Install and Secure Mailcow on Debian 12

1. Requirements

Before starting, make sure your server meets these conditions:

• Debian 12 (preferably a fresh install)
• Root or sudo privileges
• Minimum specs: 2 vCPU, 4 GB RAM
  Recommended: 8 GB RAM
• At least 40 GB disk space
• A domain name (e.g., example.com)
• Ability to edit DNS records
• Open ports: 25, 80, 443, 587, 993, 995

2. System Update & Base Configuration

Update the OS and reboot:

sudo apt update && sudo apt -y full-upgrade
sudo reboot

Set your timezone (optional):

sudo timedatectl set-timezone Europe/Paris

3. Install Docker & Docker Compose

Install required packages:

sudo apt install -y curl git apt-transport-https ca-certificates gnupg lsb-release

Add Docker’s GPG key:

curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/docker.gpg

Add Docker repository:

echo "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/debian $(lsb_release -cs) stable" \
| sudo tee /etc/apt/sources.list.d/docker.list

Install Docker + Compose plugin:

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

Enable Docker:

sudo systemctl enable --now docker
sudo docker --version
sudo docker compose version

4. Download Mailcow

cd /opt
sudo git clone https://github.com/mailcow/mailcow-dockerized
cd mailcow-dockerized

5. Generate Mailcow Configuration

Run the setup script:

sudo ./generate_config.sh

You will be prompted for:

• Mail server hostname (e.g., mail.example.com)
• Timezone
• Optional custom storage path

This creates mailcow.conf.

6. Hostname, DNS & Reverse DNS

Set the system hostname:

sudo hostnamectl set-hostname mail.example.com

Configure DNS:

• A record → mail.example.com → server IP
• PTR record → server IP → mail.example.com
  (set via networking tab)

Correct rDNS is mandatory for email deliverability.

7. Launch Mailcow

Pull and start the stack:

sudo docker compose pull
sudo docker compose up -d

Check running containers:

sudo docker compose ps

8. HTTPS via Let’s Encrypt

Mailcow automatically requests certificates if ports 80/443 are free.

After DNS propagation, visit:

https://mail.example.com

If certificates fail, inspect logs:

sudo docker compose logs acme-mailcow

9. DNS Records (MX, SPF, DKIM, DMARC)

Configure these DNS entries:

MX Record

example.com.  IN MX 10 mail.example.com.

A Record

mail.example.com. IN A <server_IP>

SPF

example.com. IN TXT "v=spf1 mx -all"

DKIM

Generate inside Mailcow UI:
Configuration → ARC/DKIM Keys
Publish the TXT record provided.

DMARC

_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

Optional Autodiscover

autodiscover.example.com → mail.example.com
autoconfig.example.com → mail.example.com

10. Firewall Rules

Install and configure UFW:

sudo apt install -y ufw
sudo ufw allow OpenSSH
sudo ufw allow 25,80,443,587,993/tcp
sudo ufw enable
sudo ufw status

11. Security & Hardening

• HTTPS enforced automatically
• Rspamd provides strong anti‑spam and anti‑abuse filtering
• Use strong passwords + enable 2FA in Mailcow UI
• Update regularly:

sudo docker compose pull
sudo docker compose up -d

• Monitor logs for brute‑force attempts

12. Backups & Updates

Backup Mailcow volumes:

Stop the stack:

sudo docker compose down

Archive volumes:

sudo tar -czf mailcow-backup.tar.gz /var/lib/docker/volumes/mailcowdockerized_*

Update Mailcow:

cd /opt/mailcow-dockerized
sudo git pull
sudo docker compose pull
sudo docker compose up -d

13. Monitoring & Troubleshooting

View all logs:

sudo docker compose logs -f

Service-specific logs:

sudo docker compose logs postfix-mailcow
sudo docker compose logs dovecot-mailcow

Restart a component:

sudo docker compose restart rspamd-mailcow

14. Useful Notes

• Admin login:
  https://mail.example.com → credentials stored in mailcow.conf
• SOGo webmail available at /SOGo
• Supports IMAP/SMTP/ActiveSync for Outlook, Thunderbird, Apple Mail
• API endpoints available for monitoring and automation

15. Final Validation Checklist

• OS updated + rebooted
• Docker & Compose installed
• Mailcow config generated
• Hostname + DNS + rDNS correct
• Containers running
• HTTPS active (Let’s Encrypt)
• MX/SPF/DKIM/DMARC configured
• Firewall restricted to mail ports
• Backup strategy ready
• Logs monitored

Your Mailcow instance is now fully operational on Debian 12