The ISPmail guide

A complete and educational guide to running your own mail server on Debian

The famous ISP-style mail server tutorial lives here. Learn how to set up your own fully-functional mail server using Postfix, Dovecot IMAP/POP3 and MySQL backend on a Debian server just like your favorite mail or website hosting provider. This guide is a voluntary project with no profit in mind.  Go ahead and learn to run your own mail server.

    For historians here are the previous versions for Debian Buster, Debian Stretch, Jessie, WheezySqueezeLennyEtchSarge and Woody.

    This is a complete and free guide that teaches you how to set up and run your own mail server. At the end of the guide you will have your own fully featured mail server based on open-source software using a cheap (virtual) server. And you will have learned all about the various components, protocols and technologies.

    This guide is free. There is no catch. I am publishing this guide without any commercial interest. My motivation is to get more people away from centralized email services. The internet wasn’t meant to run on services offered by only few monopolistic companies. People have become lazy and stopped caring. But running your own server must not become a forgotten art. As IT managers blindly follow the hype to put everything into the “cloud” we sysadmins get stupider by the day. If the trend continues only few people will know how to run a mail server while everyone else is degrading into stupid consumers. Don’t let that happen to you.

    So what will the mail server cost you? The only recurring costs you may face are for running your mail server and for renting a domain. Cheap virtual servers are usually available at around $5 / 5€ per month and have enough space to run a mail server for your friends and family. The software being used is completely free and open-source. You can even sell your service if you like. After all it is called “ISPmail” (ISP = internet service provider). Are you a sysadmin and your organization needs a mail server for a few hundred users? Go with this guide. It has been battle-tested by thousands of other sysadmins and constantly evolved over the last 20 years.

    211 thoughts on “ISPmail tutorials”

    1. Hello Christoph, this is really nice and clean. I know you’ve been critical of WordPress in the past, but I use it more and more for sites now and I think you’ve made a wise choice.

      Very nice.

      Personally, I found Drupal a disjointed nightmare and I won’t have anything to do with it any more.

    2. Thanks, Paul. In fact I was very sceptical because I had two customers with compromised web sites. And I assume they got hacked due to some outdated or badly maintained third-party plugins. Otherwise I have to agree that WordPress has come a long way. Its built-in features are way better than was Drupal comes with. And although I don’t really like PHP and have hardly done any programming with it it seems that adding functionality is not harder than what Drupal “views” have to offer. Sounds like its time for some educated blog post about Drupal versus WordPress. I really hope that Drupal 8 turns the corner.

      1. I hope this is the right place to put this. If not I apologise.
        I am also very aware that you do this in your own time. I am also aware that detailed answers to points I have raised would require significant effort. I raise them because perhaps they are things you may wish to include in due course. Any answers are appreciated.
        I created a mailserver a couple of years back using your excellent tutorial.
        In fact I am running it on a supermicro atom box xen dom1 vm with jessie.
        It’s been very good. It is only me that uses it because in the event of a problem it will only be me that suffers. however…
        I am a OpenVMS C SQL blah blah developer by trade but have a little linux, and a bit of technical knowhow.
        The time has arrived for an upgrade.
        It must be written in the stars that the time is right because “lo and behold” along comes your real jessie install tutorial.
        This I intend to follow as I have the memory span of an amoeba and have forgotten most of what was done before.
        Before I start however, I thought I would raise a couple of hopefully interesting points and ask a couple of questions that illustrate very well that I am not entirely sure what I am doing.
        1/ How easy is it to make your mailserver fault tollerant/failover capable (maybe over multiple internet locations)
        2/ How can the server be monitored against potential hack attempts
        3/ exactly which ports should I open on my routers to allow only mailserver traffic?
        4/ is it easy to allow only mailserver IO on eth1 and machine db management on eth0?

        and lastly something specific to my installation although it may be true for others
        I have a D Telekom connection and also a VPN lnk to the UK for watching TV mainly.
        I find that I can access my mailserver from through the VPN and also from my handy but not if I go straight out through my DT connection (the same as the server sits on).
        Would you have an idea about this?

        Thanks once again for the tutorial. It is by far the best I have come across.

        1. Christoph Haas

          Hi Mac. Nice to see someone who voluntarily deals with VMS. I remember it from University and although back then I had neither experience with VMS nor UNIX I found VMS the most crazy OS I could imagine. 🙂

          Anyway. Regarding your questions.

          1/ Mail server should indeed be fault tolerant. At least the MX relays that accept email from other internet servers. I’m running such a setup myself but it was out of the scope of the ISPmail guide. But perhaps I should try to at least explain the concept on an additional page. Actually all you need is two basic servers running Postfix that either have a fresh copy of the database or be in a master/slave relationship. Those relays would then forward legitimate email to your Dovecot server. Of course that won’t make the Dovecot instance, the database or the disk storage for the emails fault tolerant. A large ISP would probably use a proper FibreChannel SAN and multiple Dovecot servers. But that’s a concept I haven’t needed before. That doesn’t mean I’d be keen to one day work for an ISP and set up something like that. 🙂

          2/ Hack attempts should just occur in terms of authenticated SMTP or using POP3 or IMAP. I personally use the “fail2ban” package for that purpose. I realize I haven’t yet finished the page for the Jessie tutorial. But you may want to look here:

          3/ Traffic between servers: TCP/25 both directions. Connections from your mail users: TCP/587 incoming (however I have not yet described how to open up that port – will do that soon). Allow DNS requests: UDP/53 outgoing (or both ways if your firewall has no connection tracking). IMAP incoming (TCP/143). POP3 incoming (TCP/110) if you want to offer POP3.

          4/ Yes. In Postfix the setting is called “inet_interfaces”. Set it to eth1 and there will be no TCP listener on eth0. Dovecot has a “listen” directive in the /etc/dovecot/dovecot.conf file that allows you to specify the IP address on your eth1 interface.

          5/ So you mean you can’t access your mail server at TCP/25? Could be that your ISP is blocking that port. Then you could talk to your ISP (probably pointless) or move the server to another ISP.

          1. Ahh… VMS. Created by visionaries. Undone by marketing. Slow death by licences. Death may yet be postponed indefinitely… Pause for sad violin…
            But let us move on.
            Thanks for the info. I will check out the fail2ban.
            I do infact have some fibre channel stuff. Thus far I have not attempted to get it going via linux. This was in fact what I thought you would suggest and why I realised that the full answer was not going to be a short one. When I have upgraded I will attemp to experiment. It should also be possible via NFS should it not? My linux is very weak so I am not sure how to do this. Actually I am not entirely sure which file system linux can use to cope with multiuser multi machine access. ext3?? nfs?? A pity we cant run the openVMS file system. THere is GFS I have read but most people think this is overkill.
            I am rambling…
            Concerning the ports. I am somewhat confused.
            I do not run SMTP but use the Telekom SMTP server with reply-to set, otherwise they block mails I send out.
            I seem to be able to send to and read from the server with only ports 25 and 993 enabled. I did have 25,143,465,587,993 and 995 enabled but recently the Telekom modem failed and so by trial and error I found that these two seem to be all that is required for my client.
            In fact I can read the server with only 993 open.
            But only if I have the VPN to England running (or I access the server from my handy).
            If the VPN link to the UK is down and all traffic goes through Telekom it does not work. This was true with all the above ports open. I wondered if Telekom were not allowing me to send out a request which involved a direct loop back.
            Anyway it is much too late so once again thanks for your info. I will let you know the results of post jessie upgrade experiments.

            1. You could use dsync (, director/NFS ( You should also look at

              If I can understand you correctlly, you can not access your server from inside of your private network and server is inside your network? If that is true, than there is a problem with router config as it only routes outside-to-25->inside-node-25 and not inside-to-25->inside-node-25 … try to make a new rule that routes whatever comes from inside for a specific IP it shold route it to internal server. It also seems that you have your gateway set via VPN when connected and this way you acces it from outside?

              Port no.:
              – 110 .. POP3
              – 995 .. POP3S
              – 143 .. IMAP
              – 993 .. IMAPS
              – 25 .. SMTP
              – 465 .. SMTPS, secured by SSL (legacy)
              – 587 .. MSA, can be secured by STARTTLS command

              I would set it up to use MSA and IMAPS ports externaly and SMTP internal for server clients.

    3. Relaunched site looks great. Not being very familiar with WordPress it is nice to see what it can do. Also, thank you so very much for all the work you have put into not only the ISP Mail tutorials, but all the other stuff as well. You truly embody the spirit of Linux 🙂

      1. Christoph Haas

        Thanks for the nice words. Yes, I believe that I have in fact found a pretty nice theme for WordPress and slightly improved it. WordPress has some concepts that need some getting used to. But so far several people told me that they enjoy the clear new look. I second that. And I have removed some ancient articles that are a bit outdated and might rather be misleading. Interesting to see that still 90% of the hits to the ISPmail tutorials. And strange enough… most of that 90% are for outdated tutorials. 🙂

    4. Can you provide an approximately date, when the new tutorial for Jessie will be ready? 🙂

      1. Christoph Haas

        Yes. Roughly in a week. I’m serious. The concept is done. My test server is in production for two weeks now. The first 5 pages of the ISPmail Jessie guide are already finished. I intend to finish at least one page a day so that next week is my intended deadline.

        1. Keep working 🙂 I’m sure I’m not the only one, who is waiting for this doc. I’ve got already Jessie in production, but I will fine-tune it with pleasure.

    5. You’re not the only one who is waiting the new doc; I can’t wait to see the new tutorial on Debian Jessie and test it. Good job Christoph!

    6. While researching another issue, I came across these two (potential) statements.
      # add to the end: limit an email size 10M
      message_size_limit = 10485760
      # limit mailbox 1G
      mailbox_size_limit = 1073741824
      Having said that, it was for a straight postfix configuration, rather than the one described here. So my question is, would they work in this configuration? As it’s an easy way to limit message and mailbox sizes.

      1. Christoph Haas

        Setting the message_size_limit is a good idea. You can even use 40 MB which seems to be the common size that is allowed by most mail servers.

        The mailbox_size_limit does nothing in the context of an ISPmail setup though. It only applies to email that is delivered through the “local” agent. In other words: email that is stored in /var/mail/$USER. If you want to enforce quotas you would have to do that in Dovecot. See:

    7. ISPmail tutorial using Postfix 2.11 will be released today? I am planning to setup this server.

      1. Christoph Haas

        Yes. I’m working on the two final pages. Everything has been tested thoroughly and I’m planning to put the tutorial online in 2-3 hours.

    8. Hi Chris,
      my setups are done i am able to send the email but i can’t receive any emails. Do you think you can help me ?

    9. Delivery to the following recipient failed permanently:

      Technical details of permanent failure:
      Google tried to deliver your message, but it was rejected by the server for the recipient domain by [].

      The error that the other server returned was:
      550 5.1.1 : Recipient address rejected: User unknown in local recipient table

      1. Christoph Haas

        That means you didn’t have that user in your database. Also check that is defined as virtual domain and not in “mydestination” for Postfix.

    10. Hello! Is it possible that you will different process for the Nginx web server instead? That is my configuration and I’m worried it will all be for nothing if I follow step by step. Thank you. Also, what is the optimization level?

    11. Hello Chris,

      I’m using a mailserver system based on your tutorial for years now. (Since your Sarge tutorial). It works like a charm.
      I have a few users on my system that can send mails. I have no control over their password behaviour. So in the past sometimes a mail account gets compromised. I normally recognize that by the amount of mails are sent by the server and I shut it down and block that account. But in the last few months this problem increased and I recognize the problem to slowly.

      Do you have a simular problem in your setup? Have you found a solution? Maybe scanning outgoing mail with spamassin?

      1. Hello Chris,
        First of all, thank you for this great tutorial! It has saved me many hours.
        I have the same problem as the person above: around ~1000 accounts and a lot of users have Windows. Once in a while, they get hacked and their accounts are used for sending spam. The mailserver gets on blacklists and users are complaining about mail not arriving.
        My guess is their passwords get sniffed/keylogged when entering them for login in Roundcube. Or their mail client gets compromised.
        Are there any solutions for this? Scanning outgoing mail and/or limiting the daily amount of outgoing mail? Or some automated solution where the password gets reset when spam is detected and the user had to choose a new password after being blacklisted for a while.

        BTW, do you have a Bitcoin address for a donation?

    12. Hi,

      I was wondering if you could provide the Debian Jessie tutorial as a PDF similar to your archived legacy releases. It would be nice to have a paper copy to read when I am away from the computer – and just for static reference purposes.

      Thank you for taking the time to do this.

    13. Hi Chris,

      I really love this email setup. you have really made it more then easy to understand and setup a mail server in a secure and stable way.

      one question for me remains unanswered, and that is: How can we save incoming email encrypted on the disc? and also include the send items to be encrypted.

      i know postfix and dovecot support sieve, so would there be an option to do some on the fly encryption with a public key. so that only the email clients with the private key can open the mail in the mailbox.

      any thougts on this?


    14. Christoph, your ispmail tuts can not be accessed.
      They all give a page not found error.
      Please fix that for us.


          1. I can’t access them either. Other parts of your site are affected as wellm, it’s the first thing I checked. I can access some of your thoughts like “Your privacy checklist for the post-cloud era” for example but others like “Reverse Social Engineering” return the same error as the ISPmail tutorials.

            1. Christoph Haas

              Alright, I see the problem. I’m on it. Thanks for the hint.

            2. Christoph Haas

              Problem is fixed. Apparently a plugin I use for the CMS was automatically updated and broke many pages. Unfortunately that happened to sites all over the world. And the plugin author suddenly has stopped supporting it. Sometimes I hate CMSs.

            3. Thanks a lot! Now I can finish setting up dovecot and maybe the rest of my first very own mailserver. So far everything has been going smooth.

    15. The DKIM section for 2.9 cannot have replies/thoughts and is a bit confusing/broken.

      dkim-filter is now opendkim and a lot of the filenames have been changed.

    16. Hey Christoph,

      I like your tutorials. I’ve a suggestion; why don’t you turn this particular guide into some sort of book. It can help those readers who might need it for offline access.

      1. Christoph Haas

        I totally like the suggestion and I’m not against it. Problem is that WordPress (that fuels this web site) has no feature to merge multiple pages together. There might be an add-on to do that but I haven’t yet found it. Formerly I used Drupal that allows to PDF-export an entire branch. I’ll give it another look…

        1. Could we give it a try using LaTeX? The questsions from the users can be added at the end of each chapter as a Q&A section or inline with the text as useful remarks or “Watch out!” messages.

          Slightly related, have you read and/or can recommend any of the existing books out there?
          – Email Architecture, Design and Implementation (by Kevin Thomas)
          – Dovecot: POP3/IMAP servers for enterprises and ISPs (by Peer Heinlein)
          – SpamAssassin (by Alan Schwartz)
          – Postfix: The Definitive Guide (by Kyle Dent)

          1. Christoph Haas

            The problem is rather exporting multiple pages into a single file. Whether we put LaTeX in between doesn’t bring that further I believe.

            And, no, I haven’t ready any of those books. 🙂

    17. This may help:

      though it’s specific to whatever page id’s you write into the script.

      You could pull the pages, convert the “single” page to a pdf file and then offer it for download – amongst the million other things on your todo list 🙂

      There could also be a relatively modest cost for it as a reward for your incredible work and to help the running costs of I’m sure there’s many who would happily contribute for a “hard copy” of your work.

      I hope it’s useful.

    18. Hi,

      first of all thank you for the instructions.
      I enjoyed running a private mail server following these for more than two years.
      Now I want to switch to a different VM. My plan is to set up a new server and in the end point the DNS entries to the new machine.
      Do you have any tips or instructions for this to become a success? How do I, for example, get the mailboxes and all the postfix and dovecot settings to the new machine?

      Thanks in advance,


    19. Who do you want to gift for nba hats cheap? Get value into the
      page: Nike Browns 21 Justin Gilbert Orange Alternate Women Stitched NFL Elite Jersey

    20. For strech I would love to see an updated tutorial with the use of mdbox and a migration path from Maildir 🙂
      Great tutorials so far! Started with etch, migrated to lenny and wheezy and finally ended up on a jailed FreeBSD machine 🙂

      Thanks for your effort spent so far,


      1. Christoph Haas

        Nice idea. But there aren’t any. There are topics that are nice to digest with a glass of wine and a bag of potato chips while sitting on the sofa. But this topic appears to work better with good old text. Besides the documentation is a living piece and changes a lot. Re-editing videos is a pain. I’ve been doing a video series on Zabbix already so I know how little fun it can be.

        1. CHANDAN KUMAR

          Sir, you should try and make this webmail tutorial i believe like this amazing tutorial
          till today nobody upload. it’s very useful for beginner and also grsoft mail manager tutorial no have any other website so sir please make it and uplod it ..

    21. joaquim lopes

      I am agree with you admin should have to make video tutorials. it’s very useful for webmail users who wants to make own server..

    22. Hi Christoph Haas,

      you should really consider in adding postscreen functionality into the postfix tutorials.
      if you need any help on that, let me know

      Thanks for your great work


      1. Christoph Haas

        Eelke… to be honest I haven’t even heard of postscreen yet. Sounds very interesting. If you could help me write the Stretch tutorial (no, it’s not yet ready) that would be great.

        1. Hi Christoph, Please contact me at the email adress used in this comments form or give me yours. so we can discuss on how to set this up.
          It would really be a nice addition to this tutorial, so i’m willing to contribute to it 🙂

          Let me know


        2. Brandon Hartshorn

          Hi Christoph,

          Your tutorials here look superb, thank you for all of your effort. I look forward to setting up my own email server soon. Do you have an ETA for the new Stretch tutorial? I’m just trying to decide between waiting for the new one (I realize Stretch has only been out 1 week) or just setting up on Jessie.

          Thanks again.

        3. Rob McGee (/dev/rob0)

          Hi Signum,

          You’re welcome to link to or to grab from my howto,

          Personally I don’t see it as something to add here, but rather, a separate howto. Just as not all sites need mysql user/domain management, likewise not all sites need the same kind of spam control. And DNSBL choices can vary as well. Especially since your howto is targeted at ISP-level users; they would usually need a Spamhaus (and data feed, which costs money.

          Regards, rob0

    23. Rob McGee (/dev/rob0)

      Hi Signum,

      You’re welcome to link to or to grab from my howto,

      Personally I don’t see it as something to add here, but rather, a separate howto. Just as not all sites need mysql user/domain management, likewise not all sites need the same kind of spam control. And DNSBL choices can vary as well. Especially since your howto is targeted at ISP-level users; they would usually need a Spamhaus (and data feed, which costs money.

      Regards, rob0

    24. Hi Christoph,
      your tutorial is fantastic and it works perfectly, but i have a question for you, I don’t find any reference for configure email space (quote).
      Do you have any tip for me, I find something on dovecot wiki, but I’don’t want destroy all.

      1. Christoph Haas

        Hi Silwestro. Glad to hear that your mail server works well. Quota hasn’t been an issue for the mail servers I had to deal with. So I was too lazy to document it. But I wouldn’t worry too much. In fact you just need to add fields/columns to the virtual_users table and tell Dovecot about it. The worst that could happen is that email is rejected. To avoid that just set “soft_bounce=yes” for Postfix so that even rejected emails will stay in the queue so you have a chance to fix it.

        I will make sure that the Stretch tutorial contains a section on quotas.

    25. Nicolas Derive (kalon33)

      Dear Christoph,

      Thanks for your very useful tutorial that I use for years. Would it be possible that you provide some steps to share imap folders between some users from a domain (based on your tutorial)? I’m especially looking for a way to use an email alias to forward emails to a shared imap folder. My use case is dealing with everyday family emails with my wife, that would probably benefit to other people.

      Thanks for your help!

    26. Justin L. Franks

      Hi Cristoph,

      Thanks so much for these mail server walkthroughs. I’m an experienced sysadmin and MySQL database administrator, but up until a few years ago I never had to set up a fully-functional mail server (just needed to get a working setup to send mail to the outside world). Through your tutorials I have learned so much about running a mail server, and because of your help, I have successfully set up about a dozen mail servers on Wheezy and Jessie, a couple for my own usage (which I deviated from your guide in a few places to get things exactly as I wanted), and several for others (which I followed the guide precisely, because the setup it provides was sufficient for their needs).

      Email is one of the more complex things for a sysadmin to learn, and without you, I wouldn’t have gotten to where I am now as quickly as I did.

      I have a new VPS running the recently-released Debian 9 (Stretch), and am anxiously awaiting the release of your Stretch tutorial. I could probably figure things out on my own pretty easily, especially as it seems like Postfix 3 has a compatibility mode to work with 2.x configs, but I would rather wait until your walkthrough is published.

      But if there is any way that I can help with the Stretch tutorial, please let me know. Anything from researching the differences in the versions of the software included in Stretch, figuring out what is necessary to take a working setup with Jessie and upgrade it to Stretch, testing the unfinished guide and reporting back any issues, to simple proofreading of the text, it doesn’t matter. I know that a lot of people are patiently waiting for the new guide, and since you have already helped me quite a bit, I just want to help in whatever way you need.

      Please let me know if you would like any assistance, and thanks again!

    27. Christoph Haas

      Hi Justin,

      thanks for the feedback. The complexity of email is really crazy. That’s what you get when you start in a friendly small internet world and then things start to get big and wild. 🙂

      I intended to finish the Stretch guide during my vacation. Unfortunately my wife had different ideas on redecorating the house and garden. So my vacation is over and I didn’t write a single line. Bummer. However I have a Stretch-based server running already and it’s all not that hard. Give me a few rainy days and it’ll get further. I’ll ask for help and beta testing once I’m ready. Thanks for the offer.


      1. Hello Christoph,
        How is the Stretch tutorial going on? Can’t wait to read it and use it on my new server 🙂
        Best regards,

    28. Thank you for these great ISPmail tutorials!
      I know that you haven’t finished the Stretch tutorial yet, but do you already have some information about what will be different from the Jessie tutorial?
      When do you expect to have the Stretch tutorial finished?

    29. Christoph Haas

      Hi Simon. I have to get an update for out first because there are a couple of annoying bugs that I need to tackle. Then next on my list is the Stretch guide. I just have a sample installation and a couple of things on my todo list that I’d like to include in the next guide:
      – Quota
      – Migration to MariaDB (however to be honest I’d like to get rid of MySQL stuff altogether and move to PostgreSQL. I don’t want to annoy anyone though so perhaps I’ll just support both)
      – DKIM (DomanKeys)
      – SPF (and warning people to use it with extra care)
      – Let’s Encrypt for certificates
      – Warning about the use of virtual_aliases to send to external domains because it will forward spam and make your mail server become less trusted which can get a huge problem delivering email e.g. to Google
      – Proper use of SMTP client TLS in Postfix

      I will read through all comments and emails of the past two years though and see if there are any pressing matters and features that should be included.

      1. René Fleschenberg

        Hi Christoph,

        Great to hear you are still actively working on this. Postgres support would be great!

        I’d be willing to help out, in particular in the areas of an Ansible, playbook and with the management interface. I am currently working on a django-based management interface. Drop me a line if you need any help. Did you consider publishing the next version of the tutorial on Github or such, so that people can contribute?


        1. Christoph Haas

          Okay, then let’s add PostgreSQL. 🙂

          Helping with Ansible testing and features would be nice. I wouldn’t mind another managament interface either. With Django it’s at least easy to leverage different DBMSes.

          The tutorial is written as usual here on the website (running on WordPress). It’s the easist way to manage it for me. I’ll improve the graphics using the WordPress plugin for example and can keep track of broken links automatically. It if were in DocBook, ReST or Markdown syntax it would surely belong to a Github/Gitlab instance.

      2. Hi Christoph,
        What about RSPAMD instead of SpamAssassin?
        You have done a great job with this guide. Really appreciate it! 🙂

    30. Thanks for the reply.

      I have to set up a new Debian Strech Server with E-Mail functionality in the next two weeks. If I assume correctly, your Stretch Tutorial will not be ready until then.

      Will the Jessie tutorial also work with Stretch? Or are there too many changes in the format of the configuration files?

      1. Christoph Haas

        It will pretty much work out of the box. There may be one parameter in the Postfix’s that may cause trouble. But it was very simple to find the proper replacement configuration directive for it. So if you need the server soon then just go with the Jessie guide.

    31. I’ve recently been able to successfully set up first spf and then dkim for a domain (and will soon add a few more), by following the instructions at which I found in the readers’ comments here. It’s tailored to the jessie tutorial but it might also be referenced for the new tutorial for stretch. I haven’t tried anything with Debian 9 but I like the idea of using postfixadmin from Debian’s repository as well. What do you think of DMARC, by the way?

      1. Glad you found the instructions useful 😉

        The instructions should continue to work as is, though I’ve stopped using spamassassin/policy-spf/opendkim in favour of rspamd – which takes care of everything. I took a bunch of notes as I went along, so I’ll write up a guide for it.

        – zac.

        1. interressting, never heard of rspamd. can wait to see some how to, or maybe integrated in this tutorial

    32. Hi Christoph, I just want to thank you for your huge work. Take your time with the stretch tutorial.

    33. Hi again, I now see that you had already responded to my question earlier, after a post by “nbb” —that “you wished more people used DMARC”, but I’d like to add that I’ve also been able to configure it properly having followed steps in the “Postfix with SPF, DKIM and DMARC” guide I linked to before.” So now I’ve configured all three and I’m running out of things to do with my jessie server except perhaps to see if I can finally get postfixadmin working.
      Again I’d like to reiterate my thanks for your tutorials and also everyone else who’s contributed with their comments.

    34. Hello Christoph, thank you for posting these guides. I’ve found them to be quite helpful.

      I was thinking what could make everything here even better would be a consolidated best practice document for postfix/dovecot settings. While your guides do provide a baseline to work from, there is a lot of information that creates spinning wheels when it comes to security ramifications; spam; and required reduction in security for compatibility with MUA clients.

      An example from a recent experience of mine; Outlook 2007/2010 has some very stringent needs in order to connect for outgoing mail with a TLS connection. XP clients only support up to TLS1.0 and W7 & W8 have TLS1.1/1.2 disabled by default (these setttings are controlled by schannel protocol settings). Some registry editing needs to be done to get this working and security on the postfix side needs to be reduced in order to allow the client to actually send mail (due to helo request restrictions and RC-4 being reduced to the medium TLS bracket).

      For more info: I’m talking about these type of errors (I worked around them with a less than happy amount of reduction in security and some mitigations):

      It would be nice to have a suggested mitigation document for items like the above. There are plenty of clients that bungle helo requests, don’t supply FQDN hostnames correctly; or bork in unusual ways when the wrong AUTH mechanism is presented by the server. I’m aware these are legacy clients and there are still a lot of people that something like this could help.

      As far as I’ve found; and my google-Fu may just be failing me at this late hour; there is nothing like this anywhere.

      1. This is so confusing, in late 2017. You seem interested in securing email, but you also care about XP clients unable to connect. How exactly do you secure anything when you have clients running XP? It seems that this year should have scared everyone running XP and given service providers enough arguments to *force* their customers to abandon XP.

        You ask for “suggested mitigation”, but I hope nobody will spend a minute trying to find a way to extend the usability of XP systems.

    35. Christoph Haas

      Hi Nathan. I’m open to suggestions. Generally I try to cover security issues as well as specialties (e.g. MacOS throwing crazy errors if Dovecot and Postfix use different certificates). Outlook 2007 is pretty aged. Windows XP is totally end-of-life. 🙂
      Clients that send bogus HELO header should not pose a problem if you do SASL authentication before such helo checks. Microsoft clients are well-known for their crazy behavior in that regard.
      Your first described issue indeed looks like TLS handshaking errors. If that’s a client not working with modern crypto algorithms that’s probably something I’d be willing to accept. It’s for the users’ own sake. According to the Postfix documentation the default list of ciphers is fine.
      The second looks like you have a “sender_access” restriction somewhere that matches.
      Something I will cover is PFS (perfect forward secrecy).

    36. Hey, first of all, thank you so much for your work! I’ve been following your ispmail tutorials for a long time now!

      Do you have any idea when you will release the tutorial for Debian Stretch? I do not expect an answer like ‘it will be out on 30. September’, just a rough estimate would be enough!

      Thx in advance!

      1. Christoph Haas

        Thanks for your interest. Updating the guide is the only thing currently not on my todo list… because the dozen mails I get per day reminds me well to do my work. 🙂 Realistically I’d say… end of October.

    37. Tomasz Wostal

      Hi Christoph,
      Thanks for the great work that you did for us. I’m using your tutorials since Woody.
      I wonder if you could share a beta version for Stretch. I’m in the process of setting up an new mail server and it would help me a lot and by the way you would get a beta tester 🙂

    38. Hi Christoph,
      probably a dumb question: let’s say you have to setup a new web+mail server [ip] for the website that is already running [ip]. How do you test the site and the emails while the old server is still running? Is enough to edit /etc/hosts of a client to point to the new server [] Or how do people normally do it? I don’t have access to the old server.

    39. Just to let you know i’m looking forward for your ISP-style tutorial for Debian Stretch!
      We are nearly at the end of October 2017 now… 🙂

        1. Justin L. Franks

          Awesome! I really would like to get my web and mail server migrated from my old OpenVZ VPS running Debian Wheezy to my new KVM slice running Stretch. I could figure it out myself thanks to the guides you have posted, but it sounds like the Stretch guide will be including much more than before.

    40. Awesome tutorial on mail server setup @Christoph. Easily one of the top rated tutorial on this topic. And to top it all, the periodic updates to keep it up to date. Just Amazing!

      BTW I have a few points, if included, with make it complete:
      0. using of Lets Encrypt certificates (instead of self signed options) in the main explanation flow
      1. SPF & DKIM setup in the solution
      2. Sections on email client setup (at the end of the tutorial) using popular clients on various platforms (including outlook/PC & various mobile mail apps on Andriod/iOS)
      3. Can we include calendar & contacts setup options (CalDav/CardDav) to make it more exhaustive?

      PS: I could help with my limited knowledge in any way if you desire 🙂

          1. Christoph Haas

            Great, now you broke my concentration. 🙂 Just kidding. Although I’m a bit behind and it looks like I’ll need 1-2 weeks. Family matters. And today again was a bit wasted because a serious storm across nothern Germany caused quite some damage and it took me a while to get our kids’ trampoline back that made a crash landing on our neighbor’s henhouse. Stupid climate change.

            1. I was just visiting your site again to post the following countdown: 13 hours and 1 minute to release! 🙂

        1. Oops. I probably jumped the gun and mentioned the additional points, which Christoph has already mentioned in the earlier comments. Just happened to go through all the comments on this page & see that he has indeed mentioned to cover letsencrypt, TLS client, SPF & DKIM etc in the update.

          So, both our points are addressed 😀

    41. Hey!!! Didn’t we silently moved from “start of November” to “November”?
      I guess it’s worth waiting anyway 🙂

    42. Hi Christoph, sorry to bother you. I hate to be “that” guy but I’m really running out of time, so I’m politely asking you if it’s possible to see your stretch tutorial as it is, even if unfinished. I’m a (kind of) experienced user, so I think I can survive if there are errors in your tutorial. Please!
      Otherwise I must go with the jessie one and adapt it to stretch. Which it’s also fine with me. Thanks

      1. Christoph Haas

        Most of it is in raw form and not even yet finalized on the web site. Sorry. If you are in a hurry: just use the instructions for the Jessie tutorial. Leave out the workaround for the package bug I mentioned. That should give you a working mail server. You wouldn’t benefit from the cool new features but if you are happy with the Jessie server then Stretch will do for you.

        I wished I would have time to complete the tutorial. But my Windows colleagues at work ran a huge migration project that spectacularly failed and now I’m asked for assistance. I’m just getting home for sleeping these days. So a realistic time frame is after x-mas.

        1. It’s getting close to Christmas 🙂 Hope work is going well.
          I was very close to update to a new server but stopped because I want to wait for your Stretch tutorial. I followed your tutorial for 4 or 5 iterations. I learned so much every time.

          So I will wait for the update.

    43. Mattia,
      it’s probably not the anwser you were hoping, but I can tell you that I upgraded a Jessie server to Stretch without any issue.
      Good luck 🙂

      1. Don’t worry! My stretch server is up and running since Sunday. No problems so far. Finger crossed! 🙂

      2. Same here – installed the MySQL (MariaDB) option and it’s working really well. Very stable indeed and excellent instructions, thank you! I can’t imagine the Stretch version will be much different. Still need to install rspamd though…

    44. If anybody needs to migrate imap accounts between 2 online servers, there’s an excellent software to do this: imapsync ( I was skeptical at the beginning because it’s not in the official debian repositories, but after reading the story behind it’s quite understandable. Anyway that software is a piece of art!

      I’m trying to configure dovecot like this: so if a user puts an email in the Junk folder it calls sa-learn –spam. Do I need some special configuration to do this? Because it doesn’t work for me. Has anybody got it working?

    45. Eliezer Croitoru

      I am looking forward for his manual so I would be able to publish an ansible playbook for a full installation by this manual.

    46. Justin L. Franks

      Hi Cristoph, is there an updated ETC for the Stretch guide? If it will be done within a week or two of Christmas I’ll wait, but if it’s going to be pushed back another month I’ll just use the Jessie guide and hope for a smooth configuration update when the Stretch guide eventually is released.

      (I’d prefer to wait, but would just appreciate an updated ETC if more time is needed, since your last post in these comments is from more than a month ago.)


      1. Christoph Haas

        Sorry to leave you in the lurch like this. I’m still busy day and night with a large move of my employer. I intend to do the tutorial during xmas.

        1. Thank you for continuing to work on it. I’ve been able to adapt most of what is here to Stretch, but I’ve hit a wall with Roundcube and Postfix (Roundcube won’t log in, Postfix won’t forward mail to Dovecot) and I’m back at unsearchable problems.

    47. Merry Christmas to you Christoph. Wishing you some peace and rest!
      I know many of us are anxiously watching this site hourly for updates on the new how-to. But family and health have to come first. I completely understand where you’re coming from.

      Best regards,

      1. Christoph Haas

        Thanks – merry new happy xmas year whatever to everyone out there, too. 🙂 Fortunately I have a few days off (although my employer is completely offline today thanks to our new ISP) and have already restarted writing. I can’t promise anything though.

    48. Christoph, Please enjoy your new year holiday, your tutorial has been extremely useful to us for the last few years, a few months of wait should be ok to me – rereading your pages here and the comments made by the vast majority help me learn email techniques greatly. Happy new year to you and your family!!

    49. UrushibaraRuka

      Hey, Chrome just complained about your SSL Certificate. You might want to take a look at that.

      Other than that, I can’t wait for the new tutorial for stretch.
      I’m about to change my hoster and migrate atleast all my mails from my 3 old servers to the new one.
      Am I right to assume that I could simply backup all 3 servers, unpack the images, get the mail folder and maybe the www folder, pack
      it all into one of the backups and use that?

      1. Justin L. Franks

        Yeah the SSL certificate expired yesterday. No big deal (I think most people visiting this site understand that it is safe to ignore the warning).

    50. I wish you a happy new year and all the best! Thanks for your work, I hope you found some time to relax!

    51. Hi Christoph,
      first of all a huge thank you for the ISP mail tutorials – ages ago when you published the first version it saved my skin as I needed to build a mailserver fast with little to none knowledge about how this stuff works at all. I’ve found your page and built the server and it did run without failing for 7 or 8 years when the whole thing was de-commissioned as the project had run its course.

      Now I am about to build another mailserver and would love to know how complete the stretch release tutorial is and what time-frame do you expect to release it to public . I take it you are very busy so please do not take my question in a bad way but I would hate to build a server just to find out that a day or two later you had released a brand new tutorial.

      1. Christoph Haas

        Good news. I have continued my work. Half of the tutorial is already done and checked. If I’m really diligent I may be able to publish this weekend. But that means nothing else must break. 🙂

        1. Hi Christoph,
          thanks for the update and good news! I hope everything works out for you and looking forward to the new tutorial!

        2. Justin L. Franks

          Is there any chance of posting what you have completed so far (or at least the first couple of sections, where it gives an overview of everything)?
          That way we could see exactly what is new for this version. And maybe even get a decent head start on installation, then just continue with the rest of the process once the guide is complete.

          Either way, thanks for the update!

          1. Christoph Haas

            I’m jumping back and forth in the pages currently when editing. So the information may still be misleading.

        3. UrushibaraRuka

          That would be awsome timing, as I said above I’m about to change my hoster some time next week, your tutorial would be super helpful for that.

            1. Alexandre Cuenat

              Is it normal that i’m more thrilled about the imminent release of this guide than i was for the last Star Wars movie?

            2. Christoph Haas

              Only if you are seriously nerdy. 🙂 Although… I wouldn’t mind selling the ISPmail guide to Disney. I hated going to work every day anyway.
              Seriously though. Last page… last section… (about virus scanning). I just wonder if I should tag the guide as “beta” and wait for help from you loyal sysadmin readers… or (as I usually do) go through the entire guide from scratch on a test system. That will take another two days though.

            3. Alexandre Cuenat

              I can’t speak for the others but i don’t mind going through a bit of “whatthefisgoingon” when trying the first version of the guide and post here about the problems i’ve had

            4. Depends if there is a separate part for “migration” from old version or if the main article is just for a new installation.
              For a new installation, this beta approach fits perfectly, as it is “just” e-mail and nothing really bad breaks if installed on a new server, and it’s not time critital normally as this is not an urgent topic in real world – people like me just want to have the newest stuff 😉
              If there is a migration this would work as well – if a sysadmin really just copies and pastes stuff (no matter if the quality is as high as your content or if it is a reddit article with something like “curl | sudo sh -“) maybe he should look for some trainings 🙂

            5. Can´t wait for the guide for my second mailserver. I already used your guide for Jessie and the mailserver is still rock solid! Thank you so much for your work! As long as my new server isn´t ready for production, I would go through a beta-guide and give feedback.
              By the way: Is it so much different on stretch than on jessie?

            6. Would be great to get a “Beta” as soon as possible. – I’ve to build a Mailserver and your Jessie Guide works like a sharm, so i would be proud to give an helping hand on your Stretch Tutorial.

            7. Agreed – i’m lined up to rebuild a mail server, and would gladly do a thorough pass through of the guide and provide any feedback

            8. Justin L. Franks

              I agree with the consensus. I need to set up a new mailserver on a clean Stretch installation, and have no issues being a beta tester.

            9. As ESR said: release early, release often. The quality of work produced improves and the amount of work you have to do reduces if you develop in the open and release beta versions. This does not have to mean making it open source or lose copyright.

              You can then choose to accept feedback or not, and choose to accept patches, or not.

              You could even consider writing the documentation in Markdown and using something like mkdocs and end up with a self-building documentation system.

    52. Christoph Haas

      The Stretch guide is online. Phew… 🙂 At least most of it. I’ll keep on writing about DKIM signing, quotas and fail2ban in the next days.

      1. Hi Christoph,

        Maybe you can also add two or three lines to include accessibility to /rspamd?


      2. Jorge Biurrun

        Christoph, it’s a great guide….I’m looking forward for the quota setup. Congratulations once again.

    53. Yahoo!

      Finally my reason not to upgrade to stretch is out 🙂

      Thanks! Ill try to upgrade asap

    54. In the “No cloud” point, there’s a word missing: “If you don’t pay for it then *you* are the product.”

    55. Hey! I just found out this tutorial and it absolutely is great! But I got some problem over here.
      So I follow the Debian Jessie tutorial, and I am able to manage accounts, receive email from other mailserver and all, except for sending email to another mailserver (especially gmail and yahoo mail). Every email addressed to yahoo account get deferred, and gmail even blocked my server’s IP address. I tried to find the solution, but all I got is that I have to setup DKIM and SFP. Is that true? Or am I missing something from your turorial?
      Thank you

        1. host[]
          said: 550-5.7.1 [ 1] Our system has detected an unusual
          rate of 550-5.7.1 unsolicited mail originating from your IP address. To
          protect our 550-5.7.1 users from spam, mail sent from your IP address has
          been blocked. 550-5.7.1 Please visit 550-5.7.1
 to review our 550
          5.7.1 Bulk Email Senders Guidelines. b12-v6si3949146plr.101 – gsmtp (in
          reply to end of DATA command)

          I just check my IP there. All of them said it was not listed

          1. Christoph Haas

            I used to have that, too. Do you forward emails to gmail addresses although they may be spam? Forwarding email is generally a bad idea. But if you need to do it then don’t do that in virtual_aliases. rspamd should first filter out spam and after that you may forward emails to Google using Sieve rules.

            1. Christoph Haas

              Any decent spam filter should be okay. But for some reason you forwarded multiple emails to Google that they considered spam. Please check why that happened.

            2. So I finally manage to send email to gmail by adding my mail server domain to mydestination in /etc/postfix/, even though it is considered as spam.

              One more task to make it through yahoo

    56. Petronel Malutan

      Hi Christoph

      #1# I am on Debian 8 and I get after i am logged in with in roundcube, wherever link I click:
      [27-Sep-2018 01:37:16 America/New_York] PHP Fatal error: Call to undefined method rcmail_output_json::add_header() in /usr/share/roundcube/index.php on line 50

      #2# also I see there is commented the root password
      # – name: set the MySQL root user’s password
      # mysql_user: name=root password={{ispmail_mysql_root_password}} state=present
      I’ve thought I have readed all the pages you provided but it seems that either i did missed something or I am superficial 🙂

      #3# I did tried to run the playbook before also on a ubuntu 16 It is supposed to run too isn’t it ?

      1. Christoph Haas

        #1 Very strange. Unless the Roundcube package has changed significantly that should not happen. Or did you manually install a newer version that requires PHP 7 instead?

        #2 I commented that out because the playbook wouldn’t run a second time like that.

        #3 Haven’t tried that to be honest.

        I still have a reader’s contribution of an updated Ansible playbook for Debian Stretch that I need to look through… maybe that works for Ubuntu 16.

        1. Petronel Malutan

          I was able to finally run it today from start to end on an Ubuntu 16 I think… but commenting the unecesarry patch and I arrive with success at the end of the play. The issue I have is in Roundcube:

          Unable to connect to the database!
          Please contact your server-administrator.

          I will try to have a look in the logs ! I susspect either mysql is not starting or the pwd was not coreectly set from all.yml vars which seems to be visible as I got some error running it after renaming it to something else

    57. Hi, I’m wondering if ISPMail can be setup offline, tested, and uploaded to a “Digital Ocean” later; as I am off the grid for the most part and have limited connection to the web. Right now, this question is a big blocker for me. Thanks for taking my question

    58. Florian Fritsch

      Hi Christoph,

      just wanted to let you know that Stretch setup is working on Buster also. There is only one thing to do after upgrading (if you keep the config files of dovecot from stretch).

      Error when fetching mails:
      Jul 8 08:07:42 host dovecot: imap-login: Disconnected: TLS initialization failed. (no auth attempts in 0 secs)
      Jul 8 08:07:42 host dovecot: imap-login: Error: Failed to initialize SSL server context: Can’t load DH parameters: error:1408518A:SSL routines:ssl3_ctx_ctrl:dh key too small

      Put following line to dovecot.conf file:

      ssl_dh = </usr/share/dovecot/dh.pem

      Everything else seems to work without any problems.

      Just wanted to let you know.

      Best regards


    59. Thanks for this amazing guide, we’ve been using it since the Lenny days and i inherited this org ICT around squeeze days and now i have been asked if we could provide any kind of “high availability” setup ? the user base is relatively small and so is the data set (<200gb and <100 users) the main goal would be to reach 0/short downtime when upgrading the system and of course in case of failure, we have a virtualised infrastructure to deploy vm's as needed. I have been reading into the HAProxy solution wich seem to cover the smtp delivery part, but I have not yet found a solution for mailbox synchronisation ? is shared, remote storage on a third instance a good idea ? same for the databases ?

      thanks for the help, and again, for keeping this guide running, it's an amazing solution 🙂

    60. I have been able to fresh install on Buster aswell

      Run into a small problem with Roundcube throwing SMTP Error (250): Authentication failed – worked on day one but appears to be doing this now!

      1. Works just with ansible 2.8 from sid. For people who don’t use ansible everyday: install postgresql, create mailserver user and db ( or use existing one ) and call: ansible-playbook -i mail, -c local -e -e mailserver.postgresql.port=5432 -e mailserver.postgresql.dbname=mailserver -e mailserver.postgresql.username=mailserver -e mailserver.postgresql.password=”$MYPASSWORD” -e mailserver.postfix.overwrite_config=yes -e mailserver.postfix.mynetworks=”$MYNETWORKS” -e mailserver.dovecot.auth_default_realm=${MYDOMAIN} mail_system.yml

    61. Put me down for yet another success story, years of trouble-free self-hosted email thanks to you! Even after I went and did dist-upgrade – Highly anticipating Buster guide, hoping you’ll see it in your heart to elaborate on migration lol.

    62. Oskar Vilkevuori

      I wonder Do You have the Debian Lenny guide available somewhere? Would need to do some fine-tuning with my self signed SSL certificate since Apple suddenly dropped a support for SHA-1 less than 2048 bits and I do not exactly remember how I did that many years ago. I found this: and it does not have the how-to-do SSL part in it.

      Looking forward the new Debian Buster guide to be released. Great work. Thanks.

      1. Christoph Haas

        Hi Oskar. Yes, just scroll up this page and look for the “Lenny” link. All old versions are archived here.

    63. Tim Makarios

      Thanks for maintaining these guides for so many years!

      Just wondering what the major differences (different components, etc.) are likely to be between the Stretch and Buster guides? I’m wanting to get started on migrating an older server to Buster, and wondering how much I can achieve by just following the Stretch guide.

      1. I can only second that! Thanks for keeping up the good work on this excellent guide! Thank you 🙂
        I am indeed wondering the same as Tim for the very same reasons…

    64. Is there any update on the Buster guide? As already asked by other people, I’d also like to know what the major differences between the Stretch and Buster guide are, so as to decide wether I can start migrating my servers or not….

      I’m waiting for the Buster guide to set up a new VPS as well 🙂

      Thanks for your great work!

      1. Christoph Haas

        Hi Vincenzo. Good news… I had a knee incident and am sick at home. That gives me time to get further with the guide. 🙂 Eelke and I are working intensely on the new guide. New features will be optional server-side mail encryption, improved ham/spam per-user training, quota support and a section on auto-configuration. The guide is rewritten from scratch to throw out boring stuff and be more elaborate on the important parts.

        1. Tim Makarios

          A “knee incident” doesn’t sound much like good news, to me, but I guess every cloud has a silver lining, as they say.

          Those new features sound interesting! I’m already making some progress working through the Stretch guide, but it’s nice to know where I might eventually need to make changes, if I want to align the end result with the Buster guide.

          Thanks again for your work on this, and I hope your knee heals soon, and stays healed.

    65. Hi,

      I am about to setup a new Mailserver. This time without an all-in-one-docker-package. I am really looking forward to the new guide.

      Any news on the last to pages? 😀

      Thanks for the awesome work!


      Any body here who can make this ispmail tutorials in video it’s very good for me and also for others..

    67. Hi, thanks for keeping up such great work for a long time! I recently revisited an old mail setup for some domains and decided to use Ansible to capture everything. I used many of the same configs that you did on Buster, with an encrypted mail store, and back everything up using Bacula to a remote machine. Also put together a little perl script to manage the account database.

      The Ansible playbooks are on Github ( with documentation and pictures of my old equipment if anyone else might find them amusing and/or useful. Cheers.

    68. A couple of typos on the page:

      Your mail users can either install a comfortable IMAP client like Thunderbird or Evolution or just use the webmail interface in their browsers [so/TO] manage emails.

      Combining the components described is [no/NOT] rocket science. But you will save a lot of time by following this guide. It is based on many years of experience and feedback.

      1. Christoph Haas

        It was just an experiment whether it’s easier to read and nerdy. But I’m not convinced either to be honest.

        1. Hi Christoph,
          I’ve used your tutorials (successfully) twice in the past. Thanks for the effort you put into them.

          At present I can’t see any pictures on any of the ispmail tutorials (including some old ones that I *know* used to have pictures). All I see is blank white space where a picture should be.

          I’ve tried Firefox, Chrome, Safari and Edge. I’ve also tried macOS, Windows and Linux. Every OS/Browser combination I’ve tried gives the same answer. I also asked a friend what he saw, and he sees blanks.

          The reason I’m looking at the Buster tutorial is my old mail server running on Jessie has just failed to boot, so it’s time to move to a machine running a more modern OS. This means I can’t respond to email until I’ve completed the tutorial!

          1. Christoph Haas

            Hey Don. Thanks for the feedback. The problem with the images was on my end. I had played with an “Autooptimize” plugin for WordPress and it was a bit too eager. Do you see the images now?

            1. Yes. (Sorry for delayed response: occasionally, I have to be away from my computer 🙂 It all looks good now; Thanks for the quick response.

    69. Updated from an old Jessie version running on a Ubuntu server to a new Debian Buster server. All went smooth but I had to make a few database query tweaks,
      Copied all mail from the old server to the new one. Everything went fine 🙂
      Nice with new software updates and new spam features.
      Great work with the ISPmail…. Highly recommended

      Do not hesitate to upgrade. Old (10 years) Maildir tree still works .

    70. Hi Chris,

      Your tutorial is a great gift – I now have a full functional mail server set up – really grateful!

      I do have a question and maybe a suggestion for an additional section – virtual folders.
      I do have them working “All Mail” and “Flagged” by creating the respective dovecot-virtual files. But it seems this is a manual process for each users. For virtual mailboxes, how can I automate the process of creating the virtual folder for each user?

    71. Noticed missing word in “No cloud” section.

      If you don’t pay for it then “you” are the product.

    72. Debian Bullseye (currently worked on) – totally GREAT, best site for email server config on Debian!

    73. Hi Christoph, I am thinking this could be the best website since sliced bread. I am looking to build a 20 Ish user website comprising web sites for friends and family as a retirement project (keep the grey matter rocking !!). I am using Postfix and Dovecot, but without a MySQL db (the daughter’s squueze is an SQL DBA, but I don’t know him well enough yet to pester him with SQL queries (hahahahaha). Bearing this in mind, which of your previous versions would be the best to use.
      I am nearly there with the build but have a few errors to fix and am hoping your guide(s) will help me finally get it working.
      Looks great so far. People also seem to be very appreciative of the work you have done on this project so far – smells of dedication to the nth degree.
      All the best

    74. Hi Christoph,
      I have been using your mail server manual for a long time, and even when I am a Linux beginner, I have always run the server. Today I would like to move to a new site from the new php and so I’m waiting for you to issue a guide to Debian Bullseye. Could you indicate when it could be done? Month, half a year, a year 🙂 I’m excited
      Sincerely your fan. Sorry for the translation.

      1. Christoph Haas

        Hey, thanks for the question. I had the guide 90% done even before Bullseye was released. Sad to see that it took me so long for the remaining part. But in fact I’m working on the last two pages now. I seriously believe that I can release the new guide on 20th or 21st of November. So just 3-4 days left.

    75. Hello Christoph,
      since Wheezy I am following your guide and after every new vesion I updated my server. Thanks a lot for your work that makes it possible to set up an independend server for mailtraffic. By updating this time to Debian Bullseye I ran into a problem that can ruin all efforts around private e-mail-servers. The cause of my concern is our big player “Deutsche Telekom” with its E-Mail-Service “”. Even if you have done all your work with proper e-mail settings it is not possible to send and even not receive mails from users of My server is definitely blocked. The reason for this rejection lies in the lack of a website the domain is pointing to. At least that was communicated to me by the responsible person. That means, they do not like private operators of e-mail-servers. But I do not run a website and I am not willing to. The telekom wants a proper impressum inside a website. Fortunately only one of my more than 400 contacts use, so I can get over it. And all the other providers have obviously no problems with mails from my server. It’s worth to tell this story here, because at least all German users should now that they are running into these problems.
      Best wishes

      1. Christoph Haas

        Moin Helmut. I had a similar problem. I run a Hetzner VM for my family mail server. I checked the usual RBLs but wasn’t listed anywhere. But blocked me with a hint that I should contact I kindly asked them to unblock me and the next morning all was fixed. Interesting that they expect a web site on the mail server. In fact I have one there but I wasn’t aware that they are checking the impressum. Weird. Seems that every ISP deals with spam differently. And there are indeed a lot of Hetzner servers sending spam. I’m filing abuse reports to Hetzner very frequently.

        1. I have also been following Christoph’s tutorials since Wheezy (thanks!) and would also like to confirm the absurd policy of (considering that my server IP and domain have excellent reputation, and had no trouble exchanging mails with any bigger players, including Gmail and Microsoft).

    76. electrical scooter

      Outstanding post, you have pointed out some great points, I too conceive this s a very great website.

    77. kausik maitra

      I am configure POSTFIX SMTP server in my OWN ubuntu 18.04 server
      getting error /var/log/mail.log. Please need any one to sort the issue
      Aug 25 11:43:58 mail postfix/smtp[9008]: connect to[]:25: Connection timed out
      Aug 25 11:43:58 mail postfix/smtp[9007]: connect to[]:25: Connection timed out
      Aug 25 11:43:58 mail postfix/smtp[9008]: 4917FB82D88: to=, relay=none, delay=65944, delays=65852/0.05/92/0, dsn=4.4.1, status=deferred (connect to[]:25: Connection timed out)
      Aug 25 11:43:58 mail postfix/smtp[9007]: 50DB8B82D72: to=, relay=none, delay=66423, delays=66331/0.05/92/0, dsn=4.4.1, status=deferred (connect to[]:25: Connection timed out)
      Aug 25 11:44:26 mail postfix/smtp[9005]: connect to[]:25: Connection timed out
      Aug 25 11:44:56 mail postfix/smtp[9005]: connect to[]:25: Connection timed out
      Aug 25 11:44:56 mail postfix/smtp[9005]: F0742B82DBC: to=, relay=none, delay=63230, delays=63079/0.04/150/0, dsn=4.4.1, status=deferred (connect to[]:25: Connection timed out)

      Aug 25 11:47:26 mail postfix/qmgr[8676]: BC8EDB82F47: from=, size=412, nrcpt=1 (queue active)
      Aug 25 11:47:26 mail postfix/qmgr[8676]: 3FF35B82F45: from=, size=356, nrcpt=1 (queue active)
      Aug 25 11:47:26 mail postfix/error[9150]: BC8EDB82F47: to=, relay=none, delay=1495, delays=1495/0.01/0/0.01, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to[]:25: Connection timed out)
      Aug 25 11:47:26 mail postfix/error[9151]: 3FF35B82F45: to=, relay=none, delay=3227, delays=3227/0.01/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to[]:25: Connection timed out)

      1. Your web host/ISP is blocking outbound SMTP traffic on port 25 to mitigate spam. No offense but if you needed to post here to discover that fact you may want to reconsider self-hosting…

    78. Vrajarāja Govinda Dāsa

      Thanks for the great work!! Is it possible to have a PDF of the Bullseye Guide? It will be easier to print and have a handy copy.

      Thanks again,

    Leave a Reply

    Your email address will not be published. Required fields are marked *