I would appreciate if you leave a comment here telling others if your mail server is running. Perhaps even a word about the purpose of the mail server and the number of users you have. That allows others to see that their time is well-spent and indeed leads to a working mail server. Thanks for your feedback.
(Have I mentioned the donation button at the bottom? 🙂 )
Just another excelent guide.
Thank you for that.
Regards
Ludek
The transfer from the “old” Jessie server to a new Stretch server was very smooth. As usual the guide was very well written and the description would also help a “newbie”.
I’m looking forward to the additions (encryption, mitigations, …) in the future!
Pizza and beer are on their way!
Regards,
Thomas
Thanks for the donation. Already working on the next page. 🙂
Everything worked on the first attempt on an older installation of Stretch. I was surprised by the complexity involved of running an email server, and having all the pieces put together in this guide was quite useful.
I later saw the amount of rogue requests to the server – which I guess is expected when running any kind of public service – so it was good to know all the authentication steps were covered. I’m looking forward to any later additions to the guide.
Right now it’s just me using the server, but I will likely expand this. In fact my motivation for creating my own mail server was the higher amount of storage space. The “good” email services (read, with a sensible privacy policy and no income from ads) in my area tend to be limited to a few gigabytes, unless you pay exorbitant fees.
P.S: I’d gladly donate but me and Paypal are not exactly best friends… let me know if there’s an alternative means of donation available.
The Installation was very smooth, beside a dumb mistake on my side (missing localhost in /etc/hosts). Spam detection is GREAT now with rspamd, compared to the jessie tutorial!
I’m looking forward to the DKIM and ham/spam learning on message move, Thank you very much!
Thanks for this guide. Just a few hours to set up a new server and get it running…. DNS update takes longer than following this instruction.
Hi Christoph,
Thank you for this guide, your previous ones, and all the work you put into them. I used your previous guide starting about 6 weeks ago or so (first time finding this site) and I was able to use it to set up my environment, despite the version differences. I reviewed this updated guide and primarily pulled in the fail2ban piece to add to my existing configuration. I have 3 servers involved in my configuration: one dedicated web server (hosting multiple websites and the roundcube instance), 1 dedicated mysql server, and 1 dedicated mail server. I broke it out as such mainly for the learning experience. And a learning experience it has been! I think the hardest part for me was getting the certificates all worked out for both the web and mail servers.
Keep up the good work!
Finally done, works perfect, thanks again for this amazing guide 🙂
Already excited to go live with the new system after implementing the virus scanning part 😉
Regards,
Hampe
I’ve followed your tutorials for a few years now (Sarge maybe?) – you’ve done an amazing job.
Anyway, thought you’d like to know that our current largest install runs on a Stretch VM that links to a FreeNAS NAS for storage. We use the free BitDefender for servers milter (http://frams.bitdefender.com/download.php#) for spam control as we found spamassassin poor even after a few thousand spam and ham submissions and BitDefender has a great webGUI to tweak settings and lists.
Currently we have 25 domains on that install with 2179 mailboxes and several million mail items going back at least 5 years. We tweak the security slightly differently (phpmyadmin is on a random string such as domain.co.uk/slhfklshfkwkwlg instead of domain.co.uk/phpmyadmin, we use a high-priv user that isn’t called root or admin with those names disabled and we also limit access to it by IP range) and we have our own control panel, but all of the work ‘under the hood’ is from this guide.
Would love per-user mailbox size controls and a DKIM tutorial (we use SPF at the moment), but I’ll figure those out on a testing VM at some point.
Your setup sounds awesome! Curious to know how using the NAS for storage works, is it only used to store the dovecot maildir? I am guessing you mount the NAS to the vps with sshfs? Do you have any issues if the NAS gets disconnected / goes offline or does everything recover gracefully?
Absolutely fantastic tutorial, made the process easy while letting me learn what’s going on under the hood — and is giving me plenty of fodder for followup projects! Thanks for all the hard work that went into this.
After a 3-year run with iRedMail, it feels awesome to have a fully-functional, from-scratch mail server, and even more so now that I understand what’s going on under the hood. 🙂
I opted to go with a remote Postgres instance instead of running MySQL on localhost. I set up Roundcube on a separate web server connected to that same DB server. Everything working flawlessly at the moment.
Thanks for this incredible guide — your work was *enormously* helpful!
I am following these tutorials for years now, since debian wheezy. Thank you so much for this excellent work.
Been using your guides since forever. Though I do them on Ubuntu servers, but this has rarely been an issue. Every couple of years, I revamp my mail server, start it from scratch. Out of boredom, out of wanting it following newer technology, and out of wanting to learn more.
Thanks a lot for these guides 🙂
love it, using it for several years now.
any change you will add mail encryprion for mails that are saved on the server?
like with dovecot mail_crypt or something else?
I have set up an email server on a Raspberry Pi 3 following your instructions. There is no packaged binary for rspadm for armhf yet, so I used spamassasin instead, although I otherwise followed the stretch instructions.
There are a few niggles to sort, the main being Thunderbird refuses to sent emails via the server, complaining about being “unable to establish a link with the SMTP server using STARTTLS since it doesn’t advertise that feature”. When I telnet in on port 587 the server does advertise that STARTTLS. The webclient, and other email clients work OK, so this must be a Thunderbird glitch.
Hi Christoph,
I just wanted to say thank you, even though I do not believe that is enough!
My knowledge in regards to setting up a mail server started with the following article years ago:
https://help.ubuntu.com/community/PostfixVirtualMailBoxClamSmtpHowto
This was more of a “copy/paste” tutorial to get a functioning mail server without actually knowing what anything meant.
Your guides take it one step further and actually makes it more of a course in setting up a mail server.
You go into detail and with passion in your writing, that makes it both entertaining and a fantastic learning experince at the same time.
In my honest opinion, this is something that you could charge money for even getting access to, as a company could save a bunch of money setting up a server themselves in a couple of days following your instructions.
I’ve setup a server by following all of your instructions and have gained a lot of knowledge in the process, while also diving even deeper (as my comment spam in your guide probably suggests, sorry :P)
I will make sure to throw a donation in your direction as soon as I can afford it!
For now, I hope that this is better than nothing! 🙂
Keep up the awesome work, you got yourself a follower… nay… a fan! 😀
Thanks for the very kind feedback. I’m not doing it for the money… it just pays for the server. A user less using freemail providers is a soul saved. And no… I’m not religious. Just paranoid. 🙂
Thank you so much for this great tutorial!
In your opinion, what kind of backup strategy and tools would you recommend for this ISPmail setup? Backup for mailboxes, database, roundcube, rspamd and other components?
Actually it’s pretty simple to do a backup. Run “mysqldump mailserver” from cron to backup your control database. All relevant configuration is located in /etc so just back up that directory. And the users’ emails are located in /var/vmail. It’s not problematic if new emails are coming in or the users delete emails. Dovecot can handle that well. So you do not necessarily need any kind of snasphotting mechanism.
The simplest solution is probably to use “rsnapshot” and backup the files to another computer.
How about Roundcube? Is it sufficient to just backup the /roundcube directory?
Let’s say for example if a user would like to get back a particular email he/she deleted a few days ago, how do I recover that particular email? Is it as simple as lookup the email in the backup of /var/vmail and copy paste it over?
The Roundcube setup just consists of configuration in /etc/roundcube and the Apache virtual host configuration. So if you backup /etc then you have a copy of everything you need.
Every email is just a file in /var/vmail/DOMAIN/USER/Maildir/…
By just copying back the file(s) from a certain time range you can restore them.
Looking at the struggle that my fellow M$ Exchange administrators have that’s just fun. 🙂
You might want to remove the delete option when the current folder is Trash. I tried write protecting the Trash folder once but that was messy.
Awesome guide man. I used your guide as a primary source to construct my own domain web service alongside a few others to further enhance and properly install, for example, say phpMyAdmin. PMA actually wants it’s own database with extra tables to enable further functionality in the webUI for certain things. Something that you don’t mention here and is completely understandable. As it’s just a tad out of the scope of e-mail, even though the fundamental data is being held in the underlying database :).
However what I think you should mention in the guide, is that people should configure their MUA, wether it’s Roundcube or anything else for that matter, to actually send outgoing e-mail to the port 587. You mention the port and the configuration from postfix’ side, but I think it could use further emphasis as for me for instance, I missed that bit, just a tad bit. Otherwise, if left at default, and MUAs keep sending to 25, which they mostly do by default. The person can just masquerade any domain, any user, all of it as those restrictions aren’t configured per this guide for that side. This is of’course on the prerequisite that someone has hacked a legitimate user account and can authorize themselves through dovecot with it when they send e-mail with the from header mangled.
Uhh, may have gone off on a tangent. I just wanted to say that doing some simple sort of pentesting it was possible to output mail from let’s say random@telia.ee instead of my own domain following the @ symbol. Of’course that fails all the SPF, DKIM tests and is therefore labeled spam. But it was cool to test drive this in front of my dad and show an IT illiterate of phishing is really done. Seeing in full clear the source IP addresses in the header that betray the actual sending domain.
Anyhoo, awesome guide, it helped me bunches in setting up my very first, own, private webmail where I have complete control over all the data that I use in the big wide web world.
PS. Any chance for some sort of HTTP/php front-end guide for where users could register accounts on the site :D? Allowing me to bypass the need to manually go and enter data in the DB.
Thank you really very much. I appreciated you.
I finally went through this tut to set up a new stretch server and migrate my old jessie email over.
What a difference!
Having rspamd, clamav w/sanesecurity sigs, and modern mail with dkim/spf/dmarc is almost a night and day difference. My incoming spam has dropped to zero when I was getting at least a half dozen a day with the previous setup.
Thank you!
Running my mailservers based on these tutorials for many years. Thank you very much.
The article is great! Server working well but there’s one more thing that I would be interested to learn how to do that maybe others may be interested in also.
How do we control the mailbox disk size per email by the database?
Like 1GB storage etc…
I successfully installed a working mail server on my brand new Raspberry Pi 4 running DietPi v6.25.3 o.s.(based on Raspbian/Debian Buster) following this guide, thank you!
I have a question: how do I configure email clients (like Windows 10 email or macOS email clients) to read mails? Mail server is the FQDN of my Pi 4 but wich ports/protocols need I to set in clients configuration?
@Christoph Haas,
Great tutorial. I have just finished installation and configuration my mail server.
All hints are working on Ubuntu 18.04. Thank you.
Hi,
This was a really great guide. Still perfectly workable in Dec-2019 even though packages and versions have moved on quite a bit. Managed to get everything set up, biggest deviation was probably redis for rspamd.
Am I right in thinking that both the TLS cert and the clamav definitions will update automatically using the config in this guide?
What about automation of debian patches and security updates on a schedule overnight?
Is it good practice to schedule a cron job to reboot periodically? If so how often?
Might be nice to have a section on ongoing maintenance when you publish the buster guide.
Also you do mention the ports in use during “the big picture” but it might be good to have a firewall cheat sheet somewhere to make sure everyone has opened the relevant ports – and nothing more!
Thanks a lot for this
Alex
I’ve been following this guide on Debian 12 and so far all the instructions have worked out of the box with almost no differences.
The only minor changes I noticed in the configuration files were
1. The output of the certbot TLS tool differed slightly, but still worked
2. In roundcube I had to change the smtp_host from “localhost” to “tls://fqn.domain.name:25”
3. Dovecot had a few differences in the mailbox config. I set the delimiter to “/” and there was a difference in the mailbox naming format but I just used the new format.
I haven’t setup the spam filtering stuff yet so I’m not sure about that. Overall thanks for a great guide.