Review: 6 free email servers for small business

Even as social networking continues to gain in popularity, email remains the undisputed workhorse of messaging, far eclipsing all other forms of electronic communication. Email administration can be a costly function, especially for small to midsized organizations, and many administrators are looking for alternatives to enterprise-sized (and priced) commercial products.

For this review we tested six free or open source email server products: Apache James, Citadel, hMailServer, SmarterMail, Zarafa and Axigen. Most have commercial options, but we specifically limited our testing to the free or community editions. Some, like Zarafa and Axigen, can also scale to handle large volumes of users, while SmarterMail and Citadel are more suitable for small to midsized organizations.

The six products we chose fall into three categories: Linux-only, cross-platform and Windows only. Our Linux-only contenders are Citadel, an open source product with roots back to the early 1980s and Zarafa, a European product with several features to support mobile mail.

Cross-platform products are attractive for the obvious reason that they can run on both Linux and Windows platforms. In this category, we tested open source and Java-based Apache James, part of the well-known Apache Foundation, and Axigen, a commercial mail server that offers a free version for up to 100 users and runs on both 32- and 64-bit Windows as well as most Linux systems.

In pictures: 6 free email servers for small businesses

Cisco Ironport delivers strong email protection

On the Windows side, we tested hMailServer, which has been around since 2002 and is available under the open source GPL license, and SmarterMail, which offers a free full version of its server product limited to 10 users on one domain.

The hands-down winner was hMailServer. Small and unobtrusive, hMail server is one of those products that simply works as advertised the first time and every time, maybe without some of the latest bells and whistles like ActiveSync and mobile mail. But hMail's core mail server functions are rock solid, and this product gets high marks for all the benchmarks that matter: ease of installation, ease of configuration, small, flexible code base, reliability and fault tolerance, and last but not least, no limitation on number of domains or users.

Of the runners-up, we have to give the edge to Citadel. This compact, Linux-based mail server was not only easy to install compared to most of the Linux candidates, but it also is long on features, fully open source and available in one-size-fits-all. If you are a small to midsize Linux shop, this is an excellent choice. The current UI is somewhat dated, but this is due to be corrected in the next release, which we previewed.

All the other test candidates are competent mail servers as well. Apache James is very appealing with its cross-platform availability and our only complaint is that version 3 with all its additional features is not yet available in a stable release. Zarafa provides good core mail server functionality in its community edition, but some functionality such as calendaring and extended Outlook support are available only in the commercial version. Another strong cross-platform candidate is Axigen, as it has one of the better user interfaces, both for administration and Web mail, but is limited in the number of users. SmarterMail provides a nice alternative to hMailServer on the Windows side and its biggest and maybe only drawback is the limitation on the number of users.

Our goal was to install, configure and test each of the products using the vendor-supplied documentation and other freely available web sources. We achieved successful installations and mail delivery with all the products tested, albeit not without some challenges. Two products, which we decided not to identify, performed so poorly or were so difficult to install or configure that we dropped them from the test altogether.

While the vendor documentation was adequate for the most part, it sometimes left out important details. None of the Linux products use a graphical user interface to install, and therefore require commands to be issued at a prompt. Fine for Linux admins, not so much for a Linux novice. The install for Zarafa did not succeed until we used a root account, which requires super user privileges that a casual tester may not have access to.

We did not perform stress tests, as sending out tens of thousands of emails more or less simultaneously tends to attract the wrong kind of attention and would most certainly lead to immediate grey listing followed by black listing and a peremptory end to the test.

We tested with numerous local email accounts (in the hundreds), using a variety of different email clients (POP, IMAIL, Web and mobile devices). We did not encounter any significant performance issues except the usual latency with the mobile satellite providers. On the other hand, great performance mostly over a local LAN under ideal conditions with no competing network traffic can't be compared to "real world" email delivery, so our best advice is to perform your own tests under conditions that more closely resemble your real network architecture.

Installation can be a challenge

The first question to ask if someone is touting the benefits of a particular email solution is "Have you installed it?" Open source products in particular are notorious for packaging elements of other open source products as building blocks and then presenting the bundled components as a complete solution.

While there isn't anything fundamentally wrong with this approach, installing these bundles can prove to be quite challenging. If the provided install file or process doesn't find the requisite dependencies or you accidentally use the wrong shell program or install packages in the wrong order, you may end up with nothing more to show for your efforts than jumbled bits and pieces of non-working code strewn around your server. Thankfully we maintained pre-mailserver-install images of our servers, which we freely admit were well-worn by the time all the tests were completed.

Which brings up the point that unless you pay for vendor support, a partially installed mail server is pretty much worthless. Without expertise in all the underlying technologies, the steps to troubleshoot a failed installation can range from difficult to impossible. We crashed one install by using the "wrong" version of a shell (not clarified by the vendor's own installation instructions) and another simply by supplying a MySQL root password too early in the process. You may be wondering, what's MySQL got to do with it, and that's exactly the point about dependencies - required third-party products may or may not be properly installed and configured, or might simply be the wrong versions of the correct product, which can still have a significant, usually negative, impact on the prospects of getting the solution up and running.

The bundling caveat applies mostly to products that run on Linux, since Windows products usually install from a single file, although this is by no means a guarantee of foolproof results. One of the products that bit the dust and was unceremoniously ejected from the test lab was a Windows product so fraught with twists and turns and endless tweaking of configuration files and environment variables that it made the Linux bundles seem like a cake walk. Beware the lure of a glitzy website promising mail server Nirvana - in a market where every free ride ends at the vendor's toll booth for commercial support, simplicity is the exception and not the rule.

A note about MTAs

While we're on the subject of dependencies, it should be noted that two of the products we tested, Apache James and Zarafa, use third-party MTAs (mail transfer agents). The name is apt - the MTA is tasked with the usually invisible job of transporting mail from one place to another over SMTP. Invisible, that is, until it doesn't work, whereupon it quickly becomes apparent that this little nondescript utility is in fact the one indispensable component every mail server requires to function.

You can send email using nothing more than an old-fashioned telnet session and an MTA; conversely the most elaborate email setup without a functioning MTA will send email precisely nowhere. MTAs are true workhorses that have the capacity to transfer hundreds of emails per second. Some of the more popular MTAs include Postfix, Exim and Sendmail.

Postfix runs on a variety of Unix/Linux flavors and it is also packaged with several of the mail server solutions we tested. Exim is currently the MTA of choice in all Debian Linux systems. It has been around since the mid-1990s and is highly configurable. Unlike Postfix, it does not have a centralized mail queue and thus might not be the best choice for installations where the mail queue becomes very large.

Unlike Postfix, which is still open-source only, Sendmail has taken a commercial path with different email products and solutions. However, Sendmail continues to update and support their open source solution as well.

Here are reviews of the individual products:

How to choose a mail server

        Click to see: Features chart

hMailServer

We installed hMailServer on Windows Server 2008 Standard Edition (32-bit). During installation there are just a few prompts and installation is completed in a few minutes. HMailServer has most of the basic features a SMB would want or need (SMTP, POP and IMAP). There is no native webmail included, but hMailServer works with any web mail system that supports SMTP, POP and IMAP.

This can be a PHP-based system running on Apache such as SquirrelMail or ASP/.NET-based system running on MS IIS. All configuration is performed from a single clean interface with expandable sections for domains, users, protocols, spam configuration, server status, etc. By default hMailServer installs with a SQL Server Compact database, but it can also be used with a standard version of MS SQL Server, MySQL or PostgreSQL.

HMailServer has several built-in security features. On the spam handling side you can link to a variety of DNS black lists, SURBL reputation lists and do your own grey listing based on IP addresses. HMailServer also has the built-in capability of pointing to an external SpamAssasin server.

For virus protection hMailServer offers built in ClamWin integration and it can also be linked to any other virus scanner by pointing to an executable. By default hMailServer blocks certain attachments such as executables and you can also add other file extensions to the exclude list.

HMailServer has a flexible native rules builder that allows you to create custom rules for customizing how it handles mail. For instance, you can create a rule to delete emails from a certain domain, forward emails based on certain criteria or trigger a script.

Apache James

The Apache James (Java Apache Mail Enterprise Server) mail server is maintained by the Apache Software Foundation and the current stable release version is 2.3.2. Apache James is written entirely in Java and it runs on both the Unix/Linux and Windows platforms under supported Java architecture (which is a prerequisite). The server architecture is modular and components are developed based on an open technical standard.

Apache James has a flexible API that allows developers to develop their own mail processing agents called mailets. Mailets can be used for a variety of functions such as converting HTML emails to text, automatically adding a footer or writing to a log. Mailets can also be used to process spam by implementing techniques such as black lists, white lists, IP filtering, establishing usage limits and using Bayesian filtering. Several sample mailets are included with the Apache James 2.3.2 release.

To test the cross-platform claims, we installed James on a 64-bit Windows 7 desktop, where it worked well after some initial annoyances. The 1.4 Java version recommended in the documentation didn't work and we had to install a newer version (1.6). However, once we installed the later version of Java, the batch file install worked on the first try and we had the server up and running in about five minutes.

We also tested two third-party GUIs, but neither of these worked on our Windows machine and we were left with the decidedly more arcane and un-Windows-like method of configuring James via command prompt. Naturally, a server product would be preferred for a production environment, but we are believers that less is more and were pleased to find code with a small enough footprint to perform well on our Windows 7 desktop.

James can be used with a JDBC-compatible database to store both user data and messages. It ships with Apache Derby, an open source relational database with a small footprint (less than 3MB including the JDBC driver).

The current release supports both SMTP and POP, but not IMAP. IMAP is supported in the upcoming version 3, which has been in preview release for the past couple of years and is expected to become the current release sometime in 2012. Apache James also has a handy feature called Fetchmail, which allows a mail server to be configured to retrieve email from multiple POP3 servers and deliver it to a local spool.

SmarterMail