1. Prerequisites
- Debian 12 server (fresh install recommended)
- Root or sudo access
- At least 2 vCPU, 4 GB RAM (8 GB recommended), 40 GB storage
- A domain name (e.g. example.com)
- DNS access for your domain
- Ports 25, 80, 443, 587, 993, 995 open
2. System Preparation & Updates
sudo apt update && sudo apt -y full-upgrade
sudo reboot
Optional: set correct timezone.
sudo timedatectl set-timezone Europe/Paris
3. Install Required Packages (Docker, Docker Compose)
sudo apt install -y curl git apt-transport-https ca-certificates gnupg lsb-release
# Add Docker’s official GPG key
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/docker.gpg
# Add Docker repo
echo "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/debian $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list
# Install Docker & Compose
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
# Enable & check Docker
sudo systemctl enable --now docker
sudo docker --version
sudo docker compose version
4. Get Mailcow Source
cd /opt
sudo git clone https://github.com/mailcow/mailcow-dockerized
cd mailcow-dockerized
5. Configure Mailcow (docker-compose configuration)
Run setup script:
sudo ./generate_config.sh
You will be asked for:
- Hostname (e.g. mail.example.com)
- Timezone
- Optional mail volume path
This generates mailcow.conf.
6. Adjust Hostname, DNS, and Reverse DNS
- Ensure server hostname resolves:
hostnamectl set-hostname mail.example.com
- Set correct A record in DNS: mail.example.com → your_server_IP
- Set PTR (reverse DNS) via provider panel: your_server_IP → mail.example.com
7. Start Mailcow Stack
sudo docker compose pull
sudo docker compose up -d
Check status:
sudo docker compose ps
8. Enable HTTPS with Let’s Encrypt
By default, Mailcow auto-requests Let’s Encrypt certificates for your hostname if ports 80/443 are free.
- Ensure DNS is propagated.
- Access https://mail.example.com after ~5 minutes.
If not issued, check logs:
sudo docker compose logs acme-mailcow
9. DNS Records Setup (MX, SPF, DKIM, DMARC)
Set in your domain DNS:
- MX Record
example.com. IN MX 10 mail.example.com.
- A Record
mail.example.com. IN A your_server_IP
- SPF (TXT Record)
example.com. IN TXT "v=spf1 mx -all"
- DKIM: Generate via Mailcow UI → Configuration → ARC/DKIM Keys → publish in DNS
- DMARC (TXT Record)
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
- Autodiscover/Autoconfig (optional for clients)
autodiscover.example.com → mail.example.com
autoconfig.example.com → mail.example.com
10. Firewall Configuration
Allow only required ports:
sudo apt install -y ufw
sudo ufw allow OpenSSH
sudo ufw allow 25,80,443,587,993/tcp
sudo ufw enable
sudo ufw status
11. Securing and Hardening Mailcow
- Enforce HTTPS (done by default)
- Enable Fail2ban (Mailcow has Rspamd protections built-in)
- Use strong passwords + 2FA in Mailcow UI
- Regularly update containers (docker compose pull)
- Monitor logs for brute-force attempts
12. Backups & Updates
- Backup volumes in /var/lib/docker/volumes/mailcowdockerized_*
- Stop stack before full backup:
sudo docker compose down
sudo tar -czf mailcow-backup.tar.gz /var/lib/docker/volumes/mailcowdockerized_*
- Updates:
cd /opt/mailcow-dockerized
sudo git pull
sudo docker compose pull
sudo docker compose up -d
13. Monitoring & Troubleshooting
- Check logs:
sudo docker compose logs -f
- Check individual service:
sudo docker compose logs postfix-mailcow
sudo docker compose logs dovecot-mailcow
- Restart a service:
sudo docker compose restart rspamd-mailcow
14. Useful Tips
- Use admin account to log in → https://mail.example.com → Credentials in mailcow.conf
- Enable SOGo webmail: accessible at /SOGo path
- Use ActiveSync/IMAP/SMTP on Outlook/Thunderbird
- Monitor via /api/ endpoints or built-in dashboard
15. Final Checklist
- System updated and rebooted
- Docker & Compose installed
- Mailcow config generated
- Hostname + DNS + rDNS correct
- Mailcow containers running
- HTTPS working (Let’s Encrypt)
- DNS records MX/SPF/DKIM/DMARC set
- Firewall restricted to mail ports
- Backup strategy in place
- Logs monitored
Your Mailcow mail server is now up and running on Debian 12!