mailcow: dockerized bundles everything a modern mail server needs into Docker containers: Postfix (SMTP), Dovecot (IMAP), rspamd (spam filtering and DKIM signing), ClamAV, SOGo (webmail, calendar and contacts), ACME certificates, and a clean admin UI. It’s one of the most popular ways to self-host email for a company or family, with far less manual configuration than building it from scratch.

Prefer manual setup or a simpler bundle? See Postfix and Dovecot and Mail-in-a-Box.

Before you start: the mail server checklist

  • Outbound port 25 must be open on your server, so you can deliver mail. On VPS.DO, sending mail is supported on USA VPS plans. See email VPS.
  • Reverse DNS (PTR) for the server IP, set to the mail hostname (e.g. mail.example.com). On VPS.DO USA plans, you set this in the client area. See PTR records.
  • A clean IP. Check blocklists before starting. See IP blacklists.
  • Resources: at least 6 GB RAM recommended (ClamAV and rspamd are memory-hungry), 2+ vCPU, and 20+ GB disk plus mail storage. ClamAV can be disabled on smaller servers.
  • A dedicated server or VPS for mail only. Don’t share it with other web apps on ports 80/443 unless you configure a reverse proxy.

1. DNS records

For example.com, with the mail server at mail.example.com (203.0.113.25):

mail.example.com.          A      203.0.113.25
example.com.               MX     10 mail.example.com.
autodiscover.example.com.  CNAME  mail.example.com.
autoconfig.example.com.    CNAME  mail.example.com.
example.com.               TXT    "v=spf1 mx -all"
_dmarc.example.com.        TXT    "v=DMARC1; p=none; rua=mailto:[email protected]"

The DKIM record comes from the mailcow UI after installation. See MX records and SPF, DKIM and DMARC.

2. Install

Install Docker and the Compose plugin first. See install Docker. Then:

sudo -i
cd /opt
git clone https://github.com/mailcow/mailcow-dockerized
cd mailcow-dockerized
./generate_config.sh          # asks for the hostname (mail.example.com) and timezone
docker compose pull
docker compose up -d

Make sure nothing else uses ports 25, 80, 110, 143, 443, 465, 587, 993, 995 and 4190. Open them in the firewall. mailcow requests Let’s Encrypt certificates automatically for the hostname, and for autodiscover/autoconfig.

3. Initial configuration

Open https://mail.example.com/admin. The default login is admin / moohoo. Change it immediately, and enable 2FA for the admin.

  1. Configuration → Mail setup → Domains: add example.com.
  2. ARC/DKIM keys: generate a 2048-bit DKIM key for the domain, and publish the shown TXT record (dkim._domainkey.example.com).
  3. Mailboxes: create users. They log in to webmail at https://mail.example.com/SOGo.
  4. Aliases, catch-alls, and forwarding as needed.

4. Test deliverability

  • Send a message to a Gmail account, and check “Show original” for SPF, DKIM and DMARC PASS.
  • Score your setup at mail-tester.com.
  • Check TLS and DNS with mailcow’s built-in DNS check for each domain.

See email deliverability.

Clients

Users configure IMAP (993) and SMTP submission (587 or 465) in any mail client. Autodiscover and autoconfig records let Outlook, Thunderbird and phones set themselves up. SOGo provides webmail plus CalDAV and CardDAV for calendars and contacts. See SMTP ports.

Spam and security

  • rspamd learns from users moving mail to and from Junk. Its web UI is under the admin’s configuration menu.
  • Enable 2FA for users, and enforce strong passwords.
  • mailcow includes Netfilter (fail2ban-like) banning for brute force.
  • Keep an eye on the outgoing queue. A compromised mailbox sending spam ruins IP reputation quickly. See brute-force protection.

Backups

mailcow ships a backup helper:

cd /opt/mailcow-dockerized
MAILCOW_BACKUP_LOCATION=/backups/mailcow ./helper-scripts/backup_and_restore.sh backup all

Schedule it via cron, and copy the backups off-server. Mail is often business-critical. See backup strategy.

Updates

cd /opt/mailcow-dockerized
./update.sh

Run updates regularly (they include security fixes), and read the changelog first. See updating self-hosted apps.

Quick reference

Item Value
Admin UI https://mail.example.com/admin (change the default password!)
Webmail /SOGo
Install generate_config.sh → docker compose up -d
Update ./update.sh
Backup helper-scripts/backup_and_restore.sh backup all
Ports 25, 465, 587, 143, 993, 110, 995, 4190, 80, 443

Related: SMTP security and Roundcube webmail.

  • Email
  • Self-Hosting
  • Docker