docker-mailserver Full-Stack Mail Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## docker-mailserver - Production-Ready Full-Stack Mail Server

Deploy a complete, self-hosted mail server on AWS in minutes. This image runs docker-mailserver preconfigured as a managed system service: a Postfix mail transfer agent for sending and receiving, Dovecot for IMAP mailbox access, Rspamd for spam scoring plus DKIM signing and verification, SPF and DMARC, and Fail2ban for brute-force protection - all from one digest-pinned upstream container, with no database to run and no web console to secure.

### Why This Image Instead of a DIY Install

• Versus manual setup: Skip the hours of installing Docker, writing a compose stack, wiring up the five mail ports, provisioning a data disk, and hardening credentials. This image does all of that at launch.
• Secure by default: No mailbox and no credential ships in the image. On first boot, on your own instance, a single postmaster mailbox is created with a randomly generated password, a self-signed TLS certificate carrying your instance's own hostname is generated, and DKIM signing keys are generated per instance. Nothing is shared between customers.
• Not an open relay: The server rejects unauthenticated relay to external domains. This safety property is proven by an explicit end-to-end test at build time, not assumed.

### Application Stack

• docker-mailserver run from the official ghcr.io image, pinned by container digest so the version never drifts
• Postfix SMTP, Dovecot IMAP, Rspamd (spam scoring, DKIM, DMARC, SPF), Fail2ban brute-force protection
• A dedicated EBS data volume holding the Maildir, mail state, mail logs and config (accounts, aliases, DKIM keys, TLS material) - independently resizable, kept off the OS disk
• systemd units that bring the stack up on boot and run per-instance first-boot initialisation
• ClamAV antivirus present in the image and disabled by default (memory-heavy); a single helper script and a guide section enable it

### Mail Ports

The server publishes the five standard mail ports: 25 (inbound SMTP from other mail servers), 143 and 993 (IMAP, STARTTLS and implicit TLS), and 465 and 587 (authenticated submission, implicit and explicit TLS). Point any standard mail client at the instance on 587/993 with the full email address as the username.

### What You Need to Configure (Please Read)

A mail server that the internet trusts needs DNS and platform setup that only you can do for your domain:

• DNS records: an MX record pointing at this server, plus SPF, DKIM (the image prints the DKIM record to publish) and DMARC records for good deliverability, and a reverse DNS (PTR) record for the sending IP.
• AWS outbound port 25: AWS throttles outbound port 25 on new accounts by default. To deliver mail directly to recipient mail servers you must request removal of that limit (the 'Request to remove email sending limitations' form) and set up reverse DNS. Until then - or as the recommended production path - relay outbound mail through an authenticated smarthost on port 587, which is never throttled. A one-command helper configures the relay.

Inbound mail and IMAP are unaffected by the port 25 throttle: this is a fully functional receiving and mailbox server the moment it launches.

### Security

Per-instance secrets: The mailbox password, the TLS certificate and the DKIM signing keys are all generated on first boot on your own instance and are never shared. The image ships with no mailbox and no known login.

Encryption in transit: IMAP and submission are TLS-only. Replace the self-signed certificate with one for your own domain (the guide has the Let's Encrypt walkthrough).

Encryption at rest: The dedicated data volume holding mailboxes can use AWS EBS encryption. Enable it when launching or use encrypted snapshots.

Brute-force protection: Fail2ban is enabled and enforced, tuned so the instance can never ban itself off its own mail server.

### Use Cases

• Host mailboxes for your own domain on infrastructure you control
• Receive and archive application and system notification mail
• Provide IMAP access and authenticated submission for a small team

### 24/7 cloudimg Support

Technical support by email and live chat covers deployment, DNS and deliverability setup, TLS certificates, outbound relay configuration, spam-filter tuning and mailbox administration.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.