Yeah, since the late 90s. Been through a few migrations (sendmail to Postfix to exim, considering Postfix again if I can replicate my setup; courier to dovecot; maybe 5? different hosting providers; squirrel to roundcube to rainloop to snappymail).
It can be death by a thousand cuts though but if you can get it into a stable mode where no-one is blocking you, it'll generally just tick along.
Setup is exim on two machines with rspamd (aggressive settings) feeding one IMAP store which is accessed via an OpenResty proxy (lets me write my own auth stuff) on the other machine (and also controls where each user's IMAP store comes from - just in case I need to split and/or restore to another machine.) Oh and currently snappymail for a webmail frontend.
Main problem I had was fail2ban blocking my users because they forget passwords, don't have PTRs, etc. (it's set to be very aggressive on exim and dovecot failures because there's just a constant stream of probes and attacks) but I solved* that by unbanning the IPs people have successfully authenticated from in the last day, IYSWIM.
It can be death by a thousand cuts though but if you can get it into a stable mode where no-one is blocking you, it'll generally just tick along.
Setup is exim on two machines with rspamd (aggressive settings) feeding one IMAP store which is accessed via an OpenResty proxy (lets me write my own auth stuff) on the other machine (and also controls where each user's IMAP store comes from - just in case I need to split and/or restore to another machine.) Oh and currently snappymail for a webmail frontend.
Main problem I had was fail2ban blocking my users because they forget passwords, don't have PTRs, etc. (it's set to be very aggressive on exim and dovecot failures because there's just a constant stream of probes and attacks) but I solved* that by unbanning the IPs people have successfully authenticated from in the last day, IYSWIM.
[edit: forgot the webmail and spam parts]