Skip to main contentSkip to navigation
[email protected]
Client AreaSupport
Hosting Mammoth
HostingMammothYour Data, Our Responsibility
Home
Solutions
Hosting Services
Store
Pricing
About
Blog
API
Contact

Stay Ahead of the Curve

Get the latest insights on cybersecurity, AI innovations, and enterprise data solutions delivered to your inbox.

Hosting Mammoth
HostingMammothEnterprise Solutions

Enterprise-grade data solutions. Hosting, recovery, cybersecurity, and AI-powered services for businesses worldwide.

[email protected]
Sun - Fri, 9:00am - 5:00pm

Services

  • Cloud Hosting
  • Data Recovery
  • Cybersecurity
  • Legal Support
  • MSP Services
  • Web Development
  • AI Services
  • Free Server Migration

Hosting

  • VPS Hosting (NVMe SSD)
  • VDS Hosting (NVMe)
  • Storage VPS (High SSD)
  • GPU Servers
  • Managed Services
  • Cloud Firewall
  • Load Balancer
  • One-Click Apps
  • n8n Hosting
  • Object Storage
  • FAQ

Company

  • Store
  • Pricing
  • About Us
  • Locations
  • Blog
  • Testimonials
  • Contact
  • Affiliate Program
  • White-Label
  • Terms of Service
  • Privacy Policy
  • Browser Cookies
  • SLA

Support

  • Client Area
  • Submit Ticket
  • Knowledge Base
  • Server Status
  • API Documentation

© 2026 Hosting Mammoth. All rights reserved.

Knowledge Base
Getting StartedAccount ManagementVPS HostingGPU ServersStorage VPSCloud FirewallLoad BalancerServer ManagementBilling & PaymentsSupport & TicketsAffiliate ProgramReseller ProgramMarketplace & Appsn8n HostingManaged ServicesServer MigrationAPI & DevelopersSecurityTroubleshootingGlossaryInstall Guides
  1. Home
  2. /
  3. Support
  4. /
  5. Install Guides
  6. /
  7. How To Install Mailcow Ubuntu
GUIDEInstall Guides

How to Install Mailcow on Ubuntu 24.04 VPS: Full-Featured Self-Hosted Email Server

27 min read

How to Install Mailcow on Ubuntu 24.04 VPS: Full-Featured Self-Hosted Email Server

Running your own email server used to be a punishing exercise in Postfix manuals, Dovecot configuration files, SpamAssassin rule tuning, and endless blocklist appeals. Mailcow Dockerized changed that. It bundles every component you need for a modern mail stack — Postfix, Dovecot, SOGo webmail, Rspamd, ClamAV, Redis, MariaDB, Nginx, and automated Let's Encrypt — into a single docker compose project that you control through one polished admin UI.

This guide walks you through a production-ready Mailcow install on an Ubuntu 24.04 VPS, from DNS records to your first successfully delivered message with a 10/10 score at mail-tester.com.

Email deliverability starts with the right VPS. Mailcow needs a clean IPv4 address, unblocked port 25, and editable reverse DNS. Our CloudCore Business plan gives you all three plus the RAM headroom Rspamd and ClamAV need to run comfortably.

Table of Contents

  • What is Mailcow?
  • Why Self-Host Email on Your VPS?
  • Prerequisites
  • Step 1: Configure DNS Records First
  • Step 2: Set Reverse DNS (PTR) at Your VPS Provider
  • Step 3: Update System Packages
  • Step 4: Install Docker and Docker Compose
  • Step 5: Clone the Mailcow Repository
  • Step 6: Generate the Mailcow Configuration
  • Step 7: Review and Edit mailcow.conf
  • Step 8: Pull Images and Start the Stack
  • Step 9: Access the Admin UI and Change Default Credentials
  • Step 10: Add Your Domain, DKIM Key, and First Mailbox
  • Step 11: Publish the DKIM Record in DNS
  • Step 12: Test Deliverability with mail-tester.com
  • Post-Install: SOGo Webmail, Mobile Sync, and ActiveSync
  • Hardening: fail2ban, Quarantine, and Rspamd Tuning
  • Backup and Upgrades
  • Troubleshooting
  • FAQ
  • Next Steps
  • What is Mailcow?

    Mailcow Dockerized is an open-source email server suite maintained by Servercow (a German hosting provider) and a large community of contributors. Instead of installing and wiring together each mail component by hand, Mailcow ships a curated docker compose stack where every piece is configured to work with the others out of the box.

    The stack includes Postfix for SMTP (inbound and outbound mail transfer), Dovecot for IMAP/POP3 and Sieve filtering, SOGo for browser-based webmail, calendars, contacts, and ActiveSync, Rspamd for spam filtering, ClamAV for antivirus scanning, MariaDB for mailbox metadata, Redis for caching and rate limits, Nginx as the front-end web server, Unbound as a local recursive DNS resolver, PHP-FPM for the admin UI, and an ACME client that handles Let's Encrypt certificate issuance and renewal automatically.

    The admin UI is the centerpiece. From a single browser tab you can add domains, create mailboxes, generate DKIM keys, configure relayhosts, set quotas, manage aliases, view Rspamd scores for every inbound message, release or reject quarantined mail, inspect logs for every container, and toggle features like OAuth2, SAML SSO, fail2ban, and XMPP. There are no config files to edit once the stack is running for day-to-day operations.

    Mailcow gives you feature parity with the core of Google Workspace and Microsoft 365 for mail: IMAP/SMTP with TLS, webmail, shared calendars (CalDAV), shared address books (CardDAV), mobile sync via ActiveSync (iOS Mail, Outlook mobile, Android), push notifications, aliases, catch-all addresses, domain-wide filters, per-user Sieve rules, quota management, and granular spam controls. The administrative overhead is a few minutes per week instead of the tens of hours a hand-rolled Postfix/Dovecot stack typically demands.

    Why Self-Host Email on Your VPS?

    Running your own mail server on a VPS instead of paying per-mailbox fees to Google or Microsoft offers concrete advantages:

    • Flat cost per mailbox -- Google Workspace Business Standard runs EUR 12/user/month. A 20-person team pays EUR 240/month. A single CloudCore Business VPS hosts hundreds of mailboxes at a flat rate.
    • Complete privacy -- Your customers' contracts, invoices, and personal correspondence stay on infrastructure you control. No third-party scans the content of your messages for ad targeting or model training.
    • Unlimited aliases and catch-alls -- Most SaaS providers charge per alias. Mailcow gives you unlimited aliases, domain-level catch-alls, and regex-based routing.
    • Unlimited domains on one server -- Host 1 domain or 100 domains on the same Mailcow instance at no extra cost.
    • Full control over spam filtering -- Tune Rspamd rules, greylisting thresholds, and DNSBL checks to match your tolerance. Release false positives instantly.
    • Data sovereignty -- Choose where your data lives. For EU businesses, an EU-hosted Mailcow server simplifies GDPR compliance end to end.
    • No vendor lock-in -- IMAP, SMTP, CalDAV, CardDAV, ActiveSync — all open standards. Export, import, or migrate freely.
    • Rich integrations -- Rspamd API, Mailcow API, webhooks, and full access to every log and configuration file make Mailcow a great fit for automated provisioning, CRM sync, and helpdesk integrations.

    Cost Comparison: Self-Hosted Mailcow vs. Hosted Email

    ScenarioGoogle WorkspaceMicrosoft 365 BusinessSelf-Hosted Mailcow (VPS)
    Cost per user per month~EUR 12~EUR 11EUR 0 (unlimited on one plan)
    10 mailboxes / monthEUR 120EUR 110EUR 24.99 (flat)
    50 mailboxes / monthEUR 600EUR 550EUR 24.99 (flat)
    Custom domains1 included, extra paid1 includedUnlimited
    Aliases per userLimitedLimitedUnlimited
    Storage per user30 GB50 GBLimited only by VPS disk
    Data processorGoogleMicrosoftYou
    For any team above a handful of users, self-hosting pays for itself within the first month — and you stop paying escalating per-seat prices as you grow.

    Prerequisites

    Before you begin, make sure you have:

    • A VPS running Ubuntu 24.04 LTS with root or sudo access
    • At least 6 GB of RAM (ClamAV + Rspamd + Solr are the heaviest containers; 8 GB is comfortable)
    • At least 40 GB of free disk space (mail storage grows quickly — 100 GB+ recommended for teams)
    • A clean, dedicated IPv4 address that is not listed on major blocklists (check here)
    • Outbound port 25 open at your provider (many cloud providers block it by default — ask support to unblock)
    • Ability to edit reverse DNS (PTR) for your VPS IP
    • A domain name you control, with access to edit DNS records
    • SSH access to your server
    Recommended Plan: CloudCore Business
    >
    For a production Mailcow server running 20-100 mailboxes, we recommend the CloudCore Business plan:
    >
    - 8 vCPU cores
    - 16 GB RAM
    - 200 GB NVMe SSD
    - Clean, unblocklisted IPv4 address
    - Port 25 open by default
    - Editable reverse DNS
    - EUR 24.99/month
    >
    This gives Rspamd, ClamAV, and Solr plenty of headroom and leaves ~150 GB for mail storage. For smaller teams (under 15 mailboxes), CloudCore Professional is sufficient.

    Connect to your server via SSH to get started:

    bash
    ssh root@your-server-ip

    Step 1: Configure DNS Records First

    DNS is the single most important part of running a mail server. Misconfigured records cause the majority of deliverability problems. Set these up before you install Mailcow so that by the time the stack is running, DNS propagation is already done.

    Assume your mail server hostname will be mail.example.com and your VPS public IP is 203.0.113.50.

    Required Records

    RecordHostTypeValuePurpose
    AmailA203.0.113.50Points mail.example.com to your VPS
    AAAA (optional)mailAAAA2001:db8::1IPv6 address for mail.example.com
    MX@MX10 mail.example.com.Tells the internet where mail for example.com goes
    AutodiscoverautodiscoverCNAMEmail.example.com.Helps Outlook auto-configure
    AutoconfigautoconfigCNAMEmail.example.com.Helps Thunderbird auto-configure
    SPF@TXTv=spf1 mx ~allAuthorizes your MX to send mail for the domain
    DMARC_dmarcTXTv=DMARC1; p=quarantine; rua=mailto:[email protected]Tells receivers what to do with failing mail
    DKIMdkim._domainkeyTXT(filled in after Step 10)Signs outbound mail cryptographically

    Important DNS Notes

    • MX priority -- 10 is fine for a single mail server. Lower values mean higher priority if you add backup MXes later.
    • SPF -- Keep it minimal. v=spf1 mx ~all says "only the servers listed as MX for this domain are allowed to send on its behalf." If you also send through a transactional service (like Amazon SES), add it: v=spf1 mx include:amazonses.com ~all. A single domain can only have one SPF TXT record — never create two.
    • DMARC -- Start with p=quarantine (failing mail goes to spam) rather than p=reject. Move to p=reject once you have confirmed SPF + DKIM pass reliably for a few weeks.
    • TLSA (optional, advanced) -- If you want DANE-TLSA for verified TLS, publish a TLSA record that matches the hash of your Let's Encrypt certificate. Most hosts do not need this.
    Propagation typically takes 5-30 minutes. Confirm the records are live:

    bash
    dig +short mail.example.com A
    dig +short example.com MX
    dig +short example.com TXT
    dig +short _dmarc.example.com TXT

    Step 2: Set Reverse DNS (PTR) at Your VPS Provider

    The PTR record (reverse DNS) maps your IPv4 address back to mail.example.com. Major mail receivers (Gmail, Outlook, Yahoo) reject or deeply penalize mail from servers whose IP does not reverse to match the HELO hostname. You cannot set PTR from inside your VPS — it must be configured at your provider's control panel.

    For vps-server.host customers, open the VPS management panel, navigate to Networking > Reverse DNS, and set:

    • IP: 203.0.113.50
    • PTR hostname: mail.example.com
    Verify it from your VPS:

    bash
    dig +short -x 203.0.113.50

    Expected output:

    text
    mail.example.com.

    If it returns a generic provider hostname (like vps-xxx.example-host.net), Gmail will flag every message you send. Do not skip this step.

    Step 3: Update System Packages

    Start by updating your package index and upgrading installed packages. This ensures you have the latest security patches and kernel before Docker installs.

    bash
    sudo apt update && sudo apt upgrade -y

    If your kernel was updated, reboot before continuing:

    bash
    sudo reboot

    Then reconnect via SSH after a minute.

    Mailcow's own installer requires a few basic tools. Install them now:

    bash
    sudo apt install -y curl git ca-certificates gnupg lsb-release

    Step 4: Install Docker and Docker Compose

    Mailcow runs entirely as Docker containers, so Docker Engine and the Compose plugin are mandatory. Install the official Docker packages (not the docker.io Ubuntu package, which ships with an older version).

    For the full walkthrough, see our guide on how to install Docker on Ubuntu 24.04. The quick version:

    bash
    curl -fsSL https://get.docker.com | sh

    This script adds Docker's APT repository, installs Docker Engine, the CLI, containerd, and the docker compose plugin, and enables the docker systemd service.

    Verify the installation:

    bash
    docker --version
    docker compose version

    Expected output:

    text
    Docker version 27.5.0, build a187fa5
    Docker Compose version v2.32.1

    For more detail on docker compose commands used throughout this guide, see how to install Docker Compose on Ubuntu.

    Step 5: Clone the Mailcow Repository

    Mailcow is distributed as a Git repository containing the compose file, helper scripts, and configuration templates. Clone it into /opt, which is the conventional location recommended by the Mailcow docs.

    bash
    cd /opt
    sudo git clone https://github.com/mailcow/mailcow-dockerized.git
    cd mailcow-dockerized

    All subsequent commands in this guide assume you are in /opt/mailcow-dockerized.

    List the directory to confirm the clone succeeded:

    bash
    ls -la

    You should see generate_config.sh, docker-compose.yml, update.sh, helper-scripts/, data/, and several other files.

    Step 6: Generate the Mailcow Configuration

    Mailcow ships with an interactive script that creates the main configuration file (mailcow.conf) based on your inputs.

    bash
    sudo ./generate_config.sh

    You will be prompted for the mail server FQDN:

    text
    Mail server hostname (FQDN) - this is not your mail domain, but your mail server's hostname: mail.example.com

    Enter the same hostname you set in DNS and reverse DNS (mail.example.com). The script then generates strong random passwords for the database, DBMail, API, and other internal services, and writes mailcow.conf to the current directory.

    Expected output (abbreviated):

    text
    [INFO] - Fetching new mailcow-dockerized bootstrap...
    [INFO] - Timezone is Europe/Berlin
    [INFO] - Generated mailcow.conf successfully.

    Step 7: Review and Edit mailcow.conf

    Open the generated config and review each value. Most defaults are sane, but a few deserve attention.

    bash
    sudo nano mailcow.conf

    Key variables to check or adjust:

    • MAILCOW_HOSTNAME=mail.example.com -- Must match your DNS A record and PTR record exactly.
    • MAILCOW_TZ=Europe/Berlin -- Set to your preferred timezone. Run timedatectl list-timezones | grep -i your-city to find the right string.
    • HTTP_PORT=80 and HTTPS_PORT=443 -- Default. Change only if you run another web server on the same IP (you probably should not — Mailcow handles its own Nginx).
    • HTTP_BIND= and HTTPS_BIND= -- Leave empty to bind all interfaces. Set to a specific IP if the server has multiple addresses.
    • SMTP_PORT=25, SMTPS_PORT=465, SUBMISSION_PORT=587, IMAP_PORT=143, IMAPS_PORT=993, POP_PORT=110, POPS_PORT=995, SIEVE_PORT=4190 -- Leave at standard mail protocol ports.
    • SNAT_TO_SOURCE= -- Optional. Set to your public IPv4 if outbound mail needs to egress from a specific address (useful on hosts with multiple IPs).
    • SNAT6_TO_SOURCE= -- Same idea for IPv6.
    • SKIP_LETS_ENCRYPT=n -- Leave as n so Mailcow auto-provisions Let's Encrypt certificates for mail.example.com.
    • SKIP_CLAMD=n -- Set to y only if you are RAM-constrained. ClamAV uses ~1-2 GB but catches attachment-based malware.
    • SKIP_SOLR=n -- Set to y if you do not need full-text search in webmail. Solr uses another ~1 GB RAM.
    • USE_WATCHDOG=y -- Keep enabled. Mailcow's watchdog container monitors all other services and alerts on failure.
    Save (Ctrl+O, Enter) and exit (Ctrl+X).

    Step 8: Pull Images and Start the Stack

    Download all the Docker images for the Mailcow stack. The first pull is ~3-4 GB and takes a few minutes depending on bandwidth.

    bash
    sudo docker compose pull

    Then bring the stack up in detached mode:

    bash
    sudo docker compose up -d

    Expected output (abbreviated):

    text
    [+] Running 21/21
     ✔ Container mailcowdockerized-unbound-mailcow-1            Started
     ✔ Container mailcowdockerized-mysql-mailcow-1              Started
     ✔ Container mailcowdockerized-redis-mailcow-1              Started
     ✔ Container mailcowdockerized-rspamd-mailcow-1             Started
     ✔ Container mailcowdockerized-php-fpm-mailcow-1            Started
     ✔ Container mailcowdockerized-postfix-mailcow-1            Started
     ✔ Container mailcowdockerized-dovecot-mailcow-1            Started
     ✔ Container mailcowdockerized-nginx-mailcow-1              Started
     ✔ Container mailcowdockerized-sogo-mailcow-1               Started
     ✔ Container mailcowdockerized-acme-mailcow-1               Started
     ✔ Container mailcowdockerized-watchdog-mailcow-1           Started
     ...

    Wait about 60 seconds for all services to finish initializing, then check their status:

    bash
    sudo docker compose ps

    Every container should show running (healthy) or running. If any are stuck in restarting, check its logs:

    bash
    sudo docker compose logs <service-name>

    Step 9: Access the Admin UI and Change Default Credentials

    Open a browser and navigate to:

    text
    https://mail.example.com

    You may see a browser warning for the first few minutes — that is the self-signed bootstrap certificate before Let's Encrypt completes. Refresh a few minutes later and you should see a valid certificate issued by Let's Encrypt.

    Log in with the default admin credentials:

    • Username: admin
    • Password: moohoo
    Change these immediately. Every Mailcow install ships with the same default password. Leaving it unchanged for even a few hours exposes your server to automated scanners.

    Navigate to System > Configuration > Access > Administrators, click the pencil icon next to admin, and set a new strong password. Optionally create a second admin account as backup and delete the default admin username entirely (replace it with one of your own).

    While you are in the configuration area, enable two-factor authentication under your user's profile for the admin account — Mailcow supports WebAuthn (hardware keys) and TOTP (Authenticator apps).

    Step 10: Add Your Domain, DKIM Key, and First Mailbox

    Now add the domain Mailcow will serve mail for.

    Add the Domain

    Go to Email > Configuration > Domains > Add domain.

    • Domain: example.com
    • Description: Company Mail
    • Aliases: 400 (default)
    • Mailboxes: 10 (default, raise as needed)
    • Default mailbox quota: 3072 MB (3 GB)
    • Maximum mailbox quota: 10240 MB (10 GB)
    Click Add domain and restart SOGo.

    Generate a DKIM Key

    Go to Email > Configuration > Configuration & Details > ARC/DKIM keys.

    • Domain: example.com
    • Selector: dkim
    • Key size: 2048
    Click Add. Mailcow will generate a keypair and display the public key you need to publish in DNS. Leave this page open — you will use the displayed value in Step 11.

    Create the First Mailbox

    Go to Email > Configuration > Mailboxes > Add mailbox.

    • Username: john
    • Domain: example.com (full address becomes [email protected])
    • Full name: John Doe
    • Password: Set a strong password (or let the user set it via SOGo first-login)
    • Quota: 3072 MB
    Save. The user can now log in to SOGo at https://mail.example.com/SOGo with [email protected] and the password you set.

    Step 11: Publish the DKIM Record in DNS

    Back in Configuration & Details > ARC/DKIM keys, click the domain row to expand the public key. You will see a long string that looks like:

    text
    v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

    Copy the entire value. In your DNS provider, add a TXT record:

    • Host: dkim._domainkey
    • Type: TXT
    • Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
    • TTL: 3600
    If your DNS provider's UI splits long TXT values across multiple quoted strings, that is fine — DNS resolvers concatenate them automatically.

    Wait 5-10 minutes for propagation, then verify:

    bash
    dig +short dkim._domainkey.example.com TXT

    Or use Mailcow's built-in check: next to the DKIM entry in the admin UI, click the DNS check icon — it queries your DNS and confirms the record matches.

    Step 12: Test Deliverability with mail-tester.com

    Now for the moment of truth. Log in to SOGo as [email protected] and send a test message.

  • Visit mail-tester.com and copy the unique test address (for example, [email protected]).
  • From SOGo, compose a new message with a meaningful subject, two or three sentences of plain text, and no links or attachments. Send it to the test address.
  • Return to mail-tester.com and click Then check your score.
  • A properly configured Mailcow server with valid SPF, DKIM, DMARC, PTR, and TLS should score 10/10. If you see deductions, the report breaks down exactly which record or signature is missing — usually an SPF typo or a slow-propagating DKIM.

    Send a second test to a Gmail address you own and confirm the message lands in the inbox (not spam). Click Show original in Gmail to inspect the Authentication-Results header. You should see spf=pass, dkim=pass, and dmarc=pass.

    Post-Install: SOGo Webmail, Mobile Sync, and ActiveSync

    Mailcow bundles SOGo as a full-featured groupware suite accessible at https://mail.example.com/SOGo.

    What SOGo Gives You

    • Webmail -- Gmail-style folder list, conversation view, search, filters, vacation responder
    • Calendars -- Personal and shared calendars, meeting invites, ICS import/export, CalDAV sync
    • Contacts -- Address books with CardDAV sync and LDAP lookup
    • Tasks -- Personal and shared to-do lists with reminders
    • Preferences -- Sieve rules, auto-forward, labels, signatures, all editable from the browser

    Connecting iOS Mail

    iOS supports ActiveSync (EAS) out of the box, which gives users push mail, contacts, and calendar in a single account profile:

  • On the iPhone, go to Settings > Mail > Accounts > Add Account > Microsoft Exchange.
  • Enter the email address ([email protected]) and a short description.
  • On the next screen choose Configure Manually and enter the account password.
  • Server: mail.example.com, Domain: leave blank, Username: [email protected].
  • Toggle Mail, Contacts, Calendars, and Reminders on.
  • Done. Push notifications work without any extra setup.

    Connecting Android

    Android's built-in Mail app supports ActiveSync as "Exchange" or "Corporate". Use the same server (mail.example.com), username (full email address), and password. Gmail's Android app also supports ActiveSync — add the account as "Exchange and Office 365".

    Connecting Outlook, Thunderbird, Apple Mail

    For classic IMAP/SMTP clients:

    • IMAP: mail.example.com, port 993, SSL/TLS, username = full email address
    • SMTP: mail.example.com, port 587, STARTTLS, username = full email address, authentication required
    Thunderbird and Apple Mail auto-detect these via the autoconfig.example.com and autodiscover.example.com CNAMEs you created in Step 1.

    Hardening: fail2ban, Quarantine, and Rspamd Tuning

    Built-in fail2ban

    Mailcow ships with its own fail2ban-like component called netfilter-mailcow that watches Postfix, Dovecot, SOGo, and the admin UI for brute-force attempts and automatically bans source IPs. It is enabled by default. Manage it from System > Configuration > Access > fail2ban parameters:

    • Ban time (seconds): 604800 (1 week)
    • Maximum retries: 10
    • Blacklisted networks: add country CIDR blocks here if you want to hard-block regions
    • Whitelisted networks: always add your own office or home IP here to avoid locking yourself out
    If you prefer the traditional host-level fail2ban to complement Mailcow's internal one (for SSH, for example), install it on the host:

    bash
    sudo apt install -y fail2ban

    The two do not conflict because Mailcow operates on Docker's iptables chain while host fail2ban operates on the main INPUT chain.

    Quarantine and Spam Review

    Rspamd scores every inbound message. Messages above a threshold (default 15) go to quarantine; between 6 and 15 are tagged [SPAM] and delivered; below 6 are delivered normally.

    Go to Email > Quarantine to see pending messages. Release legitimate mail with one click — Mailcow also learns from releases to reduce future false positives. Delete genuine spam to feed Rspamd's Bayesian filter.

    Rspamd Tuning

    From the admin UI, click Email > Configuration > Configuration & Details > Rspamd settings. You can edit the score thresholds, add regex rules, import Spamhaus blocklists, or adjust greylisting aggressiveness. For most installs, the defaults are excellent — let Mailcow run for a week before tuning.

    Rspamd's own web UI (separate from the Mailcow admin) is available at System > Containers > Rspamd > Web UI. It shows per-message scores, applied rules, and rule hit rates — invaluable for debugging why legitimate mail scored high.

    Backup and Upgrades

    Backups

    Mailcow includes a backup helper script at helper-scripts/backup_and_restore.sh. Run it with a target directory:

    bash
    sudo MAILCOW_BACKUP_LOCATION=/opt/mailcow-backups ./helper-scripts/backup_and_restore.sh backup all

    Backups cover: MariaDB dump, Redis dump, Rspamd data, Postfix config, vmail (mail storage), Crypt volume (encryption keys), and SOGo data.

    Restore works the same way with restore in place of backup:

    bash
    sudo ./helper-scripts/backup_and_restore.sh restore

    Schedule a nightly cron:

    bash
    sudo crontab -e

    Add:

    text
    0 3   * cd /opt/mailcow-dockerized && MAILCOW_BACKUP_LOCATION=/opt/mailcow-backups ./helper-scripts/backup_and_restore.sh backup all --delete-days 14

    The --delete-days 14 flag automatically prunes backups older than two weeks.

    For offsite storage, sync /opt/mailcow-backups to S3, Backblaze B2, or another VPS with restic, rclone, or rsync.

    Upgrades

    Mailcow has an official update script:

    bash
    cd /opt/mailcow-dockerized
    sudo ./update.sh

    The script checks for a newer Mailcow release, pulls new images, updates the compose file, restarts containers, and runs database migrations — all while preserving configuration and mail data. Run it monthly or when a CVE affecting one of the bundled components is announced.

    Always take a backup before upgrading, and read the release notes for any breaking changes.

    Troubleshooting

    ProblemCauseSolution
    Cannot send to Gmail, Outlook, Yahoo — connection timed out on port 25Your VPS provider blocks outbound port 25Open a support ticket and ask to unblock port 25. Most legitimate mail server customers are approved within a few hours. vps-server.host leaves port 25 open by default.
    Mail goes to spam at GmailSPF, DKIM, DMARC, or PTR misconfiguredRun a fresh mail-tester.com test, read the report, fix whichever record scored low. Verify PTR with dig +short -x your-ip.
    DKIM verification failing at the receiverDNS record out of sync with Mailcow's generated keyRe-check the key in the admin UI, copy the exact value, and replace the DNS record. Confirm with dig +short dkim._domainkey.example.com TXT.
    Let's Encrypt certificate not issuedPort 80 unreachable or DNS pointing elsewhereConfirm mail.example.com resolves to this server and that port 80 is open. Check ACME logs: sudo docker compose logs acme-mailcow. Restart with sudo docker compose restart acme-mailcow.
    Messages stuck in quarantine from a trusted senderRspamd scored high on a false positiveRelease from Email > Quarantine. Add the sender to a Rspamd whitelist or increase the domain's reputation over time.
    Receiving 450 4.7.1 Greylisted on inbound mailGreylisting is asking the sender to retryNormal — legitimate senders retry within minutes. Disable per-user or per-domain under Email > Configuration > Greylisting if it causes persistent issues.
    IP on blocklists (Spamhaus, Barracuda)Previous tenant of the IP, or compromised mailbox spammingSubmit a delisting request to each blocklist. Audit mailbox passwords. Consider migrating to a clean IP — vps-server.host provides IP swaps on request.
    TLS handshake errors in Postfix logsSTARTTLS misconfigured on the remote serverUsually the remote end's problem. Check logs: sudo docker compose logs postfix-mailcow. Most such errors are transient.
    Admin UI inaccessible after rebootDocker stack did not auto-startConfirm restart: unless-stopped in docker-compose.override.yml or run sudo docker compose up -d on each boot via a systemd unit.
    High RAM usageClamAV and Solr consuming 2-3 GBExpected. On memory-constrained servers set SKIP_CLAMD=y and SKIP_SOLR=y in mailcow.conf and docker compose up -d to apply.

    Viewing Logs

    The most useful debugging tool is the docker compose logs command, scoped to the service:

    bash
    sudo docker compose logs -f postfix-mailcow
    sudo docker compose logs -f dovecot-mailcow
    sudo docker compose logs -f rspamd-mailcow
    sudo docker compose logs -f acme-mailcow

    Press Ctrl+C to stop streaming. For the last 100 lines only:

    bash
    sudo docker compose logs --tail 100 postfix-mailcow

    The admin UI also exposes logs under System > Containers — one click per service, no SSH needed.

    FAQ

    Is Mailcow free?

    Yes. Mailcow Dockerized is free and open-source under the GPL-3.0 license. The company behind it, Servercow, offers commercial support contracts and a hosted Mailcow service, but you can run the full self-hosted version forever at no cost. Your only expense is the VPS.

    How many mailboxes can I host on one VPS?

    The bottleneck is RAM and disk, not Mailcow. On an 8 vCPU / 16 GB RAM VPS with 200 GB disk, comfortably host 100-300 active mailboxes with generous per-user quotas. Rspamd and ClamAV use roughly fixed amounts of memory regardless of user count — scaling is mostly linear in disk usage. For 500+ mailboxes, move up to a larger VPS and consider separating mail storage onto a mounted block volume.

    Do I need a dedicated IP for Mailcow?

    Yes. Mail receivers evaluate sender reputation by IP address, and shared IPs (common on cheap hosting) frequently carry a spam history that will hurt your deliverability from day one. Every vps-server.host VPS comes with a dedicated IPv4 address, and we run new allocations through blocklist checks before handoff. If you discover the IP is listed, contact support for a replacement.

    Can I host multiple domains on one Mailcow?

    Absolutely — this is one of Mailcow's strengths. Add as many domains as you like from Email > Configuration > Domains. Each gets its own DKIM key, quotas, aliases, and mailbox pool. A single domain's DNS (A, MX, SPF, DKIM, DMARC) must be configured for each, but they all share the same underlying server and server hostname.

    How does Mailcow compare to Mail-in-a-Box or Mailu?

    Mailcow is the most feature-rich option. It includes SOGo webmail with groupware (calendars, contacts, ActiveSync), Rspamd with a full admin UI, quarantine management, OAuth2, SSO, and an extensive REST API. Best for teams and businesses that need a complete Google Workspace replacement.

    Mail-in-a-Box is a Python installer (not Docker) that installs directly onto Ubuntu. Simpler to get started, but fewer features, no ActiveSync, and less flexibility. Best for personal servers hosting a handful of mailboxes.

    Mailu is another Docker-based stack, lighter than Mailcow. Uses Roundcube instead of SOGo (no ActiveSync, no groupware), and has a smaller community. Best if you want Docker but do not need calendars/contacts sync.

    For most business use cases in 2026, Mailcow is the right choice — the extra resources it consumes are worth it for the feature set and active maintenance.

    Can I use Mailcow behind Cloudflare?

    Partial yes. The web admin UI (HTTP/HTTPS) can sit behind Cloudflare proxying, but SMTP, IMAP, and POP must bypass Cloudflare because Cloudflare does not proxy those protocols. In practice: point mail.example.com A record to your VPS with Cloudflare set to DNS only (grey cloud), not proxied. You lose Cloudflare's WAF on the admin UI but keep full mail functionality. If you want Cloudflare WAF on the admin panel, expose it under a separate hostname like admin.example.com (proxied) while the MX continues to point at mail.example.com (unproxied).

    Will my outbound mail reach Gmail reliably on day one?

    Usually yes, as long as SPF, DKIM, DMARC, and PTR are correctly configured and your IP is clean. Gmail sometimes applies a "sender warming" penalty to brand-new IPs for the first week — ramp up sending volume gradually (a few dozen messages per day, climbing to hundreds). Avoid sending bulk campaigns from a fresh Mailcow install — use a dedicated transactional provider for marketing mail and keep Mailcow for 1:1 business correspondence.

    Next Steps

    Now that Mailcow is running on your VPS, here are recommended follow-ups:

    • Set up automated offsite backups -- Pair the nightly backup_and_restore.sh cron with restic or rclone to push backups to S3, Backblaze B2, or a second VPS. Test restores quarterly.
    • Deploy a backup MX -- Spin up a cheap second VPS and configure it as a secondary MX (priority 20). If your primary goes down, the backup queues inbound mail until the primary returns.
    • Add an SSL-terminating reverse proxy -- If you want to share port 443 with other apps on the same server, front Mailcow with Nginx or Traefik. See the SNAT_TO_SOURCE docs at docs.mailcow.email for the full pattern.
    • Integrate with your CRM or helpdesk -- The Mailcow API lets you programmatically create mailboxes, aliases, and domains. Perfect for onboarding flows, provisioning new customers, or syncing with a billing system.
    • Enable OAuth2 and SSO -- Mailcow supports OIDC for the admin UI and SOGo. Connect it to Authentik, Keycloak, or Google Workspace for centralized auth across your stack.
    • Explore the Rspamd web UI -- Dive into per-rule hit rates and tune for your traffic. Well-tuned Rspamd is what separates a good mail server from a great one.
    • Read the official docs -- docs.mailcow.email covers every edge case, from custom Postfix overrides to multi-server relay configurations.

    Need a VPS with port 25 unblocked, clean IPv4, and editable rDNS?
    >
    Mailcow runs beautifully on our CloudCore Business plan — configured from day one for production email workloads.
    >
    - 8 vCPU cores
    - 16 GB RAM
    - 200 GB NVMe SSD
    - Clean, non-blocklisted IPv4 (and IPv6) address
    - Port 25 open by default
    - Self-service reverse DNS
    - 24/7 support with mail-specific expertise
    >
    Deploy CloudCore Business Now -- Plans start at EUR 24.99/month.

    Was this article helpful?

    ← Back to Install GuidesBrowse all categories →

    Still have questions?

    Contact Support →Submit a Ticket