Open source changes the cold-email buying decision from subscription versus subscription to product fee versus operational ownership. The code may be free, but mailbox authentication, secrets, upgrades, queue reliability, bounce handling, suppression, observability, and incident response become part of your stack.
Four projects, four different jobs
Quickly most closely resembles a conventional self-hosted sequencer: multiple inboxes, campaigns, A/B tests, reply classification, webhooks, and API access. Pigeon aims at a broader platform surface with sequences, warm-up, tracking, lead workflows, an operator console, and Docker deployment. Coldflow is earlier and narrower, emphasizing authentication checks, SMTP inboxes, CSV contacts, safe limits, and basic sequences.
OpenOutreach is different. It is an agent-led CLI that starts from an ICP description, discovers and qualifies leads, explains why each lead fits, resolves an address through an external provider, and sends a paced opener. Compare it with research and orchestration tools, not only dashboard-based sequencers.
The real self-hosting checklist
Start with release activity, issue response, license, deployment documentation, migration discipline, authentication, secret storage, backups, unsubscribe handling, suppression, bounce and complaint processing, per-mailbox limits, and an audit trail. A polished README is not production evidence.
Also identify every external dependency. An open-source orchestrator may still require a contact-data provider, model API, email-validation service, hosted database, browser-automation service, or transactional email account. Price and failure-test those dependencies as part of the product.
- Can you restore the database and campaign state?
- Are secrets encrypted and scoped?
- Do replies, bounces, complaints, and unsubscribes stop future sends?
- Can every send be traced to a mailbox and rule?
- Who patches dependencies and monitors the queue?
Deliverability does not become open source
Owning the application does not exempt the sender from recipient-provider rules. Google requires authentication, valid forward and reverse DNS for sending infrastructure, TLS, standards-compliant messages, and spam rates below its published threshold; bulk senders face additional DMARC alignment and unsubscribe requirements. Self-hosting gives you control over enforcement, but it also removes the vendor team that might otherwise surface a dangerous configuration.
When open source is the better answer
Choose it when data control, extensibility, custom workflow logic, or learning value outweighs the cost of operating another production service. Stay with managed software when the team cannot own updates, sender policy, observability, and support. A fair proof of concept runs one small internal campaign, validates every stop condition, restores from backup, rotates credentials, and measures the human maintenance time before wider adoption.