Isn't it better* to host a mail server at home than to use Proton or Tuta?

This topic always gets strong opinions on Lemmy. The truth with security is: it always depends a lot on what you're doing and fighting against, i.e. the threat vectors. There probably are some edge cases where it's better to have physical control over the server. And there will be other cases where it's better to use an established solution.

Just keep in mind, the people over at the good companies do this as a job. They probably have years of experience. Had long meetings to discuss technicalities and what might happen and how to handle it. They've analyzed the threat vectors and put some thought into the exact setup. And they likely constantly improve it. You need to judge by yourself if you can do it as good as them. And you obviously don't want to make any major mistakes.

There are several all-in-one mail solutions available. I don't know which can do encrypt at rest. Stalwart can do it. There is autocrypt.org and some Dovecot plugins, so I guess everyone can do it.

I like selfhosting and having control. What I host probably isn't perfectly secure, though. Since I don't spend all my time doing it and I also haven't had anyone else look at the config and check for potential problems. E-Mail is one of the more complicated things. Due to abuse and spam, a bazillion things got added on top of the original protocol and the other providers are relatively strict with flagging mails as spam or straigt refusing to accept them. So there are lots of things to do, and get right. Even without encryption. And usually the needed ports are blocked on residential internet connections.

(And ultimately, your house also is under some jurisdiction, so if you're worried about your own government, they can come raid your house and take your server. Or bug your phone and laptop. So you need additional security like encryption. And means to ensure they can't circumvent it. And temper-proof devices.)

One thing you'll find about self-hosting is that you find yourself on the other side of the spam shield very often, and getting your server to a point where other servers won't block or filter you can be a challenge, especially if your IP or domain is on more aggressive lists like Spamhaus.

Besides that it's not really that much different from hosting another Federated service, which you seem to have experience with.

2 points I'm not sure got mentioned here

1. There is a new hero on the block - his name is mox and he is bloody awesome! It's a single binary written in go, that takes care of (citing) ...IMAP4, SMTP, SPF, DKIM, DMARC, MTA-STS, DANE and DNSSEC, reputation-based and content-based junk filtering, Internationalization (IDNA), automatic TLS with ACME and Let's Encrypt, account autoconfiguration, webmail.. pretty much everything. As somebody who maintains few mailservers for living - this is a wet dream come true. It implements eg MTA-STS that I haven't seen even on many commercial offerings yet. You run it once - it returns a long file with DNS records for MX, SPF, DMARC, DKIM etc... You run it second time with some switch - it generates its systemd file. Then you just spin it up - and that's it. I always wanted to write something like this but I am nowhere near clever enough. There may be some performance constrains, it's probably not "production grade" yet - but I've been using it for over a year with stellar results.
2. There has been a lot of gatekeeping (they call it security strengthening) going on lately. In my experience even year ago If you managed to fit into your DKIM / DMARC / SPF rules stated in your DNS records you could still deliver pretty much everywhere. Even with a dynamic IP. As of June 2024 google started enforce PTR records and M$ I believe followed (meaning if your ip doesn't have a correct PTR record your mail isn't deliverable to Google / Microsoft mailservers). Most residential ISPs will not enable you to edit your PTR and since more and more people / companies use bloody google /M$ cloud services I don't think it's worth running mailserver just from home because the deliverability would be a hit and miss. You need at least to proxy the outgoing mail through some cheap VPS with public ip that you can set a PTR on.