Self-hosting email with Mailcow Dockerized is easy and awesome

I’ve been running my own email servers for decades for business uses and 6 years or so ago I started doing it for personal domains as well. There are many many ways to run your own email server and have full control over your own internet-based electronic text-based communications. Self-agency is imperative on the internet since there are so many tech companies trying to capture and control your information for their own advantages.

You may see other articles saying that it is very difficult or time consuming, but maybe they just don’t know what they’re doing. Well, difficulty is relative though. Is running your own email server more difficult than signing up for a cellular telephone plan that includes text messaging? Yes. Is running your own email server more difficult than running your own phone company that gives you full control over your own RCS messaging and communications systems? No, not at all. Making your own email service is much much easier than that!

My own webmail design

Mailcow comes with Sogo as the webmail interface, and it’s pretty great, but the default theme is filled with confusing mystery meat navigation that nobody understands. There are tooltips if you mouse-over the buttons that will explain them, but touch screens don’t have mouse-hover functions, so you can’t rely on those at all. Luckily, since I host my server myself, I can write some CSS code to fix those things, and I did. See: SOGO-usability-theme/README.md at main · adamzea/SOGO-usability-theme

My CSS theme adds text labels to all of the confusing unintelligible interface icons so that normal people can tell what the buttons do. I did this using the aria-label attributes that most buttons have for screen readers so that blind people can hear what the buttons mean. Why should it be easier to use for blind people than for sighted people? Anyway, a lot of the hidden labels were quite verbose or implemented in inconsistent buggy ways, so my CSS had to contend with that a bit as well. Overall, it is much easier to use now that normal people can see what the buttons mean.

Meanwhile, let’s talk more about setting up your own Mailcow server…

Get a domain

If you’re even thinking about hosting your own email server, you probably already have a domain registered on the internet. If not, it’s very easy to buy/rent one. TLD-List.com is a pretty nice way to search for and shop for available domain names. Whomever you buy the domain name from will probably give you DNS (domain name system) server record editing capabilities for free. The DNS records are basically little form fields that you can fill out in order to point the domain to different web servers, email servers, etc. This way you can choose exactly what the domain does and edit those capabilities whenever you want.

Servercow hosting

The easiest way to get a Mailcow server running is to pay Servercow a monthly fee for one. With that, all you’ll have to do is copy/paste a few DNS records into your domain’s DNS server and everything else is pretty much already done. You’ll have to log into the new email server and add the accounts you want to create email addresses for of course, but the installation stuff is already done for you.

Or get your own server with a static IP

To really run your own you’ll need an actual computer or virtual machine on the internet that you can install your email server software on.

Do you need one with outgoing port 25 support?

A lot of internet providers and virtual private server providers block outgoing traffic on port 25 because that’s the usual SMTP (simple mail transfer protocol) port that email servers use to communicate with each other. If you really want full control over your email messaging, then yes you’ll want a server that can send outgoing data over port 25. If that’s going to cost too much, you can also easily use a relay server to send your messages. This adds a layer of potential privacy violation issues but can improve delivery rates if the relay server you’re using has a good reputation.

Server recommendations

I’m currently running my Mailcow Dockerized server on the Oracle Cloud Infrastructure with an open port 25 and Ubuntu virtual private server instance. Oracle is no longer authorizing port 25 egress requests for other Oracle Cloud Infrastructure tenants, but they do offer a free relay server that you can use for 300 outgoing messages per day. See: Oracle Cloud Overview of Email Delivery.

Here’s another list of server providers to look at:

Oracle Cloud
Racknerd
DigitalOcean
Vultr
Linode
Hetzner
Amazon Lightsail
OVHCloud

Mailcow has a list of what they recommend, too.

Once you get a Linux server, you’ll have either an IP address, username, and password to log into it with SSH or an IP address and keyfile to log in with. You can use Windows Terminal or just about any command line terminal interface to connect to the server with SSH.

Install Mailcow Dockerized

You can find the Mailcow Dockerized install instructions here: Install mailcow – mailcow: dockerized documentation. Once you log into your Linux server via SSH, you might have to install some prerequisites first like so:

apt update
apt install -y git openssl curl gawk coreutils grep jq

Then Docker and Docker Compose:

curl -sSL https://get.docker.com/ | CHANNEL=stable sh systemctl enable --now docker   
apt install docker-compose-plugin

Then the actual install:

Clone the repository:

su
umask 0022
cd /opt
git clone https://github.com/mailcow/mailcow-dockerized
cd mailcow-dockerized

Generate the configuration file:
```
./generate_config.sh
```
Adjust the configuration if necessary:
```
nano mailcow.conf
```

At the end of the install, you’ll get some more DNS records that you’ll want to copy and paste into your DNS server in order to enable things like authentication for spam reduction and delivery improvements.

For some reason on my server, the regular install doesn’t recognize the IPv6 static address and automatically disables IPv6. If I manually re-enable IPv6 in the mailcow.conf file and restart the docker containers, everything is fine.

Overall, the Mailcow install is very straight forward and nicely walks you through which DNS records that you need to add in order to get everything configured properly.

Adding Domains and Users

After running through the install, you’ll get/create an administrator account for accessing the web based Mailcow dashboard where you’ll have a nice interface for adding domains, users, and all the important email server settings.

There are all sorts of great configuration settings in the Mailcow dashboard. You can specify limits for mailbox storage size, message sending quantity, etc. You can configure spam protections, antivirus scans, etc. You can also configure which protocols users can use such as IMAP, ActiveSync, SMTP, Sieve, CalDAV, CardDAV, etc. You may want to disable ActiveSync since it can use up a lot of memory on your server.

Once a user logs in or you log in as a user, you’ll be able to access Sogo webmail, along with its Calendar, Tasks, and Contacts interfaces. In the settings there will be quick configuration files for Apple iOS devices as well as settings listed for adding the IMAP, SMTP, ActiveSync, CalDAV, and CardDAV connections to pretty much any other email client. Some email clients support autoconfig in which case all you’d need to do is log in with your email address and password. That works great as well, but things like Outlook Classic don’t support autoconfig anymore.

Final security touches and updated ciphers

Mailcow’s default installation and configuration doesn’t get you totally to 100% on the internet.nl security and standards compliance test, but there are a few tweaks that will get you there.

Via: mailcow Ciphers verstärken nicht merh aktuell – mailcow community

nano /opt/mailcow-dockerized/data/conf/postfix/extra.cf

myhostname = mail.myhostname.com

tls_config_file = /opt/postfix/conf/openssl.cnf
tls_config_name = postfix

tls_high_cipherlist = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256

smtp_tls_ciphers = high
smtp_tls_mandatory_ciphers = high
smtpd_tls_ciphers = high

The official documentation contains unnecessary duplicate entries:
Hardening Ciphers – mailcow: dockerized documentation
=> 98%

For 100% see:
mailcow/mailcow-dockerized7208
and create:

nano /opt/mailcow-dockerized/data/conf/postfix/openssl.cnf

postfix = postfix_settings

[postfix_settings]
ssl_conf = postfix_ssl_settings

[postfix_ssl_settings]
system_default = postfix_tls_defaults

[postfix_tls_defaults]
SignatureAlgorithms = rsa_pss_rsae_sha512:rsa_pss_rsae_sha384:rsa_pss_rsae_sha256:RSA+SHA512:RSA+SHA384:RSA+SHA256:ECDSA+SHA512:ECDSA+SHA384:ECDSA+SHA256

restart postfix

Conclusion

While my previous personal email server was a bare bones 768Mb RAM 1 CPU 10Gb storage server with straight Dovecot/Postfix/Spamassassin using barely 300mb of RAM, it had no administrative user interface at all, no contact/calendar sync, and storage/sending limits that I never learnd how to configure with the text files and SSH command line.

Mailcow, with its web-based administration interface and highly secure configuration walk through, is much better. It’s easier to manage, easier to update, and easier to host multiple domains on. I love it!