hMail Server (Windows only) comes in first, Citadel (Linux only) is a close second
Even as social networking continues to gain in popularity, email remains the undisputed workhorse of messaging, far eclipsing all other forms of electronic communication. Email administration can be a costly function, especially for small to midsized organizations, and many administrators are looking for alternatives to enterprise-sized (and priced) commercial products.
For this review we tested six free or open source email server products: Apache James, Citadel, hMailServer, SmarterMail, Zarafa and Axigen. Most have commercial options, but we specifically limited our testing to the free or community editions. Some, like Zarafa and Axigen, can also scale to handle large volumes of users, while SmarterMail and Citadel are more suitable for small to midsized organizations.
The six products we chose fall into three categories: Linux-only, cross-platform and Windows only. Our Linux-only contenders are Citadel, an open source product with roots back to the early 1980s and Zarafa, a European product with several features to support mobile mail.
Cross-platform products are attractive for the obvious reason that they can run on both Linux and Windows platforms. In this category, we tested open source and Java-based Apache James, part of the well-known Apache Foundation, and Axigen, a commercial mail server that offers a free version for up to 100 users and runs on both 32- and 64-bit Windows as well as most Linux systems.
In pictures: 6 free email servers for small businesses
Cisco Ironport delivers strong email protection
On the Windows side, we tested hMailServer, which has been around since 2002 and is available under the open source GPL license, and SmarterMail, which offers a free full version of its server product limited to 10 users on one domain.
The hands-down winner was hMailServer. Small and unobtrusive, hMail server is one of those products that simply works as advertised the first time and every time, maybe without some of the latest bells and whistles like ActiveSync and mobile mail. But hMail’s core mail server functions are rock solid, and this product gets high marks for all the benchmarks that matter: ease of installation, ease of configuration, small, flexible code base, reliability and fault tolerance, and last but not least, no limitation on number of domains or users.
Of the runners-up, we have to give the edge to Citadel. This compact, Linux-based mail server was not only easy to install compared to most of the Linux candidates, but it also is long on features, fully open source and available in one-size-fits-all. If you are a small to midsize Linux shop, this is an excellent choice. The current UI is somewhat dated, but this is due to be corrected in the next release, which we previewed.
All the other test candidates are competent mail servers as well. Apache James is very appealing with its cross-platform availability and our only complaint is that version 3 with all its additional features is not yet available in a stable release. Zarafa provides good core mail server functionality in its community edition, but some functionality such as calendaring and extended Outlook support are available only in the commercial version. Another strong cross-platform candidate is Axigen, as it has one of the better user interfaces, both for administration and Web mail, but is limited in the number of users. SmarterMail provides a nice alternative to hMailServer on the Windows side and its biggest and maybe only drawback is the limitation on the number of users.
Our goal was to install, configure and test each of the products using the vendor-supplied documentation and other freely available web sources. We achieved successful installations and mail delivery with all the products tested, albeit not without some challenges. Two products, which we decided not to identify, performed so poorly or were so difficult to install or configure that we dropped them from the test altogether.
While the vendor documentation was adequate for the most part, it sometimes left out important details. None of the Linux products use a graphical user interface to install, and therefore require commands to be issued at a prompt. Fine for Linux admins, not so much for a Linux novice. The install for Zarafa did not succeed until we used a root account, which requires super user privileges that a casual tester may not have access to.
We did not perform stress tests, as sending out tens of thousands of emails more or less simultaneously tends to attract the wrong kind of attention and would most certainly lead to immediate grey listing followed by black listing and a peremptory end to the test.
We tested with numerous local email accounts (in the hundreds), using a variety of different email clients (POP, IMAIL, Web and mobile devices). We did not encounter any significant performance issues except the usual latency with the mobile satellite providers. On the other hand, great performance mostly over a local LAN under ideal conditions with no competing network traffic can’t be compared to “real world” email delivery, so our best advice is to perform your own tests under conditions that more closely resemble your real network architecture.
Installation can be a challenge
The first question to ask if someone is touting the benefits of a particular email solution is “Have you installed it?” Open source products in particular are notorious for packaging elements of other open source products as building blocks and then presenting the bundled components as a complete solution.
While there isn’t anything fundamentally wrong with this approach, installing these bundles can prove to be quite challenging. If the provided install file or process doesn’t find the requisite dependencies or you accidentally use the wrong shell program or install packages in the wrong order, you may end up with nothing more to show for your efforts than jumbled bits and pieces of non-working code strewn around your server. Thankfully we maintained pre-mailserver-install images of our servers, which we freely admit were well-worn by the time all the tests were completed.
Which brings up the point that unless you pay for vendor support, a partially installed mail server is pretty much worthless. Without expertise in all the underlying technologies, the steps to troubleshoot a failed installation can range from difficult to impossible. We crashed one install by using the “wrong” version of a shell (not clarified by the vendor’s own installation instructions) and another simply by supplying a MySQL root password too early in the process. You may be wondering, what’s MySQL got to do with it, and that’s exactly the point about dependencies – required third-party products may or may not be properly installed and configured, or might simply be the wrong versions of the correct product, which can still have a significant, usually negative, impact on the prospects of getting the solution up and running.
The bundling caveat applies mostly to products that run on Linux, since Windows products usually install from a single file, although this is by no means a guarantee of foolproof results. One of the products that bit the dust and was unceremoniously ejected from the test lab was a Windows product so fraught with twists and turns and endless tweaking of configuration files and environment variables that it made the Linux bundles seem like a cake walk. Beware the lure of a glitzy website promising mail server Nirvana – in a market where every free ride ends at the vendor’s toll booth for commercial support, simplicity is the exception and not the rule.
A note about MTAs
While we’re on the subject of dependencies, it should be noted that two of the products we tested, Apache James and Zarafa, use third-party MTAs (mail transfer agents). The name is apt – the MTA is tasked with the usually invisible job of transporting mail from one place to another over SMTP. Invisible, that is, until it doesn’t work, whereupon it quickly becomes apparent that this little nondescript utility is in fact the one indispensable component every mail server requires to function.
You can send email using nothing more than an old-fashioned telnet session and an MTA; conversely the most elaborate email setup without a functioning MTA will send email precisely nowhere. MTAs are true workhorses that have the capacity to transfer hundreds of emails per second. Some of the more popular MTAs include Postfix, Exim and Sendmail.
Postfix runs on a variety of Unix/Linux flavors and it is also packaged with several of the mail server solutions we tested. Exim is currently the MTA of choice in all Debian Linux systems. It has been around since the mid-1990s and is highly configurable. Unlike Postfix, it does not have a centralized mail queue and thus might not be the best choice for installations where the mail queue becomes very large.
Unlike Postfix, which is still open-source only, Sendmail has taken a commercial path with different email products and solutions. However, Sendmail continues to update and support their open source solution as well.
Here are reviews of the individual products:
Click to see: Features chart
hMailServer
We installed hMailServer on Windows Server 2008 Standard Edition (32-bit). During installation there are just a few prompts and installation is completed in a few minutes. HMailServer has most of the basic features a SMB would want or need (SMTP, POP and IMAP). There is no native webmail included, but hMailServer works with any web mail system that supports SMTP, POP and IMAP.
This can be a PHP-based system running on Apache such as SquirrelMail or ASP/.NET-based system running on MS IIS. All configuration is performed from a single clean interface with expandable sections for domains, users, protocols, spam configuration, server status, etc. By default hMailServer installs with a SQL Server Compact database, but it can also be used with a standard version of MS SQL Server, MySQL or PostgreSQL.
HMailServer has several built-in security features. On the spam handling side you can link to a variety of DNS black lists, SURBL reputation lists and do your own grey listing based on IP addresses. HMailServer also has the built-in capability of pointing to an external SpamAssasin server.
For virus protection hMailServer offers built in ClamWin integration and it can also be linked to any other virus scanner by pointing to an executable. By default hMailServer blocks certain attachments such as executables and you can also add other file extensions to the exclude list.
HMailServer has a flexible native rules builder that allows you to create custom rules for customizing how it handles mail. For instance, you can create a rule to delete emails from a certain domain, forward emails based on certain criteria or trigger a script.
Apache James
The Apache James (Java Apache Mail Enterprise Server) mail server is maintained by the Apache Software Foundation and the current stable release version is 2.3.2. Apache James is written entirely in Java and it runs on both the Unix/Linux and Windows platforms under supported Java architecture (which is a prerequisite). The server architecture is modular and components are developed based on an open technical standard.
Apache James has a flexible API that allows developers to develop their own mail processing agents called mailets. Mailets can be used for a variety of functions such as converting HTML emails to text, automatically adding a footer or writing to a log. Mailets can also be used to process spam by implementing techniques such as black lists, white lists, IP filtering, establishing usage limits and using Bayesian filtering. Several sample mailets are included with the Apache James 2.3.2 release.
To test the cross-platform claims, we installed James on a 64-bit Windows 7 desktop, where it worked well after some initial annoyances. The 1.4 Java version recommended in the documentation didn’t work and we had to install a newer version (1.6). However, once we installed the later version of Java, the batch file install worked on the first try and we had the server up and running in about five minutes.
We also tested two third-party GUIs, but neither of these worked on our Windows machine and we were left with the decidedly more arcane and un-Windows-like method of configuring James via command prompt. Naturally, a server product would be preferred for a production environment, but we are believers that less is more and were pleased to find code with a small enough footprint to perform well on our Windows 7 desktop.
James can be used with a JDBC-compatible database to store both user data and messages. It ships with Apache Derby, an open source relational database with a small footprint (less than 3MB including the JDBC driver).
The current release supports both SMTP and POP, but not IMAP. IMAP is supported in the upcoming version 3, which has been in preview release for the past couple of years and is expected to become the current release sometime in 2012. Apache James also has a handy feature called Fetchmail, which allows a mail server to be configured to retrieve email from multiple POP3 servers and deliver it to a local spool.
SmarterMail
We tested the free version of SmarterMail Windows-based mail server. SmarterMail is marketed as an ‘Exchange-level’ mail server. The free version we tested is limited to 10 users on a single domain. While this is the most limited of all the products tested, the free version of SmarterMail may be practical for small offices with just a few users. It is also somewhat unique in that it has all the features of the full version.
By default SmarterMail installs with its own embedded web server and we went with this approach for our first install, which took only a few minutes and prompted only for a minimum of configurations (admin password, IP address, DNS servers as well as basic anti spam and virus setup).
But since the vendor recommends using IIS for a more robust and secure installation, and we aren’t very fond of embedded web servers anyway, switching to this setup was an easy choice. We installed SmarterMail on a Windows Server 2008 R2 box. The installation is the same regardless of the server you’re using since the switch to IIS happens after the initial install. This involves stopping, then disabling the built-in web server and creating a site in IIS for SmarterMail. The only pre-requisite we needed to install was the .Net Framework 4.0.
Creating new domains is done from a tabbed screen with selections ranging from the basics, such as domain name and admin password, to more advanced settings such as throttling and event restrictions. Users are set up much the same way and while there are a number of custom settings that can be utilized, a basic account just needs an entry for user name and password. We found that for the most part you can accept default values and come back to tweak later.
SmarterMail is built for Webmail and has an intuitive interface that probably won’t have you missing Outlook anytime soon. In addition to email you can manage calendars, contacts and instant messages from any device with a browser. Should you desire to use a desktop mail client instead, you can use a client such as Thunderbird or Outlook.
We tested with a Thunderbird client and were able to send and receive mail with no issues. SmarterMail also has a flexible auto-discovery feature that can be used on both desktops and mobile clients which allows a device to be configured by using just the email address and password. The rest of the configuration is automatically downloaded from the mail server.
SmarterMail has mobile support for most of the common devices such as Androids, Apple devices, BlackBerry and Windows Mobile devices. It also has built-in instant messaging and a mobile interface that was created for smartphones, making easier to navigate.
Server administration is accomplished through a browser-based interface allowing administrators the flexibility of remote access, something that is helpful, especially for smaller businesses where an IT admin might not be onsite at all times. The Flash tutorials provide a quick-start guide for new users, something we found helpful.
SmarterMail can integrate with spam solutions such as SpamAssassin and Trend Micro, but it can also be configured to use other methods such as black/grey/white listing, custom headers, SMTP blocking, SPF and others.
Zarafa
Zarafa is maintained by a group in the Netherlands which specifically markets its collaboration server as an alternative to Microsoft Exchange. It features an AJAX based browser-based client with a PHP backend intended as replacement for Outlook. Zafara claims to be the only open-source collaboration platform with a MAPI-based architecture. Zarafa leverages existing open source technology such as Postfix as its MTA and stores all data in a MySQL database.
Zarafa runs on several Linux flavors such as Debian, SUSE, Red Hat and Ubuntu. We chose Debian Version 6.05. As the user manual states there are a ‘bunch of requirements’ that need to be met such as installing MySQL, Apache (or other PHP web server) and an SMTP server such as SendMail or Postfix. Installing a LAMP stack accomplishes a bulk of these prerequisites. Zarafa can be installed in four ways (distro, install scripts, manual and from source). We decided to use the install script, which, at least for our single server test, turned out to be the shortest route.
The Zarafa server is configured by a using a system-wide .cfg file. Users are typically set up using the DB plugin or if you wish to integrate with the Linux server you can use the Unix plugin. You can also manage users by using the LDAP protocol to link to solutions such as Active Directory or eDirectory.
Although Zarafa offers several commercial versions of their server, we found the open source version to be quite capable even if it lacks some of the features of its commercial counterpart (calendaring, unlimited Outlook clients and multi-server support).
Communication between the client and server is based on Simple Object Access Protocol technology. In order to communicate with mobile devices, Zarafa uses what it calls Z-push. Z-push is an open-source implementation of Microsoft’s ActiveSync protocol and it works with devices running iOS, Android, Windows Mobile, Nokia and others.
The Z-Merge framework enables developers to integrate Zarafa WebApp easily with CRM, DMS and other solutions. For instance Zarafa can integrate with SugarCRM and recently a Dropbox plug-in was made available.
Citadel
Citadel has its roots as a bulletin board system platform from the early 1980s, but has since developed into a groupware product with support for features such as calendaring, addressing and instant messaging in addition to email. Unlike most, if not all, other open source mail servers, Citadel is a custom purpose-built product.
For instance, it does not use Postfix, but it has its own custom code written in C for SMTP purposes. The company targets SMBs looking for a self-contained, low maintenance and fully integrated stack.
We installed Citadel on a server running Debian 6.05 and found it was easy to install compared to some of the other Linux products we’d been wrestling with. Management is browser-based and can be customized to display only the functions you wish to use. After creating a test domain, we set up users, which can be completed with a short two-step wizard, or manually.
The calendar and task functionality seems solid, although it would be nice to click into the calendar to create a new entry. We liked the notes section where you can put up small Post-It like notes of different colors with reminders.
Overall we found the interface to be functional and easy to use; it might not feel as Web 2.0 modern as some of the other web interfaces we tested, but our preview of the upcoming release showed major UI improvements on the way.
Citadel is also available as a virtual appliance that can run on KVM or VMware. These pre-built Linux installations are ready to go out of the box, complete with anti-spam and anti-virus. Load balancing is also available, but we tested with a single server setup.
Axigen
Axigen’s free mail server provides an alternative to open source. Just like SmarterMail it is a full version of the commercial offering, but with limits on capacity (100 users). It is available for RPM distros, Debian, Mandriva, FreeBSD, Solarias and Windows Server. We decided to go with Windows 64-bit version and installed it on a Windows Server 2008 R2 server. The installation is available as an .MSI file and the installation was very simple with a prompt for Admin password and which protocols to use.
Axigen is managed from a Web interface that we found comprehensive and easy to navigate. The use of a collapsible menu keeps the navigation less cluttered, but keeps all functionality at your fingertips. Axigen provides all features you would expect in a complete mail server. It has built-in support for Kaspersky anti-virus and anti-spam and it can be integrated with other solutions such as CommTouch, SpamAssassin and ClamAV.
Setting up a new domain and new users was easy. Both offer a ‘quick create’ option where you enter just the basics or you can expand the property sheet to modify properties to a very granular level. For instance, you can specify which protocols are available for a user, effectively only allowing the POP or Web access. The AJAX Web client interface is clearly meant as an Outlook replacement in not just look and feel, but also functionality. If you are used to Outlook, you will feel right at home with not much need for adjustment.
Another neat feature, especially when you’re not familiar with a product, is the contextual help that is displayed by default in a right-hand column. It is not obtrusive like a pop-up would be and it has just enough information to be useful. Once you become familiar with the interface, you can minimize the help function.
Perschke is CSO for Arc Seven Technology. She is also an experienced technical writer, and has written numerous white papers for a number of organizations, including Fortune 500 companies. Susan can be reached at susan@arcseven.com.
