← All write-ups

Mail Server

Mailcow: A Self-Hosted Mail Server

Jun 29, 2026~12 min readMailcow . Docker . Email
mailcow-dockerizedDocker ComposePostfixDovecotRspamdSOGo

Mailcow is a complete, self-hosted mail server packaged as a set of Docker containers — Postfix for sending, Dovecot for mailboxes, Rspamd for spam filtering, SOGo for webmail and groupware, plus a clean admin UI to tie it together. In the small-business stack it owns the most business-critical and, frankly, the most demanding service: email.

I run it as mailcow-dockerized on a dedicated Proxmox VM. This write-up covers why a company might run its own mail, how to deploy mailcow, the DNS and TLS that make email actually deliver, and — importantly — the responsibility that comes with operating your own mail server.

On this page
  1. Why run your own mail
  2. Preparing the host
  3. Installing mailcow
  4. DNS and TLS
  5. Adding domains and mailboxes
  6. What it solves for a business
  7. Running it responsibly

Why run your own mail

Email is the one service every business absolutely depends on, which is exactly why most outsource it to a provider. So why self-host? The same reasons that run through this whole stack: cost and control. Hosted mail is billed per mailbox per month, and every message — including sensitive internal and customer communication — lives on infrastructure someone else owns. Running your own means no per-mailbox fee, unlimited addresses and aliases, and full ownership of the data.

I will be honest about the trade, because email is the hardest thing here to run well. Deliverability is unforgiving — get your DNS or reputation wrong and your mail lands in spam or bounces. That is precisely why it belongs in a lab first: mailcow makes a genuinely hard problem approachable, but it does not make it trivial, and going in clear-eyed is the whole point of testing a solution before you rely on it.

01 Proxmox VM Debian + Docker 02 DNS MX . SPF . DKIM 03 Install compose up 04 mailcow mail suite 05 Domains mailboxes 06 Live mail SMTP + IMAP

Preparing the host

Give mailcow its own VM — do not share it with other services. A dedicated Debian VM on Proxmox with roughly 2 vCPUs, 6 GB of RAM, and a 40 GB+ disk is a sensible starting point (Rspamd and ClamAV are the memory-hungry parts). A few prerequisites matter before you install:

  • A fully qualified hostname for the mail server, such as mail.example.com.
  • The standard mail ports open to the VM (25, 465, 587, 993, 143, 80, 443).
  • Reverse DNS (PTR) for the public IP that matches the mail hostname — this is set at your hosting or ISP provider, and missing it is a common deliverability killer.

Install Docker Engine and the compose plugin, and set the hostname:

# Install Docker Engine + compose plugin on a fresh Debian VM
sudo apt update && sudo apt -y install curl git
curl -fsSL https://get.docker.com | sudo sh

# Set the system hostname to your mail FQDN
sudo hostnamectl set-hostname mail.example.com

Installing mailcow

With Docker in place, clone mailcow, generate its configuration, and bring the stack up. The config generator asks for your mail hostname and a couple of options, then writes a mailcow.conf you can tweak before launch:

# Clone mailcow and generate the configuration
sudo git clone https://github.com/mailcow/mailcow-dockerized /opt/mailcow-dockerized
cd /opt/mailcow-dockerized
sudo ./generate_config.sh      # prompts for mail.example.com

# Pull the images and start everything
sudo docker compose pull
sudo docker compose up -d

That brings up the full set of containers. The admin UI is then reachable over HTTPS at your mail hostname, where you log in with the default admin account (change that password immediately).

DNS and TLS

This is the part that makes or breaks email. Mail servers judge each other on DNS records that prove you are allowed to send, so these need to be correct before you send a single message:

; Core mail DNS for example.com
@        MX    10 mail.example.com.
mail     A        203.0.113.10
@        TXT      "v=spf1 mx ~all"
_dmarc   TXT      "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
; The DKIM key is generated inside mailcow and published as a TXT record

The records in plain terms: MX points mail for your domain at the server; SPF declares which hosts may send for you; DKIM (generated in the mailcow UI under the domain) cryptographically signs your outbound mail; and DMARC tells receivers what to do with mail that fails those checks. Mailcow handles TLS automatically, requesting Let’s Encrypt certificates for the hostname as long as ports 80 and 443 are reachable.

Adding domains and mailboxes

From the admin UI the day-to-day setup is quick:

  • Add your domain under Configuration, then generate its DKIM key and publish the TXT record it gives you.
  • Create mailboxes for each user, and aliases for shared addresses like support@ or info@.
  • Users get SOGo webmail out of the box — webmail plus shared calendars and contacts, which covers the groupware most small teams want.
  • Desktop and mobile clients connect over the standard secure ports: IMAP on 993 and SMTP submission on 465 or 587.

What it solves for a business

A working mailcow gives a small business its own communications platform:

  • Email and groupware together — mailboxes, shared calendars, and contacts without a separate subscription for each.
  • No per-mailbox fees — create as many addresses and aliases as you need.
  • Data ownership — internal and customer mail stays on infrastructure you control.
  • Strong spam and malware filtering — Rspamd and ClamAV are built in and genuinely good.
  • One coherent identity domain — the same @example.com that ties the business together across every other tool in the stack.

Running it responsibly

A mail server is exposed to the entire internet and carries the whole company correspondence, so it asks more of you than anything else in the stack:

  • Get the email auth right. SPF, DKIM, DMARC, and a matching PTR record are the difference between delivered mail and spam-foldered mail.
  • Keep it updated. Mailcow ships an update script; run it regularly, because an internet-facing mail server is a constant target.
  • Back it up. Mailcow includes a backup script — back up the mail data and config, and test a restore.
  • Enable two-factor on the admin UI and use strong, unique mailbox passwords.
  • Watch your reputation. Monitor blocklists and bounce rates so a problem surfaces before customers notice.
  • Plan for central identity. Mailcow can authenticate mailboxes against an external directory, so the roadmap is to tie logins to Active Directory over LDAP like the rest of the stack.

Wrap-up

Mailcow is the most demanding piece of the stack and also one of the most rewarding — a single VM gives a small business full email plus groupware on its own domain, with spam filtering that holds its own against the big providers. The catch is real: email rewards discipline around DNS, updates, and backups, and punishes neglect. Run it in a lab, learn where the sharp edges are, and it becomes a genuine alternative to paying per mailbox forever.