A self-hosted mail server gives you control over mailbox storage, sending limits, retention, and user access. It also makes you responsible for deliverability and security. If you need to install Postfix Dovecot Ubuntu on a VPS, the practical goal is simple: Postfix accepts and sends mail, while Dovecot provides secure IMAP access to users’ Maildir folders.<\/p>\n
This setup is appropriate for a small business domain, internal mail, or an application that needs a controlled SMTP service. It is not automatically the best choice for high-volume marketing email. For that workload, a specialist delivery provider can be less work and more reliable.<\/p>\n
Start with a clean Ubuntu server, a fully qualified hostname, and a domain you control. In the examples below, replace `mail.example.com` and `example.com` with your own values.<\/p>\n
Your server hostname should resolve to its public IP address. Set it before installing the mail stack:<\/p>\n
“`bash sudo hostnamectl set-hostname mail.example.com sudo nano \/etc\/hosts “`<\/p>\n
Add a line that maps the server IP to the hostname if your provider does not handle it automatically. Then update the system:<\/p>\n
“`bash sudo apt update && sudo apt upgrade -y “`<\/p>\n
Mail delivery depends as much on DNS and network policy as on package configuration. Create an A record for `mail.example.com`, an MX record for `example.com` pointing to that hostname, and a reverse PTR record from the server IP back to `mail.example.com`. The PTR record is usually configured in your VPS provider’s control panel.<\/p>\n
You should also plan SPF, DKIM, and DMARC records before sending production mail. Postfix can function without them, but many receiving servers will distrust or reject messages that lack basic domain authentication.<\/p>\n
Check whether your VPS provider blocks outbound TCP port 25. This is common on new accounts because it limits spam abuse. If port 25 is blocked, request an exemption or use a relay service for outbound delivery.<\/p>\n
Install Postfix, Dovecot IMAP support, and the SASL components that allow authenticated SMTP submission:<\/p>\n
“`bash sudo apt install postfix dovecot-imapd dovecot-lmtpd -y “`<\/p>\n
During the Postfix installation prompt, select Internet Site<\/strong>. For the system mail name, enter your primary domain, such as `example.com`.<\/p>\n Dovecot’s LMTP component is useful because it handles final delivery to mailboxes cleanly and provides better control over quotas, filtering, and delivery errors. For a basic server, IMAP is the essential service. POP3 is usually unnecessary unless you specifically support older mail clients that download and remove messages from the server.<\/p>\n Create a mailbox user for testing. On a small server, standard Linux users are the simplest option:<\/p>\n “`bash sudo adduser mailboxuser “`<\/p>\n Do not use a privileged administrator account as a mail account. Separate mail access from server administration to reduce the impact of a compromised password.<\/p>\n Open Postfix’s main configuration file:<\/p>\n “`bash sudo nano \/etc\/postfix\/main.cf “`<\/p>\n Set or update the following values. Keep existing settings that are required by your Ubuntu installation, but make sure these options are present and consistent.<\/p>\n “`conf myhostname = mail.example.com mydomain = example.com myorigin = $mydomain inet_interfaces = all inet_protocols = ipv4 mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain home_mailbox = Maildir\/ smtpd_tls_cert_file = \/etc\/letsencrypt\/live\/mail.example.com\/fullchain.pem smtpd_tls_key_file = \/etc\/letsencrypt\/live\/mail.example.com\/privkey.pem smtpd_tls_security_level = may smtpd_tls_auth_only = yes smtp_tls_security_level = may smtpd_sasl_type = dovecot smtpd_sasl_path = private\/auth smtpd_sasl_auth_enable = yes smtpd_sasl_security_options = noanonymous smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination “`<\/p>\n The `home_mailbox` setting tells Postfix to deliver local messages into a Maildir directory under each user’s home folder. Maildir stores each message as a separate file, which is reliable and works well with Dovecot.<\/p>\n The recipient restrictions matter. `reject_unauth_destination` prevents your server from becoming an open relay, a serious configuration failure that will quickly lead to abuse and IP blacklisting. Authenticated users can send mail, and the server can accept mail for its own configured domains, but strangers cannot relay through it to arbitrary destinations.<\/p>\n The certificate paths assume you already have a Let’s Encrypt certificate. If you do not, obtain a valid certificate before enabling public client access. Do not leave IMAP or SMTP submission exposed with a self-signed certificate for normal users. Most mail clients will show warnings, and users often work around them unsafely.<\/p>\n First, configure Maildir storage:<\/p>\n “`bash sudo nano \/etc\/dovecot\/conf.d\/10-mail.conf “`<\/p>\n Find the `mail_location` line and set it to:<\/p>\n “`conf mail_location = maildir:~\/Maildir “`<\/p>\n Next, configure TLS:<\/p>\n “`bash sudo nano \/etc\/dovecot\/conf.d\/10-ssl.conf “`<\/p>\n Use these settings:<\/p>\n “`conf ssl = required ssl_cert = <\/etc\/letsencrypt\/live\/mail.example.com\/fullchain.pem ssl_key = <\/etc\/letsencrypt\/live\/mail.example.com\/privkey.pem “`<\/p>\n The leading `<` tells Dovecot to read the certificate content from the file. Requiring TLS is the correct default for a public mail server. It protects credentials and mailbox contents while users connect from home networks, offices, and mobile devices.<\/p>\n Dovecot uses system authentication by default on Ubuntu, which is suitable for the local-user model used here. Now configure its authentication socket for Postfix:<\/p>\n “`bash sudo nano \/etc\/dovecot\/conf.d\/10-master.conf “`<\/p>\n Locate the `service auth` block. Inside its `unix_listener` section, add or adjust this socket:<\/p>\n “`conf unix_listener \/var\/spool\/postfix\/private\/auth { mode = 0660 user = postfix group = postfix } “`<\/p>\n Leave Dovecot’s existing client socket in place. The additional Postfix socket allows Postfix to ask Dovecot whether SMTP users supplied valid credentials.<\/p>\n Restart both services and enable them at boot:<\/p>\n “`bash sudo systemctl restart postfix dovecot sudo systemctl enable postfix dovecot sudo systemctl status postfix dovecot “`<\/p>\n If either service fails, inspect the logs rather than guessing:<\/p>\n “`bash sudo journalctl -u postfix -n 50 –no-pager sudo journalctl -u dovecot -n 50 –no-pager “`<\/p>\n With UFW enabled, allow SMTP and secure client connections:<\/p>\n “`bash sudo ufw allow 25\/tcp sudo ufw allow 587\/tcp sudo ufw allow 993\/tcp sudo ufw enable “`<\/p>\n Port 25 receives server-to-server SMTP. Port 587 is the preferred mail submission port for users and applications. Port 993 provides IMAPS, which is IMAP protected by TLS from the start of the connection.<\/p>\n For production use, explicitly configure Postfix submission service on port 587 in `\/etc\/postfix\/master.cf`. Uncomment the `submission` service and add settings that require encryption and authentication:<\/p>\n “`conf submission inet n – y – – smtpd -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject “`<\/p>\n Restart Postfix after the change:<\/p>\n “`bash sudo systemctl restart postfix “`<\/p>\n This keeps normal inbound SMTP separate from authenticated user submission. It is a cleaner model than asking mail clients to send through port 25.<\/p>\n Send a local test message first:<\/p>\n “`bash echo “Postfix test message” | mail -s “Mail server test” mailboxuser@localhost “`<\/p>\n Then check whether Maildir was created:<\/p>\n “`bash sudo ls -la \/home\/mailboxuser\/Maildir\/new “`<\/p>\n For an external test, send from another provider to `mailboxuser@example.com`. Watch the Postfix log while the message arrives:<\/p>\n “`bash sudo tail -f \/var\/log\/mail.log “`<\/p>\n Configure a desktop or mobile client with `mail.example.com` as both the IMAP and SMTP server. Use IMAP port 993 with SSL\/TLS and SMTP port 587 with STARTTLS. Authentication should use the full mailbox username and its password.<\/p>\n If receiving works but sending fails, check port 25 restrictions, reverse DNS, and the Postfix queue with `mailq`. If clients cannot authenticate, verify the Dovecot auth socket path and permissions. If mail lands in spam, do not keep changing Postfix settings blindly. Review SPF, DKIM, DMARC, PTR alignment, message content, and the sending IP reputation.<\/p>\n A mail server is not a set-and-forget VPS service. Apply security updates, review logs, back up mailbox data, and test certificate renewal. Once the basics are stable, add DKIM signing, rate limits, fail2ban protection, and monitoring that alerts you before users discover a delivery problem.<\/p>\n","protected":false},"excerpt":{"rendered":" Learn how to install Postfix Dovecot Ubuntu mail services with TLS, Maildir, SMTP authentication, testing, and practical security checks for a VPS server.<\/p>\n","protected":false},"author":0,"featured_media":45790,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-45789","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-solutions"],"_links":{"self":[{"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/posts\/45789","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/comments?post=45789"}],"version-history":[{"count":0,"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/posts\/45789\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/media\/45790"}],"wp:attachment":[{"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/media?parent=45789"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/categories?post=45789"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/tags?post=45789"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Configure Postfix for Maildir and Authenticated SMTP<\/h2>\n
Configure Dovecot IMAP Access<\/h2>\n
Open the Right Firewall Ports<\/h2>\n
Test Delivery Before Adding Real Users<\/h2>\n