Docker Compose Mail Server with Traefik

Why run a mail server with Docker and Traefik in 2026?

You don’t need to trust a cloud provider with your inbox. Every message they store or scan is one more data point in a profile you didn’t consent to. If you care about where your emails go after they leave your device, self-hosting isn’t a hobby—it’s the only real choice.

Running a mail server with Docker Compose and Traefik isn’t about complexity. It’s about control. You define the stack: SMTP, IMAP, webmail, admin UI—all versioned, reproducible, and secured. Traefik handles HTTPS and TLS routing through a single entry point, eliminating port conflicts and reducing configuration overhead.

This guide walks you through building a secure, maintainable mail stack using Docker Compose and Traefik in 2026—no cloud middlemen, no hidden policies, just your data, under your control.

Key takeaways

Docker Compose lets you define and deploy a full mail stack (SMTP, IMAP, webmail, admin UI) as a reproducible, version-controlled service configuration.
Traefik simplifies routing HTTPS and SMTP/TLS through a single entry point, eliminating port conflicts and reducing configuration complexity across services.
Self-hosting with Docker and Traefik is the only way to ensure your email data remains under your control, without reliance on cloud providers that scan or retain messages.

What does Docker Compose mail server with Traefik actually do?

You’re running a secure, self-hosted email system using containers: a mail server (like Mailu or OpenSMTPD), a web mail interface, a database, and a reverse proxy. Traefik handles public access, automatically securing your services with TLS via Let's Encrypt, routing web traffic by domain, and managing SMTP/IMAP traffic through TCP routing—no need to manually configure certificates or expose ports.

How the pieces work together

Each service runs in its own container, isolated and scalable. The mail server handles sending and receiving. The web UI lets you send and read messages through a browser. The database stores user accounts and settings. But only Traefik speaks to the outside world—acting as your public-facing gateway.

Traefik’s real power? It dynamically routes inbound HTTP(S) traffic based on domain names, meaning multiple domains can share one server. But it doesn’t stop there: it also supports TLS 1.3 termination and automated certificate issuance using Let's Encrypt—no manual renewal, no self-signed certs.

Why TCP routing matters for email

Mail protocols like SMTP (port 587/465) and IMAP (143/993) use TCP, not HTTP. Most reverse proxies can’t handle this. But Traefik’s TCP router does—it routes raw TCP streams to the correct container based on port and domain, just like HTTP routing.

That means your mail server stays protected behind the proxy while still being accessible from outside. You don’t expose container ports directly. You don’t manage TLS by hand. You don’t need a second proxy for mail. Traefik’s TCP routing is a quieter but essential feature for any modern mail setup.

This setup gives you full control—you decide who can send, who can access, and where data lives. Want a private email suite with the same architecture? Consider Unifiedesk’s self-hosted option, which brings your own mail, calendar, Drive, Docs, and AI assistant—all encrypted, all on your terms. No compromises.

How does Traefik SMTP TCP router work for mail delivery?

Traefik’s TCP routers let you route raw SMTP traffic (like on ports 587 or 465) based on domain or hostname—no HTTP required—by inspecting the initial TLS handshake or cleartext traffic. When you configure an entryPoint with TLS termination, Traefik handles the TLS handshake, then forwards plain TCP traffic to your mail server backend, simplifying deployment and enabling secure, domain-specific routing over standard ports without NAT or firewall rules.

Routing SMTP Without HTTP: How It Works

Unlike HTTP-based routing, Traefik’s tcp router type operates directly on TCP streams. This means your mail server can accept SMTP traffic on standard ports—587 for submission, 465 for submission-over-TLS—while Traefik examines the domain name during the TLS ClientHello or via SNI (Server Name Indication) to decide which backend to forward the connection to.

For example, if you send mail to mail.example.com via port 587, Traefik checks the SNI field in the TLS handshake and routes it to your mail service container, even though no HTTP request is involved. This works because the tcp router supports domain and hostSNI matchers—just like HTTP routers, but at the transport layer.

Securing and Simplifying Mail Delivery

When you configure an entryPoint with TLS, Traefik terminates the TLS connection, decrypts the traffic, and forwards it as plain TCP to your mail backend. This avoids the need for each individual service (like Postfix, Dovecot, or your mail app) to manage TLS certificates directly.

It’s a clean separation: Traefik handles certificate management (via Let’s Encrypt or internal CA), while your mail server focuses on mail processing. This matches industry best practices, where reverse proxies manage encryption at the edge—similar to how HAProxy or Nginx are used in large-scale mail setups.

With this setup, you can expose multiple mail domains or services over the same IP using different hostnames and ports—no port mapping or firewall complexity needed. For an alternative that manages the full stack with built-in encryption and zero configuration complexity, consider self-hosted Unifiedesk, which includes pre-configured mail, calendar, Drive, and AI—all behind secure, TLS-terminated entry points with automatic certificate renewal.

For more on how modern mail delivery stacks are designed, see the IETF’s guidance on mail submission and security.

Set up a secure, self-hosted email stack with Traefik

You can run a secure, self-hosted email stack using Docker Compose with Traefik as a reverse proxy by defining services for your mail server, webmail UI, database, and Traefik itself. Configure Traefik to handle HTTPS via Let’s Encrypt, route HTTP and TCP traffic to the right services, and enable automatic TLS renewals. This setup ensures encrypted communication, simplifies domain management, and integrates health checks and logging for reliability. For a managed alternative with the same privacy principles, see how Unifiedesk enables private email with self-hosting or managed deployment: self-hosting or custom domain setup.

Define the Docker Compose Services

Create a docker-compose.yml file with services: traefik, mailserver, webmail, and database. Use networks to isolate the stack and restart: unless-stopped for resilience. This structure keeps components decoupled and easy to update.
Set command in the traefik service to enable api and dashboard via --api.dashboard=true, and use --providers.docker=true to auto-discover services. This is a proven pattern in production setups and is described in the official Traefik docs.
Expose the mail server’s ports (587, 465, 143, 993) through ports in the mailserver service and assign labels like traefik.tcp.port=587 to route TCP traffic. This is essential for IMAP/SMTP to work through a reverse proxy.

Configure Traefik for TLS and Routing

Define entryPoints in traefik.yml with http (80), https (443), and tcp with specific ports (587, 465, 143, 993). These entry points let Traefik distinguish between HTTP and TCP traffic and route them correctly.
Enable Let’s Encrypt by adding acme config with email, storage, and httpChallenge (for HTTP-01) or dnsChallenge (for DNS-01). Use Let’s Encrypt’s public ACME protocol to issue and renew TLS certificates automatically.
Use labels on the webmail service to route HTTPS traffic: traefik.http.routers.webmail.rule=Host(`mail.yourdomain.com`) and traefik.http.routers.webmail.tls=true. For TCP, apply traefik.tcp.routers.smtp.rule=HostSNI(`*`) on the mailserver service to bind TLS to SNI.
Configure logging, health checks, and metrics via traefik.metrics.prometheus or traefik.log in the main config. Monitoring is not optional—use it to detect failures early and maintain uptime. You can also expose the Traefik dashboard locally for debugging.

What DNS records are required to make this work?

You need four key DNS records: an A record pointing your mail domain (like mail.example.com) to your server’s public IP, an MX record routing inbound mail to that hostname with priority 10, SPF, DKIM, and DMARC records to verify sender authenticity and reduce spam flags, and a correctly configured server hostname that isn’t on any blocklist. Without them, your mail server won’t receive messages reliably, and your domain risks being marked as spam.

Set up DNS for mail delivery and sender validation

A record for mail.example.com → point to your server’s public IP address. This ensures mail clients and servers can reach your mail server directly.
MX record → set mail.example.com as the mail exchanger with priority 10. This tells global mail servers where to deliver messages sent to @example.com.
SPF record → publish a SPF TXT record like v=spf1 a mx ip4:your.ip.address -all. This authorizes your server to send mail on behalf of your domain and helps prevent spoofing.
DKIM record → add a TXT record in your DNS for your selector (e.g. default._domainkey.example.com) with the public key generated by your mail server (e.g., using OpenDKIM). This cryptographically signs your outbound emails.
DMARC record → publish a TXT record at _dmarc.example.com with a policy like v=DMARC1; p=none; rua=mailto:[email protected]. This tells receiving servers what to do with messages that fail SPF or DKIM checks.

Verify server identity and reputation

Let’s be practical: even with perfect records, your server’s hostname must resolve correctly and your IP must not be on any major spam blacklist. Use tools like Spamhaus Lookup or MXToolbox to check your IP address before sending mail.

If you’re using a VPS provider and see sudden delivery failures, confirm that your hostname (e.g., mail.example.com) resolves to your server’s IP and that your mail server has valid reverse DNS (PTR record) configured through your provider’s control panel. This is often overlooked but critical for inbox placement.

Once records are in place, use dmarcian’s DMARC checker to validate your configuration. Don’t assume DNS propagation happens instantly—wait 5–10 minutes after updating, and verify with dig TXT _dmarc.example.com or nslookup.

For teams wanting a fully managed, secure, and privacy-focused alternative to self-hosting email and workspace tools, consider Unifiedesk self-hosted. It handles encryption at rest, secure access, and includes full calendar, drive, and AI assistant features—all with open-source transparency and strong defaults for security.

Key configuration: Traefik TCP router for SMTP (port 587)

You route SMTP traffic on port 587 via Traefik’s TCP router by defining a host-based rule using HostSNI(‘mail.example.com’), binding it to your mail server’s service, and enabling TLS. This ensures encrypted inbound email flow while aligning with standards like RFC 8314 for secure email transport.

Define a tcp entryPoint in your traefik.yml to handle port 587 with TLS enabled. This ensures encrypted communication from the outset, per industry best practice.
Create a TCP router with rule: HostSNI(mail.example.com). This uses SNI (Server Name Indication) to route traffic based on the domain, allowing multiple mail domains on a single IP — critical for multi-tenant setups.
Assign the router to a service named smtp-service, which points to your mail server’s container (e.g., a Postfix or Mailu instance). Traefik will forward traffic only if the SNI matches the configured host.
Ensure your mail server container listens on port 587 and is configured to accept TLS-secured SMTP connections. Misconfigured ports or missing TLS will cause connection drops.
Set up DKIM signing for outgoing mail. Use a DKIM key pair signed with your domain’s public key, and ensure your mail server auto-signs messages with it. This verifies authenticity, reducing spam flags — an essential practice for inbox delivery.

Why this works

Using SNI in the router rule is not optional. Without it, you can’t host multiple domains securely on one IP. The HostSNI matcher leverages TLS early in the handshake, making it impossible for attackers to intercept or redirect unencrypted traffic. This aligns with RFC 8314, which recommends TLS-based routing for modern mail systems.

Verify and test

After deployment, use MXToolbox to verify your domain’s mail records and ensure port 587 is reachable. Test sending mail from an external client — if it fails, check firewall rules, Traefik logs, and whether your mail server accepts incoming connections on 587 with STARTTLS. If you’re managing a personal workspace with sensitive data, consider using self-hosted Unifiedesk to run your full email, calendar, and file suite with control over encryption and data residency.

How to secure the mail server and prevent abuse

Secure your Docker Compose mail server with Traefik by rate-limiting SMTP and IMAP traffic, blocking brute-force attempts with fail2ban or Traefik’s middleware, running containers as non-root users, closing unused ports, and disabling unneeded services. These steps reduce attack surface and prevent abuse at scale.

Rate limiting and abuse protection

Enable rate limiting on Traefik TCP routers for SMTP (port 25/587) and IMAP (port 143/993) using the rateLimit middleware to reject excessive connection attempts.
Use Traefik’s built-in rate-limiting middleware or integrate fail2ban to automatically ban IPs after repeated failed login attempts.
Configure fail2ban to monitor mail server log files like /var/log/mail.log and apply bans via firewall rules (e.g. UFW or iptables).
Set aggressive but reasonable limits: e.g., 5 login attempts per minute per IP, then ban for 15 minutes — this blocks bots without impacting legitimate users.

Container and system hardening

Always run mail server containers as non-root users using user: 1000:1000 in Docker Compose and avoid privileged: true.
Restrict file permissions: ensure mail data volumes are owned by the service user and are not writable by others.
Close all unused ports on the host firewall; allow only 25, 587, 465 (SMTP), 143, 993 (IMAP), and 80/443 (Traefik web traffic).
Disable services that aren’t used — like LDAP or POP3 — in your email server (e.g. Postfix, Dovecot) to reduce the attack surface.
Regularly update your base images and application layers. Check IANA’s service registry to verify standard port assignments.

These practices align with industry standards for email infrastructure security. They’re not optional — they’re how you ensure your server isn’t a backdoor for spammers or an easy target for compromise.

Want a fully managed, secure, encrypted email and workspace suite? Unifiedesk offers end-to-end encryption, support for custom domains, and a private inbox with zero data mining — all open-source and self-hostable or hosted.

Learn how to self-host with Unifiedesk.

Why Unifiedesk makes self-hosting simpler

You don’t need to wrestle with TLS certificates, DNS records, or encryption keys when you use Unifiedesk for self-hosting. It handles all the hard parts—end-to-end encryption at rest with AES-256-GCM, built-in TLS via Traefik, DKIM signing, SPF/DKIM/DMARC enforcement, and secure webmail—so you can focus on using your domain, not managing its infrastructure.

Pre-configured, production-ready

Let’s be real: setting up a mail server with Docker and Traefik means debugging certificate issues, parsing SPF records, and manually securing each service. Unifiedesk ships with a fully pre-configured Docker setup that works out of the box. You pull the image, set your domain, and it just works—no guesswork.

It supports JMAP (modern, efficient), IMAP, SMTP, and webmail—all secured with industry-standard practices, including per-account encryption keys for messages and files. This means your data stays safe even if the server is compromised, and you control access to everything.

Everything you need, in one place

When you self-host with Unifiedesk, you’re not just getting mail. You get calendar, Drive, Docs, video meetings, contacts, and an AI assistant—all accessible via your domain. The AI assistant works with any OpenAI-compatible API, including self-hosted models, and your data isn’t used to train anything by default.

Inbound mail filtering, DKIM signing for outbound messages, and strict SPF/DKIM/DMARC enforcement are all automatic. This isn’t configuration—it’s security baked into the stack. No more hunting down why your emails are in junk folders.

For admin control, you get shared mailboxes, role-based permissions, and full auditability. All storage is encrypted at rest with your keys. This is the kind of privacy you can actually trust, not just promise.

Want to deploy it? Try the self-hosted option—it’s designed for teams and individuals who want sovereignty without the complexity. And if you’re still unsure, set up your custom domain in minutes, with automated MX, SPF, DKIM, and DMARC records. It’s not just a mail server—it’s your workspace, secured by design.

Trade-offs: DIY mail server vs. Unifiedesk self-hosting

Running a Docker Compose mail server with Traefik gives you full control over your stack and certificates, but you’re on the hook for every update, backup, security patch, and domain reputation. Unifiedesk simplifies this: it ships with encryption at rest, built-in email security, modern APIs like JMAP, and zero infrastructure management. You get privacy without the operational burden, especially if you're a team that values uptime and security, not sysadmin hours.

Fully visible, fully responsible

With Docker and Traefik, you see every service, every certificate, and every network route. You can tweak the startup order, inspect logs in real time, and manually renew certs with Certbot. That visibility is powerful—but so is the responsibility. You’re the one who must monitor for a log4j-style flaw, patch Postfix, rotate database backups, and handle an accidental DMARC misconfig that blacklists your domain.

Every outage, every breach, every reputation drop traces back to you. It’s an industry-standard practice to use reverse proxies like Traefik to manage TLS termination, and RFC 5322 still governs email format—yet the real work lies in maintaining the entire stack securely. As the RFC 5322 documentation reminds us, correctness in format ≠ security in operation.

Unifiedesk: privacy, automated, ready

Unifiedesk removes the complexity. You choose your domain, generate your email, and your infrastructure is encrypted at rest with AES-256-GCM under per-account keys. Mail, calendar, Drive, Docs, Meet, and AI—they all work together, protected by TLS in transit and end-to-end encryption. No more juggling Postfix, Dovecot, and OpenDKIM configs or wrestling with DMARC policies.

It’s not just about saving time. It’s about reducing risk. You avoid the creeping burden of keeping dozens of services secure—the kind of maintenance that can eat weeks a year. Teams using Unifiedesk self-hosting get JMAP, not just IMAP, for faster sync and better mobile experience. And you don’t need a DevOps team to run it.

For individuals or small teams who want privacy without the infrastructure stack, Unifiedesk handles the hard parts. You focus on work, not servers. Check out how it works: self-hosting, or get started with mail, calendar, and docs: mail, calendar, Drive, Documents, or Meet.

How to test and verify your email server setup

You’ve configured your Docker Compose mail server with Traefik—now prove it works. Test SMTP encryption with telnet and openssl s_client, verify inbound delivery using a test account, check DNS records (SPF, DKIM, DMARC) manually via mxtoolbox.com or dmarcian.com, and ensure the webmail interface loads securely over HTTPS and accepts logins. Let’s walk through each step.

Test SMTP and TLS connectivity

Use telnet mail.example.com 587 to connect to your mail server’s SMTP port and verify it responds with a 220 greeting.
Run openssl s_client -connect mail.example.com:587 -starttls smtp to confirm TLS is negotiated properly—look for Verify return code: 0 (ok) and a successful handshake.
If you see a TLS handshake error, check your Traefik TLS configuration and ensure your mail server’s certificate is correctly chained and trusted.

Verify mail delivery and DNS records

Send a test email from a known service (like Proton Mail or Tuta) to your custom domain—check if it arrives in the inbox.
Use mxtoolbox.com or dmarcian.com to check your domain’s TXT records for SPF, DKIM, and DMARC—ensure they match your configuration.
Don’t rely on automated scoring—check the actual record values. For example, SPF should allow your server’s IP, DKIM should have a valid selector and public key, and DMARC should specify a policy (e.g., rua=mailto:[email protected]).

Validate the webmail interface

Open your domain’s webmail URL in a browser (e.g. https://mail.example.com)—it should load over HTTPS with no certificate warnings.
Try logging in with test credentials—confirm the interface responds and redirects after authentication.
If you're using self-hosted Unifiedesk, ensure your Traefik reverse proxy routes /mail to the correct service with proper TLS termination. Self-hosting gives you full control, but requires vigilance on configuration.

A single misconfigured DNS record can break inbox delivery. Test each piece—before your users notice.

Remember: security is built through verification, not assumption. The same tools used by ISPs and email providers to validate domains (like RFC 5322) are your allies in ensuring reliability.

Conclusion: Your email, your rules, your infrastructure

Running a mail server with Docker Compose and Traefik is not just possible—it’s practical in 2026. With clear DNS setup, automated TLS via Let’s Encrypt, and consistent hardening, your domain can securely send and receive mail without relying on corporate gatekeepers.

But managing the full stack—mail, calendar, drive, video meetings, and document collaboration—adds complexity. For teams who want privacy by design without the operational overhead, Unifiedesk’s self-hosted deployment delivers a complete, encrypted workspace suite with per-account encryption and zero data retention.

Ready to put this into practice? Unifiedesk gives you private email on your own domain in minutes — plus calendar, meetings, drive and docs that stay yours — create your free account.

Frequently asked questions

Can Traefik handle SMTP over TCP with TLS?

Yes, Traefik supports TCP routing with TLS termination. Use `tcp.routers` and `entryPoints` with TLS configuration to handle SMTP on port 587 or 465.

Do I need to set up DMARC if I self-host email?

Yes. DMARC protects your domain from spoofing and improves deliverability. It requires publishing a DMARC TXT record and enforcing policies.

Is Docker Compose suitable for production mail servers?

Yes, if managed with care: use proper networking, persistent volumes, backups, and version control. For complex deployments, consider orchestrators like Kubernetes.

Can I use my custom domain with a self-hosted mail server?

Yes, as long as you configure DNS records (MX, SPF, DKIM, DMARC) and point your domain to a public IP with a valid certificate.

How does Unifiedesk handle email encryption for self-hosted deployments?

Self-hosted Unifiedesk encrypts every message and file at rest with AES-256-GCM under per-account keys, and uses TLS for transit.

What’s the difference between JMAP and IMAP?

JMAP is modern, efficient, and supports real-time sync. Unlike IMAP, it avoids polling and uses a single, bidirectional connection for all operations.

Do I need a public IP to run a mail server with Traefik?

Yes, because your domain must resolve to a publicly accessible IP. Dynamic DNS can help if your IP changes frequently.

How often should I update my self-hosted mail server?

Update core components (OS, Docker, Traefik, mail server) weekly. Monitor security advisories and apply patches promptly.

Can I run Unifiedesk alongside my existing Docker setup?

Yes. Unifiedesk supports Docker Compose and can be integrated into existing stacks. It does not interfere with other services using different ports.

What happens if my mail server is unreachable?

Inbound mail will be rejected or delayed based on your MX configuration. Use a backup provider or monitor your server’s uptime with tools like UptimeRobot.

Does Traefik support wildcard domains for mail?

Yes. You can use wildcards in `HostSNI` rules, but test DNS and certificate issuance carefully to avoid conflicts or misrouting.

How do I backup a self-hosted email server?

Backup the database, mail storage (e.g. `/var/mail`), and configuration files regularly. Use encrypted offsite storage and test restores.