How to Install Mailcow on Ubuntu 24.04 VPS: Full-Featured Self-Hosted Email Server
Running your own email server used to be a punishing exercise in Postfix manuals, Dovecot configuration files, SpamAssassin rule tuning, and endless blocklist appeals. Mailcow Dockerized changed that. It bundles every component you need for a modern mail stack — Postfix, Dovecot, SOGo webmail, Rspamd, ClamAV, Redis, MariaDB, Nginx, and automated Let's Encrypt — into a single docker compose project that you control through one polished admin UI.
This guide walks you through a production-ready Mailcow install on an Ubuntu 24.04 VPS, from DNS records to your first successfully delivered message with a 10/10 score at mail-tester.com.
Email deliverability starts with the right VPS. Mailcow needs a clean IPv4 address, unblocked port 25, and editable reverse DNS. Our CloudCore Business plan gives you all three plus the RAM headroom Rspamd and ClamAV need to run comfortably.
Table of Contents
What is Mailcow?
Mailcow Dockerized is an open-source email server suite maintained by Servercow (a German hosting provider) and a large community of contributors. Instead of installing and wiring together each mail component by hand, Mailcow ships a curated docker compose stack where every piece is configured to work with the others out of the box.
The stack includes Postfix for SMTP (inbound and outbound mail transfer), Dovecot for IMAP/POP3 and Sieve filtering, SOGo for browser-based webmail, calendars, contacts, and ActiveSync, Rspamd for spam filtering, ClamAV for antivirus scanning, MariaDB for mailbox metadata, Redis for caching and rate limits, Nginx as the front-end web server, Unbound as a local recursive DNS resolver, PHP-FPM for the admin UI, and an ACME client that handles Let's Encrypt certificate issuance and renewal automatically.
The admin UI is the centerpiece. From a single browser tab you can add domains, create mailboxes, generate DKIM keys, configure relayhosts, set quotas, manage aliases, view Rspamd scores for every inbound message, release or reject quarantined mail, inspect logs for every container, and toggle features like OAuth2, SAML SSO, fail2ban, and XMPP. There are no config files to edit once the stack is running for day-to-day operations.
Mailcow gives you feature parity with the core of Google Workspace and Microsoft 365 for mail: IMAP/SMTP with TLS, webmail, shared calendars (CalDAV), shared address books (CardDAV), mobile sync via ActiveSync (iOS Mail, Outlook mobile, Android), push notifications, aliases, catch-all addresses, domain-wide filters, per-user Sieve rules, quota management, and granular spam controls. The administrative overhead is a few minutes per week instead of the tens of hours a hand-rolled Postfix/Dovecot stack typically demands.
Why Self-Host Email on Your VPS?
Running your own mail server on a VPS instead of paying per-mailbox fees to Google or Microsoft offers concrete advantages:
- Flat cost per mailbox -- Google Workspace Business Standard runs EUR 12/user/month. A 20-person team pays EUR 240/month. A single CloudCore Business VPS hosts hundreds of mailboxes at a flat rate.
- Complete privacy -- Your customers' contracts, invoices, and personal correspondence stay on infrastructure you control. No third-party scans the content of your messages for ad targeting or model training.
- Unlimited aliases and catch-alls -- Most SaaS providers charge per alias. Mailcow gives you unlimited aliases, domain-level catch-alls, and regex-based routing.
- Unlimited domains on one server -- Host 1 domain or 100 domains on the same Mailcow instance at no extra cost.
- Full control over spam filtering -- Tune Rspamd rules, greylisting thresholds, and DNSBL checks to match your tolerance. Release false positives instantly.
- Data sovereignty -- Choose where your data lives. For EU businesses, an EU-hosted Mailcow server simplifies GDPR compliance end to end.
- No vendor lock-in -- IMAP, SMTP, CalDAV, CardDAV, ActiveSync — all open standards. Export, import, or migrate freely.
- Rich integrations -- Rspamd API, Mailcow API, webhooks, and full access to every log and configuration file make Mailcow a great fit for automated provisioning, CRM sync, and helpdesk integrations.
Cost Comparison: Self-Hosted Mailcow vs. Hosted Email
| Scenario | Google Workspace | Microsoft 365 Business | Self-Hosted Mailcow (VPS) |
|---|---|---|---|
| Cost per user per month | ~EUR 12 | ~EUR 11 | EUR 0 (unlimited on one plan) |
| 10 mailboxes / month | EUR 120 | EUR 110 | EUR 24.99 (flat) |
| 50 mailboxes / month | EUR 600 | EUR 550 | EUR 24.99 (flat) |
| Custom domains | 1 included, extra paid | 1 included | Unlimited |
| Aliases per user | Limited | Limited | Unlimited |
| Storage per user | 30 GB | 50 GB | Limited only by VPS disk |
| Data processor | Microsoft | You |
Prerequisites
Before you begin, make sure you have:
- A VPS running Ubuntu 24.04 LTS with root or sudo access
- At least 6 GB of RAM (ClamAV + Rspamd + Solr are the heaviest containers; 8 GB is comfortable)
- At least 40 GB of free disk space (mail storage grows quickly — 100 GB+ recommended for teams)
- A clean, dedicated IPv4 address that is not listed on major blocklists (check here)
- Outbound port 25 open at your provider (many cloud providers block it by default — ask support to unblock)
- Ability to edit reverse DNS (PTR) for your VPS IP
- A domain name you control, with access to edit DNS records
- SSH access to your server
Recommended Plan: CloudCore Business>
For a production Mailcow server running 20-100 mailboxes, we recommend the CloudCore Business plan:>
- 8 vCPU cores
- 16 GB RAM
- 200 GB NVMe SSD
- Clean, unblocklisted IPv4 address
- Port 25 open by default
- Editable reverse DNS
- EUR 24.99/month>
This gives Rspamd, ClamAV, and Solr plenty of headroom and leaves ~150 GB for mail storage. For smaller teams (under 15 mailboxes), CloudCore Professional is sufficient.
Connect to your server via SSH to get started:
ssh root@your-server-ipStep 1: Configure DNS Records First
DNS is the single most important part of running a mail server. Misconfigured records cause the majority of deliverability problems. Set these up before you install Mailcow so that by the time the stack is running, DNS propagation is already done.
Assume your mail server hostname will be mail.example.com and your VPS public IP is 203.0.113.50.
Required Records
| Record | Host | Type | Value | Purpose |
|---|---|---|---|---|
| A | mail | A | 203.0.113.50 | Points mail.example.com to your VPS |
| AAAA (optional) | mail | AAAA | 2001:db8::1 | IPv6 address for mail.example.com |
| MX | @ | MX | 10 mail.example.com. | Tells the internet where mail for example.com goes |
| Autodiscover | autodiscover | CNAME | mail.example.com. | Helps Outlook auto-configure |
| Autoconfig | autoconfig | CNAME | mail.example.com. | Helps Thunderbird auto-configure |
| SPF | @ | TXT | v=spf1 mx ~all | Authorizes your MX to send mail for the domain |
| DMARC | _dmarc | TXT | v=DMARC1; p=quarantine; rua=mailto:[email protected] | Tells receivers what to do with failing mail |
| DKIM | dkim._domainkey | TXT | (filled in after Step 10) | Signs outbound mail cryptographically |
Important DNS Notes
- MX priority --
10is fine for a single mail server. Lower values mean higher priority if you add backup MXes later. - SPF -- Keep it minimal.
v=spf1 mx ~allsays "only the servers listed as MX for this domain are allowed to send on its behalf." If you also send through a transactional service (like Amazon SES), add it:v=spf1 mx include:amazonses.com ~all. A single domain can only have one SPF TXT record — never create two. - DMARC -- Start with
p=quarantine(failing mail goes to spam) rather thanp=reject. Move top=rejectonce you have confirmed SPF + DKIM pass reliably for a few weeks. - TLSA (optional, advanced) -- If you want DANE-TLSA for verified TLS, publish a TLSA record that matches the hash of your Let's Encrypt certificate. Most hosts do not need this.
dig +short mail.example.com A
dig +short example.com MX
dig +short example.com TXT
dig +short _dmarc.example.com TXTStep 2: Set Reverse DNS (PTR) at Your VPS Provider
The PTR record (reverse DNS) maps your IPv4 address back to mail.example.com. Major mail receivers (Gmail, Outlook, Yahoo) reject or deeply penalize mail from servers whose IP does not reverse to match the HELO hostname. You cannot set PTR from inside your VPS — it must be configured at your provider's control panel.
For vps-server.host customers, open the VPS management panel, navigate to Networking > Reverse DNS, and set:
- IP:
203.0.113.50 - PTR hostname:
mail.example.com
dig +short -x 203.0.113.50Expected output:
mail.example.com.If it returns a generic provider hostname (like vps-xxx.example-host.net), Gmail will flag every message you send. Do not skip this step.
Step 3: Update System Packages
Start by updating your package index and upgrading installed packages. This ensures you have the latest security patches and kernel before Docker installs.
sudo apt update && sudo apt upgrade -yIf your kernel was updated, reboot before continuing:
sudo rebootThen reconnect via SSH after a minute.
Mailcow's own installer requires a few basic tools. Install them now:
sudo apt install -y curl git ca-certificates gnupg lsb-releaseStep 4: Install Docker and Docker Compose
Mailcow runs entirely as Docker containers, so Docker Engine and the Compose plugin are mandatory. Install the official Docker packages (not the docker.io Ubuntu package, which ships with an older version).
For the full walkthrough, see our guide on how to install Docker on Ubuntu 24.04. The quick version:
curl -fsSL https://get.docker.com | shThis script adds Docker's APT repository, installs Docker Engine, the CLI, containerd, and the docker compose plugin, and enables the docker systemd service.
Verify the installation:
docker --version
docker compose versionExpected output:
Docker version 27.5.0, build a187fa5
Docker Compose version v2.32.1For more detail on docker compose commands used throughout this guide, see how to install Docker Compose on Ubuntu.
Step 5: Clone the Mailcow Repository
Mailcow is distributed as a Git repository containing the compose file, helper scripts, and configuration templates. Clone it into /opt, which is the conventional location recommended by the Mailcow docs.
cd /opt
sudo git clone https://github.com/mailcow/mailcow-dockerized.git
cd mailcow-dockerizedAll subsequent commands in this guide assume you are in /opt/mailcow-dockerized.
List the directory to confirm the clone succeeded:
ls -laYou should see generate_config.sh, docker-compose.yml, update.sh, helper-scripts/, data/, and several other files.
Step 6: Generate the Mailcow Configuration
Mailcow ships with an interactive script that creates the main configuration file (mailcow.conf) based on your inputs.
sudo ./generate_config.shYou will be prompted for the mail server FQDN:
Mail server hostname (FQDN) - this is not your mail domain, but your mail server's hostname: mail.example.comEnter the same hostname you set in DNS and reverse DNS (mail.example.com). The script then generates strong random passwords for the database, DBMail, API, and other internal services, and writes mailcow.conf to the current directory.
Expected output (abbreviated):
[INFO] - Fetching new mailcow-dockerized bootstrap...
[INFO] - Timezone is Europe/Berlin
[INFO] - Generated mailcow.conf successfully.Step 7: Review and Edit mailcow.conf
Open the generated config and review each value. Most defaults are sane, but a few deserve attention.
sudo nano mailcow.confKey variables to check or adjust:
MAILCOW_HOSTNAME=mail.example.com-- Must match your DNS A record and PTR record exactly.MAILCOW_TZ=Europe/Berlin-- Set to your preferred timezone. Runtimedatectl list-timezones | grep -i your-cityto find the right string.HTTP_PORT=80andHTTPS_PORT=443-- Default. Change only if you run another web server on the same IP (you probably should not — Mailcow handles its own Nginx).HTTP_BIND=andHTTPS_BIND=-- Leave empty to bind all interfaces. Set to a specific IP if the server has multiple addresses.SMTP_PORT=25,SMTPS_PORT=465,SUBMISSION_PORT=587,IMAP_PORT=143,IMAPS_PORT=993,POP_PORT=110,POPS_PORT=995,SIEVE_PORT=4190-- Leave at standard mail protocol ports.SNAT_TO_SOURCE=-- Optional. Set to your public IPv4 if outbound mail needs to egress from a specific address (useful on hosts with multiple IPs).SNAT6_TO_SOURCE=-- Same idea for IPv6.SKIP_LETS_ENCRYPT=n-- Leave asnso Mailcow auto-provisions Let's Encrypt certificates formail.example.com.SKIP_CLAMD=n-- Set toyonly if you are RAM-constrained. ClamAV uses ~1-2 GB but catches attachment-based malware.SKIP_SOLR=n-- Set toyif you do not need full-text search in webmail. Solr uses another ~1 GB RAM.USE_WATCHDOG=y-- Keep enabled. Mailcow's watchdog container monitors all other services and alerts on failure.
Ctrl+O, Enter) and exit (Ctrl+X).Step 8: Pull Images and Start the Stack
Download all the Docker images for the Mailcow stack. The first pull is ~3-4 GB and takes a few minutes depending on bandwidth.
sudo docker compose pullThen bring the stack up in detached mode:
sudo docker compose up -dExpected output (abbreviated):
[+] Running 21/21
✔ Container mailcowdockerized-unbound-mailcow-1 Started
✔ Container mailcowdockerized-mysql-mailcow-1 Started
✔ Container mailcowdockerized-redis-mailcow-1 Started
✔ Container mailcowdockerized-rspamd-mailcow-1 Started
✔ Container mailcowdockerized-php-fpm-mailcow-1 Started
✔ Container mailcowdockerized-postfix-mailcow-1 Started
✔ Container mailcowdockerized-dovecot-mailcow-1 Started
✔ Container mailcowdockerized-nginx-mailcow-1 Started
✔ Container mailcowdockerized-sogo-mailcow-1 Started
✔ Container mailcowdockerized-acme-mailcow-1 Started
✔ Container mailcowdockerized-watchdog-mailcow-1 Started
...Wait about 60 seconds for all services to finish initializing, then check their status:
sudo docker compose psEvery container should show running (healthy) or running. If any are stuck in restarting, check its logs:
sudo docker compose logs <service-name>Step 9: Access the Admin UI and Change Default Credentials
Open a browser and navigate to:
https://mail.example.comYou may see a browser warning for the first few minutes — that is the self-signed bootstrap certificate before Let's Encrypt completes. Refresh a few minutes later and you should see a valid certificate issued by Let's Encrypt.
Log in with the default admin credentials:
- Username:
admin - Password:
moohoo
Change these immediately. Every Mailcow install ships with the same default password. Leaving it unchanged for even a few hours exposes your server to automated scanners.
Navigate to System > Configuration > Access > Administrators, click the pencil icon next to admin, and set a new strong password. Optionally create a second admin account as backup and delete the default admin username entirely (replace it with one of your own).
While you are in the configuration area, enable two-factor authentication under your user's profile for the admin account — Mailcow supports WebAuthn (hardware keys) and TOTP (Authenticator apps).
Step 10: Add Your Domain, DKIM Key, and First Mailbox
Now add the domain Mailcow will serve mail for.
Add the Domain
Go to Email > Configuration > Domains > Add domain.
- Domain:
example.com - Description: Company Mail
- Aliases: 400 (default)
- Mailboxes: 10 (default, raise as needed)
- Default mailbox quota: 3072 MB (3 GB)
- Maximum mailbox quota: 10240 MB (10 GB)
Generate a DKIM Key
Go to Email > Configuration > Configuration & Details > ARC/DKIM keys.
- Domain:
example.com - Selector:
dkim - Key size: 2048
Create the First Mailbox
Go to Email > Configuration > Mailboxes > Add mailbox.
- Username:
john - Domain:
example.com(full address becomes[email protected]) - Full name: John Doe
- Password: Set a strong password (or let the user set it via SOGo first-login)
- Quota: 3072 MB
https://mail.example.com/SOGo with [email protected] and the password you set.Step 11: Publish the DKIM Record in DNS
Back in Configuration & Details > ARC/DKIM keys, click the domain row to expand the public key. You will see a long string that looks like:
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...Copy the entire value. In your DNS provider, add a TXT record:
- Host:
dkim._domainkey - Type: TXT
- Value:
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA... - TTL: 3600
Wait 5-10 minutes for propagation, then verify:
dig +short dkim._domainkey.example.com TXTOr use Mailcow's built-in check: next to the DKIM entry in the admin UI, click the DNS check icon — it queries your DNS and confirms the record matches.
Step 12: Test Deliverability with mail-tester.com
Now for the moment of truth. Log in to SOGo as [email protected] and send a test message.
[email protected]).A properly configured Mailcow server with valid SPF, DKIM, DMARC, PTR, and TLS should score 10/10. If you see deductions, the report breaks down exactly which record or signature is missing — usually an SPF typo or a slow-propagating DKIM.
Send a second test to a Gmail address you own and confirm the message lands in the inbox (not spam). Click Show original in Gmail to inspect the Authentication-Results header. You should see spf=pass, dkim=pass, and dmarc=pass.
Post-Install: SOGo Webmail, Mobile Sync, and ActiveSync
Mailcow bundles SOGo as a full-featured groupware suite accessible at https://mail.example.com/SOGo.
What SOGo Gives You
- Webmail -- Gmail-style folder list, conversation view, search, filters, vacation responder
- Calendars -- Personal and shared calendars, meeting invites, ICS import/export, CalDAV sync
- Contacts -- Address books with CardDAV sync and LDAP lookup
- Tasks -- Personal and shared to-do lists with reminders
- Preferences -- Sieve rules, auto-forward, labels, signatures, all editable from the browser
Connecting iOS Mail
iOS supports ActiveSync (EAS) out of the box, which gives users push mail, contacts, and calendar in a single account profile:
[email protected]) and a short description.mail.example.com, Domain: leave blank, Username: [email protected].Done. Push notifications work without any extra setup.
Connecting Android
Android's built-in Mail app supports ActiveSync as "Exchange" or "Corporate". Use the same server (mail.example.com), username (full email address), and password. Gmail's Android app also supports ActiveSync — add the account as "Exchange and Office 365".
Connecting Outlook, Thunderbird, Apple Mail
For classic IMAP/SMTP clients:
- IMAP:
mail.example.com, port 993, SSL/TLS, username = full email address - SMTP:
mail.example.com, port 587, STARTTLS, username = full email address, authentication required
autoconfig.example.com and autodiscover.example.com CNAMEs you created in Step 1.Hardening: fail2ban, Quarantine, and Rspamd Tuning
Built-in fail2ban
Mailcow ships with its own fail2ban-like component called netfilter-mailcow that watches Postfix, Dovecot, SOGo, and the admin UI for brute-force attempts and automatically bans source IPs. It is enabled by default. Manage it from System > Configuration > Access > fail2ban parameters:
- Ban time (seconds): 604800 (1 week)
- Maximum retries: 10
- Blacklisted networks: add country CIDR blocks here if you want to hard-block regions
- Whitelisted networks: always add your own office or home IP here to avoid locking yourself out
sudo apt install -y fail2banThe two do not conflict because Mailcow operates on Docker's iptables chain while host fail2ban operates on the main INPUT chain.
Quarantine and Spam Review
Rspamd scores every inbound message. Messages above a threshold (default 15) go to quarantine; between 6 and 15 are tagged [SPAM] and delivered; below 6 are delivered normally.
Go to Email > Quarantine to see pending messages. Release legitimate mail with one click — Mailcow also learns from releases to reduce future false positives. Delete genuine spam to feed Rspamd's Bayesian filter.
Rspamd Tuning
From the admin UI, click Email > Configuration > Configuration & Details > Rspamd settings. You can edit the score thresholds, add regex rules, import Spamhaus blocklists, or adjust greylisting aggressiveness. For most installs, the defaults are excellent — let Mailcow run for a week before tuning.
Rspamd's own web UI (separate from the Mailcow admin) is available at System > Containers > Rspamd > Web UI. It shows per-message scores, applied rules, and rule hit rates — invaluable for debugging why legitimate mail scored high.
Backup and Upgrades
Backups
Mailcow includes a backup helper script at helper-scripts/backup_and_restore.sh. Run it with a target directory:
sudo MAILCOW_BACKUP_LOCATION=/opt/mailcow-backups ./helper-scripts/backup_and_restore.sh backup allBackups cover: MariaDB dump, Redis dump, Rspamd data, Postfix config, vmail (mail storage), Crypt volume (encryption keys), and SOGo data.
Restore works the same way with restore in place of backup:
sudo ./helper-scripts/backup_and_restore.sh restoreSchedule a nightly cron:
sudo crontab -eAdd:
0 3 * cd /opt/mailcow-dockerized && MAILCOW_BACKUP_LOCATION=/opt/mailcow-backups ./helper-scripts/backup_and_restore.sh backup all --delete-days 14The --delete-days 14 flag automatically prunes backups older than two weeks.
For offsite storage, sync /opt/mailcow-backups to S3, Backblaze B2, or another VPS with restic, rclone, or rsync.
Upgrades
Mailcow has an official update script:
cd /opt/mailcow-dockerized
sudo ./update.shThe script checks for a newer Mailcow release, pulls new images, updates the compose file, restarts containers, and runs database migrations — all while preserving configuration and mail data. Run it monthly or when a CVE affecting one of the bundled components is announced.
Always take a backup before upgrading, and read the release notes for any breaking changes.
Troubleshooting
| Problem | Cause | Solution |
|---|---|---|
Cannot send to Gmail, Outlook, Yahoo — connection timed out on port 25 | Your VPS provider blocks outbound port 25 | Open a support ticket and ask to unblock port 25. Most legitimate mail server customers are approved within a few hours. vps-server.host leaves port 25 open by default. |
| Mail goes to spam at Gmail | SPF, DKIM, DMARC, or PTR misconfigured | Run a fresh mail-tester.com test, read the report, fix whichever record scored low. Verify PTR with dig +short -x your-ip. |
| DKIM verification failing at the receiver | DNS record out of sync with Mailcow's generated key | Re-check the key in the admin UI, copy the exact value, and replace the DNS record. Confirm with dig +short dkim._domainkey.example.com TXT. |
| Let's Encrypt certificate not issued | Port 80 unreachable or DNS pointing elsewhere | Confirm mail.example.com resolves to this server and that port 80 is open. Check ACME logs: sudo docker compose logs acme-mailcow. Restart with sudo docker compose restart acme-mailcow. |
| Messages stuck in quarantine from a trusted sender | Rspamd scored high on a false positive | Release from Email > Quarantine. Add the sender to a Rspamd whitelist or increase the domain's reputation over time. |
Receiving 450 4.7.1 Greylisted on inbound mail | Greylisting is asking the sender to retry | Normal — legitimate senders retry within minutes. Disable per-user or per-domain under Email > Configuration > Greylisting if it causes persistent issues. |
| IP on blocklists (Spamhaus, Barracuda) | Previous tenant of the IP, or compromised mailbox spamming | Submit a delisting request to each blocklist. Audit mailbox passwords. Consider migrating to a clean IP — vps-server.host provides IP swaps on request. |
| TLS handshake errors in Postfix logs | STARTTLS misconfigured on the remote server | Usually the remote end's problem. Check logs: sudo docker compose logs postfix-mailcow. Most such errors are transient. |
| Admin UI inaccessible after reboot | Docker stack did not auto-start | Confirm restart: unless-stopped in docker-compose.override.yml or run sudo docker compose up -d on each boot via a systemd unit. |
| High RAM usage | ClamAV and Solr consuming 2-3 GB | Expected. On memory-constrained servers set SKIP_CLAMD=y and SKIP_SOLR=y in mailcow.conf and docker compose up -d to apply. |
Viewing Logs
The most useful debugging tool is the docker compose logs command, scoped to the service:
sudo docker compose logs -f postfix-mailcow
sudo docker compose logs -f dovecot-mailcow
sudo docker compose logs -f rspamd-mailcow
sudo docker compose logs -f acme-mailcowPress Ctrl+C to stop streaming. For the last 100 lines only:
sudo docker compose logs --tail 100 postfix-mailcowThe admin UI also exposes logs under System > Containers — one click per service, no SSH needed.
FAQ
Is Mailcow free?
Yes. Mailcow Dockerized is free and open-source under the GPL-3.0 license. The company behind it, Servercow, offers commercial support contracts and a hosted Mailcow service, but you can run the full self-hosted version forever at no cost. Your only expense is the VPS.
How many mailboxes can I host on one VPS?
The bottleneck is RAM and disk, not Mailcow. On an 8 vCPU / 16 GB RAM VPS with 200 GB disk, comfortably host 100-300 active mailboxes with generous per-user quotas. Rspamd and ClamAV use roughly fixed amounts of memory regardless of user count — scaling is mostly linear in disk usage. For 500+ mailboxes, move up to a larger VPS and consider separating mail storage onto a mounted block volume.
Do I need a dedicated IP for Mailcow?
Yes. Mail receivers evaluate sender reputation by IP address, and shared IPs (common on cheap hosting) frequently carry a spam history that will hurt your deliverability from day one. Every vps-server.host VPS comes with a dedicated IPv4 address, and we run new allocations through blocklist checks before handoff. If you discover the IP is listed, contact support for a replacement.
Can I host multiple domains on one Mailcow?
Absolutely — this is one of Mailcow's strengths. Add as many domains as you like from Email > Configuration > Domains. Each gets its own DKIM key, quotas, aliases, and mailbox pool. A single domain's DNS (A, MX, SPF, DKIM, DMARC) must be configured for each, but they all share the same underlying server and server hostname.
How does Mailcow compare to Mail-in-a-Box or Mailu?
Mailcow is the most feature-rich option. It includes SOGo webmail with groupware (calendars, contacts, ActiveSync), Rspamd with a full admin UI, quarantine management, OAuth2, SSO, and an extensive REST API. Best for teams and businesses that need a complete Google Workspace replacement.
Mail-in-a-Box is a Python installer (not Docker) that installs directly onto Ubuntu. Simpler to get started, but fewer features, no ActiveSync, and less flexibility. Best for personal servers hosting a handful of mailboxes.
Mailu is another Docker-based stack, lighter than Mailcow. Uses Roundcube instead of SOGo (no ActiveSync, no groupware), and has a smaller community. Best if you want Docker but do not need calendars/contacts sync.
For most business use cases in 2026, Mailcow is the right choice — the extra resources it consumes are worth it for the feature set and active maintenance.
Can I use Mailcow behind Cloudflare?
Partial yes. The web admin UI (HTTP/HTTPS) can sit behind Cloudflare proxying, but SMTP, IMAP, and POP must bypass Cloudflare because Cloudflare does not proxy those protocols. In practice: point mail.example.com A record to your VPS with Cloudflare set to DNS only (grey cloud), not proxied. You lose Cloudflare's WAF on the admin UI but keep full mail functionality. If you want Cloudflare WAF on the admin panel, expose it under a separate hostname like admin.example.com (proxied) while the MX continues to point at mail.example.com (unproxied).
Will my outbound mail reach Gmail reliably on day one?
Usually yes, as long as SPF, DKIM, DMARC, and PTR are correctly configured and your IP is clean. Gmail sometimes applies a "sender warming" penalty to brand-new IPs for the first week — ramp up sending volume gradually (a few dozen messages per day, climbing to hundreds). Avoid sending bulk campaigns from a fresh Mailcow install — use a dedicated transactional provider for marketing mail and keep Mailcow for 1:1 business correspondence.
Next Steps
Now that Mailcow is running on your VPS, here are recommended follow-ups:
- Set up automated offsite backups -- Pair the nightly
backup_and_restore.shcron withresticorrcloneto push backups to S3, Backblaze B2, or a second VPS. Test restores quarterly.
- Deploy a backup MX -- Spin up a cheap second VPS and configure it as a secondary MX (priority 20). If your primary goes down, the backup queues inbound mail until the primary returns.
- Add an SSL-terminating reverse proxy -- If you want to share port 443 with other apps on the same server, front Mailcow with Nginx or Traefik. See the
SNAT_TO_SOURCEdocs at docs.mailcow.email for the full pattern.
- Integrate with your CRM or helpdesk -- The Mailcow API lets you programmatically create mailboxes, aliases, and domains. Perfect for onboarding flows, provisioning new customers, or syncing with a billing system.
- Enable OAuth2 and SSO -- Mailcow supports OIDC for the admin UI and SOGo. Connect it to Authentik, Keycloak, or Google Workspace for centralized auth across your stack.
- Explore the Rspamd web UI -- Dive into per-rule hit rates and tune for your traffic. Well-tuned Rspamd is what separates a good mail server from a great one.
- Read the official docs -- docs.mailcow.email covers every edge case, from custom Postfix overrides to multi-server relay configurations.
Need a VPS with port 25 unblocked, clean IPv4, and editable rDNS?>
Mailcow runs beautifully on our CloudCore Business plan — configured from day one for production email workloads.>
- 8 vCPU cores
- 16 GB RAM
- 200 GB NVMe SSD
- Clean, non-blocklisted IPv4 (and IPv6) address
- Port 25 open by default
- Self-service reverse DNS
- 24/7 support with mail-specific expertise>
Deploy CloudCore Business Now -- Plans start at EUR 24.99/month.