A very effective first step is to put it on a vhost with a domain you control, and drop traffic to the default vhost. 99.999% of scanners are just going through IPs looking for stuff, so don’t give them anything. Better yet, block any IP that scans you more than a dozen or so times.

Obviously some stuff will find you through cert issuance logs, but most of the bastards don’t bother with that level of sophistication.

Ah very nice, good to hear they addressed that. It was the only real deciding factor last time I moved my mail around ~2 yrs ago

Fastmail. It’s been around forever and it just works. And they don’t do anything weird with SMTP/IMAP.

mailbox dot org is also pretty good, but I wasn’t a fan of their 2FA implementation.