Mailcow: dockerized is an open source groupware/email suite based on docker.

mailcow relies on many well known and long used components, which in combination result in an all around carefree email server.

Each container represents a single application, connected in a bridged network:

• ACME Automatic generation of Let’s Encrypt certificates
• ClamAV Antivirus scanner (optional)
• Dovecot IMAP/POP server for retrieving e-mails
• MariaDB Database for storing user information etc.
• Memcached Cache for the webmailer SOGo
• Netfilter Fail2ban-like integration
• Nginx Web server for components of the stack
• Olefy Analysis of Office documents for viruses, macros, etc.
• PHP Programming language of most web-based mailcow applications
• Postfix MTA (Mail Transfer Agent) for e-mail traffic on the Internet
• Redis Storage for spam information, DKIM key, etc.
• Rspamd Spam filter with automatic learning of spam mails
• SOGo Integrated webmailer and Cal-/Carddav interface
• Solr Full text search for IMAP connections to quickly search emails (Deprecated) (Optional)
• Unbound Integrated DNS server for verifying DNSSEC etc.

But the heart of mailcow is the graphical web interface, the mailcow UI.

It offers a place for almost all settings and allows the comfortable creation of new domains and email addresses with just a few clicks.

But also other or more tricky tasks can be done in it with ease:

• DKIM and ARC support/generation.
• Black and white lists per domain and per user.
• Spam score management per user (reject spam, flag spam, greylist).
• Allow mailbox users to create temporary spam aliases
• Prepend email tags to subject or move emails to subfolders (per user)
• Allow mailbox users to toggle TLS enforcement for inbound and outbound messages
• Users can reset caches on SOGo ActiveSync devices
• imapsync to periodically migrate or retrieve remote mailboxes
• TFA: Yubikey OTP and WebAuthn USB (Google Chrome and derivatives only), TOTP
• Add whitelist hosts to forward mail to mailcow
• Fail2ban-like integration
• Quarantine system
• Anti-virus scanning including macro scanning in Office documents
• Integrated basic monitoring
• And much more…

Before you run mailcow: dockerized, there are a few requirements that you should check:

Minimum System Resources

Please make sure that your system has at least the following resources:

ClamAV and Solr can be greedy with RAM. You may disable them in mailcow.conf by settings SKIP_CLAMD=y and SKIP_SOLR=y.

RAM usage examples

A company with 15 phones (EAS enabled) and about 50 concurrent IMAP connections should plan 16 GiB RAM.

6 GiB RAM + 1 GiB swap are fine for most private installations while 8 GiB RAM are recommended for ~5 to 10 users.

We can help to correctly plan your setup as part of our support.

Supported OS

Basically, mailcow can be used on any distribution that is supported by Docker CE (see https://docs.docker.com/install/). However, in some cases there may be incompatibilities between the operating systems and the mailcow components.

The following table contains all operating systems officially supported and tested by us (as of June 2023):

Firewall & Ports

Please check if any of mailcow’s standard ports are open and not in use by other applications:

ss -tlpn | grep -E -w '25|80|110|143|443|465|587|993|995|4190'
# or:
netstat -tulpn | grep -E -w '25|80|110|143|443|465|587|993|995|4190'

If this command returns any results please remove or stop the application running on that port. You may also adjust mailcows ports via the mailcow.conf configuration file.

Default Ports

If you have a firewall in front of mailcow, please make sure that these ports are open for incoming connections:

To bind a service to an IP address, you can prepend the IP like this: SMTP_PORT=1.2.3.4:25

Important: You cannot use IP:PORT bindings in HTTP_PORT and HTTPS_PORT. Please use HTTP_PORT=1234 and HTTP_BIND=1.2.3.4 instead.

Important for Hetzner firewalls

Quoting https://github.com/chermsen via https://github.com/mailcow/mailcow-dockerized/issues/497#issuecomment-469847380 (THANK YOU!):

For all who are struggling with the Hetzner firewall:

Port 53 unimportant for the firewall configuration in this case. According to the documentation unbound uses the port range 1024-65535 for outgoing requests. Since the Hetzner Robot Firewall is a static firewall (each incoming packet is checked isolated) – the following rules must be applied:

For TCP

SRC-IP:       ---
DST IP:       ---
SRC Port:    ---
DST Port:    1024-65535
Protocol:    tcp
TCP flags:   ack
Action:      Accept

For UDP

SRC-IP:       ---
DST IP:       ---
SRC Port:    ---
DST Port:    1024-65535
Protocol:    udp
Action:      Accept

If you want to apply a more restrictive port range you have to change the config of unbound first (after installation):

{mailcow-dockerized}/data/conf/unbound/unbound.conf:

outgoing-port-avoid: 0-32767

Now the firewall rules can be adjusted as follows:

[...]
DST Port:  32768-65535
[...]

Date and Time

To ensure that you have the correct date and time setup on your system, please check the output of timedatectl status:

$ timedatectl status
      Local time: Sat 2017-05-06 02:12:33 CEST
  Universal time: Sat 2017-05-06 00:12:33 UTC
        RTC time: Sat 2017-05-06 00:12:32
       Time zone: Europe/Berlin (CEST, +0200)
     NTP enabled: yes
NTP synchronized: yes
 RTC in local TZ: no
      DST active: yes
 Last DST change: DST began at
                  Sun 2017-03-26 01:59:59 CET
                  Sun 2017-03-26 03:00:00 CEST
 Next DST change: DST ends (the clock jumps one hour backwards) at
                  Sun 2017-10-29 02:59:59 CEST
                  Sun 2017-10-29 02:00:00 CET

The lines NTP enabled: yes and NTP synchronized: yes indicate whether you have NTP enabled and if it’s synchronized.

To enable NTP you need to run the command timedatectl set-ntp true. You also need to edit your /etc/systemd/timesyncd.conf:

# vim /etc/systemd/timesyncd.conf
[Time]
NTP=0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org

Hetzner Cloud (and probably others)

Check /etc/network/interfaces.d/50-cloud-init.cfg and change the IPv6 interface from eth0:0 to eth0:

# Wrong:
auto eth0:0
iface eth0:0 inet6 static
# Right:
auto eth0
iface eth0 inet6 static

Reboot or restart the interface. You may want to disable cloud-init network changes.

MTU

Especially relevant for OpenStack users: Check your MTU and set it accordingly in docker-compose.yml. See Troubleshooting in our Installation guide.

DNS setup

Below you can find a list of recommended DNS records. While some are mandatory for a mail server (A, MX), others are recommended to build a good reputation score (TXT/SPF) or used for auto-configuration of mail clients (SRV).

References

• A good article covering all relevant topics: “3 DNS Records Every Email Marketer Must Know”
• Another great one, but Zimbra as an example platform: “Best Practices on Email Protection: SPF, DKIM and DMARC”
• An in-depth discussion of SPF, DKIM and DMARC: “How to eliminate spam and protect your name with DMARC”
• A thorough guide on understanding DMARC: “Demystifying DMARC: A guide to preventing email spoofing”

Reverse DNS of your IP address

Make sure that the PTR record of your IP address matches the FQDN of your mailcow host: ${MAILCOW_HOSTNAME} ¹. This record is usually set at the provider you leased the IP address (server) from.

The minimal DNS configuration

This example shows you a set of records for one domain managed by mailcow. Each domain that is added to mailcow needs at least this set of records to function correctly.

# Name              Type       Value
mail                IN A       1.2.3.4
autodiscover        IN CNAME   mail.example.org. (your ${MAILCOW_HOSTNAME})
autoconfig          IN CNAME   mail.example.org. (your ${MAILCOW_HOSTNAME})
@                   IN MX 10   mail.example.org. (your ${MAILCOW_HOSTNAME})

Note: The mail DNS record which binds the subdomain to the given ip address must only be set for the domain on which mailcow is running and that is used to access the web interface. For every other mailcow managed domain, the MX record will route the traffic.

DKIM, SPF and DMARC

In the example DNS zone file snippet below, a simple SPF TXT record is used to only allow THIS server (the MX) to send mail for your domain. Every other server is disallowed but able to (“~all“). Please refer to SPF Project for further reading.

# Name              Type       Value
@                   IN TXT     "v=spf1 mx a -all"

It is highly recommended to create a DKIM TXT record in your mailcow UI and set the corresponding TXT record in your DNS records. Please refer to OpenDKIM for further reading.

# Name              Type       Value
dkim._domainkey     IN TXT     "v=DKIM1; k=rsa; t=s; s=email; p=..."

The last step in protecting yourself and others is the implementation of a DMARC TXT record, for example by using the DMARC Assistant (check).

# Name              Type       Value
_dmarc              IN TXT     "v=DMARC1; p=reject; rua=mailto:[email protected]"

The advanced DNS configuration

SRV records specify the server(s) for a specific protocol on your domain. If you want to explicitly announce a service as not provided, give “.” as the target address (instead of “mail.example.org.”). Please refer to RFC 2782.

# Name              Type       Priority Weight Port    Value
_autodiscover._tcp  IN SRV     0        1      443      mail.example.org. (your ${MAILCOW_HOSTNAME})
_caldavs._tcp       IN SRV     0        1      443      mail.example.org. (your ${MAILCOW_HOSTNAME})
_caldavs._tcp       IN TXT                              "path=/SOGo/dav/"
_carddavs._tcp      IN SRV     0        1      443      mail.example.org. (your ${MAILCOW_HOSTNAME})
_carddavs._tcp      IN TXT                              "path=/SOGo/dav/"
_imap._tcp          IN SRV     0        1      143      mail.example.org. (your ${MAILCOW_HOSTNAME})
_imaps._tcp         IN SRV     0        1      993      mail.example.org. (your ${MAILCOW_HOSTNAME})
_pop3._tcp          IN SRV     0        1      110      mail.example.org. (your ${MAILCOW_HOSTNAME})
_pop3s._tcp         IN SRV     0        1      995      mail.example.org. (your ${MAILCOW_HOSTNAME})
_sieve._tcp         IN SRV     0        1      4190     mail.example.org. (your ${MAILCOW_HOSTNAME})
_smtps._tcp         IN SRV     0        1      465      mail.example.org. (your ${MAILCOW_HOSTNAME})
_submission._tcp    IN SRV     0        1      587      mail.example.org. (your ${MAILCOW_HOSTNAME})

Testing

Here are some tools you can use to verify your DNS configuration:

• MX Toolbox (DNS, SMTP, RBL)
• port25.com (DKIM, SPF)
• Mail-tester (DKIM, DMARC, SPF)
• DMARC Analyzer (DMARC, SPF)
• MultiRBL.valli.org (DNSBL, RBL, FCrDNS)

Misc

Optional DMARC Statistics

If you are interested in statistics, you can additionally register with some of the many below DMARC statistic services – or self-host your own.

It is worth mentioning, that the following suggestions are not a comprehensive list of all services and tools available, but only a small few of the many choices.

• Postmaster Tool
• parsedmarc (self-hosted)
• Fraudmarc
• Postmark
• Dmarcian

Email test for SPF, DKIM and DMARC:

To run a rudimentary email authentication check, send a mail to check-auth at verifier.port25.com and wait for a reply. You will find a report similar to the following:

==========================================================
Summary of Results
==========================================================
SPF check:          pass
"iprev" check:      pass
DKIM check:         pass
DKIM check:         pass
SpamAssassin check: ham

==========================================================
Details:
==========================================================
....

The full report will contain more technical details.

Fully Qualified Domain Name (FQDN)

curl -sSL https://get.docker.com/ | CHANNEL=stable sh
# After the installation process is finished, you may need to enable the service and make sure it is started (e.g. CentOS 7)
systemctl enable --now docker

apt update
apt install docker-compose-plugin

yum update
yum install docker-compose-plugin

LATEST=$(curl -Ls -w %{url_effective} -o /dev/null https://github.com/docker/compose/releases/latest) && LATEST=${LATEST##*/} && curl -L https://github.com/docker/compose/releases/download/$LATEST/docker-compose-$(uname -s)-$(uname -m) > /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose

rpm -qa | grep container-selinux

docker info | grep selinux

{
  "selinux-enabled": true
}

$ su
# umask
0022 # <- Verify it is 0022
# cd /opt
# git clone https://github.com/mailcow/mailcow-dockerized
# cd mailcow-dockerized

./generate_config.sh

nano mailcow.conf

networks:
  mailcow-network:
    ...
    driver_opts:
      com.docker.network.driver.mtu: 1450
    ...

docker compose pull
docker compose up -d