I have read multiple Q&A's on this topic from here and other SE sites. They all mention self-signed certs are not recommended due to MITM attacks. However, I haven't found anything with mention of creating your own CA and issuing certs for your servers.
My question expands on this topic, as I want to know if creating your own CA and issuing certs for your server reduces the possibility of a MITM attack. I would keep the CA private key locally to prevent anyone from generating additional certs. By being my own CA, I can verify in the certificate that it is indeed me who generated it and that the traffic is not "spoofed". I would copy the CA pub key to all my devices so the warning message wouldn't pop up anymore.
Although this brings up another question, can the attack create his own CA using my information entered, and generate a SSL key too to trick me? How does having a signed certificate differ at this point?
It seems to me that being your own CA or using a trusted CA does not differ much if the attacker has control of the mail server.