It's behind a firewall. The only thing exposed to the outside is port 22 - and only pubkey login too.

And gee dude... It's been running for 18 years without being pwned 🙂

https://security-tracker.debian.org/tracker/

Depending on how it was configured it may or not be have been compromised. Probably better to go the nuclear option.

Everyone has a test environment. Some people also have production environments

The amount of dos systems I have seen powering critical infrastructure in banks and hospitals is quite frankly nightmare fuel.

Patience. It really helps to have all the latest set up: SPF, DKIM, DMARC. Then after that it's a matter of IP reputation, you can email the various blocklists and you wait for the rest of them to clear on their own.

I've had that IP for 10 years and it has never sent spam, and I've sent enough emails that people open that it actually does get through fine. I haven't had to think about it for a long time, it just keeps on working. Barely had to even adjust my Postfix config through the upgrades.

Unfortunately that's not true. I've been running mail servers under my domain since around 2000, almost as long as Microsoft has been running Hotmail, and I was certainly following good standards like SPF and DKIM well before they considered such a thing... and yet Microsoft is the bane of my mail server's existence. Despite no compromises resulting in spam blasts, MS still regularly shuts me out with no reason given and no hits showing on their monitors. If I can find their email address to ask what the problem is, I get a generic "your domain has been cleared" sort of reply but never any reason why they blocked me in the first place.

I've started up new domains and never had an issue getting mail accepted.

There's a right way to do it, and most people that complain that hosting email is impossible don't know how to configure it correctly.

You need SPF, DKIM, DMARC with a RUA set up to an email that doesn't bounce. That's pretty much it. I've been running email servers a long time and actually set up email from a new domain/IP a couple of years ago as well.

It takes a special kind to run and maintain a mail server. More so for doing it for such a long time.

Nah you can use ghetto smtp to relay incoming mail to a different port on your server if your ISP blocks incoming 25 and sendinblue (it's changed names but my sendinblue config is still working) to send outgoing mail if they block outgoing 25. It's less than ideal but doable for low volume private email servers.

I'm a kid of the cold war.

If you are worried that the NSA might be reading your email maybe it’ll be better for society if you don’t update … just saying.

This is how massive botnets form