What back-end mail server software do you use?
We use Postfix for SMTP, Dovecot for IMAP and POP, OpenDKIM and OpenDMARC for signing messages and checking incoming messages against foreign domains' published DMARC policies, and amavisd-new, ClamAV and SpamAssassin to scan incoming mail for spam and viruses. User credentials are maintained in a MariaDB database, with passwords stored as salted hashes. Our account management web app is PostfixAdmin, and our hosted webmail app is Roundcube.