This topic always gets strong opinions on Lemmy. The truth with security is: it always depends a lot on what you’re doing and fighting against, i.e. the threat vectors. There probably are some edge cases where it’s better to have physical control over the server. And there will be other cases where it’s better to use an established solution.

Just keep in mind, the people over at the good companies do this as a job. They probably have years of experience. Had long meetings to discuss technicalities and what might happen and how to handle it. They’ve analyzed the threat vectors and put some thought into the exact setup. And they likely constantly improve it. You need to judge by yourself if you can do it as good as them. And you obviously don’t want to make any major mistakes.

There are several all-in-one mail solutions available. I don’t know which can do encrypt at rest. Stalwart can do it. There is autocrypt.org and some Dovecot plugins, so I guess everyone can do it.

I like selfhosting and having control. What I host probably isn’t perfectly secure, though. Since I don’t spend all my time doing it and I also haven’t had anyone else look at the config and check for potential problems. E-Mail is one of the more complicated things. Due to abuse and spam, a bazillion things got added on top of the original protocol and the other providers are relatively strict with flagging mails as spam or straigt refusing to accept them. So there are lots of things to do, and get right. Even without encryption. And usually the needed ports are blocked on residential internet connections.

(And ultimately, your house also is under some jurisdiction, so if you’re worried about your own government, they can come raid your house and take your server. Or bug your phone and laptop. So you need additional security like encryption. And means to ensure they can’t circumvent it. And temper-proof devices.)