ISPmail on Debian Buster – your mail server workshop


Would you like to have your own mail server? Are you familiar with Linux? Then this guide will help you set it up. All it takes is a little time and effort, the monthly costs of a cheap virtual server (starting at around 5€) and a domain at your favorite hosting provider. The software being used is completely free and open-source. You can even make money with it. After all it is called “ISPmail” (ISP = internet service provider). Are you a sysadmin and your employer needs a mail server for their 500 employees? Or do you just want to get rid of freemail services for yourself? Then go with this guide. It has been battle-tested by thousands of other readers.

The setup is based on open-source software. There is no catch. I don’t charge for this guide. If you learn something and end up with a working mail server this makes me happy. Yes, I’m a bit weird, I know. If you feel you would like to return the favor you can easily make me happy by clicking on the donation link at the bottom of this page. And please respect the copyright. I have seen literal copies of my work on the internet by people even making money with it. That’s annoying.

This guide is different from most other because you will learn how email transport and delivery works. You will obtain the skills needed to install, reliably run and troubleshoot your mail server. I firmly believe that those skills are necessary because what good is a broken server with a sysadmin who doesn’t even know where to find the log files.

I have maintained this guide since Debian Woody was released in 2002. It has taken me entire holidays to write and maintain it. So thank you all for your kind feedback and support – I would probably have discontinued this guide without you. And this is already the ninth edition. Un… fucking… believable. 🙂

Beta warning

This version of the ISPmail guide is once again trying to follow new technology (systemd, IPv6, nftables) while keeping as much as possible as it was. It took several weeks to update the guide and test it. However the guide is still fresh from the shelf and released around Christmas 2019. So please do not despair if you find any irregularities. Just put your question in the comments and I will jump in and assist where possible.

Live support?

If you are lucky and desperate you may get instant help online. As an experiment there is an ispmail channel on matrix.org.

What your mail server will be able to do…

  • Receive emails for your own domain.
  • Filter out most of the spam and malware.
  • Send emails out to any other servers/domains on the internet.
  • Encrypt all connections (if the other mail servers have encryption enabled, too).
  • Add cryptographic DKIM signatures to outgoing emails automatically to help others verify your emails as authentic.
  • Store as many emails for as many email addresses as you have disk space.
  • Optionally encrypt emails on the server.
  • Set quotas (mailbox size limits) per user.
  • Let your users fetch email using IMAP or POP3 and send email through your servers using SMTP.
  • Allow users to manage server-based filter rules. Distribute incoming emails to different folders. Forward copies. Or send out-of-office notifications.
  • Provide a webmail interface so users can access their emails securely from any location using just a web browser.
  • Mitigate brute force attacks.
  • Have firewall rules to protect the server.

What you will need

  • Linux experience. Preferably using a Debian-derivative like Debian, Ubuntu or Mint. No godlike skills required. But know your basics: navigating through the file system, editing files, watching log files and having basic understanding of DNS and SQL (SELECT, INSERT, rows, columns).
  • Time and patience. You will need 2 hours to 2 days depending on your skills. We will proceed slowly and after every step ensure that no mistakes were made. Don’t hurry and skip parts even if they appear confusing or boring at first. If you get lost just submit your question at the bottom of any page throughout this guide and help is on the way.
  • server that runs with Debian Buster. (Support for other Debian-derivatives is considered.) 1 GB of RAM and a 20 GB disk is fine for your friends and family. Rent a cheap virtual server. Or use a decommissioned laptop or old PC. Other Linux distributions likely come with other versions of the software and have different default configuration – so your mileage will vary if you use anything else than Debian.
  • A public IP address that does not belong to a range of typical ISP customers. You usually can’t operate the mail server from a dialup IP address at home because those IP ranges are globally blacklisted as mail servers. Make sure that your IP address is not blacklisted before you start.
  • An internet domain (or more) to receive emails for. You need to be able to set A, MX and TXT records for that domain.

Why this guide may not be for your

You don’t care about learning anything? You just need a working mail server quickly? There are ready solutions like iRedMail that you may want to consider. Preparing and running a mail server requires a certain technical understanding. And that’s what the ISPmail guide is for. Experience from giving support to other sysadmins shows that most problems appear because some detail in a complex setup goes wrong and they have no idea how to track it down. Email has evolved a lot over the past 35 years and has become a complex matter. Go with ready solutions if you like. But I have a feeling that we meet again. And you will probably not save time either taking the easy route.


The whole tutorial is split into several pages. Please use the links on the right side to navigate through the pages. Make sure you have the server, a non-blacklisted IP and a domain ready. Let’s go.

19 thoughts on “ISPmail on Debian Buster – your mail server workshop

  • 2019-12-27 at 23:40

    Great! Many thanks for your efforts on maintaining this super useful mail-server tutorial.
    I am going to try it out over the weekend.

    First remark: the next buttons on this and the next page are not working

    • 2019-12-28 at 00:37

      Please let me know how far you get. 🙂 Thanks for the hint… fixing the ‘next’ buttons right away.

  • 2019-12-28 at 17:54

    Thank you Christoph. You are a trusted knowledge source. This is a big contribution to the community.

  • 2019-12-28 at 23:59

    Endlich, lange gewartet für einen neuen Server. Danke für deine deine Arbeit.

    • 2019-12-29 at 11:26

      Freut mich, wenn ich helfen kann. Und vor allem freut es mich, dass ich endlich fertig geworden bin. 🙂

  • 2019-12-29 at 20:04

    Yay! I’ll be working on setting this up over the next couple of weeks and migrating my old setup!

  • 2020-01-03 at 09:54

    Just arrived here to get the setup working again. Just migrated to buster and the “old” setup does not work anymore. I have a clue of what went wrong, but I want to go along your guide to not miss anything. The old setup was set up with one of your older guides and I went from there, with some additional settings.
    But now to the reason I wanted to leave a comment here:
    You don’t necessarily need a non-blacklisted IP to be able to sent mails from your mailserver. You can also relay your mails using another mailserver that allows it. E.g. Gmail allows you to relay mails through google servers.

    • 2020-01-03 at 10:00

      Out of curiosity: does gmail not check whether the sender address is a Google address?

      • 2020-01-03 at 10:44

        You can verify your address with Google. Google will send a mail with a link to verify you have control over that email address and then you can use that address as sender address.

  • 2020-01-07 at 11:01

    Dear Christoph,

    thank you so much for this guide and update, we’ve been running it for almost a decade now 🙂 i was wondering if you ever looked at the possiblities for an HA version with duplicate of the main services ?

    Thanks again.

    • 2020-01-07 at 11:24

      A decade is nice. Good to see that someone actually reads the guides. 🙂

      Unfortunately in the last years I didn’t have a larger project (or employer) that required such a setup. Let’s say I have a general idea how that could work. haproxy as a load balancer. Multiple SMTP servers querying the same database – or even multiple database in a master/slave replication fashion. The most interesting challenge is probably disk storage. I probably wouldn’t trust NFS so I think I would give GlusterFS a try. And in any serious environment I would instantly replace MariaDB by PostgreSQL. 🙂

      If running Kubernetes (especially on-premise) weren’t such an evil pain in the donkey that might actually be a nice way to run the components.

      • 2020-01-07 at 11:41

        Thanks, we’ve been looking in that direction so i guess we’ll keep digging. the email volume isn’t that big, nor the user count but it is an interesting Learning experience 😀

  • 2020-01-09 at 14:05

    Hi Christoph and Friends!
    You write: “A server that runs with Debian Buster. (Support for other Debian-derivatives is considered.)”

    What do you mean by this? Is it possible to apply this guide also (for example) to Ubuntu 20.04 LTS?
    I’m thinking about Ubuntu LTS for longer support time, albeit ethically…


    • 2020-01-09 at 14:23

      Mainly I was thinking about Ubuntu, Mint and similar distributions. The issue is software versions and to describe configurations options properly and get the components to work together and have it tested. Currently I’m still fixing smaller issues that I missed despite my testing even in Debian Buster. And realistically I cannot invest enough time to test it on other distributions thouroughly. So… this might be one feature that I may not be able to provide.

  • 2020-01-09 at 14:59

    I will try and let you know!
    I don’t demand any further commitment from you, you are already doing a lot !!!



  • 2020-01-28 at 05:35

    Christoph, your guides are fantastic!! I have been using them since Lenny!!

    Quick question: When it comes to ipv4 and ipv6 can they both be done at the roundcube level “https:// and then leave all mx records in IPV4 and only allow smtp over ipv4. Some server hosting services don’t allow ipv6 smtp. Would roundcube still function properly? I’m new to ipv6.

    • 2020-01-28 at 15:57

      Paul, thanks for the nice words and glad to have you as a long-term fan. 🙂

      If the sender does not speak IPv6 it will fall back to IPv4. So if your server supports IPv6 I would strongly suggest to use it.

      Or is there an actual ISP that support IPv6 but blocks SMTP over it?

      • 2020-01-28 at 18:52

        Hey Christoph,

        Thanks for the info. Its not really a ISP issue just the server hosting company DigitalOcean.
        DigitalOcean allows ipv6 public ip but does not allow ipv6 over smtp. I found this posting that explained why.
        “Admin Response
        Hi, We do not allow SMTP over IPv6 because when IPV6 addresses are blacklisted providers will blacklist the entire /64. Due to this it is not very useful to allow DigitalOcean users to run mail servers on IPV6.”

        So if I setup a AAAA record for the public ipv6 and don’t bother with the mx record for ipv6 a Roundcube user would not have any issues sending emails etc..? My thinking is if a user is on the road he or she could connect to email using native ipv6 and at work where ipv4 is used, then they could submit from a email client ie Thunderbird. Would that work?

        Thanks again for all your work,

  • 2020-02-20 at 08:18

    Hi Christoph,

    Your guide is amazing 🙂
    I will set up my mail server in couple of days and say goodbye to Tutanota.

    I will adapt your guide to redirect traffic throw a nginx reverse proxy.
    the certificates and security rules for all my sites are managed by the reverse proxy.

    So, could you put a recap of all port that have to be opened/redirect on the router/reverse proxy please ?

    Thanks in advance


Leave a Reply

Your email address will not be published. Required fields are marked *