A self-hosted mail server is not a weekend project if your business depends on reliable customer communication. The software installation is straightforward. The harder work is proving to receiving servers that your mail is legitimate, protecting user credentials, and monitoring delivery after launch. This Ubuntu mail server guide focuses on a practical setup for a small business that needs control without creating a full-time mail administration job.<\/p>\n
Before installing anything, decide whether you need a mailbox server, an outbound relay, or both. A mailbox server receives mail for your domain and gives users access through IMAP. An outbound relay sends application notifications, WordPress form submissions, invoices, and staff mail through authenticated SMTP.<\/p>\n
Running both services on one Ubuntu VPS is reasonable for a small team with modest volume. It is less suitable for bulk campaigns, high-volume transactional mail, or businesses without time to respond to abuse reports and delivery issues. For those cases, keep mailboxes on your server if needed, but use a specialist SMTP provider for outbound application mail.<\/p>\n
Also check the basics before proceeding. Your provider must allow outbound connections on port 25, and it must let you set reverse DNS, also called a PTR record. Many low-cost VPS providers restrict port 25 because spam abuse is common. No amount of Postfix configuration fixes a blocked port or a missing PTR record.<\/p>\n
For this guide, assume the server is named `mail.example.com`, the primary domain is `example.com`, and you are using a current Ubuntu LTS release.<\/p>\n
Start with a clean, fully patched server. Give it enough resources for the expected number of mailboxes and message volume, but do not overbuild. For a small team, 2 GB of RAM and reliable storage are often a sensible starting point. Disk space matters more than CPU when users keep attachments for years.<\/p>\n
Set the fully qualified hostname and update the system:<\/p>\n
“`bash sudo hostnamectl set-hostname mail.example.com sudo apt update && sudo apt upgrade -y sudo reboot “`<\/p>\n
After reconnecting, create a non-root administrator account, use SSH keys, and disable password-based SSH access when your access process supports it. A mail server is exposed to constant login attempts, so basic server hardening is not optional.<\/p>\n
Create DNS records before requesting a TLS certificate. You need an A record for `mail.example.com` pointing to the server IP and an MX record for `example.com` pointing to `mail.example.com`. At the hosting provider, set the server IP’s PTR record to `mail.example.com`. The forward A record and reverse PTR record should agree.<\/p>\n
That alignment affects reputation. Receiving systems commonly examine the sending IP, the hostname announced during SMTP, and reverse DNS. A server that identifies itself as a generic VPS hostname will have a harder time earning trust.<\/p>\n
Postfix handles SMTP delivery and receipt. Dovecot provides secure IMAP access so users can read mail in Outlook, Apple Mail, Thunderbird, or a mobile client. Install both with the required SASL authentication components:<\/p>\n
“`bash sudo apt install postfix dovecot-imapd dovecot-core certbot -y “`<\/p>\n
During the Postfix prompt, select \u201cInternet Site\u201d and enter `example.com` as the system mail name. This gets the initial package configuration in place, but it is not the final security configuration.<\/p>\n
For a simple first deployment, use local Linux accounts and Maildir storage. This is easier to maintain than a virtual mailbox database for a small team. Create each mailbox user with `adduser`, then restrict SSH access separately so those accounts cannot become interactive server logins.<\/p>\n
Edit `\/etc\/postfix\/main.cf` and confirm or add the following settings. Preserve existing distribution defaults unless you understand why they are being changed.<\/p>\n
“`conf myhostname = mail.example.com mydomain = example.com myorigin = $mydomain inet_interfaces = all inet_protocols = all mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain home_mailbox = Maildir\/<\/p>\n
smtpd_sasl_type = dovecot smtpd_sasl_path = private\/auth smtpd_sasl_auth_enable = yes smtpd_tls_auth_only = yes smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination “`<\/p>\n
The final line is essential. It prevents the server from becoming an open relay, which would quickly lead to spam abuse and IP blacklisting. Do not copy random Postfix restriction rules from old forum posts without understanding their order. Postfix evaluates these rules in sequence.<\/p>\n
Next, edit `\/etc\/dovecot\/conf.d\/10-mail.conf`:<\/p>\n
“`conf mail_location = maildir:~\/Maildir “`<\/p>\n
In `\/etc\/dovecot\/conf.d\/10-auth.conf`, ensure the following authentication mechanisms are enabled:<\/p>\n
“`conf auth_mechanisms = plain login “`<\/p>\n
Plain and login authentication are acceptable only inside TLS encryption. That is why TLS is configured before opening mail services to users.<\/p>\n
Request a certificate for the mail hostname. If nothing else is using port 80, the standalone method is simple:<\/p>\n
“`bash sudo certbot certonly –standalone -d mail.example.com “`<\/p>\n
Then add these lines to `\/etc\/postfix\/main.cf`:<\/p>\n
“`conf smtpd_tls_cert_file = \/etc\/letsencrypt\/live\/mail.example.com\/fullchain.pem smtpd_tls_key_file = \/etc\/letsencrypt\/live\/mail.example.com\/privkey.pem smtpd_tls_security_level = may smtp_tls_security_level = may “`<\/p>\n
In `\/etc\/dovecot\/conf.d\/10-ssl.conf`, configure Dovecot to require encryption:<\/p>\n
“`conf ssl = required ssl_cert = <\/etc\/letsencrypt\/live\/mail.example.com\/fullchain.pem ssl_key = <\/etc\/letsencrypt\/live\/mail.example.com\/privkey.pem “`<\/p>\n
Allow only the ports you need in your firewall: 25 for server-to-server SMTP, 587 for authenticated message submission, 993 for IMAPS, and 80 temporarily or permanently if you use certificate validation through it. Port 465 may be useful for legacy clients, but do not open it unless you configure and need it.<\/p>\n
Restart the services and check their status:<\/p>\n
“`bash sudo systemctl restart postfix dovecot sudo systemctl status postfix dovecot “`<\/p>\n
Set up a certificate renewal deployment hook that reloads both services after renewal. An expired certificate can stop users from sending or reading mail even when the server itself is functioning.<\/p>\n
TLS protects mail in transit. It does not establish sending authorization. For reliable delivery to major providers, publish SPF, DKIM, and DMARC.<\/p>\n
Your initial SPF TXT record can be `v=spf1 mx -all` if this server is the only sender for the domain. If you also use a help desk, newsletter tool, or cloud service, SPF must include those senders. This is where many businesses accidentally break invoice or form emails after tightening their policy.<\/p>\n
DKIM signs outgoing messages with a private key on the server. Install and configure OpenDKIM, generate a domain key, then publish the generated public key as a DNS TXT record. Connect OpenDKIM to Postfix through its local socket. The exact key selector is your choice, but document it because you will need that record during troubleshooting and future key rotation.<\/p>\n
Start DMARC in monitoring mode with `p=none`. Review reports before moving to quarantine or reject. A strict policy is valuable only after you have identified every legitimate system that sends as your domain.<\/p>\n
A successful service restart does not prove mail works. Create a test mailbox, send messages to several external providers, and reply back to it. Check spam placement, headers, DKIM results, SPF alignment, and the TLS connection used by your mail client.<\/p>\n
For server-side diagnostics, these commands cover most early problems:<\/p>\n
“`bash sudo journalctl -u postfix -f sudo journalctl -u dovecot -f sudo postqueue -p “`<\/p>\n
Postfix logs reveal DNS failures, rejected recipients, authentication errors, and delayed deliveries. A growing queue is a warning, not a condition to ignore until users complain. Common causes include a blocked outbound port, incorrect DNS, remote reputation rejection, or an application trying to relay without SMTP authentication.<\/p>\n
Back up mailbox data, Postfix configuration, Dovecot configuration, DKIM keys, and DNS records. Test a restore of at least one mailbox. A backup that has never been restored is only an assumption.<\/p>\n
A well-run Ubuntu mail server stays useful because it is kept deliberately boring: current patches, valid certificates, monitored logs, tested backups, and clear boundaries around what it should send. That discipline will do more for business email reliability than another layer of complicated configuration.<\/p>\n","protected":false},"excerpt":{"rendered":"
This Ubuntu mail server guide shows small businesses how to configure Postfix, Dovecot, DNS, TLS, and deliverable email without avoidable complexity today.<\/p>\n","protected":false},"author":0,"featured_media":45826,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-45825","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-solutions"],"_links":{"self":[{"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/posts\/45825","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/comments?post=45825"}],"version-history":[{"count":0,"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/posts\/45825\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/media\/45826"}],"wp:attachment":[{"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/media?parent=45825"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/categories?post=45825"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.s-sols.com\/api\/wp\/v2\/tags?post=45825"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}