How to Install and Set Up Mailcow on Ubuntu and Debian VPS

Mailcow is a complete, open-source mail server suite built with Docker. It includes SMTP and IMAP services, webmail, spam filtering, antivirus, calendars, contacts, and an administration panel in one deployment.

This guide explains how to install and configure Mailcow on a fresh Ubuntu or Debian VPS. The commands work on Ubuntu 22.04 or newer and Debian 11 through 13, which are among the operating systems officially tested by Mailcow.

Before You Start

Mailcow should run on a fresh KVM-based VPS, not inside OpenVZ, LXC, Virtuozzo, or another containerized VPS. Plan for at least:

• 1 GHz CPU
• 6 GiB RAM and 1 GiB swap for the default configuration
• 20 GiB disk space before storing email
• A public IPv4 address, with IPv6 configured correctly if your VPS provides it

You also need a domain name, access to its DNS zone, and the ability to set reverse DNS (PTR) for the VPS IP. Set the PTR record to the same fully qualified hostname you will use for Mailcow, such as mail.example.com.

Mailcow uses several ports. Make sure ports 25, 80, 443, 465, 587, 993, and 4190 are available; ports 110, 143, and 995 are also used if you enable POP3 or non-encrypted IMAP. Do not install another mail server, web server, or reverse proxy on those ports first.

Prepare the VPS

Connect to the server over SSH and update the system:

sudo apt update && sudo apt full-upgrade -y

Install the packages required by the Mailcow installer:

sudo apt install -y git openssl curl gawk coreutils grep jq

Check the server clock before continuing:

timedatectl status

The system should report that NTP is enabled and synchronized. If it is not, enable time synchronization with:

sudo timedatectl set-ntp true

Install Docker and Docker Compose

Mailcow requires Docker Engine 24 or newer and Docker Compose 2 or newer. Install the current stable Docker packages using Docker's official installation script:

curl -sSL https://get.docker.com/ | CHANNEL=stable sh
sudo systemctl enable --now docker

Install the Compose plugin:

sudo apt update
sudo apt install -y docker-compose-plugin

Confirm that both tools are available:

docker --version
docker compose version

The Compose command uses a space: docker compose, not the older docker-compose command.

Configure DNS

Create the DNS records before starting Mailcow. In the examples below, replace example.com, mail.example.com, and 203.0.113.10 with your own values.

mail              A       203.0.113.10
example.com       MX 10   mail.example.com.
autodiscover      CNAME   mail.example.com.
autoconfig        CNAME   mail.example.com.

The mail A record is for the hostname used by Mailcow. For each additional domain you add later, create an MX record that points to that hostname.

Add an initial SPF record for the domain:

example.com       TXT     "v=spf1 mx a -all"

After Mailcow is running, generate a DKIM key in the Mailcow administration panel and publish the TXT record it gives you. Add a DMARC record after verifying that SPF and DKIM pass:

_dmarc            TXT     "v=DMARC1; p=none; rua=mailto:postmaster@example.com"

You can move from p=none to a stricter policy such as p=quarantine or p=reject once you have confirmed that legitimate messages authenticate correctly.

Download and Initialize Mailcow

Clone the Mailcow repository under /opt:

sudo -i
umask 0022
cd /opt
git clone https://github.com/mailcow/mailcow-dockerized
cd mailcow-dockerized

Generate the configuration file:

./generate_config.sh

When prompted for the mail server hostname, enter the same FQDN you used for the PTR and A records:

mail.example.com

Open the generated configuration if you need to review it:

nano mailcow.conf

For a standard installation, the generated defaults are usually sufficient. Do not change the service ports unless you already have a documented port conflict. If your VPS has no usable IPv6 connectivity, follow Mailcow's IPv6-disable instructions before starting the stack rather than leaving a broken IPv6 configuration in place.

Start Mailcow

Download the container images and start all services in the background:

docker compose pull
docker compose up -d

Check the containers and follow the logs if the first startup takes a few minutes:

docker compose ps
docker compose logs -f --tail=100

When the containers are healthy and DNS has propagated, open:

https://mail.example.com/admin

The initial administrator credentials shown by the official installer are username admin and password moohoo. Change the password immediately after the first login.

Add a Mail Domain and Mailbox

1. Sign in to the Mailcow administration panel.
2. Open Configuration and choose Mail Setup.
3. Add your mail domain, for example example.com.
4. Create a mailbox such as hello@example.com and assign a strong password.
5. Generate a DKIM key for the domain and copy the displayed TXT record into your DNS provider.
6. Wait for DNS changes to propagate, then send a test message in both directions.

For a typical email client, use the Mailcow hostname for both incoming and outgoing mail:

IMAP over SSL:       mail.example.com, port 993
SMTP submission:     mail.example.com, port 587, STARTTLS
Username:            the complete email address

Use the mailbox address as the username, not only the part before @.

Verify Email Authentication

Before sending real traffic, verify the following:

• The domain's MX record points to mail.example.com.
• The Mailcow hostname has a matching A record.
• The VPS reverse DNS/PTR points back to mail.example.com.
• SPF passes for outbound messages.
• DKIM passes using the key generated by Mailcow.
• DMARC reports are being received and reviewed.

Send a test message to an external mailbox and inspect its authentication results. Services such as Mail-Tester and MXToolbox can also check DNS, SPF, DKIM, DMARC, and blacklist status.

Secure and Maintain Mailcow

Enable two-factor authentication for the administrator account and use a unique password. Keep the Mailcow directory and its Docker volumes backed up; containers can be recreated, but mailbox data and configuration still need a recovery plan.

To update Mailcow later, read the current release notes first, then run the project's update workflow from the installation directory. A typical update starts with:

cd /opt/mailcow-dockerized
git pull
./update.sh

Do not remove Docker volumes when troubleshooting or updating. They contain your mail data.

Troubleshooting

Port 25 is blocked

Some providers block outbound SMTP on new VPS instances. Check the provider firewall and request SMTP port 25 access if necessary. Also confirm that no local service is already listening on port 25:

ss -tlpn | grep -E -w '25|80|110|143|443|465|587|993|995|4190'

The SSL certificate is not issued

Verify that the hostname resolves to the VPS, that port 80 is reachable from the internet, and that the hostname entered during generate_config.sh matches the DNS record. Check the ACME logs:

cd /opt/mailcow-dockerized
docker compose logs --tail=200 acme-mailcow

Mail lands in spam

Check PTR, SPF, DKIM, and DMARC first. A new IP address may also have little sending reputation. Keep the server's hostname consistent, avoid bulk sending, and monitor bounce messages and blacklist listings.

Frequently Asked Questions

Can I install Mailcow on a small VPS?

Mailcow is a complete groupware stack rather than only an SMTP server. The official minimum is 6 GiB RAM plus 1 GiB swap, while 8 GiB RAM is a more comfortable starting point for a small private installation.

Can I use a domain different from the Mailcow hostname?

Yes. The hostname such as mail.example.com identifies the Mailcow server. You can add other domains in the administration panel and point their MX records to that hostname.

Do I need a reverse proxy?

No. A standard Mailcow installation includes its own web server and ACME certificate handling. If you put another reverse proxy in front of it, follow Mailcow's reverse-proxy documentation and avoid port conflicts.

Is Mailcow suitable for production email?

It can be, but deliverability depends on DNS, reverse DNS, IP reputation, authentication, backups, monitoring, and provider policies. Test the complete setup before migrating important mailboxes.

Get Started

Deploy a fresh CloudBlast VPS with enough RAM and disk for your mailboxes, set its reverse DNS, and follow the steps above to run your own Mailcow mail platform. Review CloudBlast plans and pricing to choose the right server size.

For the latest version-specific requirements, always check the official Mailcow installation guide, system prerequisites, and DNS guide.