as good as any for free certs. Go for it!

There are many differences between Dovecot versions 1 and 2, as you're aware. For my mailserver (Debian 6), I installed Dovecot 2.x from the backports repository. This should make the upgrade from Debian 6 to 7 easier.

I'd also recommend installing opendkim from backports. The older version in the Squeeze repository did funky things for me….

Thank you for advices, I'll try the backports and see where it all goes. I am also open for additional suggestions, especially with staying up to date with software changes so I can upgrade more easily.

The nice thing about Debian Stable is that they only release security updates between releases, which means software is not going to change behavior on you[1]. And since Debian only releases once every two years, you don't need to constantly stay on top of changes. My advice is that when you're ready to upgrade to the next Debian release, check the documentation for all your important services to see what has changed. Also read the Debian Release Notes, which usually mention major changes to popular packages. In addition, the 'apt-get dist-upgrade' process usually alerts you to major changes, and sometimes even attempts to migrate configuration for you. In my experience, major changes usually aren't that big of a deal, and definitely not something to worry about except when upgrading every two years.

If you want to minimize surprises and downtime during upgrades, then I recommend you spin up a second Linode with the new version of Debian to test your configuration. Once it's perfected, you can either proceed with the upgrade on your original Linode or migrate the data to your new Linode, swap IP addresses, and destroy the old one. The latter approach is not for the faint of heart but is definitely "professional-grade" because it really minimizes downtime. Configuration management like Chef or Puppet helps a lot if you do that. In either case, since Linode refunds the rest of the month to your balance, running an extra 512 MB Linode for a day costs <$1.

Regarding the mail server, Postfix/Dovecot is an excellent choice, as is using DKIM. Be sure to enable opportunistic TLS in Postfix so Postfix uses encryption whenever possible when talking with other mail servers. Be aware that Debian Backports isn't technically supported by the Debian Security Team, so you might not get security updates in a timely fashion. Also, Backports does release non-security updates between releases which means behavior might change on you. For these reasons I don't use Backports on servers if I can avoid it.

[1] In the rare case that a security update requires a behavior change, details are published in /usr/share/doc/package/NEWS.Debian. If you have the apt-listchanges package installed, such details will be automatically emailed to root. But this is a very rare occurrence.

AGWA, thank you so much for your advice. It has helped me tremendously in planning the upgrade process. Now I fear upgrading a lot less than I used to. :-)