Planning to run my own personal mail server

interservermike · June 2024

Mail.baby with mailcow should not be an issue.

Mxroute would be the better option.

JohnFilch123 · June 2024

I have been self-hosting email since around 2019. Tried a few things like mail-in-a-box, iredmail and montoba (not sure I spelled it correctly). For the past few years I have been using mailcow and am very happy with it. Occasionally get issues with sending email to hotmail but I do not care much about hotmail/gmail/crapmail etc. Overall, pretty happy with self-hosting but need a bigger server now (running out of SSD).

iOVZ · June 2024

mailu

Fubukibox · June 2024

It's been a while since i last talked here. Anyways, i got mailcow setup and everything configured. the thing i cannot understand is iptables rules. It's like trying to fix a backend of a server with multiple eth cables.

+got mailcow setup
+ setup nginx as a reverse proxy on the host and removed P443 for nginx inside the mailcow docker yml config (also got nextcloud setup behind nginx. still need to configure it)
+ tested sending emails to my tuta account and it worked. (Already sent a test email to https://www.mail-tester.com/ and got a 10/10 )
+ added a rule to allow myself and it somehow broke iptables (I had ufw disabled before i installed mailcow)
+ attempted to manually fix /etc/iptables/rules.v4 (still didn't work out and still saw broken ports... (open/closed/blocked ports))

# Generated by iptables-save v1.8.7 on Sun Jun  9 16:55:53 2024
*filter
:INPUT ACCEPT [176497:36472609]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [719389:612794539]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
:MAILCOW - [0:0]
:ufw-after-forward - [0:0]
:ufw-after-input - [0:0]
:ufw-after-logging-forward - [0:0]
:ufw-after-logging-input - [0:0]
:ufw-after-logging-output - [0:0]
:ufw-after-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-before-input - [0:0]
:ufw-before-logging-forward - [0:0]
:ufw-before-logging-input - [0:0]
:ufw-before-logging-output - [0:0]
:ufw-before-output - [0:0]
-A INPUT -m comment --comment mailcow -j MAILCOW
-A FORWARD -m comment --comment mailcow -j MAILCOW
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o br-mailcow -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-mailcow -j DOCKER
-A FORWARD -i br-mailcow ! -o br-mailcow -j ACCEPT
-A FORWARD -i br-mailcow -o br-mailcow -j ACCEPT
-A FORWARD -s [REDACTED]/32 -j ACCEPT
-A FORWARD -s [REDACTED]/32 -j ACCEPT
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 9443 -j ACCEPT
-A DOCKER -d 172.17.0.3/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 8000 -j ACCEPT
-A DOCKER -d 172.22.1.5/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 8983 -j ACCEPT
-A DOCKER -d 172.22.1.249/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 6379 -j ACCEPT
-A DOCKER -d 172.22.1.6/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 3306 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 12345 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 4190 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 995 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 993 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 143 -j ACCEPT
-A DOCKER -d 172.22.1.250/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 110 -j ACCEPT
-A DOCKER -d 172.22.1.253/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 587 -j ACCEPT
-A DOCKER -d 172.22.1.253/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 465 -j ACCEPT
-A DOCKER -d 172.22.1.253/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 25 -j ACCEPT
-A DOCKER -d 172.22.1.8/32 ! -i br-mailcow -o br-mailcow -p tcp -m tcp --dport 81 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i br-mailcow ! -o br-mailcow -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o br-mailcow -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -p tcp -m tcp --dport 4910 -j ACCEPT
-A DOCKER-USER -p tcp -m tcp --dport 995 -j ACCEPT
-A DOCKER-USER -p tcp -m tcp --dport 110 -j ACCEPT
-A DOCKER-USER -p tcp -m tcp --dport 993 -j ACCEPT
-A DOCKER-USER -p tcp -m tcp --dport 143 -j ACCEPT
-A DOCKER-USER -p tcp -m tcp --dport 587 -j ACCEPT
-A DOCKER-USER -p tcp -m tcp --dport 465 -j ACCEPT
-A DOCKER-USER -p tcp -m tcp --dport 25 -j ACCEPT
-A DOCKER-USER -p tcp -m tcp --dport 443 -j ACCEPT
-A DOCKER-USER -p tcp -m tcp --dport 443 -j ACCEPT
-A DOCKER-USER -s [REDACTED]/32 -j ACCEPT
-A DOCKER-USER -s [REDACTED]/32 -j ACCEPT
-A DOCKER-USER -i lo -j ACCEPT
-A DOCKER-USER -m state --state RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-USER -p tcp -m tcp --dport 22 -j DROP
-A DOCKER-USER -p icmp -m icmp --icmp-type 8 -j DROP
-A DOCKER-USER -j REJECT
-A MAILCOW ! -i br-mailcow -o br-mailcow -p tcp -m comment --comment "mailcow isolation" -j DROP
COMMIT
#Completed on Sun Jun 9 16:55:53 2024 Generated by iptables-save v1.8.7 on Sun Jun 9 16:55:53 2024
*nat
:PREROUTING ACCEPT [292250:40857834]
:INPUT ACCEPT [83024:4798081]
:OUTPUT ACCEPT [83341:5062938]
:POSTROUTING ACCEPT [148122:9031877]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.22.1.0/24 ! -o br-mailcow -j MASQUERADE
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 172.17.0.3/32 -d 172.17.0.3/32 -p tcp -m tcp --dport 9443 -j MASQUERADE
-A POSTROUTING -s 172.17.0.3/32 -d 172.17.0.3/32 -p tcp -m tcp --dport 8000 -j MASQUERADE
-A POSTROUTING -s 172.22.1.5/32 -d 172.22.1.5/32 -p tcp -m tcp --dport 8983 -j MASQUERADE
-A POSTROUTING -s 172.22.1.249/32 -d 172.22.1.249/32 -p tcp -m tcp --dport 6379 -j MASQUERADE
-A POSTROUTING -s 172.22.1.6/32 -d 172.22.1.6/32 -p tcp -m tcp --dport 3306 -j MASQUERADE
-A POSTROUTING -s 172.22.1.250/32 -d 172.22.1.250/32 -p tcp -m tcp --dport 12345 -j MASQUERADE
-A POSTROUTING -s 172.22.1.250/32 -d 172.22.1.250/32 -p tcp -m tcp --dport 4190 -j MASQUERADE
-A POSTROUTING -s 172.22.1.250/32 -d 172.22.1.250/32 -p tcp -m tcp --dport 995 -j MASQUERADE
-A POSTROUTING -s 172.22.1.250/32 -d 172.22.1.250/32 -p tcp -m tcp --dport 993 -j MASQUERADE
-A POSTROUTING -s 172.22.1.250/32 -d 172.22.1.250/32 -p tcp -m tcp --dport 143 -j MASQUERADE
-A POSTROUTING -s 172.22.1.250/32 -d 172.22.1.250/32 -p tcp -m tcp --dport 110 -j MASQUERADE
-A POSTROUTING -s 172.22.1.253/32 -d 172.22.1.253/32 -p tcp -m tcp --dport 587 -j MASQUERADE
-A POSTROUTING -s 172.22.1.253/32 -d 172.22.1.253/32 -p tcp -m tcp --dport 465 -j MASQUERADE
-A POSTROUTING -s 172.22.1.253/32 -d 172.22.1.253/32 -p tcp -m tcp --dport 25 -j MASQUERADE
-A POSTROUTING -s 172.22.1.8/32 -d 172.22.1.8/32 -p tcp -m tcp --dport 81 -j MASQUERADE
-A DOCKER -i br-mailcow -j RETURN
-A DOCKER -i docker0 -j RETURN
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 9443 -j DNAT --to-destination 172.17.0.3:9443
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 8000 -j DNAT --to-destination 172.17.0.3:8000
-A DOCKER -d 127.0.0.1/32 ! -i br-mailcow -p tcp -m tcp --dport 18983 -j DNAT --to-destination 172.22.1.5:8983
-A DOCKER -d 127.0.0.1/32 ! -i br-mailcow -p tcp -m tcp --dport 7654 -j DNAT --to-destination 172.22.1.249:6379
-A DOCKER -d 127.0.0.1/32 ! -i br-mailcow -p tcp -m tcp --dport 13306 -j DNAT --to-destination 172.22.1.6:3306
-A DOCKER -d 127.0.0.1/32 ! -i br-mailcow -p tcp -m tcp --dport 19991 -j DNAT --to-destination 172.22.1.250:12345
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 4190 -j DNAT --to-destination 172.22.1.250:4190
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 995 -j DNAT --to-destination 172.22.1.250:995
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 993 -j DNAT --to-destination 172.22.1.250:993
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 143 -j DNAT --to-destination 172.22.1.250:143
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 110 -j DNAT --to-destination 172.22.1.250:110
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 587 -j DNAT --to-destination 172.22.1.253:587
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 465 -j DNAT --to-destination 172.22.1.253:465
-A DOCKER ! -i br-mailcow -p tcp -m tcp --dport 25 -j DNAT --to-destination 172.22.1.253:25
-A DOCKER -d 127.0.0.1/32 ! -i br-mailcow -p tcp -m tcp --dport 81 -j DNAT --to-destination 172.22.1.8:81
COMMIT
# Completed on Sun Jun  9 16:55:53 2024

tldr: i fucking hate iptables and got mailcow & nginx & nextcloud setup (iptables is so confusing. What the FUCK is a DOCKER-USER rules)

NJa64F · June 2024

I dont use docker but what little I understand is your forward chain jumps to DOCKER-USER chain which accepts common mail ports , established and related, some redacted ips. Then it drops ssh and rejects the rest.

I would think a new topic will get you more traction

Fubukibox · June 2024

@jperkins said:
I dont use docker but what little I understand is your forward chain jumps to DOCKER-USER chain which accepts common mail ports , established and related, some redacted ips. Then it drops ssh and rejects the rest.

I would think a new topic will get you more traction

the 2 redacted ips are just 1: my home ip address and 2: another vps ip address. I was planning to just remove

-A FORWARD -s [REDACTED]/32 -j ACCEPT
-A FORWARD -s [REDACTED]/32 -j ACCEPT

but making a new topic? yeah, i could do that tomorrow (It's 10:08 PM UTC -7 rn)

FatGrizzly · June 2024

if you're not a fan of docker, iRedMail can be given a try.

NJa64F · June 2024

@Fubukibox said:
but making a new topic? yeah, i could do that tomorrow (It's 10:08 PM UTC -7 rn)

I'm sorry . Didnt realize you were the OP.

What I dont understand about what you posted is masquerading when the source and dest ip are the same.
-A POSTROUTING -s 172.17.0.3/32 -d 172.17.0.3/32 -p tcp -m tcp --dport 9443 -j MASQUERADE

I am sure it is just a lack of understanding on my part

Fubukibox · June 2024

@jperkins said:

@Fubukibox said:
but making a new topic? yeah, i could do that tomorrow (It's 10:08 PM UTC -7 rn)

I'm sorry . Didnt realize you were the OP.

What I dont understand about what you posted is masquerading when the source and dest ip are the same.
-A POSTROUTING -s 172.17.0.3/32 -d 172.17.0.3/32 -p tcp -m tcp --dport 9443 -j MASQUERADE

I am sure it is just a lack of understanding on my part

i don't remember setting that up. That's my portainer docker server.

@FatGrizzly said:
if you're not a fan of docker, iRedMail can be given a try.

i am using docker desktop on my laptop and docker on all of my servers. the thing i don't understand is setting up iptables correctly. in the mailcow docs it says something about "move your ruleset to the DOCKER-USER chain" https://docs.mailcow.email/getstarted/prerequisite-system/#firewall-ports

https://unrouted.io/2017/08/15/docker-firewall/ https://blog.donnex.net/docker-and-iptables-filtering/
might just disable iptables and re-read these blog posts. (and reconfigure my iptables rules useing DOCKER-USER). I can take a look at iRedMail and set it up in a vm in my homelab proxmox server in a ubuntu 22.04 VM. Thanks for the suggestion tho!

FatGrizzly · June 2024

@Fubukibox said:

@jperkins said:

@Fubukibox said:
but making a new topic? yeah, i could do that tomorrow (It's 10:08 PM UTC -7 rn)

I'm sorry . Didnt realize you were the OP.

What I dont understand about what you posted is masquerading when the source and dest ip are the same.
-A POSTROUTING -s 172.17.0.3/32 -d 172.17.0.3/32 -p tcp -m tcp --dport 9443 -j MASQUERADE

I am sure it is just a lack of understanding on my part

i don't remember setting that up. That's my portainer docker server.

@FatGrizzly said:
if you're not a fan of docker, iRedMail can be given a try.

i am using docker desktop on my laptop and docker on all of my servers. the thing i don't understand is setting up iptables correctly. in the mailcow docs it says something about "move your ruleset to the DOCKER-USER chain" https://docs.mailcow.email/getstarted/prerequisite-system/#firewall-ports

https://unrouted.io/2017/08/15/docker-firewall/ https://blog.donnex.net/docker-and-iptables-filtering/
might just disable iptables and re-read these blog posts. (and reconfigure my iptables rules useing DOCKER-USER). I can take a look at iRedMail and set it up in a vm in my homelab proxmox server in a ubuntu 22.04 VM. Thanks for the suggestion tho!

I've never gotten ufw+docker to work nor csf+docker to work.

Hell, thats one reason why I ditched docker for good.

Its my personal preference, but do give iRedMail a try in a hobby vm when you can!

emgh · June 2024

@interservermike said:
Mail.baby with mailcow should not be an issue.

Mxroute would be the better option.

Why?

kait · June 2024

@emgh said:

@interservermike said:
Mail.baby with mailcow should not be an issue.

Mxroute would be the better option.

Why?

Cheaper I guess and less self hostable maintaining stuff crap bugs.

jobayer · June 2024

Easy way = set up cyberpanel it comes with postfix, dovecot and rainloop. It doesn't take much resources and ui is user friendly. Moreover cli and API can be used. One more thing it's free and open source.

Hard way: Setup postfix, rainloop, dovecot and for database use SQLite or mysql. Best thing is that if you don't like the ui you can use it as smtp or usw different ui app like roundcube or others. Most of the ui is compatible with postfix.

Not_Oles · June 2024

@Fubukibox

@Fubukibox said: a.... I would rather manage my vps via the terminal.

@Fubukibox said: It's just i prefer doing things in the terminal. (i like dark things)

Sorry, I'm just now seeing your thread for the first time right now. I'm late to the party.

Could I please suggest that you might enjoy looking at:

I've been using Migadu for several years with zero problems. One of my friends also uses Migadu like me, every day. If you decide to try Migadu, let me know, because I might be able to get you 50% off.

Since you like command line so much:

MH Message Handling System

For context about command line email within the Unix philosophy, you might take a look at Marcus Schnalke's Master's Thesis as well as other parts of Schnalke's website. Schnalke's site includes links to a couple of video presentations about mmh.

Various formats for Schnalke's thesis

As a possible alternative to Schnalke's mmh, you might like:

mblaze

Here's a blog post comparing mmh and mblaze:

Alternative email handling with mmh and mblaze

You might want to check out:

The Mail Operators Mailing List

I've subscribed to mailop for many years. It's fun to read messages from the true email insiders. Sometimes @jar posts in mailop, and I enjoy reading his posts.

@Fubukibox said: Already sent a test email to https://www.mail-tester.com/ and got a 10/10

Congrats! But, sadly, nowadays, even a perfect mail-tester score sometimes is not enough to get delivery to Gmail. See Part II of my first link, above.

Personally, I've used Mail-in-a-Box and some of my friends use it too. Mail-in-a-box is well maintained and has worked well for me and my friends over the years. Mail-in-a-box has a helpful forum.

I used nmh as my main email user agent for a long time. If you want to try nmh, I could share my nmh configuration. I haven't tried mblaze. Right now, I'm using a fast i9-13900 bare metal server, and I am thinking of putting Schnalke's mmh on it. If you might want a shell account, maybe with sudo, we could talk about it. Hope you continue having fun with email! Best wishes!

Fubukibox · June 2024

@Not_Oles said:
@Fubukibox

@Fubukibox said: a.... I would rather manage my vps via the terminal.

@Fubukibox said: It's just i prefer doing things in the terminal. (i like dark things)

Sorry, I'm just now seeing your thread for the first time right now. I'm late to the party.

Could I please suggest that you might enjoy looking at:

Setting Up an Email Server; Delivery Issues When Sending From A Clean IP

Fix Gmail Deliverability Problems Inexpensively With Migadu!

I've been using Migadu for several years with zero problems. One of my friends also uses Migadu like me, every day. If you decide to try Migadu, let me know, because I might be able to get you 50% off.

Since you like command line so much:

MH Message Handling System

For context about command line email within the Unix philosophy, you might take a look at Marcus Schnalke's Master's Thesis as well as other parts of Schnalke's website. Schnalke's site includes links to a couple of video presentations about mmh.

Various formats for Schnalke's thesis

As a possible alternative to Schnalke's mmh, you might like:

mblaze

Here's a blog post comparing mmh and mblaze:

Alternative email handling with mmh and mblaze

You might want to check out:

The Mail Operators Mailing List

I've subscribed to mailop for many years. It's fun to read messages from the true email insiders. Sometimes @jar posts in mailop, and I enjoy reading his posts.

@Fubukibox said: Already sent a test email to https://www.mail-tester.com/ and got a 10/10

Congrats! But, sadly, nowadays, even a perfect mail-tester score sometimes is not enough to get delivery to Gmail. See Part II of my first link, above.

Personally, I've used Mail-in-a-Box and some of my friends use it too. Mail-in-a-box is well maintained and has worked well for me and my friends over the years. Mail-in-a-box has a helpful forum.

I used nmh as my main email user agent for a long time. If you want to try nmh, I could share my nmh configuration. I haven't tried mblaze. Right now, I'm using a fast i9-13900 bare metal server, and I am thinking of putting Schnalke's mmh on it. If you might want a shell account, maybe with sudo, we could talk about it. Hope you continue having fun with email! Best wishes!

Sorry for the late reply. Im mostly stuck on configuring iptables. i like reading mail through web gui that mailcow provides. I don't send emails to gmail or hotmail since i don't usually care to send any emails to gmail/hotmail or any other major public mail servers. Although i will check the links you have provided and yeah. I'm mostly setting my mailcow to send emails to my proton/tuta email that is sent from my home proxmox server/nextcloud server so it's something like

Proxmox Homelab --> Contabo VPS (1.2.3.4) --> tuta/proton (10.x.x.x) or something like that. Thanks for the replay tho!

Fubukibox · June 2024

@jobayer said:
Easy way = set up cyberpanel it comes with postfix, dovecot and rainloop. It doesn't take much resources and ui is user friendly. Moreover cli and API can be used. One more thing it's free and open source.

Hard way: Setup postfix, rainloop, dovecot and for database use SQLite or mysql. Best thing is that if you don't like the ui you can use it as smtp or usw different ui app like roundcube or others. Most of the ui is compatible with postfix.

this is cool but i woud prefer sticking with mailcow for now. (and the terminal) Thanks for the suggestion tho!

safiedin · August 2024

just read your post, i created my first email server using mailcow. It was pretty easy, and I was lucky to have a clean IP. All is well for sending/receive. I also tried to integrate mailbaby to it, and sending an email was little bit faster. Not sure why. I had 4core and 8gb ram, and have cloudpanel installed as well. Its using about 5.5Gb at the moment with all services up. But then again cloudpanel is still empty, havent migrate anything yet to it. Just to test out stuff at the moment.

vitobotta · August 2024

Check out https://mailu.io/2024.06/ too, it's pretty nice and easy to install and manage.

chiccorosso · August 2024

I think better cloud solutions. No one it's better for spam like google or outlook

natestamm · August 2024

I found stock Sendmail to be more appropriate for most mail server needs, When I found out how configurable it really is, and rarely deviate anymore. That's just my experience, And there are lots of solutions for integrating a web interface because of it's universal or stock Fs based inclusivity. I've dealt with nightmare setups like lots of people have, But knowing how to setup Sendmail as a proper mail server is in my opinion invaluable. It can do more than many think until they read into the Official Documentation.

xiaoz · August 2024

I have been using Mailcow to set up my email service for nearly two years now, and it has been running well. Choosing Mailcow has proven to be a good decision.

If it's just for personal use, you might also consider the Zoho Mail Lite plan, which is quite affordable and supports unlimited aliases.

WhiteRoseG · August 2024

I use Virtualmin

Howdy, Stranger!

Categories

In this Discussion

Planning to run my own personal mail server

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Planning to run my own personal mail server

Comments