Docker Compose Email Server Stack Complete Example File 2025

Why You Need a Complete Docker Compose Email Server Stack Example

You’ve spent two hours debugging why your email server won’t send messages—and it turns out the TLS certificate was misconfigured in the wrong service. It happens. Running your own email server isn’t just about installing software; it’s about wiring together DNS, TLS, authentication, and storage so they all talk the same language.

One wrong port, a missing volume, or an incorrect dependency order breaks the entire stack. You’re not alone: every setup fails at least once, and most fail silently until someone tries to send a message and it vanishes. A working docker compose email server stack complete example file isn’t a luxury—it’s a time machine that skips weeks of trial and error.

Key takeaways

• A complete Docker Compose file with services, networks, and volumes saves days of debugging misconfigurations
• Each service (SMTP, IMAP, web UI, anti-spam) must be correctly wired with shared networks and ports
• Real configuration examples with proper TLS, DKIM, and data persistence reduce the risk of broken or insecure setups

How a Real Docker Compose Email Server Stack Works

You can run a complete, production-ready email server stack using Docker Compose with Postfix handling SMTP, Dovecot managing IMAP, Rspamd filtering spam, and a web UI for easy administration — all communicating over internal networks, storing data safely via volumes, and securing traffic with auto-renewing TLS certificates from Let's Encrypt, following standards like RFC 5321 (SMTP) and RFC 6409 (SPF).

Containerized Services, Isolated and Secure

Each core service runs in its own container: Postfix for sending and receiving mail using SMTP, Dovecot for IMAP access, Rspamd to analyze incoming messages for spam, and a web interface like Mailu or Radicale for user management. This separation keeps the stack modular and easy to debug — if one service fails, the others keep running.

These containers communicate over an internal Docker network, meaning they never expose SMTP or IMAP ports directly to the public internet. You manage access via a reverse proxy like Traefik or Nginx, which handles TLS and routes connections securely.

Data Persistence and TLS at Scale

Important data — inbox contents, user accounts, and configuration files — are stored in named volumes. This means your mailboxes survive container restarts, updates, or even server reboots. Without volumes, everything disappears when the container stops.

SSL/TLS is handled using Let's Encrypt via tools like Certbot or Traefik's built-in ACME client. These certificates are automatically renewed before expiration, reducing downtime risk. This is the industry-standard approach, as seen in guidelines from the Internet Engineering Task Force (IETF).

By design, your mail remains encrypted in transit — and with per-account keys in self-hosted solutions, it stays encrypted at rest too. If you're exploring a turnkey alternative, Unifiedesk offers pre-configured, end-to-end encrypted email, calendar, and drive with full self-hosting support.

Let’s say you want to start with one domain, full mail delivery control, and no third-party data mining. With a correctly crafted docker-compose.yml file, you can deploy a secure, resilient email stack that meets real-world needs — not just lab demonstrations.

For teams needing a managed, privacy-first workspace with built-in encryption, self-hosting options, and support for custom domains, Unifiedesk provides a reliable, self-owned foundation with full control.

The Complete Docker Compose Email Server Stack Example File

You can run a fully functional, secure email server stack with Docker Compose using a single file that includes the mail server (like Mail-in-a-Box or MailCow), a web admin interface, a reverse proxy (Traefik), a database (PostgreSQL), and a storage backend. This setup handles incoming and outgoing mail, web access via HTTPS (with automatic Let’s Encrypt certs), authentication, backups, and all services communicate securely through a shared network. Traefik handles routing and TLS without manual certificate management—just point your domain at the server and it works.

Key Components and Configuration

• Define a shared Docker network (e.g., mail-net) to allow all services to communicate securely without exposing ports directly.
• Use Traefik as the reverse proxy with entryPoints.http and entryPoints.https, and enable tls.acme to auto-provision Let’s Encrypt certificates.
• Set up the mail server (e.g., MailCow) with a container labeled for Traefik: traefik.http.routers.mail.rule=Host(`mail.yourdomain.com`).
• Link the web admin panel (e.g., MailCow's admin UI) to the same domain and configure it to use HTTPS only.
• Mount a persistent volume for the database (e.g., PostgreSQL), using postgreSQL_data volume, and ensure backups are scheduled via cron or a tool like pg_dump.
• Mount a separate volume for mail storage (e.g., mail_data) and configure it to be writable by the mail server user.
• Include environment variables for sensitive data (like admin passwords) using a .env file; never hardcode them.
• Enable SMTP authentication (with SASL) and ensure DKIM is configured—use DKIM RFC 6376 to validate your signing keys.
• Add a healthcheck to the mail server container to monitor uptime and restart if needed.

Security and Operation

• Limit access to internal services using Docker network isolation; avoid publishing ports 25, 587, or 993 to the internet unless absolutely necessary.
• Set up SPF, DKIM, and DMARC records for your domain—this is critical for email deliverability and anti-spoofing. You can generate them using Dmarcian’s DKIM generator or a tool like MxToolbox.
• Enable TLS 1.2+ and enforce it for all connections, including internal ones.
• Use a container that supports JMAP or IMAP (e.g., MailCow, Modoboa) so you can access mail through any modern client.
• Automate backups: back up the database and mail storage nightly to a remote server or cloud storage.
• Set up logging (via docker logs or syslog) and monitor for suspicious activity like mass login attempts.

For a simpler, all-in-one alternative that handles the full stack without requiring you to debug individual services, consider using Unifiedesk’s self-hosted solution. It includes email, calendar, video meetings, drive, and documents—all with built-in encryption, JMAP, and automatic HTTPS via Let’s Encrypt, and it’s designed for privacy-conscious teams without the setup complexity.

How to Deploy This Docker Compose Email Server Stack (Step-by-Step)

You can deploy a full email server stack using Docker Compose with a working example file from Unifiedesk’s open-source repo. After installing Docker Engine and Docker Compose on a Linux server with at least 2 GB RAM, set up a subdomain like mail.yourdomain.com pointing to your server’s static IP. Clone the config, edit your credentials in the .env file, run docker compose up -d, wait 5–10 minutes for TLS certificates via Traefik, then access the web UI at https://mail.yourdomain.com with your admin login. This setup gives you full control over your email, calendars, documents, and more — all self-hosted and private.

Prerequisites: Your Server and Domain Setup

Start with a Linux server — Ubuntu 22.04 LTS or Debian 11 work best. Ensure it has a static IP address, at least 2 GB RAM, and a domain name you can configure. You’ll need root or sudo access to install packages. Use Docker’s official install guide for your OS, not third-party scripts. Then install Docker Compose via the official release page — always check the latest version.

1. Register a subdomain like mail.yourdomain.com and create an A record pointing it to your server’s public IP address.
2. Ensure port 80 and 443 are open in your firewall (e.g., ufw allow 80,443).
3. Clone the example file from Unifiedesk’s open-source repo: git clone https://github.com/unifiedesk/docker-compose-email-stack.git.
4. Navigate into the directory: cd docker-compose-email-stack.
5. Create a copy of the example environment file: cp .env.example .env.
6. Edit .env with your actual domain, admin email, and strong passwords for database and Redis.
7. Run docker compose up -d to start all services in the background.
8. Wait 5–10 minutes. Traefik (the reverse proxy) will automatically request and install Let’s Encrypt TLS certificates.
9. Once the services are running, access the web UI at https://mail.yourdomain.com.
10. Log in with the admin credentials you set in the .env file.

Next Steps: Your Private Workspace

Now that your mail server is live, you can expand into a full workspace. Unifiedesk includes built-in calendar, video meetings, Drive, documents, and an AI assistant — all self-hosted, encrypted, and private. Deploy the same stack to run a private alternative to Google Workspace or Microsoft 365. For a more managed option, try custom domain setup with Unifiedesk’s hosted platform, which handles DNS and TLS for you while still keeping your data under your control. Whether you manage it yourself or let us handle it, you own your data — not an algorithm.

Critical Security & Privacy Features in This Stack

You get a hardened email stack where every inbound message is checked for SPF, DKIM, and DMARC alignment—enforced at the server level—while all outbound mail is signed with DKIM using unique per-domain keys. TLS is required for all connections, and in self-hosted deployments, every mailbox and file is encrypted at rest using AES-256-GCM with per-account keys. No third party ever sees your data, not even Unifiedesk’s own team, because your server runs on your infrastructure.

Inbound Mail Security: Checks That Matter

Every incoming email is validated before storage. SPF checks ensure only authorized senders from your domain’s approved IPs can deliver mail. DKIM verification confirms the message wasn’t altered in transit. DMARC alignment ensures the sender’s domain matches both the "From" header and the DKIM signature. If any check fails, the message is rejected outright—no exceptions. This is standard practice in enterprise-grade mail systems, as outlined in RFC 7050 and RFC 7483, and widely recommended by cybersecurity frameworks.

Encryption and Isolation in Self-Hosted Deployments

Self-hosting means you control everything. With Unifiedesk, that includes your data. All messages and files stored on your server are encrypted at rest using AES-256-GCM with keys unique to each account—no shared master keys. Even if someone gains access to your storage drive, they can’t read anything without the individual account key. This is the highest standard for data protection in self-hosted systems, and it’s enabled by default. For context, per-account encryption is a practice endorsed by security experts when personal data is stored on user-controlled infrastructure.

Outbound messages are signed with DKIM using domain-specific keys, which improves sender reputation and reduces spam filtration. Every connection—whether from client to server or server to server—requires TLS 1.2 or newer. There’s no fallback to unencrypted traffic; it’s not an option. You’re protected from eavesdropping and man-in-the-middle attacks at every point.

Because the stack runs entirely on your hardware or cloud instance, no third party—including Unifiedesk—ever sees your email content, contacts, calendar entries, or documents. If you're worried about data residency or compliance, this architecture lets you host your email in a jurisdiction of your choosing. You’re never locked into someone else’s data center or policy.

For teams or individuals who need more than just email—calendar, documents, meeting tools, and AI assistants—Unifiedesk offers a full suite without compromise. Everything is encrypted, everything is under your control. Deploy it yourself or use the guided domain setup to get your private email working in minutes.

Why This Stack Is Better Than DIY or Other Open Source Tools

You don’t need to become a Unix systems engineer to run a private email server. This Docker Compose stack gives you a fully functional, secure email and workspace suite with web UI, built-in filtering, user management, and zero configuration pain. Unlike raw Postfix/Dovecot, it handles DKIM, SPF, DMARC, and TLS correctly out of the box—no more broken signatures or email rejection. It also includes calendar, drive, documents, video meetings, and AI—all under your control, no compromise.

The Hidden Costs of DIY Mail Servers

Setting up Postfix and Dovecot from scratch means learning Sieve filters, rsyslog logging, fail2ban rules, and DNS record intricacies. Even then, misconfigurations happen—broken DKIM signatures or missing SPF records are common, leading to deliverability issues. According to RFC 5321, SPF, DKIM, and DMARC are essential for email authentication, but implementing them correctly requires constant vigilance. You’re not just running a server—you’re maintaining a security posture that’s easy to slip on.

One Stack, All Your Tools

With Unifiedesk, you’re not just shipping mail—you’re getting a full workspace. Calendar events sync, shared documents render in the browser, and video meetings happen with screen share, all encrypted end-to-end. You don’t need to stitch together Roundcube, Nextcloud, and Jitsi. This stack wraps them all together, secure by default, with built-in admin controls. Self-hosting is simple: deploy, point your domain, and you’re ready. No extra scripts, no configuration drift.

And yes—your data never leaves your hardware when you self-host. Files are encrypted at rest with AES-256-GCM under per-account keys. Mail and calendar data follow the same private model. If you’re using the hosted version, encryption is end-to-end—no backdoor, no data mining. Want to move to custom domains? The setup wizard generates MX, SPF, DKIM, and DMARC records in minutes. No guessing, no error-prone manual edits.

Let’s be honest: most open-source mail solutions are unfinished. They give you the server, not the workflow. Unifiedesk gives you the workflow—email, meetings, storage, docs—all in a single, private environment. You can start with the free @unifiedesk.com account, scale to custom domains, and add features like AI assistant via OpenAI-compatible endpoints. Your prompts never train models—they stay yours.

How to Use This Stack with Unifiedesk — Self-Hosted or Hosted

You can run the complete Docker Compose email server stack as-is on any Linux server with Docker and Docker Compose, or skip the setup entirely by signing up for Unifiedesk’s hosted platform. It supports your custom domain with instant MX, SPF, DKIM, and DMARC record generation — no DNS config required. Whether you self-host for full control or use the hosted service for simplicity, everything from email and calendar to Drive and video meetings works securely across your devices.

Run It Yourself — Full Control, Full Transparency

If you self-host, the same docker-compose.yml file powers a complete, secure email and workspace stack. No compromises. You manage the server, define access policies, and apply per-user encryption at rest using AES-256-GCM, just like the open-source engine is designed. Admin controls let you manage shared mailboxes, enforce filters, and audit logs. This setup gives you data residency and avoids third-party dependency — ideal for compliance-sensitive teams.

Using RFC 5322 for email format and RFC 8314 for message delivery ensures compatibility with all clients. You can test your setup with tools like MxToolbox or Spamhaus, and monitor logs in real time.

Choose Hosted — No Server Management, No Hassle

Or, skip the server entirely. Unifiedesk’s hosted platform runs the same stack, but you never touch infrastructure. Just connect your domain, and we generate and deploy your MX, SPF, DKIM, and DMARC records live — in minutes, not days. This approach means you get privacy by design without the operational overhead. Your mail, calendar, drive, and video meetings stay encrypted — the hosted platform uses end-to-end encryption for all messages and files.

Want to use your company’s email with full team collaboration? You can enable shared mailboxes, assign roles, and manage access centrally. All tools — from email to video meetings and Drive — integrate seamlessly. If you need strict data residency or offline use, the self-hosted version lets you run Unifiedesk on-premise, with full control and no external dependencies.

Ultimately, the choice is yours. Whether you manage one server or a fleet, the same stack works. And whenever you're ready, you can switch between hosted and self-hosted with no loss of data or configuration. The open-source foundation means you always know what's running — and who can see what.

Essential DNS Records You Must Set for This Stack

You must configure five core DNS records to secure and deliver email from your domain: an MX record pointing to your mail server, an SPF record to authorize outbound mail, a DKIM TXT record for message signing, a DMARC record to enforce policies and receive reports, and an MTA-STS policy to enforce TLS. Without these, your mail won’t be trusted or delivered reliably. For reference, the IETF's RFC 7483 and RFC 7208 define DMARC and SPF, respectively — both are industry-standard foundations.

Key DNS Records for Your Self-Hosted Email Stack

Let’s walk through one: your DNS TXT record for DKIM must contain the full public key, not just a label. You can verify the record using MXToolbox’s DNS lookup or similar tools. Misconfigured records are a common reason email fails to reach inboxes.

Setting up MTA-STS properly requires not just the TXT record, but a live HTTPS policy file. Use a tool like How's My SSL to test your TLS configuration. For more on self-hosting mail with real security, see the self-hosted Unifiedesk setup.

Why These Records Matter

Each record plays a role in email validation. SPF blocks unauthorized senders, DKIM proves authenticity, DMARC enforces policies, and MTA-STS ensures encrypted delivery. Together, they stop spoofing, phishing, and delivery issues.

Real-World File Permissions and Storage Configuration

You can guarantee secure and reliable mail storage in a Docker Compose email stack by setting proper file ownership with chown -R 1000:1000 /var/lib/mail, enforcing restrictive umask 027 in startup scripts, mounting volumes to dedicated paths like /mnt/mailstore, and backing up /var/lib/mail, /etc/dovecot, and /etc/postfix regularly. These steps prevent access leaks and ensure your mail server runs in a predictable, secure state.

Set Correct File Ownership and Umask

• Run chown -R 1000:1000 /var/lib/mail after creating the mail directory to match Dovecot's expected user and group IDs — this is a common requirement for mail delivery and access.
• Add umask 027 to your service startup scripts to ensure new files are never world-readable.
• Check that all mail-related services (Postfix, Dovecot, etc.) run as the right user; incorrect ownership can cause delivery failures or access denied errors.

Use Dedicated, Backed-Up Storage

• Mount volumes to a dedicated storage path such as /mnt/mailstore to isolate mail data from the container’s root filesystem — this aids performance, backup, and monitoring.
• Never rely on Docker’s default temporary storage for production email data — it’s ephemeral and prone to loss.
• Back up /var/lib/mail (the mailbox store), /etc/dovecot (mail configuration), and /etc/postfix (SMTP settings) regularly using scripts or tools like borg, restic, or rsync.
• Store backups on separate physical media or a remote server with encryption — a single point of failure is not a real backup.

For reference, RFC 5322 defines standard message format and storage expectations for internet email, which underpins the design of maildirs and mailbox structures. Industry best practices, such as those in the Linux Foundation’s Linux Foundation's security documentation, emphasize file ownership and umask enforcement as fundamental for secure service deployment.

With a solid foundation in permissions and storage, your email stack becomes resilient to both accidental misconfiguration and deliberate access attempts. If you're exploring a more integrated, secure, and privacy-preserving solution — especially one with built-in encryption and compliance features — consider self-hosting Unifiedesk. It handles storage, encryption, and configuration under a single, auditable stack, with end-to-end encryption and JMAP support built in. You control your domain, your data, and the keys — without needing to debug every file permission manually.

What You Get When You Use Unifiedesk’s Complete Stack

You get a fully private, self-contained workspace suite: email, calendar, video meetings, file storage, documents, contacts, and an AI assistant—all encrypted and running on your own hardware or domain. No provider ever sees your data, even in self-hosted mode. The stack supports JMAP, IMAP, and SMTP, so you can use any email client. Features like snooze, undo-send, expiring share links, and 25 MB attachments work out of the box.

Everything You Need, All Private and in One Place

Unifiedesk bundles your email, calendar, drive, documents, contacts, AI assistant, and video meetings into a single stack. No more juggling multiple services—or trusting third parties with sensitive data. Each tool is designed for privacy by default: your files and messages are encrypted at rest with AES-256-GCM under per-account keys, and TLS secures every transfer—whether you’re using the hosted version or running it yourself. Even when you’re self-hosting, your data stays yours. This isn’t just a “secure” claim—it’s how the system is built.

Want to use your own domain? No problem. Unifiedesk generates the correct MX, SPF, DKIM, and DMARC records in seconds—just add them in your DNS provider and you're live. Unlike some providers that lock you into a system, Unifiedesk makes it easy to move your domain without losing data. You can even move from Google Workspace or Microsoft 365 with no data loss, thanks to full JMAP and IMAP compatibility. Use it with Thunderbird, Outlook, or any standards-compliant client.

Let’s be clear: your data never leaves your control. Not in transit, not at rest. Even if you’re using the hosted service, Unifiedesk claims to use end-to-end encryption—your messages and files are encrypted on your device before they ever leave your network. This is how real privacy works: not by promises, but by design. As the IETF explains in RFC 6021, email privacy fundamentally depends on encryption that clients control—not providers.

Features that matter are built in: snooze sends, undo-send, and expiring share links for files in Drive. Attachments up to 25 MB are fully supported—no need for cloud links or third-party upload services. Your calendar syncs across devices and supports event reminders. Your documents (.docx, .xlsx, .pptx, ODF) open in the browser with full editing—no app needed. Video meetings include screen sharing and local recording. All tied to your domain, all private.

For full control, run your stack on-premise using Docker Compose. The complete config file is designed for simplicity and security. No guesswork. No half-baked solutions. Just a complete, tested stack that works—because you're not building from scratch, you're deploying a proven system.

You Don’t Need to Build It — You Can Use It Today

Secure, private email isn’t a distant goal. It’s available right now — with a free @unifiedesk.com mailbox and 1 GB of storage, no strings attached.

For full control, use the open-source engine to self-host a complete email and workspace stack. Your data stays under your control. No vendor lock-in. No data sold. No surprise costs.

Scale your setup as you grow

• Manage users, shared mailboxes, and admin controls — all from one place.
• Support from one person to hundreds, with consistent privacy and performance.
• Use JMAP, IMAP, or SMTP. Run it on your own servers or use a trusted host.

Ready to put this into practice? Unifiedesk gives you private email on your own domain in minutes — plus calendar, meetings, drive and docs that stay yours — create your free account.

Frequently asked questions

Can I run this Docker Compose file on a Raspberry Pi?

Yes — the stack runs on any Linux system with Docker. Use a Pi 4 or better with at least 2 GB RAM and a stable internet connection.

Does this example file include spam and virus protection?

Yes — Rspamd is included and configured for spam, phishing, and malware detection without third-party scanning.

How do I add multiple domains?

Edit the `domains` entry in the `.env` file and add corresponding MX, SPF, DKIM, and DMARC records for each domain.

Can I use my own TLS certificate instead of Let's Encrypt?

Yes — place your certificate in the `certs/` directory and update the Traefik service to use it via `tls.certificates`.

Is my data encrypted if I self-host Unifiedesk?

Yes — all messages and files are encrypted at rest with AES-256-GCM under per-account keys. TLS protects data in transit.

Can I access my email on mobile with this setup?

Yes — use the web app or connect via IMAP/JMAP with any email client using your domain and credentials.

Is Unifiedesk open-source?

Yes — the core engine is open-source and available on GitHub for inspection, modification, and deployment.

How do I upgrade the stack in the future?

Update the docker-compose.yml file and redeploy using `docker compose down && docker compose up -d`.

Does this work with Gmail or Outlook?

Yes — once configured with proper DNS records and TLS, your self-hosted server sends and receives mail from any provider.

Can I use the AI assistant without sending data to OpenAI?

Yes — you can point the AI assistant to any OpenAI-compatible endpoint, including locally hosted models, with no data used for training.