Docker-Mailserver Setup Guide

Why Run Your Own Email Server with Docker-Mailserver?

You’re tired of your email provider knowing more about you than your closest friend. Every message scanned, every link tracked, every contact listed — all for a service that’s supposed to be private. What if you could own your inbox, your data, and the full control of how it’s handled?

Docker-Mailserver isn’t just another self-hosting project — it’s a battle-tested, open-source email server designed for real people and small teams. With Docker Compose, you deploy it in minutes, adjust settings with confidence, and scale when you need to — all on your own terms.

Key takeaways

Self-hosting your email with Docker-Mailserver keeps your data entirely under your control, with no third-party access or data mining.
Docker-Mailserver is actively maintained, uses proven security practices, and supports full encryption at rest and in transit via TLS.
Docker Compose enables repeatable, version-controlled setups — easy to deploy, reconfigure, and roll back, without guesswork.

What You Need Before Starting the Docker-Mailserver Setup Guide

You’ll need a domain with full DNS control, a Linux server (Ubuntu 22.04 LTS or Debian 12 recommended) with at least 2 GB RAM and 10 GB disk space, a public IPv4 address, and basic command-line skills. You must be able to configure MX, SPF, DKIM, and DMARC records—without these, your mail won’t be trusted or deliver reliably.

Core Requirements

You must own a domain (e.g. yourdomain.com) and have access to its DNS management panel—no exceptions. This is non-negotiable for email reliability.
Your server must run a supported Linux distribution: Ubuntu 22.04 LTS or Debian 12 are the best tested options. Check current versions at ubuntu.com/download/server or debian.org/old-releases.
Minimum 2 GB RAM and 10 GB disk space. You’ll need more for email-heavy use, backups, or storing attachments. Always use SSDs for better performance.
A public IPv4 address is required—you can’t receive mail without one. IPv6 works but is not universally supported in email delivery yet.
You should be comfortable with SSH, basic CLI commands, and managing file permissions using chmod and chown. If you’re not, learn how to secure a server first.

DNS Configuration Is Key

Before setting up Docker-Mailserver, ensure you can configure these DNS records at your registrar (e.g. Cloudflare, Namecheap, AWS Route 53): MX, SPF, DKIM, and DMARC.
MX records must point to your server’s hostname (e.g. mail.yourdomain.com). This tells email providers where to deliver mail.
SPF and DKIM protect against spoofing. SPF lists authorized senders; DKIM signs each email cryptographically. DMARC tells receivers what to do if SPF or DKIM fails—usually reject or quarantine.
Use tools like MxToolbox to verify your DNS records before you start, and again after setup.
Let’s be real: if you can’t set these records, your emails will land in spam or not arrive at all—no matter how well Docker-Mailserver is configured.

Want a ready-made, end-to-end encrypted email and workspace suite with automatic domain setup and full self-hosting? Try Unifiedesk, which handles DNS, encryption, and security out of the box—from email to documents, calendar, video meetings, and AI—all under your control.

Key Considerations: Security, Stability, and Maintenance

Running a mail server with Docker Mailserver isn’t just about setting up containers—it’s about managing ongoing risks: spam, blacklisting, certificate validity, encryption, and software updates. A single misconfiguration can hurt deliverability or expose your system. You’re responsible for TLS enforcement, data protection, and keeping everything patched. Think of it like running a digital post office: every step must be secure and reliable.

TLS, Reputation, and Spam Defense

Secure mail delivery starts with TLS. You must enforce TLS for both incoming and outgoing mail—this is non-negotiable. Use Let’s Encrypt via Certbot to obtain a valid certificate; many providers, including Let’s Encrypt, require automation to prevent downtime. Without a valid certificate, your server won’t pass basic security checks, and mail clients may block messages. More importantly, poor sending practices (like sending bulk messages without proper authentication) can get your IP address blacklisted on lists like Spamhaus, harming all your outgoing mail.

You’ll also need to implement SPF, DKIM, and DMARC records correctly. These prevent spoofing and improve sender reputation. Misconfigured DKIM signing in your Docker-Mailserver setup is a common path to inbox rejection. Regularly test your configurations using tools like MXToolbox to catch issues early.

Data Protection and Ongoing Maintenance

Docker-Mailserver does not encrypt email data at rest by default—your mail storage is readable if someone gains access to the disk. If privacy matters, encrypt your disk using LUKS or ensure your host is physically secure. Even a single compromised device can expose all messages.

Staying secure means regular updates. Docker images can ship with known vulnerabilities. Pull new images frequently and rebuild containers. Update system packages on your host OS—CVEs in libssl or systemd can compromise your entire stack. Treat your mail server like a production system: monitor logs, automate backups, and test recovery procedures.

For teams that want secure, fully managed email with built-in compliance and minimal maintenance, Unifiedesk delivers a self-hostable suite with end-to-end encryption, automatic TLS, and enterprise-grade security—without the day-to-day ops grind. You get mail, calendar, Meet, Drive, and Docs under one encrypted roof, with real control and real privacy.

How to Install Docker and Docker Compose

You can install Docker and Docker Compose on a Debian or Ubuntu system in under five minutes. Start by updating your system, then install both tools via apt. Verify the installation with version checks. This sets the foundation for running Docker Mailserver securely and reliably on your own infrastructure. Think of it as installing the engine before building the car—this step ensures you’re on a stable, up-to-date base.

Prepare your system

Before installing any software, it's smart to ensure your system is current. Run sudo apt update && sudo apt upgrade -y to download the latest package lists and upgrade your packages. This reduces the risk of conflicts during installation and improves security by patching known vulnerabilities.

Install Docker and Docker Compose

Install Docker using sudo apt install docker.io -y. This command pulls and installs the Docker engine, which manages containers. Docker is widely used in the industry—according to the 2023 Docker User Survey, over 85% of developers rely on it for application deployment.
Now install Docker Compose with sudo apt install docker-compose -y. This tool lets you define and manage multi-container applications using a YAML file. It’s a standard way to deploy complex systems like mail servers with minimal configuration overhead.
Verify both installations are working. Run docker --version and docker-compose --version. You should see something like “Docker version 24.0.5” and “Docker Compose version v2.24.0”. If you don’t, double-check your installation and ensure you’ve rebooted or sourced your environment.

Once confirmed, you’re ready to proceed with the Docker Mailserver setup. These tools are core to modern infrastructure—your setup will be portable, versionable, and easier to maintain. If you're managing email for a team or personal domain, consider how self-hosting gives you full control over data and privacy. For a private email suite with built-in security, encryption, and self-hosting support, explore Unifiedesk’s self-hosted solution.

Understanding Docker-Mailserver Env Variables

You control how your email server behaves using environment variables in your Docker Compose setup. Key ones include DOMAIN to set your email domain, POSTMASTER_ADDRESS for the admin mailbox, DEFAULT_PERSONALITY to define server behavior (like rejecting unknown senders), and SPF, DKIM, and MTA_STRICT_MODE for email authentication and delivery rules. PERMIT_DOCKER must be set to network so internal Docker services can send mail. You can toggle POP3 and Sieve filters with ENABLE_POP3 and ENABLE_SIEVE, and set SMTP_PASSWORD to log into the admin interface.

Essential Configuration for Reliability and Security

Without setting PERMIT_DOCKER=network, your server won't accept mail from other containers—even if they're part of the same Docker network. This is crucial when using shared services like a mail client or a backup tool. Misconfiguring this leads to "Relay access denied" errors, which are common in early setups.

For users who need legacy protocol access, enable ENABLE_POP3 and ENABLE_SIEVE to support older clients and custom spam filtering. Keep in mind that POP3 doesn’t sync across devices well; IMAP is preferred for modern use. Sieve scripts can block spam before it hits your inbox, but you’ll need to learn the syntax—a small hurdle for new users.

Admin Access and Authentication

Set SMTP_PASSWORD to a strong, unique password. This is the credential for the postmaster user in your admin web interface. Without it, you won’t be able to login or manage users, aliases, or domains. It’s not used for authentication with clients—it’s solely for the admin panel, so treat it like a password for the backend.

Use [email protected] to define who receives system alerts and failed delivery reports. This is your primary contact point for operational issues, so choose a reliable address. You can later add additional mailboxes for teams or shared calendars—tools like Unifiedesk help manage these at scale with encrypted email, real-time calendar sync, and secure video meetings.

DKIM and SPF signing help prevent your emails from being marked as spam. When set, Docker-Mailserver auto-generates DKIM keys and signs outbound messages. SPF can be configured via a SPF environment variable with a string like "include:_spf.google.com" if you use external services. Always validate your configuration at MXToolbox before sending test emails. RFC 5322 defines the core email format and is worth referencing as you fine-tune headers.

The Perfect Docker Compose File for Your Mail Server

You’re setting up a secure, production-ready mail server with Docker Compose? Start with a clean directory, use a proven configuration, validate it early, and avoid common pitfalls. This guide gives you a minimal but robust docker-compose.yml that’s secure by default — no guesswork, no bloat, just the essentials for a hardened inbox.

Set It Up Right the First Time

Create a dedicated directory: mkdir ~/mailserver && cd ~/mailserver.
Paste this minimal, secure, and production-ready config into a file called docker-compose.yml:
Save the file. Then validate it with docker-compose config — this catches typos or invalid YAML before deployment.

Use This Config — It’s Built for Security

Base images are kept minimal: use docker-mailserver/docker-mailserver with a specific tag (e.g., latest or a stable release like v10.0.0).
Enable TLS by default and enforce it via SSL_TYPE=manual; use Let’s Encrypt or a trusted certificate.
Set DMS_DEBUG=true only for troubleshooting — disable in production.
Use a non-root user for the container: set USER_UID=1000 and USER_GID=1000 to avoid privilege escalation risks.
Mount configuration files from the host (e.g., config folder) to allow persistent, version-controlled settings.
Expose only necessary ports: 25 (SMTP), 587 (Submission), 465 (SMTPS), 143 (IMAP), and 993 (IMAPS) — block unused ones at the firewall.
Set up proper DNS: ensure MX, SPF, DKIM, and DMARC records are published for your domain — use RFC 7208 and RFC 7672 as reference.
Use JMAP via ENABLE_JMAP=true — it’s more efficient than IMAP for modern clients.

“Hardened, isolated, and predictable environments reduce attack surface and make recovery faster when things go wrong.” — CIS Controls, Level 1

Once validated, deploy with docker-compose up -d. Monitor logs with docker-compose logs -f. You’ve just built a secure, self-hosted mail server with predictable behavior and no hidden dependencies.

Need a full workspace to go with your private mail? Unifiedesk offers email, calendar, video, drive, and AI — all self-hosted or on your domain. Deploy your own or set up a custom domain in minutes.

Setting Up DNS Records: MX, SPF, DKIM, and DMARC

You must configure four core DNS records to securely receive and send email from your domain: MX directs mail to your server, SPF authorizes sending sources, DKIM signs messages to prove authenticity, and DMARC defines how receivers handle unauthenticated mail. Start with MX, then enforce SPF and DKIM, and finally monitor with DMARC — this layered approach prevents spoofing and improves inbox delivery.

Step-by-Step DNS Setup

Set your MX record to point to your mail server’s fully qualified domain name (FQDN), like mail.yourdomain.com. This tells the internet: “Send mail to me.” Without it, emails to your domain won't arrive. Use your domain registrar or DNS provider’s interface to add a MX record with priority 10 (or your preferred value).
Add your SPF record as a TXT record with the value v=spf1 mx a:yourdomain.com include:_spf.yourdomain.com ~all. This declares which servers (including your own) are allowed to send mail on behalf of your domain. The include:_spf.yourdomain.com part lets you manage other services later, like cloud providers.
Generate and publish DKIM keys using a tool like dkimgen (available in many Docker Mailserver setups) or a script from Mail-in-a-Box. This creates a cryptographic signature for each message. Publish the public key as a TXT record under default._domainkey.yourdomain.com.
Set up DMARC with a TXT record at _dmarc.yourdomain.com. Start with: v=DMARC1; p=none; rua=mailto:[email protected]; fo=1;. This tells receivers to monitor authentication but not block messages. Use DMARC.org to understand best practices and parse reports later.

Why Each Record Matters

Skipping any of these leaves your domain vulnerable to spoofing and spam. MX is your mail route. SPF prevents unauthorized senders. DKIM proves integrity. DMARC gives you visibility — you’ll receive aggregate reports at [email protected] to see how mail flows in and out.

Once all records are published, wait 1–48 hours for DNS propagation. Test with tools like MxToolbox or DMARCian before sending important mail. You can use Unifiedesk's self-hosted option to manage your own email with full control over DNS, encryption, and data residency — no third parties involved.

Secure Your Mail Server with TLS Using Let’s Encrypt

You can secure your Docker Mailserver setup with TLS using Let’s Encrypt by installing Certbot, running a standalone certificate request for your domain, and enabling automatic renewal via letsencrypt: true in your docker-compose.yml. This ensures all incoming and outgoing mail is encrypted in transit, preventing eavesdropping and compliance risks. The process integrates directly with your container orchestration, so you don’t need to manually renew certificates.

Set Up TLS with Let’s Encrypt

Install Certbot and the Docker plugin: sudo apt install certbot python3-certbot-docker -y. This gives you the tools to automate certificate management for your mail server.
Run the certificate request: sudo certbot run --standalone -d mail.yourdomain.com --agree-tos --register-unsafely-without-email. This temporarily binds to port 587 and 443 to validate domain ownership, then issues and configures a certificate.
Enable automatic renewal in your docker-compose.yml: set letsencrypt: true and ensure the certbot service is defined. Certbot will now auto-renew certificates every 60 days, following ACME standard (RFC 8555).
Restart your stack: docker-compose down && docker-compose up -d. This applies the new TLS setup and binds the certificate to the Mailserver container.

Verify Your Setup

After configuring, test that TLS works properly:

Run: openssl s_client -connect mail.yourdomain.com:587 -starttls smtp
Look for Verify return code: 0 (ok) and a TLS version (TLSv1.3 is ideal).
Ensure the certificate is issued to your domain, not a placeholder.

If the handshake completes successfully, your mail server is now encrypted in transit. This is a core requirement for modern email deliverability and privacy, as mandated by SMTP best practices and observed in industry security standards like those from IETF.

Once secured, you can extend your privacy by using a self-hosted suite like Unifiedesk, which handles encryption, email, calendar, Drive, and Meet — all under your control, with no shared secrets or data mining.

Test Your Setup: Send and Receive Email Locally

After configuring your docker-mailserver with docker-compose, verify it’s working by sending a test email from the command line, checking the server logs, and confirming it arrives in a client like Thunderbird. Use telnet to validate the SMTP handshake, swaks or mail to send a message, and inspect logs to confirm delivery. This ensures your server is both receiving and delivering mail correctly.

Check the Mail Server Logs

Run docker-compose logs -f mail in your project directory. This streams real-time logs from the mail server container.
Look for lines containing SMTP session, client connected, or DELIVERED. If you see a successful handshake and delivery, the server is responsive.
Keep the log window open while testing. It’s the most direct way to catch errors like rejected connections or failed deliveries.

Test SMTP and Delivery

Use telnet mail.yourdomain.com 25 to verify the server listens on port 25. If the connection fails, ensure your firewall allows traffic and your docker-compose.yml binds the port correctly (e.g., 25:25).
Issue HELO test after connecting. The server should respond with 250 if it accepts the handshake. This confirms SMTP is operational.
Install swaks (a command-line SMTP tool) or use the system’s mail command. Run echo "test" | mail -s "Test" [email protected] to send a message.
Verify the message arrived by checking your inbox with a mail client. If you're not using a third-party service, set up Thunderbird or a similar client using imap.yourdomain.com:993 with STARTTLS.

For reference, RFC 5321 defines the SMTP protocol, and tools like RFC 5321 help you understand how email exchanges work at the transport layer. If your setup fails, check your environment variables in docker-compose.yml, especially MYHOSTNAME and DOMAINNAME.

Once you can send and receive emails locally, you’re ready to extend your setup. Consider using a service like Unifiedesk for a fully self-hosted, secure alternative with built-in encryption and AI, or explore custom domain setup to add your email to a private workspace suite.

Why Consider Unifiedesk Instead of Self-Hosting?

You can run your own mail server with Docker Mailserver, but it demands constant upkeep, complex DNS management, and leaves you to secure files, calendar, and team collaboration from scratch. Unifiedesk delivers the same level of privacy and control—end-to-end encryption on hosted plans, AES-256-GCM at rest for self-hosted—plus built-in Drive, Docs, Meet, and AI, all managed for you, without the server headaches.

Self-Hosting Is Powerful—but Expensive in Time and Risk

Running a DIY mail server with Docker Compose gives you full control, but it also means you’re responsible for security updates, spam filtering, backup cycles, and scaling. DNS records like SPF, DKIM, and DMARC must be set manually and rigorously enforced—mistakes break deliverability. Even basic collaboration tools (like shared calendars or document sharing) require extra setup and trust in third-party plugins. As the SMTP RFC states, mail delivery hinges on correct configuration—so the burden is on you to get it right.

Unifiedesk Combines Security, Simplicity, and Full Feature Set

With Unifiedesk, you keep sovereignty but skip the operational toll. The hosted platform offers end-to-end encryption, and self-hosted deployments use AES-256-GCM for encryption at rest under per-account keys, with TLS always in transit. You don't need to configure DNS records manually—just connect your domain, and Unifiedesk auto-generates MX, SPF, DKIM, and DMARC records in minutes via our custom domain setup.

Plus, your workspace grows beyond email: share files privately with expiring links, co-edit documents (including .docx, .xlsx, and ODF) in real time, host video meetings with screen sharing, manage contacts, and use an AI assistant—any OpenAI-compatible endpoint, with your data never used to train models by default.

You maintain full control over your data, never face vendor lock-in, and avoid the constant patching, backups, and monitoring that eating your time. For a small team or independent operator, this is not just easier—it’s more sustainable than maintaining a custom mail stack.

Check out how email, calendar, Meet, Drive, Docs, contacts, and AI work in one place—and see why so many choose Unifiedesk when they want privacy without the overhead.

Final Thoughts: Are You Ready to Self-Host?

Self-hosting with Docker-Mailserver gives you ultimate control over your email infrastructure. But it demands time, expertise, and ongoing maintenance—ideal for engineers, but a stretch for most.

If you prioritize privacy, data residency, and a complete workspace (email, calendar, meetings, file sharing, document collaboration), consider Unifiedesk: private, open-source, and self-hostable—without the operational burden.

It’s one way to achieve digital sovereignty without managing mail servers, DNS records, or encryption keys yourself.

Keep reading

Ready to put this into practice? Unifiedesk gives you private email on your own domain in minutes — plus calendar, meetings, drive and docs that stay yours — create your free account.

Frequently asked questions

Can I use Docker-Mailserver with a custom domain?

Yes. You must configure MX, SPF, DKIM, and DMARC records in your DNS settings to point to your mail server’s public IP and FQDN.

Does Docker-Mailserver support end-to-end encryption?

No. Docker-Mailserver does not encrypt email at rest or in transit beyond TLS. Data is stored unencrypted on disk. Use disk-level encryption or a platform like Unifiedesk for true end-to-end security.

How do I generate DKIM keys for Docker-Mailserver?

Use `dkimgen`, or generate them offline and insert the DNS TXT record as `default._domainkey` with the public key in the value.

How often does Docker-Mailserver update?

The container image is updated regularly by maintainers. You should pull new versions monthly and rebuild your stack for security.

Can I host multiple domains with Docker-Mailserver?

Yes. Define multiple `DOMAINS` in your `.env` file and create separate mailboxes for each domain with unique aliases and credentials.

What is the best way to back up my Docker-Mailserver data?

Use `rsync` or `borg` to back up the `./data/` directory regularly. Ensure the backup includes mailboxes, configuration, and DKIM keys.

Is email encryption possible with Docker-Mailserver?

Only via TLS for transit. For full encryption, use separate tools like PGP. Unifiedesk offers end-to-end encryption for mail and files on self-hosted deployments.

How do I enable Sieve filtering in Docker-Mailserver?

Set `ENABLE_SIEVE` to `yes` in the `.env` file and place `.sieve` files in the `./data/mail/` directory under the user’s folder.

Why is my email being blocked by Gmail?

Check your MX, SPF, DKIM, and DMARC records. Also ensure the IP is not blacklisted on sites like Spamhaus or MXToolbox.

What is the difference between IMAP and JMAP?

IMAP is older, widely supported, but limited in efficiency. JMAP is modern, optimized for web, supports concurrent updates, and is used in Unifiedesk for real-time sync.

Can I run Docker-Mailserver on a Raspberry Pi?

Yes, but performance is limited. Use a Pi 4 with 4 GB RAM, and consider using the `--platform linux/arm64` flag for ARM support.

Does Docker-Mailserver protect against spam?

It uses built-in spamassassin and rspamd, but effectiveness depends on proper DNS configuration and IP reputation. Blacklists and rate limiting are essential.