ISPmail tutorials

The famous ISP-style mail server tutorials live here. Learn how to set up your own fully-functional mail server using Postfix, Dovecot IMAP/POP3 and MySQL backend on a Debian server just like your favorite mail or website hosting provider.

I have been maintaining the ISPmail tutorial since Debian Woody. However those older Debian versions are no longer supported. If you still like to read the old versions I have provided PDF versions of the tutorials for Squeeze, Lenny, Etch, Sarge and Woody.

24 thoughts on “ISPmail tutorials

  • 2015-10-09 at 12:28

    Hello Christoph, this is really nice and clean. I know you’ve been critical of WordPress in the past, but I use it more and more for sites now and I think you’ve made a wise choice.

    Very nice.

    Personally, I found Drupal a disjointed nightmare and I won’t have anything to do with it any more.

  • 2015-10-09 at 13:12

    Thanks, Paul. In fact I was very sceptical because I had two customers with compromised web sites. And I assume they got hacked due to some outdated or badly maintained third-party plugins. Otherwise I have to agree that WordPress has come a long way. Its built-in features are way better than was Drupal comes with. And although I don’t really like PHP and have hardly done any programming with it it seems that adding functionality is not harder than what Drupal “views” have to offer. Sounds like its time for some educated blog post about Drupal versus WordPress. I really hope that Drupal 8 turns the corner.

    • 2015-11-06 at 17:21

      I hope this is the right place to put this. If not I apologise.
      I am also very aware that you do this in your own time. I am also aware that detailed answers to points I have raised would require significant effort. I raise them because perhaps they are things you may wish to include in due course. Any answers are appreciated.
      I created a mailserver a couple of years back using your excellent tutorial.
      In fact I am running it on a supermicro atom box xen dom1 vm with jessie.
      It’s been very good. It is only me that uses it because in the event of a problem it will only be me that suffers. however…
      I am a OpenVMS C SQL blah blah developer by trade but have a little linux, and a bit of technical knowhow.
      The time has arrived for an upgrade.
      It must be written in the stars that the time is right because “lo and behold” along comes your real jessie install tutorial.
      This I intend to follow as I have the memory span of an amoeba and have forgotten most of what was done before.
      Before I start however, I thought I would raise a couple of hopefully interesting points and ask a couple of questions that illustrate very well that I am not entirely sure what I am doing.
      1/ How easy is it to make your mailserver fault tollerant/failover capable (maybe over multiple internet locations)
      2/ How can the server be monitored against potential hack attempts
      3/ exactly which ports should I open on my routers to allow only mailserver traffic?
      4/ is it easy to allow only mailserver IO on eth1 and machine db management on eth0?

      and lastly something specific to my installation although it may be true for others
      I have a D Telekom connection and also a VPN lnk to the UK for watching TV mainly.
      I find that I can access my mailserver from through the VPN and also from my handy but not if I go straight out through my DT connection (the same as the server sits on).
      Would you have an idea about this?

      Thanks once again for the tutorial. It is by far the best I have come across.

      • 2015-11-09 at 09:38

        Hi Mac. Nice to see someone who voluntarily deals with VMS. I remember it from University and although back then I had neither experience with VMS nor UNIX I found VMS the most crazy OS I could imagine. :)

        Anyway. Regarding your questions.

        1/ Mail server should indeed be fault tolerant. At least the MX relays that accept email from other internet servers. I’m running such a setup myself but it was out of the scope of the ISPmail guide. But perhaps I should try to at least explain the concept on an additional page. Actually all you need is two basic servers running Postfix that either have a fresh copy of the database or be in a master/slave relationship. Those relays would then forward legitimate email to your Dovecot server. Of course that won’t make the Dovecot instance, the database or the disk storage for the emails fault tolerant. A large ISP would probably use a proper FibreChannel SAN and multiple Dovecot servers. But that’s a concept I haven’t needed before. That doesn’t mean I’d be keen to one day work for an ISP and set up something like that. :)

        2/ Hack attempts should just occur in terms of authenticated SMTP or using POP3 or IMAP. I personally use the “fail2ban” package for that purpose. I realize I haven’t yet finished the page for the Jessie tutorial. But you may want to look here:

        3/ Traffic between servers: TCP/25 both directions. Connections from your mail users: TCP/587 incoming (however I have not yet described how to open up that port – will do that soon). Allow DNS requests: UDP/53 outgoing (or both ways if your firewall has no connection tracking). IMAP incoming (TCP/143). POP3 incoming (TCP/110) if you want to offer POP3.

        4/ Yes. In Postfix the setting is called “inet_interfaces”. Set it to eth1 and there will be no TCP listener on eth0. Dovecot has a “listen” directive in the /etc/dovecot/dovecot.conf file that allows you to specify the IP address on your eth1 interface.

        5/ So you mean you can’t access your mail server at TCP/25? Could be that your ISP is blocking that port. Then you could talk to your ISP (probably pointless) or move the server to another ISP.

        • 2015-11-10 at 00:59

          Ahh… VMS. Created by visionaries. Undone by marketing. Slow death by licences. Death may yet be postponed indefinitely… Pause for sad violin…
          But let us move on.
          Thanks for the info. I will check out the fail2ban.
          I do infact have some fibre channel stuff. Thus far I have not attempted to get it going via linux. This was in fact what I thought you would suggest and why I realised that the full answer was not going to be a short one. When I have upgraded I will attemp to experiment. It should also be possible via NFS should it not? My linux is very weak so I am not sure how to do this. Actually I am not entirely sure which file system linux can use to cope with multiuser multi machine access. ext3?? nfs?? A pity we cant run the openVMS file system. THere is GFS I have read but most people think this is overkill.
          I am rambling…
          Concerning the ports. I am somewhat confused.
          I do not run SMTP but use the Telekom SMTP server with reply-to set, otherwise they block mails I send out.
          I seem to be able to send to and read from the server with only ports 25 and 993 enabled. I did have 25,143,465,587,993 and 995 enabled but recently the Telekom modem failed and so by trial and error I found that these two seem to be all that is required for my client.
          In fact I can read the server with only 993 open.
          But only if I have the VPN to England running (or I access the server from my handy).
          If the VPN link to the UK is down and all traffic goes through Telekom it does not work. This was true with all the above ports open. I wondered if Telekom were not allowing me to send out a request which involved a direct loop back.
          Anyway it is much too late so once again thanks for your info. I will let you know the results of post jessie upgrade experiments.

          • 2015-12-01 at 16:36

            You could use dsync (, director/NFS ( You should also look at

            If I can understand you correctlly, you can not access your server from inside of your private network and server is inside your network? If that is true, than there is a problem with router config as it only routes outside-to-25->inside-node-25 and not inside-to-25->inside-node-25 … try to make a new rule that routes whatever comes from inside for a specific IP it shold route it to internal server. It also seems that you have your gateway set via VPN when connected and this way you acces it from outside?

            Port no.:
            – 110 .. POP3
            – 995 .. POP3S
            – 143 .. IMAP
            – 993 .. IMAPS
            – 25 .. SMTP
            – 465 .. SMTPS, secured by SSL (legacy)
            – 587 .. MSA, can be secured by STARTTLS command

            I would set it up to use MSA and IMAPS ports externaly and SMTP internal for server clients.

  • 2015-10-09 at 14:29

    Relaunched site looks great. Not being very familiar with WordPress it is nice to see what it can do. Also, thank you so very much for all the work you have put into not only the ISP Mail tutorials, but all the other stuff as well. You truly embody the spirit of Linux :)

    • 2015-10-09 at 14:42

      Thanks for the nice words. Yes, I believe that I have in fact found a pretty nice theme for WordPress and slightly improved it. WordPress has some concepts that need some getting used to. But so far several people told me that they enjoy the clear new look. I second that. And I have removed some ancient articles that are a bit outdated and might rather be misleading. Interesting to see that still 90% of the hits to the ISPmail tutorials. And strange enough… most of that 90% are for outdated tutorials. :)

  • 2015-10-13 at 12:55

    Can you provide an approximately date, when the new tutorial for Jessie will be ready? :-)

    • 2015-10-13 at 13:07

      Yes. Roughly in a week. I’m serious. The concept is done. My test server is in production for two weeks now. The first 5 pages of the ISPmail Jessie guide are already finished. I intend to finish at least one page a day so that next week is my intended deadline.

      • 2015-10-13 at 15:17

        Nice to hear that. I can hardly wait!

      • 2015-10-14 at 01:29

        Keep working :) I’m sure I’m not the only one, who is waiting for this doc. I’ve got already Jessie in production, but I will fine-tune it with pleasure.

  • 2015-10-14 at 08:37

    You’re not the only one who is waiting the new doc; I can’t wait to see the new tutorial on Debian Jessie and test it. Good job Christoph!

  • 2015-10-23 at 13:12

    While researching another issue, I came across these two (potential) statements.
    # add to the end: limit an email size 10M
    message_size_limit = 10485760
    # limit mailbox 1G
    mailbox_size_limit = 1073741824
    Having said that, it was for a straight postfix configuration, rather than the one described here. So my question is, would they work in this configuration? As it’s an easy way to limit message and mailbox sizes.

    • 2015-10-23 at 13:54

      Setting the message_size_limit is a good idea. You can even use 40 MB which seems to be the common size that is allowed by most mail servers.

      The mailbox_size_limit does nothing in the context of an ISPmail setup though. It only applies to email that is delivered through the “local” agent. In other words: email that is stored in /var/mail/$USER. If you want to enforce quotas you would have to do that in Dovecot. See:

      • 2015-10-23 at 15:40

        Wow! Thank you for the reply Christoph. I’ll look into the Dovecot configuation.

  • 2015-10-25 at 06:08

    ISPmail tutorial using Postfix 2.11 will be released today? I am planning to setup this server.

    • 2015-10-25 at 07:27

      Yes. I’m working on the two final pages. Everything has been tested thoroughly and I’m planning to put the tutorial online in 2-3 hours.

  • 2015-11-10 at 03:52

    Hi Chris,
    my setups are done i am able to send the email but i can’t receive any emails. Do you think you can help me ?

    • 2015-11-10 at 12:15

      @Babu: What did you try? What happend wrongly? What’s in the logs?

  • 2015-11-10 at 15:18

    Delivery to the following recipient failed permanently:

    Technical details of permanent failure:
    Google tried to deliver your message, but it was rejected by the server for the recipient domain by [].

    The error that the other server returned was:
    550 5.1.1 : Recipient address rejected: User unknown in local recipient table

    • 2015-11-10 at 15:33

      That means you didn’t have that user in your database. Also check that is defined as virtual domain and not in “mydestination” for Postfix.

  • 2016-01-06 at 22:42

    Hello! Is it possible that you will different process for the Nginx web server instead? That is my configuration and I’m worried it will all be for nothing if I follow step by step. Thank you. Also, what is the optimization level?

  • 2016-01-12 at 12:43

    Hello Chris,

    I’m using a mailserver system based on your tutorial for years now. (Since your Sarge tutorial). It works like a charm.
    I have a few users on my system that can send mails. I have no control over their password behaviour. So in the past sometimes a mail account gets compromised. I normally recognize that by the amount of mails are sent by the server and I shut it down and block that account. But in the last few months this problem increased and I recognize the problem to slowly.

    Do you have a simular problem in your setup? Have you found a solution? Maybe scanning outgoing mail with spamassin?


Leave a Reply

Your email address will not be published. Required fields are marked *

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.