Self-hosted, on-premise, private: the terms
- Self-hosted is the general term: the software runs on infrastructure you administer, wherever that is.
- On-premise is self-hosted on hardware in your own building or data-centre cage.
- Private email infrastructure covers both, plus a dedicated environment operated for you by a provider. The defining feature is that no other tenant shares the servers.
- Air-gapped is on-premise with no connection to the public internet, used for internal mail on sensitive networks.
Why an organisation self-hosts
Most businesses are better served by a hosted service. Self-hosting is chosen when one of these applies:
- Residency rules. A regulator, a contract or an internal policy requires that mail never leave a defined environment. See data sovereignty.
- Isolation. Internal correspondence on a network that must not touch the internet, common in security, defence and some financial operations.
- Key custody. The organisation wants to be the only party that has ever held the signing keys and the database.
- Existing capacity. There is already an operations team, storage and backup regime, so adding a mail platform is marginal cost.
What you take on
Self-hosting moves responsibilities from the provider to you. Be honest about each before choosing it:
| Responsibility | Hosted by Ontech | Self-hosted |
|---|---|---|
| Servers, storage, database | Ontech | You |
| Backups and restore tests | Ontech | You |
| Patching and upgrades | Ontech | You, with Ontech releases |
| TLS certificates, DNS, IP reputation | Ontech | You |
| Platform bugs and support | Ontech | Ontech |
| Who can access the data | You, and Ontech operators | You only |
How ontechmail is deployed self-hosted
The platform is delivered as a set of containers: the web front end and API, the inbound mail receiver, the IMAP and POP3 servers, the SMTP submission service, the outbound delivery worker, a PostgreSQL database and S3-compatible object storage for attachments. It runs on ordinary Linux hosts behind your own reverse proxy and TLS certificates. Ontech provides the deployment guide, the DNS record set for each domain and the DKIM key generation tooling.
Receiving internet mail behind a blocked port
Many Zambian ISPs block inbound port 25, which stops a self-hosted server receiving internet mail directly. ontechmail includes a tunnel-based cloud relay: your server dials out to the relay, the relay accepts mail on its public address, and hands it back over the tunnel. Nothing inbound needs to be opened on your firewall.
Air-gapped operation
For internal-only mail the platform runs with no egress. Users still get webmail, the OMail app on the internal network, IMAP and SMTP submission; only mail to and from the internet is absent, by design.
Security is the same either way
Self-hosting does not make a platform more secure by itself; it changes who is responsible. The controls are identical on both deployments: TLS on every connection, bcrypt-hashed passwords, two-factor authentication with recovery codes, per-domain DKIM signing, open-relay protection on the inbound receiver, spam scoring, sandboxed HTML rendering and an audit log of administrative actions. The email security page details each.
A practical path
Many organisations start on the hosted service in Zambia, prove the platform with real users, and move to self-hosted once the policy or procurement case is made. Because mailboxes are standard IMAP stores, the move is a copy, not a migration project. Contact info@ontech.co.zm to scope a deployment.
Frequently asked questions
What is self-hosted email?
Self-hosted email means the mail platform runs on servers your organisation controls, on-premise or in a private environment, rather than on a public provider's shared infrastructure. You own the mailboxes, the stored data and the signing keys.
Can ontechmail run without internet access?
Yes. The platform can be deployed air-gapped for internal mail. Receiving internet mail naturally requires connectivity; where inbound port 25 is blocked, Ontech provides a tunnel-based relay so your server dials out and receives mail over that tunnel.
Who maintains a self-hosted deployment?
Your team operates the servers, backups and updates; Ontech supplies the platform, deployment guidance and support. Organisations without in-house operations staff usually choose the hosted service instead.
Is self-hosted more secure than hosted?
Neither is automatically more secure. Self-hosting gives you physical and administrative control; hosted gives you a team that patches and monitors the service. Both ontechmail options use the same TLS, two-factor authentication, DKIM signing and audit logging.