This is something I have extensive and recent experience with.
My whole domain is run out of my home with services from DNS to Mail running on Slackware 12. I recently migrated from old hardware to new and Slackware 11 to Slackware 12 and as part of it I decided I wanted to overhaul my mail services. At the time I was running the defaults that come with Slackware, Sendmail and UW-IMAP. I started with those at home as a learning experience, not out of preference and having spent a long time with both, I decided I wanted more flexibility, more security and went looking for answers.
Here's a lot of useful information from my experiences at work (as a SysAdmin) and at home. I apologise for the random nature of the information burst - but I can't be arsed to gather it all together and structure my response.
1. OS If CentOS is your choice and you are sticking with it - fine. If you are uncertain whether you wish to change your OS and you are going to be running a mailserver I HEAVILY recommend you investigate Slackware or Debian - my preference being Slackware (especially for servers, although I use it for Desktop/Laptop/Server/Media Centre).
2. MTAThere are currently four choices for an MTA currently considered sane: Sendmail, Postfix, Exim, Qmail.
Sendmail is the oldest and everything else basically has to be sendmail-compatible in order to get accepted. However, Sendmail is also the most insecure inherently in its design. If you run a Sendmail mailserver - be prepared to get yourself into a monthly patching cycle. It's also a pain in the
[Censored] to configure if you've never done it before and I just generally don't recommend it. Some SysAdmins won't use anything else, but that's because they know Sendmail inside out and are comfortable with it. Don't start with it.
Qmail is ridiculously complicated and has only really gained its current popularity due to the fanboy culture grown through qmailrocks.org. Again, if it's really what you want then ok - but I personally wouldn't consider it a sane choice. I'm not going to bother going into detail at the moment.
Exim is good. That's pretty much it. Our company's mailserver is currently Exim running on Fedora Core 3. It's fairly stable, fairly secure, fairly easy to configure and maintain and it has a few tools around for ease of maintenance too. I wouldn't berate you for running it - it's ok.
However, my absolute recommendation (and the choice I made after a month or more of investigation and deliberation) would be Postfix. Postfix was designed for three things: Security, Speed & Ease of Administration and it does all three brilliantly - the security model for one is the best of any MTA I know. Also, whenever you want to integrate something into your mailserver, postfix is usually the easier one. Mailman for example is almost designed with Postfix in mind. I'm also running it with SSL SMTP enabled and that works great too.
3. DatabaseAlthough my database of choice is always MySQL, there's no need for a mailserver to use a database. Certainly not in any scenario I would recommend.
4. IMAP / POP3 ServerCourier. Courier. Courier. Courier. Courier. Courier. Courier.
Dovecot has it's uses, but it can be a pain - it's what we are running here at work, and although it's going to be a real pain to change it, we are going to migrate to UW or Courier. Random example: Dovecot on Fedora Core 3. If you rlogin to the server, dovecot crashes. No reason, no log entry, no port conflicts, no anything - dovecot just stops working and has to be restarted (although there are other times when it does that for no reason). I'm not saying that it will do that to you, but I've certainly found it to be less than robust and, in case it's an issue related to the OS - note that Fedora3 and CentOS basically run from the same codebase.
I looked at all the options and came to one single conclusion for my mailserver. UW or Courier. UW is damn good, but it just didn't give me the features I wanted. Courier does.
I am now running Courier IMAP, IMAPS, POP3, POP3S with signed SSL certificates, compiled with Cyrus SASL etc and it all works beautifully, server side and client side. The maildir mailbox format is just what I want, the setup was easy and I love it.
5. Anti-Virus / Anti-SpamYou got it on the nose. ClamAV and SpamAssassin is the way to go - I run that combination anywhere and everywhere and it's everything I want and/or need. The only thing I would mention is that if I had unlimited funds, I might replace ClamAV with Kaspersky's server engine. But I don't.
6. GreylistingPostgrey is a yes. Note the first four letters in postgrey - remind you of postfix? There's a reason. Use both.
7. Encryption / AuthenticationAs above, using TLS, SSL, SASL all happily with my combination - definitely the way to go.
8. amavisdNothing worth saying.
9. WebmailSquirrelMail rules and sucks simultaneously. It buckles under pressure, doesn't look very good and can be a pain in the
[Censored], but then again it's generally a decent Does What It Says on The Tin webmail system. Again, we use it at work, but you can never rely on it - eg, once a mailbox exceeds 400 messages here, squirrel just refuses to play.
There are a number of other options out there, but my recommendation is to just not bother. If someone needs access to mail remotely, instruct them on how to set up IMAP mail in a client anywhere and bob's your proverbial. If they don't have access to a mail client, then Mail2Web will do the job given the right information and it's much better than squirrelmail.
Ok, I'm off to breath now - any questions, things I didn't mention, things I need to clarify, points of discussion, let me know.
