Once upon a time there were many mail servers on the internet. If your organisation wanted to receive and send emails then you would have your system administrator set up a mail server. He would add a DNS record and create a cryptic Sendmail configuration file. Fast forward a few decades and suddenly we have arrived in the cloud ages. The world of internet services is dominated by a few monopolistic companies. Having worked in IT for 25 years I feel frustrated about the ignorance and laziness of decision makers. Cloud providers rip obscene profits while IT staff is evolving into dumb customers instead of doing their actual job.
If you are like me then you want to stay as independent as possible. And that includes being in charge of your own email service. Maybe not for your employer but at least for yourself, your friends and family. Become your own internet service provider (ISP) for email. Hence the name: ISPmail.
This is a complete and free guide that teaches you how to set up and run your own mail server. At the end of the guide you will have your own fully featured mail server based on open-source software using a cheap virtual 5€ server. And you will have learned all about the various components, protocols and technologies. This guide has been battle-tested by thousands of other sysadmins and constantly evolved over the last 20 years. I am publishing this guide without any commercial motives, so all you would have to invest is your time.
What your mail server can do
- Receive emails on your domains.
- Filter out spam. (We will not deal with detection of Wind*ws malware though.)
- Send emails out to any other servers/domains on the internet. Connections will be encrypted when possible.
- Add automatic cryptographic signatures (DKIM / Domain Keys) to outgoing emails to prove that you are the owner of your domain.
- Store as many emails for as many email addresses as you have disk space. Set limits (“quotas”) per user. The only limit is the size of your disk.
- Let your users fetch email using IMAP or POP3 and send email through your servers using SMTP.
- Allow users to manage server-based filter rules. Distribute incoming emails to different folders. Forward copies. Or send out-of-office notifications.
- Provide a webmail interface so users can access their emails securely from any location using a web browser.
- Mitigate brute force attacks.
What you will need
- Linux experience. Preferably a Debian-derivative. No godlike skills required. But know your basics: navigating through the file system, editing files, watching log files. Have some basic understanding of DNS. Bonus points if you have played with an SQL database and know about SELECT, INSERT, rows, columns.
- Time. 2 hours to 2 days.
- A server that runs Debian Bookworm. 1 GB of RAM and a 20 GB disk/SSD is fine for your friends and family. Rent a cheap virtual server. Or use a decommissioned laptop. Other Linux distributions likely come with other versions of the software and have different configurations and paths on disk. It will work but you will need to deviate from this guide.
- The provider providing you with the server needs to allow SMTP send and receive. These providers are known to be troublesome:
- Hetzner (DE, FI, US): Will allow SMTP after a month of paying for their service and per a request issued at https://console.hetzner.cloud/limits
- DigitalOcean (US): Blocks SMTP and tells you that running your own mail server is a bad idea. Avoid.
- Your server needs to have a public IP address that does not belong to a range of typical ISP customers. You usually can’t operate the mail server from a dialup IP address at home because those IP ranges are blacklisted by most other mail servers. Make sure that your IP address is not blacklisted before you start. If you rent a virtual server from your favorite hosting company you probably won’t have any problems.
- An internet domain (or several) to receive emails for. You need to be able to set A, MX and TXT records for that domain. You should also be able to set PTR records for your IP address because some mail servers on the internet require you to have matching forward and reverse DNS records.
- Patience. We will proceed slowly and after every step ensure that are still on track. Don’t hurry and skip parts even if they appear confusing at first. If you get lost just submit your question at the bottom of any page throughout this guide and help is on the way. Or join the chat channel.
What this is not about
If you just want to have a working mail server and do not care how it works then this guide is not for you. Check out ready solutions like mailinabox or iRedMail. Running a mail server requires technical understanding. And that’s what the ISPmail guide is for. Experience from giving support to other sysadmins shows that most problems appear because some detail in a complex setup goes wrong and they have no idea how to fix it. Email has evolved a lot over the past 40 years. Go with ready solutions if you like. But I have a feeling that we meet again. And you will probably not save time either taking the supposedly easy route.
Ready?
The entire tutorial is split into several pages. Please use the links on the right side to navigate through the pages. Let’s go.
Congrats to the new Bookworm guide!
Hace pocos días me di una vuelta y me decía “sería interesante la guía actualizada y usando PostgreSql o LDAP”, claro que habrá otras propuestas y sabrás escoger las mejores. Al margen, muchísimas gracias por tu ayuda.
PS: I have written in my native language because I am from Ecuador, in this way I hope you see the tremendous reach of your contribution, thank you again.
Thanks so much for your latest guide, Christoph.
By far the best mxserver guide I’ve ever come across. Have learned much from your site over the years. Regards, Bryce, New Zealand.
Tx a lot
Hello Christoph,
I am using your guide since decades. I have look at the date from first mail I sent and receive with my own mailserver. 1.3.2004. So in 3 months it is 20 years.
Your guide is nearly perfect. In 3 or 4 weeks I will migrate my old server to a new one. With your guide it is no problem.
Thank you
Olaf
Urgent update notification! See:
https://www.postfix.org/smtp-smuggling.html
The Wietse Postfix Debian fix is out already, but needs further fitting in main.cf
@ CCC, 37C3, Timo Longin about
https://media.ccc.de/v/37c3-11782-smtp_smuggling_spoofing_e-mails_worldwide
Happy fixing
What are some options for a VPS host? I’ve been researching but many either block port 25, don’t offer Debian Bookworm, or have been sold/rebranded. As of writing I’ve looked at LithiumHosting, SwissMade, Linode, 1&1/Ionos, and Hostinger.
In Germany I would probably go with Netcup if you don’t mind that they don’t do backups for you. IONOS is damn expensive, and they have developed from a nerd company to an annoying sales company. Plus the kind of backup they offer is worse than no backup. I personally like Hetzner because they offer great service and features for a low price – you just have to wait a month if you aren’t a customer yet.
The motivational section for the Bullseye version of this tutorial was great. It needs to be emphasized that this not just “allows you to run your own email server”, but why you should run your own email server. Because running an email server is not a very easy task, regardless of how much knowledge you have. You also lose those office- and groupware-like integrations if you do that.
Therefore, the benefits of running your own email server and, preferably, mechanisms to work around these problems, or how to cope with them, imho need to be highlighted.
Hi Christoph,
have you at one point tried to setup Dovecot OAUTH2 authentication? Would be interesting to for getting 2-factor authentication running in this setup.
Thanks for your tutorials, they have been great from the beginning.
Congratulations Christoph on creating and maintaining this amazing and well structured email encyclopedia, which is essentially becoming an integral part of internet history!
I have noticed that this latest guide does not delve too much into Fire-walling and brute force mitigation / fail2ban usage etc.
Is this less important with the new setup? should we still look into installing fail2ban and other defensive measures not yet mentioned on this latest guide?
If that’s the case, creating a dedicated page for server security and vulnerability management could be highly beneficial.
Fail-to-ban is no less important now than it was previously. It is easier to set up as most of the necessary scripts/config files are built-in now.
FYI, I think the 1 GB RAM requirement is too low. I use 2 GB and this is still too low, even with a 4 GB swapfile, due to redis used by rspamd. Occasionally the OOM killer kicks in and kills redis…
That’s interesting. I just checked my personal server that is used for friends and family. And so far I was too lazy to tune Redis and MariaDB. They are eating way more RAM than needed.
MariaDB: 1200 MB (also used for other purposes on that server)
Redis: 230 MB
Apache: 200 MB
rspamd: 150 MB
Postfix: 15 MB
Dovecot: 20 MB
Whatever the exact numbers are, you have a point here. I should spend a little time tuning down the processes. After all I start to realize that most of us in fact just use the server for friends and family… and not huge corporations. Or aren’t we? 🙂
I’m hoping to glean some info on how to set this up whereby the VPS is the mail gateway which will transport/relay mail in/out from the main “backend mailbox server” hosted elsewhere. Ideally the mail gateway would also reverse proxy Roundcube, etc. to the “backend mailbox server”.
ISPmail is not what you’re looking for as a dummy relay (although it could work, it would be a massive overkill).
ISPmail is oriented towards the back end while something like OpenSMTPD or Postfix would probably make a more suitable relay.
nginx may be able to forward both HTTP and SMTP/POP3/IMAP requests directly to your backend server(s) unless it is running something evil (i.e. Exchange Server).
https://docs.nginx.com/nginx/admin-guide/mail-proxy/mail-proxy/
I can only join the chorus of thanks for this precious tool kindly offered to us. I am not a system administrator but despite this I managed to follow and understand the guide, to the point of modifying some instructions to manage my case: nginx, postgresql, SNI, fail2ban and nftables coexist harmoniously in a cloud server that allows me to manage three domains of as many companies, (plus some domains through the use of aliases).
Thank you Christoph Haas for allowing us to keep the torch of freedom high.