Self-Hosted Email Marketing Software Compared: Mautic, Listmonk, Sendy, Dittofeed and More (2026)

Self-hosted email marketing software is a campaign application you run on your own servers, so the subscriber database stays with you. Mail can still leave through your own mail transfer agent (MTA) or through a relay such as Amazon SES. In 2026 the active open-source choices are Mautic, Listmonk, Keila, phpList and Dittofeed; Sendy and Mailcoach are paid; Mailtrain has had no release since 2021. The right pick depends on licence, sending model and consent tooling, compared below.

Who this is for: marketing-operations leads, architects and DPOs choosing a self-hosted Mailchimp alternative, and teams deciding when an application is no longer enough. Part of the email and activation infrastructure hub; for the market backdrop, read MailOps in 2026.

What "self-hosted" covers, and what it does not

Three layers hide inside the phrase:

• Application layer: lists, segments, templates, campaigns, tracking, unsubscribe pages. Every project below provides this.
• Sending layer: the MTA that opens port 25 connections to Gmail, Outlook.com, Yahoo and iCloud, or the relay that does it for you. Only Postal and Mailtrain (through its built-in ZoneMTA) ship a real MTA; the rest hand mail to SMTP or an API.
• Data layer: who may be mailed, on what basis, with what history. Most tools keep this inside the email database, which becomes a problem once SMS, push and ad audiences exist.

Terms used here: self-hosted means you operate the software; on-premise means in your own data centre; private cloud means a dedicated environment in your cloud account or a vendor's; customer-owned means you hold the data, keys and upgrade timing; sovereign means no foreign authority can compel access. Self-hosting an application meets only the first.

Master comparison: ten projects, one table

Data comes from each project's LICENSE file, the GitHub API and documentation, collected on 2026-10-17 7–20. "Not found" means the pages opened do not say; it is not proof of absence.

Notes on the table:

Reading the table: five practical observations

1. Only two projects bring an MTA. Postal is a full mail server; Mailtrain bundles ZoneMTA 141520. Everything else assumes SMTP or an API from someone else, so deliverability still depends on a third party.
2. Maintenance varies sharply. Mautic, Listmonk, Keila, phpList and Plunk have commits within five weeks. Dittofeed's last stable tag is from December 2025, with alpha tags since. Mailtrain has had no release since June 2021 and no default-branch commit since December 2022 14; treat it as legacy.
3. Licence changes what you can do with a fork. MIT (Dittofeed core, Postal) is permissive; GPL and AGPL carry copyleft 710; Sendy and Mailcoach are commercial, and Mailcoach single-domain licences may not be built into a SaaS product 17.
4. Stack weight differs widely. Listmonk is one binary plus PostgreSQL; Dittofeed's compose files add ClickHouse, Temporal and object storage 13. Choose by what your team already operates.
5. Consent tooling is thin outside Mautic, Listmonk, Keila and Dittofeed, and scale signals are mostly vendor claims. Where the table says "not found", plan to build suppression sync yourself, and load-test your own bounce and unsubscribe paths.

Mautic vs Listmonk

Pick Mautic when you need marketing automation: behavioural segments, lead scoring, multi-step campaigns, per-channel Do Not Contact and a preference centre 9. The cost is a heavier PHP and MySQL estate, cron or queue workers, and the Composer-versus-transport caveats above. Pick Listmonk when the job is newsletters and announcements at high volume with a small footprint: one Go binary, PostgreSQL, configurable bounce handling and a documented API 1011. Listmonk describes itself as a one-way mailing list manager, not a journey tool.

Listmonk vs Sendy

Both are cheap to run. Sendy costs a one-time $69 and sends only through Amazon SES, so your reputation, bounce stream and sandbox limits are SES's 12. Listmonk is AGPL, free, and relay-agnostic: you can point different campaigns at different SMTP servers and receive bounce webhooks from several providers 10. Sendy suits an SES-standardised agency with client logins; Listmonk suits teams that want to switch relays without migrating software. Neither stores consent history beyond list status.

Dittofeed: what "open source" means here

Dittofeed's repository is MIT licensed and the project says it is free forever 13. Its README adds that a licensed closed-source codebase provides multi-tenancy, embedding and white-labelling. It is closer to a customer-engagement platform (events, journeys and segments across email, SMS and push) than to a newsletter tool, which explains the heavier stack. For plain campaigns it is more than you need; for event-triggered messaging fed from your own data it is a credible self-hosted option, and it sits beside the projects in our open-source customer data platform comparison.

Choosing a self-hosted Mailchimp alternative by situation

What self-hosting does not fix: deliverability

Software choice does not change what mailbox providers demand. Gmail's rules apply from February 2024 to every sender: SPF or DKIM, valid forward and reverse DNS, TLS and a spam rate under 0.3 percent. Senders of about 5,000 or more messages a day to personal Gmail accounts also need SPF, DKIM and DMARC, an aligned From domain and one-click unsubscribe for marketing mail; that bulk status is permanent once reached, and messages from subdomains count toward the same primary domain 12. Yahoo asks bulk senders for SPF, DKIM, DMARC at least p=none, one-click unsubscribe and unsubscribes honoured within two days, without publishing a volume threshold 3. Outlook.com applies the same logic to domains sending 5,000 or more messages a day: Microsoft says non-compliant mail goes to junk first, and its support page documents the rejection 550 5.7.515 45. Apple's iCloud Mail asks for authentication, consistent IPs and domains, and separate marketing and transactional streams 6. RFC 8058 requires both unsubscribe headers to be covered by the DKIM signature 21, so check that your relay or MTA signs them. The detail is in Email Authentication in 2026.

Relay or own MTA changes who carries the reputation work. With a relay, SES or SendGrid manages IPs; you manage domains, content and lists. With your own MTA you also carry reverse DNS, port 25 access, blocklist checks and gradual volume ramps: Gmail asks senders to increase volume gradually 1, and Postal's own prerequisites warn that your provider's IP may already be blocklisted and that many providers block port 25 20. Postal's own documentation says running a mail server "isn't something for everyone" 20. For measurement, see Inbox Placement vs Delivery Rate.

Self-hosted email marketing and GDPR

Self-hosting keeps the subscriber table in your infrastructure, simplifying access control and residency. It does not make you compliant:

• A relay is a processor. If mail passes through SES, SendGrid or Postmark, the controller must use only processors giving sufficient guarantees and bind them by contract to documented instructions (Art. 28(1), 28(3)(a)) 22. US relays also raise transfer questions; see GDPR transfers after Latombe.
• Objection to direct marketing is absolute. Art. 21(2)–(3) says personal data "shall no longer be processed" for direct marketing once the person objects 23. The UK ICO advises keeping a suppression record rather than erasing the address, so the objection survives re-imports 24.
• Withdrawal must be as easy as giving consent (Art. 7(3)) 25. Tools that store unsubscribes per list rather than per person struggle here.
• Data subject tooling. Listmonk's subscription page template offers data export and wipe 10; Mautic offers per-channel Do Not Contact and frequency rules 9. Neither reaches your CRM, support desk or SMS system on its own.

The architecture for propagating a withdrawal everywhere is in Consent Withdrawal Across Channels.

When to go infrastructure-grade

An application plus a relay is the right answer for most senders. It stops being enough when one or more of these signals appears:

The last row is where email meets the data layer. Deliverability and compliance both reduce to state: who may be contacted, on what basis, with what history. If that state lives inside an email application, SMS, push and ad audiences drift from it. The durable pattern keeps consent and audience state in a customer data platform (CDP) you own and treats the email application and MTA as downstream destinations fed by events. That is one reason to compare self-hosted email tools alongside self-hosted customer data platforms. PrivyCDP is one example: a customer-owned, single-tenant customer data platform with customer-held keys, an immutable append-only audit ledger and open APIs and webhooks; it is not an email sender. iAge Technologies, PrivyCDP's owner, also offers email infrastructure under the InboxSuite name.

Self-hosting the MTA is a bad idea if nobody will read DMARC reports, watch Postmaster Tools and answer blocklist tickets; a reputable relay under a signed data processing agreement is then the safer choice.

Checklist: choosing and running a self-hosted platform

• Write down whether you need an application only, a relay, or your own MTA.
• Confirm the licence (MIT, GPL, AGPL, commercial) against your fork and hosting plans, and check release dates; avoid projects with years of silence.
• Publish SPF, DKIM and DMARC for the sending domain before the first send; align the From domain.
• Add RFC 8058 one-click headers to marketing mail and sign them with DKIM.
• Wire bounce and complaint webhooks; set thresholds that blocklist hard bounces and complaints.
• Decide where consent and suppression live, and test that an unsubscribe propagates to every channel.
• Sign a data processing agreement with every relay and record it in your vendor register.
• Separate marketing and transactional streams by subdomain and, where volume justifies, IP pool.
• Monitor Postmaster Tools, DMARC aggregate reports and Microsoft SNDS weekly.
• Load-test the unsubscribe and bounce paths, not only the send path.

If your email programme must sit inside a regulated boundary, with the sending layer, consent state and audit trail all under your control, start with the deployment qualification and see how the pieces fit. Back to the email hub.