OVERRIDE_HOSTNAME
$DOMAINNAME
RELAY_HOST vs DEFAULT_RELAY_HOST
RELAY_HOST
DEFAULT_RELAY_HOST
DEFAULT_RELAY_HOST is encouraged, but presently does not support sender domain opt-out (setup relay exclude-domain).
setup relay exclude-domain
Opt-in for relay host support
If you only want to enable relay for specific sender domains, use can use opt-in via setup relay add-domain.
setup relay add-domain
Configures a default relay host.
Info
[example.com]:587
$RELAY_USER
$RELAY_PASSWORD
[mail.example.com]:587
example.com:587
Technical Details
Configures the Postfix main.cf setting: relayhost
main.cf
relayhost
postfix-relaymap.cf
Note
Expects a value like mail.example.com. Internally this will be wrapped to [mail.example.com], so it should resolve to the MTA directly.
mail.example.com
[mail.example.com]
Do not use with DEFAULT_RELAY_HOST. RELAY_HOST has precedence as it is configured with sender_dependent_relayhost_maps.
sender_dependent_relayhost_maps
This feature is configured internally using the:
sender_dependent_relayhost_maps = texthash:/etc/postfix/relayhost_map
/etc/postfix/relayhost_map
Default => 25
Support for configuring a different port than 25 for RELAY_HOST to use.
Requires RELAY_HOST.
Configuring relay host credentials make outbound authentication mandatory
Presently when RELAY_USER + RELAY_PASSWORD or postfix-sasl-password.cf are configured, all outbound mail traffic is configured to require a secure connection established and forbids the omission of credentials.
RELAY_USER
RELAY_PASSWORD
postfix-sasl-password.cf
Additional feature work is required to only enforce these requirements on mail sent through a configured relay host.
Provide the credentials to use with RELAY_HOST or DEFAULT_RELAY_HOST.
Alternative credentials config
You may prefer to use setup relay add-auth to avoid exposure of secrets in ENV.
setup relay add-auth
Credentials for relay hosts are configured internally using the:
smtp_sasl_password_maps = texthash:/etc/postfix/sasl_passwd
/etc/postfix/sasl_passwd
This file has relay hosts that must match the host:port of /etc/postfix/relayhost_map or main.cf:relayhost. DMS support handles this for you.
host:port
main.cf:relayhost
docker-mailserver
This Documentation is Versioned
Make sure to select the correct version of this documentation! It should match the version of the image you are using. The default version corresponds to the :latest image tag - the most recent stable release.
:latest
This documentation provides you not only with the basic setup and configuration of DMS but also with advanced configuration, elaborate usage scenarios, detailed examples, hints and more.
docker-mailserver, or DMS for short, is a production-ready fullstack but simple mail server (SMTP, IMAP, LDAP, Anti-spam, Anti-virus, etc.). It employs only configuration files, no SQL database. The image is focused around the slogan \"Keep it simple and versioned\".
If you're completely new to mail servers or you want to read up on them, check out our Introduction page. If you're new to DMS as a mail server appliance, make sure to read the Usage chapter first. If you want to look at examples for Docker Compose, we have an Examples page.
There is also a script - setup.sh - supplied with this project. It supports you in configuring and administrating your server. Information on how to get it and how to use it is available on a dedicated page.
setup.sh
We have a dedicated configuration page. It contains most of the configuration and explanation you need to setup your mail server properly. Be aware that advanced tasks may still require reading through all parts of this documentation; it may also involve inspecting your running container for debugging purposes. After all, a mail server is a complex arrangement of various programs.
Important
If you'd like to change, patch or alter files or behavior of DMS, you can use a script. Just place a script called user-patches.sh in your ./docker-data/dms/config/ folder volume (which is mounted to /tmp/docker-mailserver/ inside the container) and it will be run on container startup. See the 'Modifications via Script' page for additional documentation and an example.
user-patches.sh
./docker-data/dms/config/
/tmp/docker-mailserver/
You might also want to check out:
Tip
Definitely check out the FAQ for more information and tips! Please do not open an issue before you have checked our documentation for answers, including the FAQ!
DMS employs a variety of tests. If you want to know more about our test suite, view our testing docs.
We are always happy to welcome new contributors. For guidelines and entrypoints please have a look at the Contributing section.
None! No database is required. The filesystem is the database. This image is based on config files that can be persisted using bind mounts (default) or Docker volumes, and as such versioned, backed up and so forth.
Mails are stored in /var/mail/${domain}/${username}. Since v9.0.0 it is possible to add custom user_attributes for each accounts to have a different mailbox configuration (See #1792).
/var/mail/${domain}/${username}
v9.0.0
user_attributes
INBOX is setup by default with the special IMAP folders Drafts, Sent, Junk and Trash. You can learn how to modify or add your own folders (including additional special folders like Archive) by visiting our docs page Customizing IMAP Folders for more information.
INBOX
Drafts
Sent
Junk
Trash
Archive
Make sure to read the CHANGELOG before updating to new versions, to be prepared for possible breaking changes.
Then, run the following commands:
docker compose pull\ndocker compose down\ndocker compose up -d\n
You should see the new version number on startup, for example: [ INF ] Welcome to docker-mailserver 11.3.1. And you're done! Don't forget to have a look at the remaining functions of the setup.sh script with ./setup.sh help.
[ INF ] Welcome to docker-mailserver 11.3.1
./setup.sh help
As you'll realistically be deploying to production on a Linux host, if you are on Windows or macOS and want to run the image locally first, it's advised to do so via a VM guest running Linux if you have issues running DMS on your host system.
Warning
ClamAV can consume a lot of memory, as it reads the entire signature database into RAM.
Current figure is about 850M and growing. If you get errors about ClamAV or amavis failing to allocate memory you need more RAM or more swap and of course docker must be allowed to use swap (not always the case). If you can't use swap at all you may need 3G RAM.
DMS aggregates multiple \"sub-services\", such as Postfix, Dovecot, Fail2ban, SpamAssassin, etc. In many cases, one may edit a sub-service's config and reload that very sub-service, without stopping and relaunching the whole mail server.
In order to do so, you'll probably want to push your config updates to your server through a Docker volume (these docs use: ./docker-data/dms/config/:/tmp/docker-mailserver/), then restart the sub-service to apply your changes, using supervisorctl. For instance, after editing fail2ban's config: supervisorctl restart fail2ban.
./docker-data/dms/config/:/tmp/docker-mailserver/
supervisorctl
supervisorctl restart fail2ban
See the documentation for supervisorctl.
To add, update or delete an email account; there is no need to restart postfix / dovecot service inside the container after using setup.sh script.
For more information, see #1639.
Share the host's /etc/localtime with the container, e.g. by using a bind mount:
/etc/localtime
volumes:\n - /etc/localtime:/etc/localtime:ro\n
Optionally, you can set the TZ ENV variable; e.g. TZ=Europe/Berlin. Check this list for which values are allowed.
TZ
TZ=Europe/Berlin
All files are using the Unix format with LF line endings. Please do not use CRLF.
LF
CRLF
DMS supports multiple domains out of the box, so you can do this:
./setup.sh email add user1@example.com\n./setup.sh email add user1@example.de\n./setup.sh email add user1@server.example.org\n
From the location of your compose.yaml, create a compressed archive of your docker-data/dms/config/ and docker-data/dms/mail-* folders:
compose.yaml
docker-data/dms/config/
docker-data/dms/mail-*
tar --gzip -cf \"backup-$(date +%F).tar.gz\" ./docker-data/dms\n
Then to restore docker-data/dms/config/ and docker-data/dms/mail-* folders from your backup file:
tar --gzip -xf backup-date.tar.gz\n
Assuming that you use docker-compose and data volumes, you can backup the configuration, emails and logs like this:
docker-compose
# create backup\ndocker run --rm -it \\\n -v \"${PWD}/docker-data/dms/config/:/tmp/docker-mailserver/\" \\\n -v \"${PWD}/docker-data/dms-backups/:/backup/\" \\\n --volumes-from mailserver \\\n alpine:latest \\\n tar czf \"/backup/mail-$(date +%F).tar.gz\" /var/mail /var/mail-state /var/log/mail /tmp/docker-mailserver\n\n# delete backups older than 30 days\nfind \"${PWD}/docker-data/dms-backups/\" -type f -mtime +30 -delete\n
See this part of the documentation for further details and best practice advice, especially regarding security concerns.
Login is full email address (<user>@<domain>).
<user>@<domain>
# IMAP\nusername: <user1@example.com>\npassword: <mypassword>\nserver: <mail.example.com>\nimap port: 143 or 993 with STARTTLS/SSL (recommended)\nimap path prefix: INBOX\n\n# SMTP\nsmtp port: 587 or 465 with STARTTLS/SSL (recommended)\nusername: <user1@example.com>\npassword: <mypassword>\n
DMS is properly configured for port 587, if possible, we recommend using port 465 for SMTP though. See this section to learn more about ports.
Yes, but not without some configuration changes. Normally it is assumed that DMS runs on a host with a name, so the fully qualified host name might be mail.example.com with the domain example.com. The MX records point to mail.example.com.
example.com
To use a bare domain (where the host name is example.com and the domain is also example.com), change mydestination:
mydestination
mydestination = $myhostname, localhost.$mydomain, localhost
mydestination = localhost.$mydomain, localhost
Add the latter line to docker-data/dms/config/postfix-main.cf. If that doesn't work, make sure that OVERRIDE_HOSTNAME is blank in your mailserver.env file. Without these changes there will be warnings in the logs like:
docker-data/dms/config/postfix-main.cf
mailserver.env
warning: do not list domain example.com in BOTH mydestination and virtual_mailbox_domains\n
Plus of course mail delivery fails.
Also you need to define hostname: example.com in your compose.yaml.
hostname: example.com
You might not want a bare domain
We encourage you to consider using a subdomain where possible.
user@example.com
Considering you want to redirect all incoming e-mails for the domain example.com to user1@example.com, add the following line to docker-data/dms/config/postfix-virtual.cf:
user1@example.com
docker-data/dms/config/postfix-virtual.cf
@example.com user1@example.com\n
First of all, create a special alias named devnull by editing docker-data/dms/config/postfix-aliases.cf:
devnull
docker-data/dms/config/postfix-aliases.cf
devnull: /dev/null\n
Considering you want to delete all the e-mails received for baduser@example.com, add the following line to docker-data/dms/config/postfix-virtual.cf:
baduser@example.com
baduser@example.com devnull\n
If you use a catch-all rule for the main/sub domain, you need another entry in docker-data/dms/config/postfix-virtual.cf:
@mail.example.com hello@example.com\nbaduser@example.com devnull\ndevnull@mail.example.com devnull\n
Both RSA and ECDSA certs are supported. You can provide your own cert files manually, or mount a letsencrypt generated directory (with alternative support for Traefik's acme.json). Check out the SSL_TYPE documentation for more details.
letsencrypt
acme.json
SSL_TYPE
If this migration implies a DNS modification, be sure to wait for DNS propagation before opening an issue. Few examples of symptoms can be found here or here.
This could be related to a modification of your MX record, or the IP mapped to mail.example.com. Additionally, validate your DNS configuration.
MX
If everything is OK regarding DNS, please provide formatted logs and config files. This will allow us to help you.
If we're blind, we won't be able to do anything.
You see errors like \"Connection Refused\" and \"Connection closed by foreign host\", or you cannot connect at all? You may not be able to connect with your mail client (MUA)? Make sure to check Fail2Ban did not ban you (for exceeding the number of tried logins for example)! You can run
docker exec <CONTAINER NAME> setup fail2ban\n
and check whether your IP address appears. Use
docker exec <CONTAINER NAME> setup fail2ban unban <YOUR IP>\n
to unban the IP address.
SMTP_ONLY=1
See #1247 for an example.
Todo
Write a How-to / Use-Case / Tutorial about authentication with SMTP_ONLY.
SMTP_ONLY
hostname
Normally you will assign DMS a hostname such as mail.example.com. If you instead use a bare domain (such as example.com) or add an alias / account with the same value as your hostname, this can cause a conflict for mail addressed to @hostname as Postfix gets confused where to deliver the mail (hostname is configured for only system accounts via the Postfix main.cf setting mydestination).
@hostname
When this conflict is detected you'll find logs similar to this:
warning: do not list domain mail.example.com in BOTH mydestination and virtual_mailbox_domains\n...\nNOQUEUE: reject: RCPT from HOST[IP]: 550 5.1.1 <RECIPIENT>: Recipient address rejected: User unknown in local recipient table; ...\n
Opt-out of mail being directed to services by excluding $myhostname as a destination with a postfix-main.cf override config:
$myhostname
postfix-main.cf
mydestination = localhost.$mydomain, localhost\n
You may want to configure a postmaster alias via setup alias add to receive system notifications.
postmaster
setup alias add
Internal mail destined for root, amavis or other accounts will now no longer be received without an alias or account created for them.
root
amavis
Using user-patches.sh, update the container file /etc/postfix/main.cf to include:
/etc/postfix/main.cf
proxy_interfaces = X.X.X.X (your public IP)\n
Suppose you want to change a number of settings that are not listed as variables or add things to the server that are not included?
DMS has a built-in way to do post-install processes. If you place a script called user-patches.sh in the config directory it will be run after all configuration files are set up, but before the postfix, amavis and other daemons are started.
It is common to use a local directory for config added to docker-mailsever via a volume mount in your compose.yaml (eg: ./docker-data/dms/config/:/tmp/docker-mailserver/).
docker-mailsever
Add or create the script file to your config directory:
cd ./docker-data/dms/config\ntouch user-patches.sh\nchmod +x user-patches.sh\n
Then fill user-patches.sh with suitable code.
If you want to test it you can move into the running container, run it and see if it does what you want. For instance:
# start shell in container\n./setup.sh debug login\n\n# check the file\ncat /tmp/docker-mailserver/user-patches.sh\n\n# run the script\n/tmp/docker-mailserver/user-patches.sh\n\n# exit the container shell back to the host shell\nexit\n
You can do a lot of things with such a script. You can find an example user-patches.sh script here: example user-patches.sh script.
We also have a very similar docs page specifically about this feature!
Special use-case - patching the supervisord configuration
supervisord
It seems worth noting, that the user-patches.sh gets executed through supervisord. If you need to patch some supervisord config (e.g. /etc/supervisor/conf.d/saslauth.conf), the patching happens too late.
/etc/supervisor/conf.d/saslauth.conf
An easy workaround is to make the user-patches.sh reload the supervisord config after patching it:
#!/bin/bash\nsed -i 's/rimap -r/rimap/' /etc/supervisor/conf.d/saslauth.conf\nsupervisorctl update\n
Use the following command:
./setup.sh fail2ban ban <IP>\n
The default bantime is 180 days. This value can be customized.
If you got any problems with SPF and/or forwarding mails, give SRS a try. You enable SRS by setting ENABLE_SRS=1. See the variable description for further information.
ENABLE_SRS=1
There are many reasons why email might be rejected, common causes are:
DMS does not manage those concerns, verify they are not causing your delivery problems before reporting a bug on our issue tracker. Resources that can help you troubleshoot:
Anti-spam rules are managed in docker-data/dms/config/spamassassin-rules.cf.
docker-data/dms/config/spamassassin-rules.cf
x-headers
subdomain.example.com
In the default setup, amavis only applies SpamAssassin x-headers into domains matching the template listed in the config file (05-domain_id in the amavis defaults).
05-domain_id
The default setup @local_domains_acl = ( \".$mydomain\" ); does not match subdomains. To match subdomains, you can override the @local_domains_acl directive in the amavis user config file 50-user with @local_domains_maps = (\".\"); to match any sort of domain template.
@local_domains_acl = ( \".$mydomain\" );
@local_domains_acl
50-user
@local_domains_maps = (\".\");
Put received spams in .Junk/ imap folder using SPAMASSASSIN_SPAM_TO_INBOX=1 and MOVE_SPAM_TO_JUNK=1 and add a user cron like the following:
.Junk/
SPAMASSASSIN_SPAM_TO_INBOX=1
MOVE_SPAM_TO_JUNK=1
Example
NOTE: This example assumes you have a /var/mail-state volume mounted.
/var/mail-state
# m h dom mon dow command\n# Everyday 2:00AM, learn spam from a specific user\n0 2 * * * docker exec mailserver sa-learn --spam /var/mail/example.com/username/.Junk --dbpath /var/mail-state/lib-amavis/.spamassassin\n
With docker-compose you can more easily use the internal instance of cron within DMS. This is less problematic than the simple solution shown above, because it decouples the learning from the host on which DMS is running, and avoids errors if the mail server is not running.
cron
The following configuration works nicely:
Create a system cron file:
# in the compose.yaml root directory\nmkdir -p ./docker-data/dms/cron\ntouch ./docker-data/dms/cron/sa-learn\nchown root:root ./docker-data/dms/cron/sa-learn\nchmod 0644 ./docker-data/dms/cron/sa-learn\n
Edit the system cron file nano ./docker-data/dms/cron/sa-learn, and set an appropriate configuration:
nano ./docker-data/dms/cron/sa-learn
# '> /dev/null' to send error notifications from 'stderr' to 'postmaster@example.com'\n#\n# m h dom mon dow user command\n#\n# Everyday 2:00AM, learn spam from a specific user\n# spam: junk directory\n0 2 * * * root sa-learn --spam /var/mail/example.com/username/.Junk --dbpath /var/mail-state/lib-amavis/.spamassassin > /dev/null\n# ham: archive directories\n15 2 * * * root sa-learn --ham /var/mail/example.com/username/.Archive* --dbpath /var/mail-state/lib-amavis/.spamassassin > /dev/null\n# ham: inbox subdirectories\n30 2 * * * root sa-learn --ham /var/mail/example.com/username/cur* --dbpath /var/mail-state/lib-amavis/.spamassassin > /dev/null\n#\n# Everyday 3:00AM, learn spam from all users of a domain\n# spam: junk directory\n0 3 * * * root sa-learn --spam /var/mail/not-example.com/*/.Junk --dbpath /var/mail-state/lib-amavis/.spamassassin > /dev/null\n# ham: archive directories\n15 3 * * * root sa-learn --ham /var/mail/not-example.com/*/.Archive* --dbpath /var/mail-state/lib-amavis/.spamassassin > /dev/null\n# ham: inbox subdirectories\n30 3 * * * root sa-learn --ham /var/mail/not-example.com/*/cur* --dbpath /var/mail-state/lib-amavis/.spamassassin > /dev/null\n
Then with compose.yaml:
services:\n mailserver:\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n volumes:\n - ./docker-data/dms/cron/sa-learn:/etc/cron.d/sa-learn\n
Or with Docker Swarm:
services:\n mailserver:\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n # ...\n configs:\n - source: my_sa_crontab\n target: /etc/cron.d/sa-learn\n\nconfigs:\n my_sa_crontab:\n file: ./docker-data/dms/cron/sa-learn\n
With the default settings, SpamAssassin will require 200 mails trained for spam (for example with the method explained above) and 200 mails trained for ham (using the same command as above but using --ham and providing it with some ham mails).
--ham
This is related to Amavis processing the mail after SpamAssassin has analyzed it and assigned a spam score.
docker-data/dms/config/amavis.cf
SPAM and INFECTED emails that reach the SA_KILL threshold are archived into quarantine.
SA_KILL
Instead of a quarantine folder, you can use a dedicated mailbox instead. Create an account like quarantine@example.com and create docker-data/dms/config/amavis.cf:
quarantine@example.com
$clean_quarantine_to = \"quarantine\\@example.com\";\n$virus_quarantine_to = \"quarantine\\@example.com\";\n$banned_quarantine_to = \"quarantine\\@example.com\";\n$bad_header_quarantine_to = \"quarantine\\@example.com\";\n$spam_quarantine_to = \"quarantine\\@example.com\";\n
This article answers the question \"What is a mail server, and how does it perform its duty?\" and it gives the reader an introduction to the field that covers everything you need to know to get started with DMS.
A mail server is only a part of a client-server relationship aimed at exchanging information in the form of emails. Exchanging emails requires using specific means (programs and protocols).
DMS provides you with the server portion, whereas the client can be anything from a terminal via text-based software (eg. Mutt) to a fully-fledged desktop application (eg. Mozilla Thunderbird, Microsoft Outlook\u2026), to a web interface, etc.
Unlike the client-side where usually a single program is used to perform retrieval and viewing of emails, the server-side is composed of many specialized components. The mail server is capable of accepting, forwarding, delivering, storing and overall exchanging messages, but each one of those tasks is actually handled by a specific piece of software. All of these \"agents\" must be integrated with one another for the exchange to take place.
DMS has made informed choices about those components and their (default) configuration. It offers a comprehensive platform to run a fully featured mail server in no time!
The following components are required to create a complete delivery chain:
Here's a schematic view of mail delivery:
Sending an email: MUA ----> MTA ----> (MTA relays) ----> MDA\nFetching an email: MUA <--------------------------------- MDA\n
There may be other moving parts or sub-divisions (for instance, at several points along the chain, specialized programs may be analyzing, filtering, bouncing, editing\u2026 the exchanged emails).
In a nutshell, DMS provides you with the following components:
Here's where DMS's toolchain fits within the delivery chain:
docker-mailserver is here:\n \u250f\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2513\nSending an email: MUA ---> MTA ---> (MTA relays) ---> \u252b MTA \u256e \u2503\nFetching an email: MUA <------------------------------ \u252b MDA \u256f \u2503\n \u2517\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u251b\n
Let's say Alice owns a Gmail account, alice@gmail.com; and Bob owns an account on a DMS instance, bob@dms.io.
alice@gmail.com
bob@dms.io
Make sure not to conflate these two very different scenarios: A) Alice sends an email to bob@dms.io => the email is first submitted to MTA smtp.gmail.com, then relayed to MTA smtp.dms.io where it is then delivered into Bob's mailbox. B) Bob sends an email to alice@gmail.com => the email is first submitted to MTA smtp.dms.io, then relayed to MTA smtp.gmail.com and eventually delivered into Alice's mailbox.
smtp.gmail.com
smtp.dms.io
In scenario A the email leaves Gmail's premises, that email's initial submission is not handled by your DMS instance(MTA); it merely receives the email after it has been relayed by Gmail's MTA. In scenario B, the DMS instance(MTA) handles the submission, prior to relaying.
The main takeaway is that when a third-party sends an email to a DMS instance(MTA) (or any MTA for that matter), it does not establish a direct connection with that MTA. Email submission first goes through the sender's MTA, then some relaying between at least two MTAs is required to deliver the email. That will prove very important when it comes to security management.
One important thing to note is that MTA and MDA programs may actually handle multiple tasks (which is the case with DMS's Postfix and Dovecot).
For instance, Postfix is both an SMTP server (accepting emails) and a relaying MTA (transferring, ie. sending emails to other MTA/MDA); Dovecot is both an MDA (delivering emails in mailboxes) and an IMAP server (allowing MUAs to fetch emails from the mail server). On top of that, Postfix may rely on Dovecot's authentication capabilities.
The exact relationship between all the components and their respective (sometimes shared) responsibilities is beyond the scope of this document. Please explore this wiki & the web to get more insights about DMS's toolchain.
In the previous section, three components were outlined. Each one of those is responsible for a specific task when it comes to exchanging emails:
Postfix handles Submission (and may handle Relay), whereas Dovecot handles Retrieval. They both need to be accessible by MUAs in order to act as servers, therefore they expose public endpoints on specific TCP ports. Those endpoints may be secured, using an encryption scheme and TLS certificates.
When it comes to the specifics of email exchange, we have to look at protocols and ports enabled to support all the identified purposes. There are several valid options and they've been evolving overtime.
The following picture gives a visualization of the interplay of all components and their respective ports:
\u250f\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 Submission \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2513\u250f\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 Transfer/Relay \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2513\n\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2510\nMUA ----- STARTTLS -------> \u2524(587) MTA \u256e (25)\u251c <-- cleartext ---> \u250a Third-party MTA \u250a\n ----- implicit TLS ---> \u2524(465) \u2502 | \u2514\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2518\n ----- cleartext ------> \u2524(25) \u2502 |\n |\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504|\nMUA <---- STARTTLS -------- \u2524(143) MDA \u256f |\n <---- implicit TLS ---- \u2524(993) |\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n \u2517\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 Retrieval \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u251b\n
If you're new to email infrastructure, both that table and the schema may be confusing. Read on to expand your understanding and learn about DMS's configuration, including how you can customize it.
For a MUA to send an email to an MTA, it needs to establish a connection with that server, then push data packets over a network that both the MUA (client) and the MTA (server) are connected to. The server implements the SMTP protocol, which makes it capable of handling Submission.
In the case of DMS, the MTA (SMTP server) is Postfix. The MUA (client) may vary, yet its Submission request is performed as TCP packets sent over the public internet. This exchange of information may be secured in order to counter eavesdropping.
Now let's say I own an account on a DMS instance, me@dms.io. There are two very different use-cases for Submission:
me@dms.io
In the first scenario, I will be submitting my email directly to my DMS instance/MTA (Postfix), which will then relay the email to its recipient's MTA for final delivery. In this case, Submission is first handled by establishing a direct connection to my own MTA-so at least for this portion of the delivery chain, I'll be able to ensure security/confidentiality. Not so much for what comes next, ie. relaying between MTAs and final delivery.
In the second scenario, a third-party email account owner will be first submitting an email to some third-party MTA. I have no control over this initial portion of the delivery chain, nor do I have control over the relaying that comes next. My MTA will merely accept a relayed email coming \"out of the blue\".
My MTA will thus have to support two kinds of Submission:
\u250f\u2501\u2501\u2501 Outbound Submission \u2501\u2501\u2501\u2513\n\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2510\nMe ---------------> \u2524 \u251c -----------------> \u250a \u250a\n \u2502 My MTA \u2502 \u250a Third-party MTA \u250a\n \u2502 \u251c <----------------- \u250a \u250a\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2518\n\n \u2517\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 Inbound Submission \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u251b\n
When it comes to securing Outbound Submission you should prefer to use Implicit TLS connection via ESMTP on port 465 (see RFC 8314). Please read our article about Understanding the Ports for more details!
This Submission setup is sometimes referred to as SMTPS. Long story short: this is incorrect and should be avoided.
Although a very satisfactory setup, Implicit TLS on port 465 is somewhat \"cutting edge\". There exists another well established mail Submission setup that must be supported as well, SMTP+STARTTLS on port 587. It uses Explicit TLS: the client starts with a cleartext connection, then the server informs a TLS-encrypted \"upgraded\" connection may be established, and the client may eventually decide to establish it prior to the Submission. Basically it's an opportunistic, opt-in TLS upgrade of the connection between the client and the server, at the client's discretion, using a mechanism known as STARTTLS that both ends need to implement.
In many implementations, the mail server doesn't enforce TLS encryption, for backwards compatibility. Clients are thus free to deny the TLS-upgrade proposal (or misled by a hacker about STARTTLS not being available), and the server accepts unencrypted (cleartext) mail exchange, which poses a confidentiality threat and, to some extent, spam issues. RFC 8314 (section 3.3) recommends for a mail server to support both Implicit and Explicit TLS for Submission, and to enforce TLS-encryption on ports 587 (Explicit TLS) and 465 (Implicit TLS). That's exactly DMS's default configuration: abiding by RFC 8314, it enforces a strict (encrypt) STARTTLS policy, where a denied TLS upgrade terminates the connection thus (hopefully but at the client's discretion) preventing unencrypted (cleartext) Submission.
encrypt
A final Outbound Submission setup exists and is akin SMTP+STARTTLS on port 587, but on port 25. That port has historically been reserved specifically for unencrypted (cleartext) mail exchange though, making STARTTLS a bit wrong to use. As is expected by RFC 5321, DMS uses port 25 for unencrypted Submission in order to support older clients, but most importantly for unencrypted Transfer/Relay between MTAs.
Granted it's still very difficult enforcing encryption between MTAs (Transfer/Relay) without risking dropping emails (when relayed by MTAs not supporting TLS-encryption), Inbound Submission is to be handled in cleartext on port 25 by default.
Overall, DMS's default configuration for SMTP looks like this:
\u250f\u2501\u2501\u2501 Outbound Submission \u2501\u2501\u2501\u2513\n\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2510\nMe -- cleartext --> \u2524(25) (25)\u251c --- cleartext ---> \u250a \u250a\nMe -- TLS ---> \u2524(465) My MTA \u2502 \u250a Third-party MTA \u250a\nMe -- STARTTLS ---> \u2524(587) \u2502 \u250a \u250a\n \u2502 (25)\u251c <---cleartext ---- \u250a \u250a\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2504\u2518\n\n \u2517\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 Inbound Submission \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u251b\n
A MUA willing to fetch an email from a mail server will most likely communicate with its IMAP server. As with SMTP described earlier, communication will take place in the form of data packets exchanged over a network that both the client and the server are connected to. The IMAP protocol makes the server capable of handling Retrieval.
In the case of DMS, the IMAP server is Dovecot. The MUA (client) may vary, yet its Retrieval request is performed as TCP packets sent over the public internet. This exchange of information may be secured in order to counter eavesdropping.
Again, as with SMTP described earlier, the IMAP protocol may be secured with either Implicit TLS (aka. IMAPS / IMAP4S) or Explicit TLS (using STARTTLS).
The best practice as of 2020 is to enforce IMAPS on port 993, rather than IMAP+STARTTLS on port 143 (see RFC 8314); yet the latter is usually provided for backwards compatibility.
DMS's default configuration enables both Implicit and Explicit TLS for Retrievial, on ports 993 and 143 respectively.
Similarly to IMAP, the older POP3 protocol may be secured with either Implicit or Explicit TLS.
The best practice as of 2020 would be POP3S on port 995, rather than POP3+STARTTLS on port 110 (see RFC 8314).
DMS's default configuration disables POP3 altogether. One should expect MUAs to use TLS-encrypted IMAP for Retrieval.
As a batteries included container image, DMS provides you with all the required components and a default configuration to run a decent and secure mail server. One may then customize all aspects of its internal components.
Eventually, it is up to you deciding exactly what kind of transportation/encryption to use and/or enforce, and to customize your instance accordingly (with looser or stricter security). Be also aware that protocols and ports on your server can only go so far with security; third-party MTAs might relay your emails on insecure connections, man-in-the-middle attacks might still prove effective, etc. Advanced counter-measure such as DANE, MTA-STS and/or full body encryption (eg. PGP) should be considered as well for increased confidentiality, but ideally without compromising backwards compatibility so as to not block emails.
This pages explains how to get started with DMS. The guide uses Docker Compose as a reference. In our examples, a volume mounts the host location docker-data/dms/config/ to /tmp/docker-mailserver/ inside the container.
Before you can get started with deploying your own mail server, there are some requirements to be met:
There are a few requirements for a suitable host system:
PTR
About the Container Runtime
On the host, you need to have a suitable container runtime (like Docker or Podman) installed. We assume Docker Compose is installed. We have aligned file names and configuration conventions with the latest Docker Compose (currently V2) specification.
If you're using podman, make sure to read the related documentation.
The DNS setup is a big and essential part of the whole setup. There is a lot of confusion for newcomers and people starting out when setting up DNS. This section provides an example configuration and supplementary explanation. We expect you to be at least a bit familiar with DNS, what it does and what the individual record types are.
Now let's say you just bought example.com and you want to be able to send and receive e-mails for the address test@example.com. On the most basic level, you will need to
test@example.com
A
11.22.33.44
We will later dig into DKIM, DMARC & SPF, but for now, these are the records that suffice in getting you up and running. Here is a short explanation of what the records do:
test@mail.example.com
test@some-other-domain.com
some-other-domain.com
About The Mail Server's Fully Qualified Domain Name
The mail server's fully qualified domain name (FQDN) in our example above is mail.example.com. Please note though that this is more of a convention, and not due to technical restrictions. One could also run the mail server
foo.example.com
The FQDN is what is relevant for TLS certificates, it has no (inherent/technical) relation to the email addresses and accounts DMS manages. That is to say: even though DMS runs on mail.example.com, or foo.example.com, or example.com, there is nothing that prevents it from managing mail for barbaz.org - barbaz.org will just need to set its MX record to mail.example.com (or foo.example.com or example.com).
barbaz.org
If you setup everything, it should roughly look like this:
$ dig @1.1.1.1 +short MX example.com\nmail.example.com\n$ dig @1.1.1.1 +short A mail.example.com\n11.22.33.44\n$ dig @1.1.1.1 +short -x 11.22.33.44\nmail.example.com\n
To understand which tags you should use, read this section carefully. Our CI will automatically build, test and push new images to the following container registries:
docker.io/mailserver/docker-mailserver
ghcr.io/docker-mailserver/docker-mailserver
All workflows are using the tagging convention listed below. It is subsequently applied to all images.
push
master
edge
v1.2.3
1.2.3
1.2
1
latest
Issue the following commands to acquire the necessary files:
DMS_GITHUB_URL=\"https://raw.githubusercontent.com/docker-mailserver/docker-mailserver/master\"\nwget \"${DMS_GITHUB_URL}/compose.yaml\"\nwget \"${DMS_GITHUB_URL}/mailserver.env\"\n
-z
-Z
VAR=VAL
OVERRIDE_HOSTNAME=$HOSTNAME.$DOMAINNAME
Using the Correct Commands For Stopping and Starting DMS
Use docker compose up / down, not docker compose start / stop. Otherwise, the container is not properly destroyed and you may experience problems during startup because of inconsistent state.
docker compose up / down
docker compose start / stop
Using Ctrl+C is not supported either!
Ctrl+C
For an overview of commands to manage DMS config, run: docker exec -it <CONTAINER NAME> setup help.
docker exec -it <CONTAINER NAME> setup help
We encourage you to directly use setup inside the container (like shown above). If you still want to use setup.sh, here's some information about it.
setup
If no DMS container is running, any ./setup.sh command will check online for the :latest image tag (the current stable release), performing a docker pull ... if necessary followed by running the command in a temporary container:
./setup.sh
docker pull ...
$ ./setup.sh help\nImage 'ghcr.io/docker-mailserver/docker-mailserver:latest' not found. Pulling ...\nSETUP(1)\n\nNAME\n setup - 'docker-mailserver' Administration & Configuration script\n...\n\n$ docker run --rm ghcr.io/docker-mailserver/docker-mailserver:latest setup help\nSETUP(1)\n\nNAME\n setup - 'docker-mailserver' Administration & Configuration script\n...\n
On first start, you will need to add at least one email account (unless you're using LDAP). You have two minutes to do so, otherwise DMS will shutdown and restart. You can add accounts by running docker exec -ti <CONTAINER NAME> setup email add user@example.com. That's it! It really is that easy.
docker exec -ti <CONTAINER NAME> setup email add user@example.com
You definitely want to setup TLS. Please refer to our documentation about TLS.
You should add at least one alias, the postmaster alias. This is a common convention, but not strictly required.
docker exec -ti <CONTAINER NAME> setup alias add postmaster@example.com user@example.com\n
You will very likely want to configure your DNS with these TXT records: SPF, DKIM, and DMARC. We also ship a dedicated page in our documentation about the setup of DKIM, DMARC & SPF.
If you'd like to change, patch or alter files or behavior of DMS, you can use a script. See this part of our documentation for a detailed explanation.
Here are some tools you can use to verify your configuration:
This page contains valuable information when it comes to resolving issues you encounter.
Contributions Welcome!
Please consider contributing solutions to the FAQ
Correctly starting DMS
Use the --force-recreate option to avoid configuration mishaps: docker compose up --force-recreate
--force-recreate
docker compose up --force-recreate
Alternatively, always use docker compose down to stop DMS. Do not rely on CTRL + C, docker compose stop, or docker compose restart.
docker compose down
CTRL + C
docker compose stop
docker compose restart
DMS setup scripts are run when a container starts, but may fail to work properly if you do the following:
docker stop
docker compose up
Volumes persist data across container instances, however the same container instance will keep internal changes not stored in a volume until the container is removed.
Due to this, DMS setup scripts may modify configuration it has already modified in the past.
Some service providers block outbound traffic on port 25. Common hosting providers known to have this issue:
These links may advise how the provider can unblock the port through additional services offered, or via a support ticket request.
Common logs related to this are:
warning: do not list domain domain.fr in BOTH mydestination and virtual_mailbox_domains
Recipient address rejected: User unknown in local recipient table
If your logs look like this, you likely have assigned the same FQDN to the DMS hostname and your mail accounts which is not supported by default. You can either adjust your DMS hostname or follow this FAQ advice
It is also possible that DMS services are temporarily unavailable when configuration changes are detected, producing the 2nd error. Certificate updates may be a less obvious trigger.
LOG_LEVEL
debug
trace
docker log <CONTAINER NAME>
docker logs -f <CONTAINER NAME>
To get a shell inside the container run: docker exec -it <CONTAINER NAME> bash. To install additional software, run:
docker exec -it <CONTAINER NAME> bash
apt-get update
apt-get install <PACKAGE>
apt-get install neovim
nano
If you need more flexibility than what the docker logs command offers, then the most useful locations to get relevant DMS logs within the container are:
docker logs
/var/log/mail/<SERVICE>.log
/var/log/supervisor/<SERVICE>.log
You may use nano (a text editor) to edit files, while less (a file viewer) and tail/cat are useful tools to inspect the contents of logs.
less
tail
cat
It's possible that the issue you're experiencing is due to a compatibility conflict.
This could be from outdated software, or running a system that isn't able to provide you newer software and kernels. You may want to verify if you can reproduce the issue on a system that is not affected by these concerns.
userland-proxy
v23
iptables
nftables
v20.10.0
volumes
gRPC FUSE
VirtioFS
unified
Values in bold are the default values. If an option doesn't work as documented here, check if you are running the latest image. The current master branch corresponds to the image ghcr.io/docker-mailserver/docker-mailserver:edge.
ghcr.io/docker-mailserver/docker-mailserver:edge
If you can't set your hostname (eg: you're in a container platform that doesn't let you) specify it via this environment variable. It will have priority over docker run --hostname, or the equivalent hostname: field in compose.yaml.
docker run --hostname
hostname:
hostname -f
Set the log level for DMS. This is mostly relevant for container startup scripts and change detection event feedback.
Valid values (in order of increasing verbosity) are: error, warn, info, debug and trace. The default log level is info.
error
warn
info
Here you can adjust the log-level for Supervisor. Possible values are
The log-level will show everything in its class and above.
Default: 5000
The User ID assigned to the static vmail user for /var/mail (Mail storage managed by Dovecot).
/var/mail
The Group ID assigned to the static vmail group for /var/mail (Mail storage managed by Dovecot).
Configures the provisioning source of user accounts (including aliases) for user queries and authentication by services managed by DMS (Postfix and Dovecot).
OAuth2 Support
Presently DMS supports OAuth2 only as an supplementary authentication method.
ACCOUNT_PROVISIONER
A second container for the ldap service is necessary (e.g. bitnami/openldap).
bitnami/openldap
Set different options for mynetworks option (can be overwrite in postfix-main.cf) WARNING: Adding the docker network's gateway to the list of trusted hosts, e.g. using the network or connected-networks option, can create an open relay, for instance if IPv6 is enabled on the host machine but not in Docker.
network
connected-networks
PERMIT_DOCKER=connected-networks
Note: you probably want to set POSTFIX_INET_PROTOCOLS=ipv4 to make it work fine with Docker.
POSTFIX_INET_PROTOCOLS=ipv4
Set the timezone. If this variable is unset, the container runtime will try to detect the time using /etc/localtime, which you can alternatively mount into the container. The value of this variable must follow the pattern AREA/ZONE, i.e. of you want to use Germany's time zone, use Europe/Berlin. You can lookup all available timezones here.
AREA/ZONE
Europe/Berlin
Amavis content filter (used for ClamAV & SpamAssassin)
This page provides information on Amavis' logging statistics.
This enables DNS block lists in Postscreen. If you want to know which lists we are using, have a look at the default main.cf for Postfix we provide and search for postscreen_dnsbl_sites.
postscreen_dnsbl_sites
A Warning On DNS Block Lists
Make sure your DNS queries are properly resolved, i.e. you will most likely not want to use a public DNS resolver as these queries do not return meaningful results. We try our best to only evaluate proper return codes - this is not a guarantee that all codes are handled fine though.
Note that emails will be rejected if they don't pass the block list checks!
Enables MTA-STS support for outbound mail.
See MTA-STS for further explanation.
Enables the OpenDKIM service.
Enables the OpenDMARC service.
Enabled policyd-spf in Postfix's configuration. You will likely want to set this to 0 in case you're using Rspamd (ENABLE_RSPAMD=1).
policyd-spf
0
ENABLE_RSPAMD=1
If you enable Fail2Ban, don't forget to add the following lines to your compose.yaml:
cap_add:\n - NET_ADMIN\n
Otherwise, nftables won't be able to ban IPs.
In the majority of cases, you want letsencrypt or manual.
manual
self-signed can be used for testing SSL until you provide a valid certificate, note that third-parties cannot trust self-signed certificates, do not use this type in production. custom is a temporary workaround that is not officially supported.
self-signed
custom
SSL_CERT_PATH
SSL_KEY_PATH
SSL_ALT_CERT_PATH
SSL_ALT_KEY_PATH
None
Please read the SSL page in the documentation for more information.
Configures the handling of creating mails with forged sender addresses.
Enables the Sender Rewriting Scheme. SRS is needed if DMS acts as forwarder. See postsrsd for further explanation.
In case your network interface differs from eth0, e.g. when you are using HostNetworking in Kubernetes, you can set this to whatever interface you want. This interface will then be used.
eth0
Set how many days a virusmail will stay on the server before being deleted
Configure Postfix virtual_transport to deliver mail to a different LMTP client (default is a unix socket to dovecot).
virtual_transport
Provide any valid URI. Examples:
lmtp:unix:/var/run/dovecot/lmtp
lmtp:unix:private/dovecot-lmtp
lmtps:inet:<host>:<port>
lmtp:<kopano-host>:2003
Set the mailbox size limit for all users. If set to zero, the size will be unlimited (default). Size is in bytes.
See mailbox quota.
Set the message size limit for all users. If set to zero, the size will be unlimited (not recommended!). Size is in bytes.
Mails larger than this limit won't be scanned. ClamAV must be enabled (ENABLE_CLAMAV=1) for this.
Check for updates on container start and then once a day. If an update is available, a mail is send to POSTMASTER_ADDRESS.
Customize the update check interval. Number + Suffix. Suffix must be 's' for seconds, 'm' for minutes, 'h' for hours or 'd' for days.
This option has been added in November 2019. Using other format than Maildir is considered as experimental in docker-mailserver and should only be used for testing purpose. For more details, please refer to Dovecot Documentation.
If enabled, employs reject_unknown_client_hostname to sender restrictions in Postfix's configuration.
reject_unknown_client_hostname
Note: More details at http://www.postfix.org/postconf.5.html#inet_protocols
Note: More information at https://dovecot.org/doc/dovecot-example.conf
Routes mail identified as spam into the recipient(s) Junk folder (via a Dovecot Sieve script).
Mail is received as spam when it has been marked with either header:
X-Spam: Yes
X-Spam-Flag: YES
Enable to treat received spam as \"read\" (avoids notification to MUA client of new mail).
This variable defines a prefix for e-mails tagged with the X-Spam: Yes (Rspamd) or X-Spam-Flag: YES (SpamAssassin/Amavis) header.
Default: empty (no prefix will be added to e-mails)
Add trailing white-space by quote wrapping the value: SPAM_SUBJECT='[SPAM] '
SPAM_SUBJECT='[SPAM] '
Enable or disable Rspamd.
Explicit control over running a Redis instance within the container. By default, this value will match what is set for ENABLE_RSPAMD.
ENABLE_RSPAMD
The purpose of this setting is to opt-out of starting an internal Redis instance when enabling Rspamd, replacing it with your own external instance.
You will need to provide configuration at /etc/rspamd/local.d/redis.conf similar to:
/etc/rspamd/local.d/redis.conf
servers = \"redis.example.test:6379\";\nexpand_keys = true;\n
This settings controls whether checks should be performed on emails coming from authenticated users (i.e. most likely outgoing emails). The default value is 0 in order to align better with SpamAssassin. We recommend reading through the Rspamd documentation on scanning outbound emails though to decide for yourself whether you need and want this feature.
Not all checks and actions are disabled
DKIM signing of e-mails will still happen.
Controls whether the Rspamd Greylisting module is enabled. This module can further assist in avoiding spam emails by greylisting e-mails with a certain spam score.
When enabled,
Attention
As of now, the spam learning database is global (i.e. available to all users). If one user deliberately trains it with malicious data, then it will ruin your detection rate.
This feature is suitably only for users who can tell ham from spam and users that can be trusted.
Can be used to enable or disable the Hfilter group module. This is used by DMS to adjust the HFILTER_HOSTNAME_UNKNOWN symbol, increasing its default weight to act similar to Postfix's reject_unknown_client_hostname, without the need to outright reject a message.
HFILTER_HOSTNAME_UNKNOWN
Can be used to control the score when the HFILTER_HOSTNAME_UNKNOWN symbol applies. A higher score is more punishing. Setting it to 15 (the default score for rejecting an e-mail) is equivalent to rejecting the email when the check fails.
Default: 6 (which corresponds to the add_header action)
add_header
Enables regular Postfix log summary (\"pflogsumm\") mail reports.
This is a new option. The old REPORT options are still supported for backwards compatibility. If this is not set and reports are enabled with the old options, logrotate will be used.
Recipient address for Postfix log summary reports.
Sender address (FROM) for pflogsumm reports (if Postfix log summary reports are enabled).
FROM
Interval for logwatch report.
Recipient address for logwatch reports if they are enabled.
Sender address (FROM) for logwatch reports if logwatch reports are enabled.
Defines who receives reports (if they are enabled).
Defines who sends reports (if they are enabled).
mailserver-report@<YOUR DOMAIN>
Changes the interval in which log files are rotated.
LOGROTATE_INTERVAL only manages logrotate within the container for services we manage internally.
LOGROTATE_INTERVAL
logrotate
The entire log output for the container is still available via docker logs mailserver (or your respective container name). If you want to configure external log rotation for that container output as well, : Docker Logging Drivers.
docker logs mailserver
By default, the logs are lost when the container is destroyed (eg: re-creating via docker compose down && docker compose up -d). To keep the logs, mount a volume (to /var/log/mail/).
docker compose down && docker compose up -d
/var/log/mail/
This variable can also determine the interval for Postfix's log summary reports, see PFLOGSUMM_TRIGGER.
PFLOGSUMM_TRIGGER
Integration with Amavis involves processing mail based on the assigned spam score via SA_TAG, SA_TAG2 and SA_KILL.
SA_TAG
SA_TAG2
These settings have equivalent ENV supported by DMS for easy adjustments, as documented below.
KAM is a 3rd party SpamAssassin ruleset, provided by the McGrail Foundation. If SpamAssassin is enabled, KAM can be used in addition to the default ruleset.
D_BOUNCE
D_PASS
The Amavis action configured by this setting:
$final_spam_destiny
$final_bad_header_destiny
This ENV setting is related to
MARK_SPAM_AS_READ=1
SPAM_SUBJECT
Mail is not yet considered spam at this spam score, but for purposes like diagnostics it can be useful to identify mail with a spam score at a lower bound than SA_TAG2.
X-Spam
Send a simple mail to a local DMS account hello@example.com:
hello@example.com
docker exec dms swaks --server 0.0.0.0 --to hello@example.com --body 'spam'\n
Inspecting the raw mail you will notice several X-Spam headers were added to the mail like this:
X-Spam-Flag: NO\nX-Spam-Score: 4.162\nX-Spam-Level: ****\nX-Spam-Status: No, score=4.162 tagged_above=2 required=4\n tests=[BODY_SINGLE_WORD=1, DKIM_ADSP_NXDOMAIN=0.8,\n NO_DNS_FOR_FROM=0.379, NO_RECEIVED=-0.001, NO_RELAYS=-0.001,\n PYZOR_CHECK=1.985] autolearn=no autolearn_force=no\n
The X-Spam-Score is 4.162
X-Spam-Score
4.162
High enough for SA_TAG to trigger adding these headers, but not high enough for SA_TAG2 (which would set X-Spam-Flag: YES instead).
When a spam score is high enough, mark mail as spam (Appends the mail header: X-Spam-Flag: YES).
Interaction with other ENV
Controls the spam score threshold for triggering an action on mail that has a high spam score.
The value should be high enough to be represent confidence in mail as spam:
Experiences from DMS users with these settings has been collected here, along with some direct configuration guides (under \"Resources for references\").
DMS will configure Amavis with either of these actions based on the DMS SPAMASSASSIN_SPAM_TO_INBOX ENV setting:
SPAMASSASSIN_SPAM_TO_INBOX
$sa_dsn_cutoff_level
10
D_REJECT
D_DISCARD
When mail has a spam score that reaches the SA_KILL threshold:
X-Quarantine-ID
If emails are quarantined, they are compressed and stored at a location:
/var/lib/amavis/virusmails/
/var/mail-state/
/var/mail-state/lib-amavis/virusmails/
Easily list mail stored in quarantine with find and the quarantine path:
find
find /var/lib/amavis/virusmails -type f\n
This will uncomment the respective line in /etc/spamassasin/local.cf
/etc/spamassasin/local.cf
Activate this only if you are confident in your bayes database for identifying spam.
Activate this only if you are confident in your bayes database for identifying ham.
fetchmail
/etc/fetchmailrc
Note: The defaults of your fetchmailrc file need to be at the top of the file. Otherwise it won't be added correctly to all separate fetchmail instances.
Enable or disable getmail.
getmail
https://oauth2.example.com/userinfo/
<dns-name>
<ip-address>
ldaps://mail.example.com
ldap://
ldaps://
ldapi://
(&(mail=%s)(mailEnabled=TRUE))
(&(mailGroupMember=%s)(mailEnabled=TRUE))
(&(mailAlias=%s)(mailEnabled=TRUE))
(&(|(mail=*@%s)(mailalias=*@%s)(mailGroupMember=*@%s))(mailEnabled=TRUE))
(|($LDAP_QUERY_FILTER_USER)($LDAP_QUERY_FILTER_ALIAS)($LDAP_QUERY_FILTER_GROUP))
The following variables overwrite the default values for /etc/dovecot/dovecot-ldap.conf.ext.
/etc/dovecot/dovecot-ldap.conf.ext
LDAP_SEARCH_BASE
ou=people,dc=domain,dc=com
SSHA
LDAP_BIND_DN
cn=admin,dc=domain,dc=com
LDAP_BIND_PW
DOVECOT_DN
LDAP_SERVER_HOST
(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))
homeDirectory=home,qmailUID=uid,qmailGID=gid,mailMessageStore=mail
DOVECOT_USER_FILTER
uid=user,userPassword=password
postgrey
Note: This postgrey setting needs ENABLE_POSTGREY=1
ENABLE_POSTGREY=1
saslauthd
ldap
shadow
mysql
rimap
no
yes
ldap_start_tls
ldap_tls_check_peer
Path to directory with CA (Certificate Authority) certificates.
ldap_tls_cacert_dir
File containing CA (Certificate Authority) certificate(s).
ldap_tls_cacert_file
(&(uniqueIdentifier=%u)(mailEnabled=TRUE))
(&(sAMAccountName=%U)(objectClass=person))
(&(uid=%U)(objectClass=person))
Specify what password attribute to use for password verification.
userPassword
ldap_password_attr
bind
fastbind
Specify the authentication mechanism for SASL bind.
ldap_mech
An email has an \"envelope\" sender (indicating the sending server) and a \"header\" sender (indicating who sent it). More strict SPF policies may require you to replace both instead of just the envelope sender.
More info.
dd if=/dev/urandom bs=24 count=1 2>/dev/null | base64
If you want to use POP3(S), you have to add the ports 110 and/or 995 (TLS secured) and the environment variable ENABLE_POP3 to your compose.yaml:
ENABLE_POP3
mailserver:\n ports:\n - \"25:25\" # SMTP (explicit TLS => STARTTLS)\n - \"143:143\" # IMAP4 (explicit TLS => STARTTLS)\n - \"465:465\" # ESMTP (implicit TLS)\n - \"587:587\" # ESMTP (explicit TLS => STARTTLS)\n - \"993:993\" # IMAP4 (implicit TLS)\n - \"110:110\" # POP3\n - \"995:995\" # POP3 (with TLS)\n environment:\n - ENABLE_POP3=1\n
setup.sh is not required. We encourage you to use docker exec -ti <CONTAINER NAME> setup instead.
docker exec -ti <CONTAINER NAME> setup
This script assumes Docker or Podman is used. You will not be able to use setup.sh with other container orchestration tools.
setup.sh is a script that is complimentary to the internal setup command in DMS.
It mostly provides the convenience of aliasing docker exec -ti <CONTAINER NAME> setup, inferring the container name of a running DMS instance or running a new instance and bind mounting necessary volumes implicitly.
It is intended to be run from the host machine, not from inside your running container. The latest version of the script is included in the DMS repository. You may retrieve it at any time by running this command in your console:
wget https://raw.githubusercontent.com/docker-mailserver/docker-mailserver/master/setup.sh\nchmod a+x ./setup.sh\n
For more information on using the script run: ./setup.sh help.
Users (email accounts) are managed in /tmp/docker-mailserver/postfix-accounts.cf. The best way to manage accounts is to use the reliable setup command inside the container. Just run docker exec <CONTAINER NAME> setup help and have a look at the section about subcommands, specifically the email subcommand.
/tmp/docker-mailserver/postfix-accounts.cf
docker exec <CONTAINER NAME> setup help
email
You can add an account by running docker exec -ti <CONTAINER NAME> setup email add <NEW ADDRESS>. This method is strongly preferred.
docker exec -ti <CONTAINER NAME> setup email add <NEW ADDRESS>
This method is discouraged!
Alternatively, you may directly add the full email address and its encrypted password, separated by a pipe. To generate a new mail account data, directly from your host, you could for example run the following:
docker run --rm -it \\\n --env MAIL_USER=user1@example.com \\\n --env MAIL_PASS=mypassword \\\n ghcr.io/docker-mailserver/docker-mailserver:latest \\\n /bin/bash -c \\\n 'echo \"${MAIL_USER}|$(doveadm pw -s SHA512-CRYPT -u ${MAIL_USER} -p ${MAIL_PASS})\" >>docker-data/dms/config/postfix-accounts.cf'\n
You will then be asked for a password, and be given back the data for a new account entry, as text. To actually add this new account, just copy all the output text in docker-data/dms/config/postfix-accounts.cf file of your running container.
docker-data/dms/config/postfix-accounts.cf
The result could look like this:
user1@example.com|{SHA512-CRYPT}$6$2YpW1nYtPBs2yLYS$z.5PGH1OEzsHHNhl3gJrc3D.YMZkvKw/vp.r5WIiwya6z7P/CQ9GDEJDr2G2V0cAfjDFeAQPUoopsuWPXLk3u1\n
imap-quota
The best way to manage aliases is to use the reliable setup script inside the container. Just run docker exec <CONTAINER NAME> setup help and have a look at the section about subcommands, specifically the alias-subcommand.
alias
You may read Postfix's documentation on virtual aliases first. Aliases are managed in /tmp/docker-mailserver/postfix-virtual.cf. An alias is a full email address that will either be:
/tmp/docker-mailserver/postfix-virtual.cf
Alias and target are space separated. An example on a server with example.com as its domain:
# Alias delivered to an existing account\nalias1@example.com user1@example.com\n\n# Alias forwarded to an external email address\nalias2@example.com external-account@gmail.com\n
Additional regexp aliases can be configured by placing them into docker-data/dms/config/postfix-regexp.cf. The regexp aliases get evaluated after the virtual aliases (container path: /tmp/docker-mailserver/postfix-virtual.cf). For example, the following docker-data/dms/config/postfix-regexp.cf causes all email sent to \"test\" users to be delivered to qa@example.com instead:
docker-data/dms/config/postfix-regexp.cf
qa@example.com
/^test[0-9][0-9]*@example.com/ qa@example.com\n
Postfix supports so-called address tags, in the form of plus (+) tags - i.e. address+tag@example.com will end up at address@example.com. This is configured by default and the (configurable!) separator is set to +. For more info, see Postfix's official documentation.
address+tag@example.com
address@example.com
+
If you do decide to change the configurable separator, you must add the same line to both docker-data/dms/config/postfix-main.cf and docker-data/dms/config/dovecot.cf, because Dovecot is acting as the delivery agent. For example, to switch to -, add:
docker-data/dms/config/dovecot.cf
-
recipient_delimiter = -\n
Getting started with ldap and DMS we need to take 3 parts in account:
postfix
dovecot
Have a look at the ENV page for information on the default values.
LDAP_QUERY_FILTER_*
Those variables contain the LDAP lookup filters for postfix, using %s as the placeholder for the domain or email address in question. This means that...
%s
DOMAIN
virtual_alias_domains
USER
ALIAS
GROUP
(mail=%s)
virtual_mailbox_maps
virtual_alias_maps
(mailAlias=%s)
(mailGroupMember=%s)
ceo@example.org
hr@example.org
SENDERS
SPOOF_PROTECTION=1
admin
(|(memberOf=cn=admin,*)(mail=%s))
A really simple LDAP_QUERY_FILTER configuration, using only the user filter and allowing only admin@* to spoof any sender addresses.
LDAP_QUERY_FILTER
admin@*
- LDAP_START_TLS=yes\n- ACCOUNT_PROVISIONER=LDAP\n- LDAP_SERVER_HOST=ldap.example.org\n- LDAP_SEARCH_BASE=dc=example,dc=org\"\n- LDAP_BIND_DN=cn=admin,dc=example,dc=org\n- LDAP_BIND_PW=mypassword\n- SPOOF_PROTECTION=1\n\n- LDAP_QUERY_FILTER_DOMAIN=(mail=*@%s)\n- LDAP_QUERY_FILTER_USER=(mail=%s)\n- LDAP_QUERY_FILTER_ALIAS=(|) # doesn't match anything\n- LDAP_QUERY_FILTER_GROUP=(|) # doesn't match anything\n- LDAP_QUERY_FILTER_SENDERS=(|(mail=%s)(mail=admin@*))\n
DOVECOT_*_FILTER
DOVECOT_*_ATTRS
These variables specify the LDAP filters that dovecot uses to determine if a user can log in to their IMAP account, and which mailbox is responsible to receive email for a specific postfix user.
This is split into the following two lookups, both using %u as the placeholder for the full login name (see dovecot documentation for a full list of placeholders). Usually you only need to set DOVECOT_USER_FILTER, in which case it will be used for both filters.
%u
DOVECOT_PASS_FILTER
If your directory doesn't have the postfix-book schema installed, then you must change the internal attribute handling for dovecot. For this you have to change the pass_attr and the user_attr mapping, as shown in the example below:
pass_attr
user_attr
- DOVECOT_PASS_ATTRS=<YOUR_USER_IDENTIFIER_ATTRIBUTE>=user,<YOUR_USER_PASSWORD_ATTRIBUTE>=password\n- DOVECOT_USER_ATTRS=<YOUR_USER_HOME_DIRECTORY_ATTRIBUTE>=home,<YOUR_USER_MAILSTORE_ATTRIBUTE>=mail,<YOUR_USER_MAIL_UID_ATTRIBUTE>=uid,<YOUR_USER_MAIL_GID_ATTRIBUTE>=gid\n
For DOVECOT_*_ATTRS, you can replace ldapAttr=dovecotAttr with =dovecotAttr=%{ldap:ldapAttr} for more flexibility, like for example =home=/var/mail/%{ldap:uid} or just =uid=5000.
ldapAttr=dovecotAttr
=dovecotAttr=%{ldap:ldapAttr}
=home=/var/mail/%{ldap:uid}
=uid=5000
A list of dovecot attributes can be found in the dovecot documentation.
- DOVECOT_USER_ATTRS=mailHomeDirectory=home,mailUidNumber=uid,mailGidNumber=gid,mailStorageDirectory=mail\n- DOVECOT_PASS_ATTRS=uniqueIdentifier=user,userPassword=password\n- DOVECOT_USER_FILTER=(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))\n
Setup for a directory that has the qmail-schema installed and uses uid:
uid
- DOVECOT_PASS_ATTRS=uid=user,userPassword=password\n- DOVECOT_USER_ATTRS=homeDirectory=home,qmailUID=uid,qmailGID=gid,mailMessageStore=mail\n- DOVECOT_USER_FILTER=(&(objectClass=qmailUser)(uid=%u)(accountStatus=active))\n
The LDAP server configuration for dovecot will be taken mostly from postfix, other options can be found in the environment section in the docs.
DOVECOT_AUTH_BIND
Set this to yes to enable authentication binds (more details in the dovecot documentation). Currently, only DN lookup is supported without further changes to the configuration files, so this is only useful when you want to bind as a readonly user without the permission to read passwords.
SASLAUTHD_LDAP_FILTER
This filter is used for saslauthd, which is called by postfix when someone is authenticating through SMTP (assuming that SASLAUTHD_MECHANISMS=ldap is being used). Note that you'll need to set up the LDAP server for saslauthd separately from postfix.
SASLAUTHD_MECHANISMS=ldap
The filter variables are explained in detail in the LDAP_SASLAUTHD file, but unfortunately, this method doesn't really support domains right now - that means that %U is the only token that makes sense in this variable.
LDAP_SASLAUTHD
%U
When to use this and how to avoid it
Using a separate filter for SMTP authentication allows you to for example allow noreply@example.org to send email, but not log in to IMAP or receive email: (&(mail=%U@example.org)(|(memberOf=cn=email,*)(mail=noreply@example.org)))
noreply@example.org
(&(mail=%U@example.org)(|(memberOf=cn=email,*)(mail=noreply@example.org)))
If you don't want to use a separate filter for SMTP authentication, you can set SASLAUTHD_MECHANISMS=rimap and SASLAUTHD_MECH_OPTIONS=127.0.0.1 to authenticate against dovecot instead - this means that the DOVECOT_USER_FILTER and DOVECOT_PASS_FILTER will be used for SMTP authentication as well.
SASLAUTHD_MECHANISMS=rimap
SASLAUTHD_MECH_OPTIONS=127.0.0.1
- ENABLE_SASLAUTHD=1\n- SASLAUTHD_MECHANISMS=ldap\n- SASLAUTHD_LDAP_FILTER=(mail=%U@example.org)\n
To enable LDAPS, all you need to do is to add the protocol to LDAP_SERVER_HOST, for example ldaps://example.org:636.
ldaps://example.org:636
To enable LDAP over StartTLS (on port 389), you need to set the following environment variables instead (the protocol must not be ldaps:// in this case!):
- LDAP_START_TLS=yes\n- DOVECOT_TLS=yes\n- SASLAUTHD_LDAP_START_TLS=yes\n
In addition to LDAP explanation above, when Docker Mailserver is intended to be used with Active Directory (or the equivalent implementations like Samba4 AD DC) the following points should be taken into consideration:
sAMAccountName
proxyAddresses
smtp:
smtp:some.name@example.com
uidNumber
gidNumber
ldap:uidNumber
5000
ldap-groups.cf
leaf_result_attribute = mail
special_result_attribute = member
The configuration shown to get the Group to work is from here and here.
# user-patches.sh\n\n...\ngrep -q '^leaf_result_attribute = mail$' /etc/postfix/ldap-groups.cf || echo \"leaf_result_attribute = mail\" >> /etc/postfix/ldap-groups.cf\ngrep -q '^special_result_attribute = member$' /etc/postfix/ldap-groups.cf || echo \"special_result_attribute = member\" >> /etc/postfix/ldap-groups.cf\n...\n
/etc/ldap/ldap.conf
TLS_REQCERT
demand
hard
ca.crt
# user-patches.sh\n\n...\ncp /MOUNTED_FOLDER/ca.crt /usr/local/share/ca-certificates/\nupdate-ca-certificates\n...\n
The changes on the configurations necessary to work with Active Directory (only changes are listed, the rest of the LDAP configuration can be taken from the other examples shown in this documentation):
# If StartTLS is the chosen method to establish a secure connection with Active Directory.\n- LDAP_START_TLS=yes\n- SASLAUTHD_LDAP_START_TLS=yes\n- DOVECOT_TLS=yes\n\n- LDAP_QUERY_FILTER_USER=(&(objectclass=person)(mail=%s))\n- LDAP_QUERY_FILTER_ALIAS=(&(objectclass=person)(proxyAddresses=smtp:%s))\n# Filters Active Directory groups (mail lists). Additional changes on ldap-groups.cf are also required as shown above.\n- LDAP_QUERY_FILTER_GROUP=(&(objectClass=group)(mail=%s))\n- LDAP_QUERY_FILTER_DOMAIN=(mail=*@%s)\n# Allows only Domain admins to send any sender email address, otherwise the sender address must match the LDAP attribute `mail`.\n- SPOOF_PROTECTION=1\n- LDAP_QUERY_FILTER_SENDERS=(|(mail=%s)(proxyAddresses=smtp:%s)(memberOf=cn=Domain Admins,cn=Users,dc=*))\n\n- DOVECOT_USER_FILTER=(&(objectclass=person)(sAMAccountName=%n))\n# At the moment to be able to use %{ldap:uidNumber}, a manual bug fix as described above must be used. Otherwise %{ldap:uidNumber} %{ldap:uidNumber} must be replaced by the hard-coded value 5000.\n- DOVECOT_USER_ATTRS==uid=%{ldap:uidNumber},=gid=5000,=home=/var/mail/%Ln,=mail=maildir:~/Maildir\n- DOVECOT_PASS_ATTRS=sAMAccountName=user,userPassword=password\n- SASLAUTHD_LDAP_FILTER=(&(sAMAccountName=%U)(objectClass=person))\n
services:\n mailserver:\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n container_name: mailserver\n hostname: mail.example.com\n\n ports:\n - \"25:25\"\n - \"143:143\"\n - \"587:587\"\n - \"993:993\"\n\n volumes:\n - ./docker-data/dms/mail-data/:/var/mail/\n - ./docker-data/dms/mail-state/:/var/mail-state/\n - ./docker-data/dms/mail-logs/:/var/log/mail/\n - ./docker-data/dms/config/:/tmp/docker-mailserver/\n - /etc/localtime:/etc/localtime:ro\n\n environment:\n - ENABLE_SPAMASSASSIN=1\n - ENABLE_CLAMAV=1\n - ENABLE_FAIL2BAN=1\n - ENABLE_POSTGREY=1\n\n # >>> Postfix LDAP Integration\n - ACCOUNT_PROVISIONER=LDAP\n - LDAP_SERVER_HOST=ldap.example.org\n - LDAP_BIND_DN=cn=admin,ou=users,dc=example,dc=org\n - LDAP_BIND_PW=mypassword\n - LDAP_SEARCH_BASE=dc=example,dc=org\n - LDAP_QUERY_FILTER_DOMAIN=(|(mail=*@%s)(mailAlias=*@%s)(mailGroupMember=*@%s))\n - LDAP_QUERY_FILTER_USER=(&(objectClass=inetOrgPerson)(mail=%s))\n - LDAP_QUERY_FILTER_ALIAS=(&(objectClass=inetOrgPerson)(mailAlias=%s))\n - LDAP_QUERY_FILTER_GROUP=(&(objectClass=inetOrgPerson)(mailGroupMember=%s))\n - LDAP_QUERY_FILTER_SENDERS=(&(objectClass=inetOrgPerson)(|(mail=%s)(mailAlias=%s)(mailGroupMember=%s)))\n - SPOOF_PROTECTION=1\n # <<< Postfix LDAP Integration\n\n # >>> Dovecot LDAP Integration\n - DOVECOT_USER_FILTER=(&(objectClass=inetOrgPerson)(mail=%u))\n - DOVECOT_PASS_ATTRS=uid=user,userPassword=password\n - DOVECOT_USER_ATTRS==home=/var/mail/%{ldap:uid},=mail=maildir:~/Maildir,uidNumber=uid,gidNumber=gid\n # <<< Dovecot LDAP Integration\n\n # >>> SASL LDAP Authentication\n - ENABLE_SASLAUTHD=1\n - SASLAUTHD_MECHANISMS=ldap\n - SASLAUTHD_LDAP_FILTER=(&(mail=%U@example.org)(objectClass=inetOrgPerson))\n # <<< SASL LDAP Authentication\n\n - SSL_TYPE=letsencrypt\n - PERMIT_DOCKER=host\n\n cap_add:\n - NET_ADMIN\n
services:\n mailserver:\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n container_name: mailserver\n hostname: mail.example.com\n\n ports:\n - \"25:25\"\n - \"143:143\"\n - \"587:587\"\n - \"993:993\"\n\n volumes:\n - ./docker-data/dms/mail-data/:/var/mail/\n - ./docker-data/dms/mail-state/:/var/mail-state/\n - ./docker-data/dms/config/:/tmp/docker-mailserver/\n\n environment:\n # We are not using dovecot here\n - SMTP_ONLY=1\n - ENABLE_SPAMASSASSIN=1\n - ENABLE_CLAMAV=1\n - ENABLE_FAIL2BAN=1\n - ENABLE_POSTGREY=1\n - SASLAUTHD_PASSWD=\n\n # >>> SASL Authentication\n - ENABLE_SASLAUTHD=1\n - SASLAUTHD_LDAP_FILTER=(&(sAMAccountName=%U)(objectClass=person))\n - SASLAUTHD_MECHANISMS=ldap\n # <<< SASL Authentication\n\n # >>> Postfix Ldap Integration\n - ACCOUNT_PROVISIONER=LDAP\n - LDAP_SERVER_HOST=<yourLdapContainer/yourLdapServer>\n - LDAP_SEARCH_BASE=dc=mydomain,dc=loc\n - LDAP_BIND_DN=cn=Administrator,cn=Users,dc=mydomain,dc=loc\n - LDAP_BIND_PW=mypassword\n - LDAP_QUERY_FILTER_USER=(&(objectClass=user)(mail=%s))\n - LDAP_QUERY_FILTER_GROUP=(&(objectclass=group)(mail=%s))\n - LDAP_QUERY_FILTER_ALIAS=(&(objectClass=user)(otherMailbox=%s))\n - LDAP_QUERY_FILTER_DOMAIN=(&(|(mail=*@%s)(mailalias=*@%s)(mailGroupMember=*@%s))(mailEnabled=TRUE))\n # <<< Postfix Ldap Integration\n\n # >>> Kopano Integration\n - POSTFIX_DAGENT=lmtp:kopano:2003\n # <<< Kopano Integration\n\n - SSL_TYPE=letsencrypt\n - PERMIT_DOCKER=host\n\n cap_add:\n - NET_ADMIN\n
This is only a supplement to the existing account provisioners
Accounts must still be managed via the configured ACCOUNT_PROVISIONER (FILE or LDAP).
Reasoning for this can be found in #3480. Future iterations on this feature may allow it to become a full account provisioner.
The present OAuth2 support provides the capability for 3rd-party applications such as Roundcube to authenticate with DMS (dovecot) by using a token obtained from an OAuth2 provider, instead of passing passwords around.
This example assumes you have:
Setup Instructions
Edit the following values in mailserver.env:
# -----------------------------------------------\n# --- OAUTH2 Section ----------------------------\n# -----------------------------------------------\n\n# empty => OAUTH2 authentication is disabled\n# 1 => OAUTH2 authentication is enabled\nENABLE_OAUTH2=1\n\n# Specify the user info endpoint URL of the oauth2 provider\nOAUTH2_INTROSPECTION_URL=https://authentik.example.com/application/o/userinfo/\n
https://roundcube.example.com/index.php/login/oauth
Add the following to oauth2.inc.php (documentation):
oauth2.inc.php
$config['oauth_provider'] = 'generic';\n$config['oauth_provider_name'] = 'Authentik';\n$config['oauth_client_id'] = '<insert client id here>';\n$config['oauth_client_secret'] = '<insert client secret here>';\n$config['oauth_auth_uri'] = 'https://authentik.example.com/application/o/authorize/';\n$config['oauth_token_uri'] = 'https://authentik.example.com/application/o/token/';\n$config['oauth_identity_uri'] = 'https://authentik.example.com/application/o/userinfo/';\n\n// Optional: disable SSL certificate check on HTTP requests to OAuth server. For possible values, see:\n// http://docs.guzzlephp.org/en/stable/request-options.html#verify\n$config['oauth_verify_peer'] = false;\n\n$config['oauth_scope'] = 'email openid profile';\n$config['oauth_identity_fields'] = ['email'];\n\n// Boolean: automatically redirect to OAuth login when opening Roundcube without a valid session\n$config['oauth_login_redirect'] = false;\n
A dovecot master account is able to login as any configured user. This is useful for administrative tasks like hot backups.
It is possible to create, update, delete and list dovecot master accounts using setup.sh. See setup.sh help for usage.
setup.sh help
This feature is presently not supported with LDAP.
Once a master account is configured, it is possible to connect to any users mailbox using this account. Log in over POP3/IMAP using the following credential scheme:
Username: <EMAIL ADDRESS>*<MASTER ACCOUNT NAME>
<EMAIL ADDRESS>*<MASTER ACCOUNT NAME>
Password: <MASTER ACCOUNT PASSWORD>
<MASTER ACCOUNT PASSWORD>
Full-text search allows all messages to be indexed, so that mail clients can quickly and efficiently search messages by their full text content. Dovecot supports a variety of community supported FTS indexing backends.
DMS comes pre-installed with two plugins that can be enabled with a dovecot config file.
Please be aware that indexing consumes memory and takes up additional disk space.
The dovecot-fts-xapian plugin makes use of Xapian. Xapian enables embedding an FTS engine without the need for additional backends.
The indexes will be stored as a subfolder named xapian-indexes inside your local mail-data folder (/var/mail internally). With the default settings, 10GB of email data may generate around 4GB of indexed data.
xapian-indexes
mail-data
While indexing is memory intensive, you can configure the plugin to limit the amount of memory consumed by the index workers. With Xapian being small and fast, this plugin is a good choice for low memory environments (2GB) as compared to Solr.
To configure fts-xapian as a dovecot plugin, create a file at docker-data/dms/config/dovecot/fts-xapian-plugin.conf and place the following in it:
fts-xapian
docker-data/dms/config/dovecot/fts-xapian-plugin.conf
mail_plugins = $mail_plugins fts fts_xapian\n\nplugin {\n fts = xapian\n fts_xapian = partial=3 full=20 verbose=0\n\n fts_autoindex = yes\n fts_enforced = yes\n\n # disable indexing of folders\n # fts_autoindex_exclude = \\Trash\n\n # Index attachements\n # fts_decoder = decode2text\n}\n\nservice indexer-worker {\n # limit size of indexer-worker RAM usage, ex: 512MB, 1GB, 2GB\n vsz_limit = 1GB\n}\n\n# service decode2text {\n# executable = script /usr/libexec/dovecot/decode2text.sh\n# user = dovecot\n# unix_listener decode2text {\n# mode = 0666\n# }\n# }\n
adjust the settings to tune for your desired memory limits, exclude folders and enable searching text inside of attachments
Update compose.yaml to load the previously created dovecot plugin config file:
services:\n mailserver:\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n container_name: mailserver\n hostname: mail.example.com\n env_file: mailserver.env\n ports:\n - \"25:25\" # SMTP (explicit TLS => STARTTLS)\n - \"143:143\" # IMAP4 (explicit TLS => STARTTLS)\n - \"465:465\" # ESMTP (implicit TLS)\n - \"587:587\" # ESMTP (explicit TLS => STARTTLS)\n - \"993:993\" # IMAP4 (implicit TLS)\n volumes:\n - ./docker-data/dms/mail-data/:/var/mail/\n - ./docker-data/dms/mail-state/:/var/mail-state/\n - ./docker-data/dms/mail-logs/:/var/log/mail/\n - ./docker-data/dms/config/:/tmp/docker-mailserver/\n - ./docker-data/dms/config/dovecot/fts-xapian-plugin.conf:/etc/dovecot/conf.d/10-plugin.conf:ro\n - /etc/localtime:/etc/localtime:ro\n restart: always\n stop_grace_period: 1m\n cap_add:\n - NET_ADMIN\n
Recreate containers:
docker compose down\ndocker compose up -d\n
Initialize indexing on all users for all mail:
docker compose exec mailserver doveadm index -A -q \\*\n
Run the following command in a daily cron job:
docker compose exec mailserver doveadm fts optimize -A\n
# in the compose.yaml root directory\nmkdir -p ./docker-data/dms/cron # if you didn't have this folder before\ntouch ./docker-data/dms/cron/fts_xapian\nchown root:root ./docker-data/dms/cron/fts_xapian\nchmod 0644 ./docker-data/dms/cron/fts_xapian\n
Edit the system cron file nano ./docker-data/dms/cron/fts_xapian, and set an appropriate configuration:
nano ./docker-data/dms/cron/fts_xapian
# Adding `MAILTO=\"\"` prevents cron emailing notifications of the task outcome each run\nMAILTO=\"\"\n#\n# m h dom mon dow user command\n#\n# Everyday 4:00AM, optimize index files\n0 4 * * * root doveadm fts optimize -A\n
services:\n mailserver:\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n volumes:\n - ./docker-data/dms/cron/fts_xapian:/etc/cron.d/fts_xapian\n
The dovecot-solr Plugin is used in conjunction with Apache Solr running in a separate container. This is quite straightforward to setup using the following instructions.
Solr is a mature and fast indexing backend that runs on the JVM. The indexes are relatively compact compared to the size of your total email.
However, Solr also requires a fair bit of RAM. While Solr is highly tuneable, it may require a bit of testing to get it right.
compose.yaml:
solr:\n image: lmmdock/dovecot-solr:latest\n volumes:\n - ./docker-data/dms/config/dovecot/solr-dovecot:/opt/solr/server/solr/dovecot\n restart: always\n\n mailserver:\n depends_on:\n - solr\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n ...\n volumes:\n ...\n - ./docker-data/dms/config/dovecot/10-plugin.conf:/etc/dovecot/conf.d/10-plugin.conf:ro\n ...\n
./docker-data/dms/config/dovecot/10-plugin.conf:
./docker-data/dms/config/dovecot/10-plugin.conf
mail_plugins = $mail_plugins fts fts_solr\n\nplugin {\n fts = solr\n fts_autoindex = yes\n fts_solr = url=http://solr:8983/solr/dovecot/\n}\n
Recreate containers: docker compose down ; docker compose up -d
docker compose down ; docker compose up -d
Flag all user mailbox FTS indexes as invalid, so they are rescanned on demand when they are next searched: docker compose exec mailserver doveadm fts rescan -A
docker compose exec mailserver doveadm fts rescan -A
See #905
Ample Opportunities for Issues
Numerous bug reports have been raised in the past about IPv6. Please make sure your setup around DMS is correct when using IPv6!
If your host system supports IPv6 and an AAAA DNS record exists to direct IPv6 traffic to DMS, you may experience issues when an IPv6 connection is made:
AAAA
The impact of losing the real IP of the client connection can negatively affect DMS:
When the host network receives a connection to a containers published port, it is routed to the containers internal network managed by Docker (typically a bridge network).
By default, the Docker daemon only assigns IPv4 addresses to containers, thus it will only accept IPv4 connections (unless a docker-proxy process is listening, which the default daemon setting userland-proxy: true enables). With the daemon setting userland-proxy: true (default), IPv6 connections from the host can also be accepted and routed to containers (even when they only have IPv4 addresses assigned). userland-proxy: false will require the container to have atleast an IPv6 address assigned.
docker-proxy
userland-proxy: true
userland-proxy: false
This can be problematic for IPv6 host connections when internally the container is no longer aware of the original client IPv6 address, as it has been proxied through the IPv4 or IPv6 gateway address of it's connected network (eg: 172.17.0.1 - Docker allocates networks from a set of default subnets).
172.17.0.1
This can be fixed by enabling a Docker network to assign IPv6 addresses to containers, along with some additional configuration. Alternatively you could configure the opposite to prevent IPv6 connections being made.
With UFW or Firewalld
When one of these firewall frontends are active, remote clients should fail to connect instead of being masqueraded as the docker network gateway IP. Keep in mind that this only affects remote clients, it does not affect local IPv6 connections originating within the same host.
You can enable IPv6 support in Docker for container networks, however compatibility concerns may affect your success.
The official Docker documentation on enabling IPv6 has been improving and is a good resource to reference.
Enable ip6tables support so that Docker will manage IPv6 networking rules as well. This will allow for IPv6 NAT to work like the existing IPv4 NAT already does for your containers, avoiding the above issue with external connections having their IP address seen as the container network gateway IP (provided an IPv6 address is also assigned to the container).
ip6tables
Configure the following in /etc/docker/daemon.json
/etc/docker/daemon.json
{\n \"ip6tables\": true,\n \"experimental\" : true,\n \"userland-proxy\": true\n}\n
experimental: true
ip6tables: true
Now restart the daemon if it's running: systemctl restart docker.
systemctl restart docker
Next, configure a network with an IPv6 subnet for your container with any of these examples:
These examples are focused on a IPv6 ULA subnet which is suitable for most users as described in the next section.
/64
/112
default-address-pools
The preferred approach is with user-defined networks via compose.yaml (recommended) or CLI with docker network create:
docker network create
Create the network in compose.yaml and attach a service to it:
services:\n mailserver:\n networks:\n - dms-ipv6\n\nnetworks:\n dms-ipv6:\n enable_ipv6: true\n ipam:\n config:\n - subnet: fd00:cafe:face:feed::/64\n
default
You can optionally avoid the service assignment by overriding the default user-defined network that Docker Compose generates. Just replace dms-ipv6 with default.
dms-ipv6
The Docker Compose default bridge is not affected by settings for the default bridge (aka docker0) in /etc/docker/daemon.json.
bridge
docker0
To reference this network externally (from other compose files or docker run), assign the networks name key in compose.yaml.
docker run
name
Create the network via a CLI command (which can then be used with docker run --network dms-ipv6):
docker run --network dms-ipv6
docker network create --ipv6 --subnet fd00:cafe:face:feed::/64 dms-ipv6\n
Optionally reference it from one or more compose.yaml files:
services:\n mailserver:\n networks:\n - dms-ipv6\n\nnetworks:\n dms-ipv6:\n external: true\n
This approach is discouraged
The bridge network is considered legacy.
Add these two extra IPv6 settings to your daemon config. They only apply to the default bridge docker network aka docker0 (which containers are attached to by default when using docker run).
{\n \"ipv6\": true,\n \"fixed-cidr-v6\": \"fd00:cafe:face:feed::/64\",\n}\n
Compose projects can also use this network via network_mode:
network_mode
services:\n mailserver:\n network_mode: bridge\n
Do not use 2001:db8:1::/64 for your private subnet
2001:db8:1::/64
The 2001:db8 address prefix is reserved for documentation. Avoid creating a subnet with this prefix.
2001:db8
Presently this is used in examples for Dockers IPv6 docs as a placeholder, while mixed in with private IPv4 addresses which can be misleading.
If you've configured IPv6 address pools in /etc/docker/daemon.json, you do not need to specify a subnet explicitly. Otherwise if you're unsure what value to provide, here's a quick guide (Tip: Prefer IPv6 ULA, it's the least hassle):
fd00:cafe:face:feed::/64
With Docker CLI or Docker Compose, run a traefik/whoami container with your IPv6 docker network and port 80 published. You can then send a curl request (or via address in the browser) from another host (as your remote client) with an IPv6 network, the RemoteAddr value returned should match your client IPv6 address.
traefik/whoami
RemoteAddr
docker run --rm -d --network dms-ipv6 -p 80:80 traefik/whoami\n# On a different host, replace `2001:db8::1` with your DMS host IPv6 address\ncurl --max-time 5 http://[2001:db8::1]:80\n
IPv6 ULA address priority
DNS lookups that have records for both IPv4 and IPv6 addresses (eg: localhost) may prefer IPv4 over IPv6 (ULA) for private addresses, whereas for public addresses IPv6 has priority. This shouldn't be anything to worry about, but can come across as a surprise when testing your IPv6 setup on the same host instead of from a remote client.
localhost
The preference can be controlled with /etc/gai.conf, and appears was configured this way based on the assumption that IPv6 ULA would never be used with NAT. It should only affect the destination resolved for outgoing connections, which for IPv6 ULA should only really affect connections between your containers / host. In future IPv6 ULA may also be prioritized.
/etc/gai.conf
This article describes how to deploy DMS to Kubernetes. Please note that there is also a Helm chart available.
Requirements
We assume basic knowledge about Kubernetes from the reader. Moreover, we assume the reader to have a basic understanding of mail servers. Ideally, the reader has deployed DMS before in an easier setup with Docker (Compose).
About Support for Kubernetes
Please note that Kubernetes is not officially supported and we do not build images specifically designed for it. When opening an issue, please remember that only Docker & Docker Compose are officially supported.
This content is entirely community-supported. If you find errors, please open an issue and provide a PR.
We want to provide the basic configuration in the form of environment variables with a ConfigMap. Note that this is just an example configuration; tune the ConfigMap to your needs.
ConfigMap
---\napiVersion: v1\nkind: ConfigMap\n\nmetadata:\n name: mailserver.environment\n\nimmutable: false\n\ndata:\n TLS_LEVEL: modern\n POSTSCREEN_ACTION: drop\n OVERRIDE_HOSTNAME: mail.example.com\n FAIL2BAN_BLOCKTYPE: drop\n POSTMASTER_ADDRESS: postmaster@example.com\n UPDATE_CHECK_INTERVAL: 10d\n POSTFIX_INET_PROTOCOLS: ipv4\n ENABLE_CLAMAV: '1'\n ENABLE_POSTGREY: '0'\n ENABLE_FAIL2BAN: '1'\n AMAVIS_LOGLEVEL: '-1'\n SPOOF_PROTECTION: '1'\n MOVE_SPAM_TO_JUNK: '1'\n ENABLE_UPDATE_CHECK: '1'\n ENABLE_SPAMASSASSIN: '1'\n SUPERVISOR_LOGLEVEL: warn\n SPAMASSASSIN_SPAM_TO_INBOX: '1'\n\n # here, we provide an example for the SSL configuration\n SSL_TYPE: manual\n SSL_CERT_PATH: /secrets/ssl/rsa/tls.crt\n SSL_KEY_PATH: /secrets/ssl/rsa/tls.key\n
We can also make use of user-provided configuration files, e.g. user-patches.sh, postfix-accounts.cf and more, to adjust DMS to our likings. We encourage you to have a look at Kustomize for creating ConfigMaps from multiple files, but for now, we will provide a simple, hand-written example. This example is absolutely minimal and only goes to show what can be done.
postfix-accounts.cf
---\napiVersion: v1\nkind: ConfigMap\n\nmetadata:\n name: mailserver.files\n\ndata:\n postfix-accounts.cf: |\n test@example.com|{SHA512-CRYPT}$6$someHashValueHere\n other@example.com|{SHA512-CRYPT}$6$someOtherHashValueHere\n
Static Configuration
With the configuration shown above, you can not dynamically add accounts as the configuration file mounted into the mail server can not be written to.
Use persistent volumes for production deployments.
Thereafter, we need persistence for our data. Make sure you have a storage provisioner and that you choose the correct storageClassName.
storageClassName
---\napiVersion: v1\nkind: PersistentVolumeClaim\n\nmetadata:\n name: data\n\nspec:\n storageClassName: local-path\n accessModes:\n - ReadWriteOnce\n resources:\n requests:\n storage: 25Gi\n
A Service is required for getting the traffic to the pod itself. The service is somewhat crucial. Its configuration determines whether the original IP from the sender will be kept. More about this further down below.
Service
The configuration you're seeing does keep the original IP, but you will not be able to scale this way. We have chosen to go this route in this case because we think most Kubernetes users will only want to have one instance.
---\napiVersion: v1\nkind: Service\n\nmetadata:\n name: mailserver\n labels:\n app: mailserver\n\nspec:\n type: LoadBalancer\n\n selector:\n app: mailserver\n\n ports:\n # Transfer\n - name: transfer\n port: 25\n targetPort: transfer\n protocol: TCP\n # ESMTP with implicit TLS\n - name: esmtp-implicit\n port: 465\n targetPort: esmtp-implicit\n protocol: TCP\n # ESMTP with explicit TLS (STARTTLS)\n - name: esmtp-explicit\n port: 587\n targetPort: esmtp-explicit\n protocol: TCP\n # IMAPS with implicit TLS\n - name: imap-implicit\n port: 993\n targetPort: imap-implicit\n protocol: TCP\n
Last but not least, the Deployment becomes the most complex component. It instructs Kubernetes how to run the DMS container and how to apply your ConfigMaps, persisted storage, etc. Additionally, we can set options to enforce runtime security here.
Deployment
ConfigMaps
---\napiVersion: apps/v1\nkind: Deployment\n\nmetadata:\n name: mailserver\n\n annotations:\n ignore-check.kube-linter.io/run-as-non-root: >-\n 'mailserver' needs to run as root\n ignore-check.kube-linter.io/privileged-ports: >-\n 'mailserver' needs privileged ports\n ignore-check.kube-linter.io/no-read-only-root-fs: >-\n There are too many files written to make The\n root FS read-only\n\nspec:\n replicas: 1\n selector:\n matchLabels:\n app: mailserver\n\n template:\n metadata:\n labels:\n app: mailserver\n\n annotations:\n container.apparmor.security.beta.kubernetes.io/mailserver: runtime/default\n\n spec:\n hostname: mail\n containers:\n - name: mailserver\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n imagePullPolicy: IfNotPresent\n\n securityContext:\n # Required to support SGID via `postdrop` executable\n # in `/var/mail-state` for Postfix (maildrop + public dirs):\n # https://github.com/docker-mailserver/docker-mailserver/pull/3625\n allowPrivilegeEscalation: true\n readOnlyRootFilesystem: false\n runAsUser: 0\n runAsGroup: 0\n runAsNonRoot: false\n privileged: false\n capabilities:\n add:\n # file permission capabilities\n - CHOWN\n - FOWNER\n - MKNOD\n - SETGID\n - SETUID\n - DAC_OVERRIDE\n # network capabilities\n - NET_ADMIN # needed for F2B\n - NET_RAW # needed for F2B\n - NET_BIND_SERVICE\n # miscellaneous capabilities\n - SYS_CHROOT\n - KILL\n drop: [ALL]\n seccompProfile:\n type: RuntimeDefault\n\n # You want to tune this to your needs. If you disable ClamAV,\n # you can use less RAM and CPU. This becomes important in\n # case you're low on resources and Kubernetes refuses to\n # schedule new pods.\n resources:\n limits:\n memory: 4Gi\n cpu: 1500m\n requests:\n memory: 2Gi\n cpu: 600m\n\n volumeMounts:\n - name: files\n subPath: postfix-accounts.cf\n mountPath: /tmp/docker-mailserver/postfix-accounts.cf\n readOnly: true\n\n # PVCs\n - name: data\n mountPath: /var/mail\n subPath: data\n readOnly: false\n - name: data\n mountPath: /var/mail-state\n subPath: state\n readOnly: false\n - name: data\n mountPath: /var/log/mail\n subPath: log\n readOnly: false\n\n # certificates\n - name: certificates-rsa\n mountPath: /secrets/ssl/rsa/\n readOnly: true\n\n # other\n - name: tmp-files\n mountPath: /tmp\n readOnly: false\n\n ports:\n - name: transfer\n containerPort: 25\n protocol: TCP\n - name: esmtp-implicit\n containerPort: 465\n protocol: TCP\n - name: esmtp-explicit\n containerPort: 587\n - name: imap-implicit\n containerPort: 993\n protocol: TCP\n\n envFrom:\n - configMapRef:\n name: mailserver.environment\n\n restartPolicy: Always\n\n volumes:\n # configuration files\n - name: files\n configMap:\n name: mailserver.files\n\n # PVCs\n - name: data\n persistentVolumeClaim:\n claimName: data\n\n # certificates\n - name: certificates-rsa\n secret:\n secretName: mail-tls-certificate-rsa\n items:\n - key: tls.key\n path: tls.key\n - key: tls.crt\n path: tls.crt\n\n # other\n - name: tmp-files\n emptyDir: {}\n
In this example, we use cert-manager to supply RSA certificates. You can also supply RSA certificates as fallback certificates, which DMS supports out of the box with SSL_ALT_CERT_PATH and SSL_ALT_KEY_PATH, and provide ECDSA as the proper certificates.
cert-manager
---\napiVersion: cert-manager.io/v1\nkind: Certificate\n\nmetadata:\n name: mail-tls-certificate-rsa\n\nspec:\n secretName: mail-tls-certificate-rsa\n isCA: false\n privateKey:\n algorithm: RSA\n encoding: PKCS1\n size: 2048\n dnsNames: [mail.example.com]\n issuerRef:\n name: mail-issuer\n kind: Issuer\n
You will need to have cert-manager configured. Especially the issue will need to be configured. Since we do not know how you want or need your certificates to be supplied, we do not provide more configuration here. The documentation for cert-manager is excellent.
Sensitive Data
For storing OpenDKIM keys, TLS certificates or any sort of sensitive data, you should be using Secrets. You can mount secrets like ConfigMaps and use them the same way.
Secret
The TLS docs page provides guidance when it comes to certificates and transport layer security. Always provide sensitive information vai Secrets.
Secrets
The more difficult part with Kubernetes is to expose a deployed DMS to the outside world. Kubernetes provides multiple ways for doing that; each has downsides and complexity. The major problem with exposing DMS to outside world in Kubernetes is to preserve the real client IP. The real client IP is required by DMS for performing IP-based SPF checks and spam checks. If you do not require SPF checks for incoming mails, you may disable them in your Postfix configuration by dropping the line that states: check_policy_service unix:private/policyd-spf.
check_policy_service unix:private/policyd-spf
The easiest approach was covered above, using externalTrafficPolicy: Local, which disables the service proxy, but makes the service local as well (which does not scale). This approach only works when you are given the correct (that is, a public and routable) IP address by a load balancer (like MetalLB). In this sense, the approach above is similar to the next example below. We want to provide you with a few alternatives too. But we also want to communicate the idea of another simple method: you could use a load-balancer without an external IP and DNAT the network traffic to the mail server. After all, this does not interfere with SPF checks because it keeps the origin IP address. If no dedicated external IP address is available, you could try the latter approach, if one is available, use the former.
externalTrafficPolicy: Local
The simplest way is to expose DMS as a Service with external IPs. This is very similar to the approach taken above. Here, an external IP is given to the service directly by you. With the approach above, you tell your load-balancer to do this.
---\napiVersion: v1\nkind: Service\n\nmetadata:\n name: mailserver\n labels:\n app: mailserver\n\nspec:\n selector:\n app: mailserver\n ports:\n - name: smtp\n port: 25\n targetPort: smtp\n # ...\n\n externalIPs:\n - 80.11.12.10\n
This approach
The proxy pod helps to avoid the necessity of specifying external IPs explicitly. This comes at the cost of complexity; you must deploy a proxy pod on each Node you want to expose DMS on.
One way to preserve the real client IP is to use hostPort and hostNetwork: true. This comes at the cost of availability; you can reach DMS from the outside world only via IPs of Node where DMS is deployed.
hostPort
hostNetwork: true
---\napiVersion: extensions/v1beta1\nkind: Deployment\n\nmetadata:\n name: mailserver\n\n# ...\n spec:\n hostNetwork: true\n\n # ...\n containers:\n # ...\n ports:\n - name: smtp\n containerPort: 25\n hostPort: 25\n - name: smtp-auth\n containerPort: 587\n hostPort: 587\n - name: imap-secure\n containerPort: 993\n hostPort: 993\n # ...\n
With this approach,
This way is ideologically the same as using a proxy pod, but instead of a separate proxy pod, you configure your ingress to proxy TCP traffic to the DMS pod using the PROXY protocol, which preserves the real client IP.
With an NGINX ingress controller, set externalTrafficPolicy: Local for its service, and add the following to the TCP services config map (as described here):
25: \"mailserver/mailserver:25::PROXY\"\n465: \"mailserver/mailserver:465::PROXY\"\n587: \"mailserver/mailserver:587::PROXY\"\n993: \"mailserver/mailserver:993::PROXY\"\n
HAProxy
With HAProxy, the configuration should look similar to the above. If you know what it actually looks like, add an example here.
Then, configure both Postfix and Dovecot to expect the PROXY protocol:
kind: ConfigMap\napiVersion: v1\nmetadata:\n name: mailserver.config\n labels:\n app: mailserver\ndata:\n postfix-main.cf: |\n postscreen_upstream_proxy_protocol = haproxy\n postfix-master.cf: |\n smtp/inet/postscreen_upstream_proxy_protocol=haproxy\n submission/inet/smtpd_upstream_proxy_protocol=haproxy\n submissions/inet/smtpd_upstream_proxy_protocol=haproxy\n dovecot.cf: |\n # Assuming your ingress controller is bound to 10.0.0.0/8\n haproxy_trusted_networks = 10.0.0.0/8, 127.0.0.0/8\n service imap-login {\n inet_listener imap {\n haproxy = yes\n }\n inet_listener imaps {\n haproxy = yes\n }\n }\n# ...\n---\n\nkind: Deployment\napiVersion: extensions/v1beta1\nmetadata:\n name: mailserver\nspec:\n template:\n spec:\n containers:\n - name: docker-mailserver\n volumeMounts:\n - name: config\n subPath: postfix-main.cf\n mountPath: /tmp/docker-mailserver/postfix-main.cf\n readOnly: true\n - name: config\n subPath: postfix-master.cf\n mountPath: /tmp/docker-mailserver/postfix-master.cf\n readOnly: true\n - name: config\n subPath: dovecot.cf\n mountPath: /tmp/docker-mailserver/dovecot.cf\n readOnly: true\n
To enable the fetchmail service to retrieve e-mails set the environment variable ENABLE_FETCHMAIL to 1. Your compose.yaml file should look like following snippet:
ENABLE_FETCHMAIL
environment:\n - ENABLE_FETCHMAIL=1\n - FETCHMAIL_POLL=300\n
Generate a file called fetchmail.cf and place it in the docker-data/dms/config/ folder. Your DMS folder should look like this example:
fetchmail.cf
\u251c\u2500\u2500 docker-data/dms/config\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 dovecot.cf\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 fetchmail.cf\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 postfix-accounts.cf\n\u2502\u00a0\u00a0 \u2514\u2500\u2500 postfix-virtual.cf\n\u251c\u2500\u2500 compose.yaml\n\u2514\u2500\u2500 README.md\n
A detailed description of the configuration options can be found in the online version of the manual page.
poll 'imap.gmail.com' proto imap\n user 'username'\n pass 'secret'\n is 'user1@example.com'\n ssl\n
poll 'pop3.gmail.com' proto pop3\n user 'username'\n pass 'secret'\n is 'user2@example.com'\n ssl\n
Caution
Don\u2019t forget the last line! (eg: is 'user1@example.com'). After is, you have to specify an email address from the configuration file: docker-data/dms/config/postfix-accounts.cf.
is 'user1@example.com'
is
More details how to configure fetchmail can be found in the fetchmail man page in the chapter \u201cThe run control file\u201d.
By default the fetchmail service searches every 5 minutes for new mails on your external mail accounts. You can override this default value by changing the ENV variable FETCHMAIL_POLL:
FETCHMAIL_POLL
environment:\n - FETCHMAIL_POLL=60\n
You must specify a numeric argument which is a polling interval in seconds. The example above polls every minute for new mails.
To debug your fetchmail.cf configuration run this command:
./setup.sh debug fetchmail\n
For more information about the configuration script setup.sh read the corresponding docs.
Here a sample output of ./setup.sh debug fetchmail:
./setup.sh debug fetchmail
fetchmail: 6.3.26 querying outlook.office365.com (protocol POP3) at Mon Aug 29 22:11:09 2016: poll started\nTrying to connect to 132.245.48.18/995...connected.\nfetchmail: Server certificate:\nfetchmail: Issuer Organization: Microsoft Corporation\nfetchmail: Issuer CommonName: Microsoft IT SSL SHA2\nfetchmail: Subject CommonName: outlook.com\nfetchmail: Subject Alternative Name: outlook.com\nfetchmail: Subject Alternative Name: *.outlook.com\nfetchmail: Subject Alternative Name: office365.com\nfetchmail: Subject Alternative Name: *.office365.com\nfetchmail: Subject Alternative Name: *.live.com\nfetchmail: Subject Alternative Name: *.internal.outlook.com\nfetchmail: Subject Alternative Name: *.outlook.office365.com\nfetchmail: Subject Alternative Name: outlook.office.com\nfetchmail: Subject Alternative Name: attachment.outlook.office.net\nfetchmail: Subject Alternative Name: attachment.outlook.officeppe.net\nfetchmail: Subject Alternative Name: *.office.com\nfetchmail: outlook.office365.com key fingerprint: 3A:A4:58:42:56:CD:BD:11:19:5B:CF:1E:85:16:8E:4D\nfetchmail: POP3< +OK The Microsoft Exchange POP3 service is ready. [SABFADEAUABSADAAMQBDAEEAMAAwADAANwAuAGUAdQByAHAAcgBkADAAMQAuAHAAcgBvAGQALgBlAHgAYwBoAGEAbgBnAGUAbABhAGIAcwAuAGMAbwBtAA==]\nfetchmail: POP3> CAPA\nfetchmail: POP3< +OK\nfetchmail: POP3< TOP\nfetchmail: POP3< UIDL\nfetchmail: POP3< SASL PLAIN\nfetchmail: POP3< USER\nfetchmail: POP3< .\nfetchmail: POP3> USER user1@outlook.com\nfetchmail: POP3< +OK\nfetchmail: POP3> PASS *\nfetchmail: POP3< +OK User successfully logged on.\nfetchmail: POP3> STAT\nfetchmail: POP3< +OK 0 0\nfetchmail: No mail for user1@outlook.com at outlook.office365.com\nfetchmail: POP3> QUIT\nfetchmail: POP3< +OK Microsoft Exchange Server 2016 POP3 server signing off.\nfetchmail: 6.3.26 querying outlook.office365.com (protocol POP3) at Mon Aug 29 22:11:11 2016: poll completed\nfetchmail: normal termination, status 1\n
To enable the getmail service to retrieve e-mails set the environment variable ENABLE_GETMAIL to 1. Your compose.yaml file should include the following:
ENABLE_GETMAIL
environment:\n - ENABLE_GETMAIL=1\n - GETMAIL_POLL=5\n
In your DMS config volume (eg: docker-data/dms/config/), create a getmail-<ID>.cf file for each remote account that you want to retrieve mail and store into a local DMS account. <ID> should be replaced by you, and is just the rest of the filename (eg: getmail-example.cf). The contents of each file should be configuration like documented below.
getmail-<ID>.cf
<ID>
getmail-example.cf
The directory structure should similar to this:
\u251c\u2500\u2500 docker-data/dms/config\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 dovecot.cf\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 getmail-example.cf\n\u2502\u00a0\u00a0 \u251c\u2500\u2500 postfix-accounts.cf\n\u2502\u00a0\u00a0 \u2514\u2500\u2500 postfix-virtual.cf\n\u251c\u2500\u2500 docker-compose.yml\n\u2514\u2500\u2500 README.md\n
The default options added to each getmail config are:
[options]\nverbose = 0\nread_all = false\ndelete = false\nmax_messages_per_session = 500\nreceived = false\ndelivered_to = false\n
If you want to use a different base config, mount a file to /etc/getmailrc_general. This file will replace the default \"Common Options\" base config above, that all getmail-<ID>.cf files will extend with their configs when used.
/etc/getmailrc_general
This example will:
alice
notsecure
[retriever]\ntype = SimpleIMAPRetriever\nserver = imap.gmail.com\nusername = alice\npassword = notsecure\n[destination]\ntype = MDA_external\npath = /usr/lib/dovecot/deliver\nallow_root_commands = true\narguments =(\"-d\",\"user1@example.com\")\n
Just like the IMAP example above, but instead via POP3 protocol if you prefer that over IMAP.
[retriever]\ntype = SimplePOP3Retriever\nserver = pop3.gmail.com\nusername = alice\npassword = notsecure\n[destination]\ntype = MDA_external\npath = /usr/lib/dovecot/deliver\nallow_root_commands = true\narguments =(\"-d\",\"user1@example.com\")\n
By default the getmail service checks external mail accounts for new mail every 5 minutes. That polling interval is configurable via the GETMAIL_POLL ENV variable, with a value in minutes (default: 5, min: 1, max: 30):
GETMAIL_POLL
environment:\n - GETMAIL_POLL=1\n
It is possible to utilize the getmail-gmail-xoauth-tokens helper to provide authentication using xoauth2 for gmail (example 12) or Microsoft Office 365 (example 13)
getmail-gmail-xoauth-tokens
xoauth2
Advice may be outdated
This section was contributed by the community some time ago and some configuration examples may be outdated.
Sieve allows to specify filtering rules for incoming emails that allow for example sorting mails into different folders depending on the title of an email.
Global vs User order
There are global and user specific filters which are filtering the incoming emails in the following order:
Global-before -> User specific -> Global-after
Global filters are applied to EVERY incoming mail for EVERY email address.
docker-data/dms/config/before.dovecot.sieve
docker-data/dms/config/after.dovecot.sieve
To specify a user-defined Sieve filter place a .dovecot.sieve file into a virtual user's mail folder (e.g. /var/mail/example.com/user1/home/.dovecot.sieve). If this file exists dovecot will apply the filtering rules.
.dovecot.sieve
/var/mail/example.com/user1/home/.dovecot.sieve
It's even possible to install a user provided Sieve filter at startup during users setup: simply include a Sieve file in the docker-data/dms/config/ path for each user login that needs a filter. The file name provided should be in the form <user_login>.dovecot.sieve, so for example for user1@example.com you should provide a Sieve file named docker-data/dms/config/user1@example.com.dovecot.sieve.
<user_login>.dovecot.sieve
docker-data/dms/config/user1@example.com.dovecot.sieve
An example of a sieve filter that moves mails to a folder INBOX/spam depending on the sender address:
INBOX/spam
require [\"fileinto\", \"reject\"];\n\nif address :contains [\"From\"] \"spam@spam.com\" {\n fileinto \"INBOX.spam\";\n} else {\n keep;\n}\n
That folders have to exist beforehand if sieve should move them.
Another example of a sieve filter that forward mails to a different address:
require [\"copy\"];\n\nredirect :copy \"user2@not-example.com\";\n
Just forward all incoming emails and do not save them locally:
redirect \"user2@not-example.com\";\n
You can also use external programs to filter or pipe (process) messages by adding executable scripts in docker-data/dms/config/sieve-pipe or docker-data/dms/config/sieve-filter.
docker-data/dms/config/sieve-pipe
docker-data/dms/config/sieve-filter
This can be used in lieu of a local alias file, for instance to forward an email to a webservice.
require [\"vnd.dovecot.pipe\"];\npipe \"external-program\";\n
For more examples or a detailed description of the Sieve language have a look at the official site. Other resources are available on the internet where you can find several examples.
It is possible to sort subaddresses such as user+mailing-lists@example.com into a corresponding folder (here: INBOX/Mailing-lists) automatically.
user+mailing-lists@example.com
INBOX/Mailing-lists
require [\"envelope\", \"fileinto\", \"mailbox\", \"subaddress\", \"variables\"];\n\nif envelope :detail :matches \"to\" \"*\" {\n set :lower :upperfirst \"tag\" \"${1}\";\n if mailboxexists \"INBOX.${1}\" {\n fileinto \"INBOX.${1}\";\n } else {\n fileinto :create \"INBOX.${tag}\";\n }\n}\n
The Manage Sieve extension allows users to modify their Sieve script by themselves. The authentication mechanisms are the same as for the main dovecot service. ManageSieve runs on port 4190 and needs to be enabled using the ENABLE_MANAGESIEVE=1 environment variable.
4190
ENABLE_MANAGESIEVE=1
# compose.yaml\nports:\n - \"4190:4190\"\nenvironment:\n - ENABLE_MANAGESIEVE=1\n
All user defined sieve scripts that are managed by ManageSieve are stored in the user's home folder in /var/mail/example.com/user1/home/sieve. Just one Sieve script might be active for a user and is sym-linked to /var/mail/example.com/user1/home/.dovecot.sieve automatically.
/var/mail/example.com/user1/home/sieve
ManageSieve makes sure to not overwrite an existing .dovecot.sieve file. If a user activates a new sieve script the old one is backed up and moved to the sieve folder.
sieve
The extension is known to work with the following ManageSieve clients:
DMS has several locations in the container which may be worth persisting externally via Docker Volumes.
docker-data/dms/
Reference - Volmes for DMS
Our docs may refer to these DMS specific volumes only by name, or the host/container path for brevity.
docker-data/dms/mail-data/
/var/mail/
docker-data/dms/mail-state/
docker-data/dms/mail-logs/
This is the location where mail is delivered to your mailboxes.
Run-time specific state lives here, but so does some data you may want to keep if a failure event occurs (crash, power loss).
Examples of relevant data
When a volume is mounted to /var/mail-state/
/var/lib/redis
/var/mail-state/lib-redis/
Supported services: Postfix, Dovecot, Fail2Ban, Amavis, PostGrey, ClamAV, SpamAssassin, Rspamd & Redis, Fetchmail, Getmail, LogRotate, PostSRSd, MTA-STS.
Sometimes it is helpful to disable this volume when troubleshooting to verify if the data stored here is in a bad state (eg: caused by a failure event).
This can be a useful volume to persist for troubleshooting needs for the full set of log files.
Most configuration files for Postfix, Dovecot, etc. are persisted here.
This is a list of all configuration files and directories which are optional, automatically generated / updated by our setup CLI, or other internal scripts.
setup.sh config dkim
${login}.dovecot.sieve
setup.sh email
setup.sh email restrict
setup.sh alias
<username>:<password>
setup.sh relay add-auth <domain> <username> [<password>]
setup.sh relay add-domain
setup.sh relay exclude-domain
setup-stack.sh
virtual_mailbox_domains
fail2ban.cf
/etc/amavis/conf.d/50-user
/etc/dovecot/local.conf
Podman is a daemonless container engine for developing, managing, and running OCI Containers on your Linux System.
About Support for Podman
Please note that Podman is not officially supported as DMS is built and verified on top of the Docker Engine. This content is entirely community supported. If you find errors, please open an issue and provide a PR.
About this Guide
This guide was tested with Fedora 34 using systemd and firewalld. Moreover, it requires Podman version >= 3.2. You may be able to substitute dnf - Fedora's package manager - with others such as apt.
systemd
firewalld
dnf
apt
About Security
Running podman in rootless mode requires additional modifications in order to keep your mailserver secure. Make sure to read the related documentation.
While using Podman, you can just manage docker-mailserver as what you did with Docker. Your best friend setup.sh includes the minimum code in order to support Podman since it's 100% compatible with the Docker CLI.
The installation is basically the same. Podman v3.2 introduced a RESTful API that is 100% compatible with the Docker API, so you can use Docker Compose with Podman easily. Install Podman and Docker Compose with your package manager first.
sudo dnf install podman docker-compose\n
Then enable podman.socket using systemctl.
podman.socket
systemctl
systemctl enable --now podman.socket\n
This will create a unix socket locate under /run/podman/podman.sock, which is the entrypoint of Podman's API. Now, configure docker-mailserver and start it.
/run/podman/podman.sock
export DOCKER_HOST=\"unix:///run/podman/podman.sock\"\ndocker compose up -d mailserver\ndocker compose ps\n
You should see that docker-mailserver is running now.
Podman is daemonless, that means if you want docker-mailserver self-start while boot up the system, you have to generate a systemd file with Podman CLI.
podman generate systemd mailserver > /etc/systemd/system/mailserver.service\nsystemctl daemon-reload\nsystemctl enable --now mailserver.service\n
Running rootless containers is one of Podman's major features. But due to some restrictions, deploying docker-mailserver in rootless mode is not as easy compared to rootfull mode.
~/.config
Also notice that Podman's rootless mode is not about running as a non-root user inside the container, but about the mapping of (normal, non-root) host users to root inside the container.
In order to make rootless DMS work we must modify some settings in the Linux system, it requires some basic linux server knowledge so don't follow this guide if you not sure what this guide is talking about. Podman rootfull mode and Docker are still good and security enough for normal daily usage.
First, enable podman.socket in systemd's userspace with a non-root user.
systemctl enable --now --user podman.socket\n
The socket file should be located at /var/run/user/$(id -u)/podman/podman.sock. Then, modify compose.yaml to make sure all ports are bindings are on non-privileged ports.
/var/run/user/$(id -u)/podman/podman.sock
services:\n mailserver:\n ports:\n - \"10025:25\" # SMTP (explicit TLS => STARTTLS)\n - \"10143:143\" # IMAP4 (explicit TLS => STARTTLS)\n - \"10465:465\" # ESMTP (implicit TLS)\n - \"10587:587\" # ESMTP (explicit TLS => STARTTLS)\n - \"10993:993\" # IMAP4 (implicit TLS)\n
Then, setup your mailserver.env file follow the documentation and use Docker Compose to start the container.
export DOCKER_HOST=\"unix:///var/run/user/$(id -u)/podman/podman.sock\"\ndocker compose up -d mailserver\ndocker compose ps\n
In rootless mode, podman resolves all incoming IPs as localhost, which results in an open gateway in the default configuration. There are two workarounds to fix this problem, both of which have their own drawbacks.
The PERMIT_DOCKER variable in the mailserver.env file allows to specify trusted networks that do not need to authenticate. If the variable is left empty, only requests from localhost and the container IP are allowed, but in the case of rootless podman any IP will be resolved as localhost. Setting PERMIT_DOCKER=none enforces authentication also from localhost, which prevents sending unauthenticated emails.
PERMIT_DOCKER
PERMIT_DOCKER=none
The second workaround is slightly more complicated because the compose.yaml has to be modified. As shown in the fail2ban section the slirp4netns network driver has to be enabled. This network driver enables podman to correctly resolve IP addresses but it is not compatible with user defined networks which might be a problem depending on your setup.
slirp4netns
Rootless Podman requires adding the value slirp4netns:port_handler=slirp4netns to the --network CLI option, or network_mode setting in your compose.yaml.
slirp4netns:port_handler=slirp4netns
--network
You must also add the ENV NETWORK_INTERFACE=tap0, because Podman uses a hard-coded interface name for slirp4netns.
NETWORK_INTERFACE=tap0
services:\n mailserver:\n network_mode: \"slirp4netns:port_handler=slirp4netns\"\n environment:\n - NETWORK_INTERFACE=tap0\n ...\n
podman-compose is not compatible with this configuration.
podman-compose
Generate a systemd file with the Podman CLI.
podman generate systemd mailserver > ~/.config/systemd/user/mailserver.service\nsystemctl --user daemon-reload\nsystemctl enable --user --now mailserver.service\n
Systemd's user space service is only started when a specific user logs in and stops when you log out. In order to make it to start with the system, we need to enable linger with loginctl
loginctl
loginctl enable-linger <username>\n
Remember to run this command as root user.
When it comes to forwarding ports using firewalld, see https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/securing_networks/using-and-configuring-firewalld_securing-networks#port-forwarding_using-and-configuring-firewalld for more information.
firewall-cmd --permanent --add-forward-port=port=<25|143|465|587|993>:proto=<tcp>:toport=<10025|10143|10465|10587|10993>\n...\n\n# After you set all ports up.\nfirewall-cmd --reload\n
Notice that this will only open the access to the external client. If you want to access privileges port in your server, do this:
firewall-cmd --permanent --direct --add-rule <ipv4|ipv6> nat OUTPUT 0 -p <tcp|udp> -o lo --dport <25|143|465|587|993> -j REDIRECT --to-ports <10025|10143|10465|10587|10993>\n...\n# After you set all ports up.\nfirewall-cmd --reload\n
Just map all the privilege port with non-privilege port you set in compose.yaml before as root user.
Amazon SES (Simple Email Service) is intended to provide a simple way for cloud based applications to send email and receive email. For the purposes of this project only sending email via SES is supported. Older versions of docker-mailserver used AWS_SES_HOST and AWS_SES_USERPASS to configure sending, this has changed and the setup is managed through Configure Relay Hosts.
AWS_SES_HOST
AWS_SES_USERPASS
You will need to create some Amazon SES SMTP credentials. The SMTP credentials you create will be used to populate the RELAY_USER and RELAY_PASSWORD environment variables.
The RELAY_HOST should match your AWS SES region, the RELAY_PORT will be 587.
RELAY_PORT
If all of your email is being forwarded through AWS SES, DEFAULT_RELAY_HOST should be set accordingly.
Example:
DEFAULT_RELAY_HOST=[email-smtp.us-west-2.amazonaws.com]:587\n
If you set up AWS Easy DKIM you can safely skip setting up DKIM as the AWS SES will take care of signing your outgoing email.
To verify proper operation, send an email to some external account of yours and inspect the mail headers. You will also see the connection to SES in the mail logs. For example:
May 23 07:09:36 mail postfix/smtp[692]: Trusted TLS connection established to email-smtp.us-east-1.amazonaws.com[107.20.142.169]:25:\nTLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)\nMay 23 07:09:36 mail postfix/smtp[692]: 8C82A7E7: to=<someone@example.com>, relay=email-smtp.us-east-1.amazonaws.com[107.20.142.169]:25,\ndelay=0.35, delays=0/0.02/0.13/0.2, dsn=2.0.0, status=sent (250 Ok 01000154dc729264-93fdd7ea-f039-43d6-91ed-653e8547867c-000000)\n
Rather than having Postfix deliver mail directly, you can configure Postfix to send mail via another mail relay (smarthost). Examples include Mailgun, Sendgrid and AWS SES.
Depending on the domain of the sender, you may want to send via a different relay, or authenticate in a different way.
Basic configuration is done via environment variables:
empty
Setting these environment variables will cause mail for all sender domains to be routed via the specified host, authenticating with the user/password combination.
For users of the previous AWS_SES_* variables: please update your configuration to use these new variables, no other configuration is required.
AWS_SES_*
Sender dependent authentication is done in docker-data/dms/config/postfix-sasl-password.cf. You can create this file manually, or use:
docker-data/dms/config/postfix-sasl-password.cf
setup.sh relay add-auth <domain> <username> [<password>]\n
An example configuration file looks like this:
@domain1.com relay_user_1:password_1\n@domain2.com relay_user_2:password_2\n
If there is no other configuration, this will cause Postfix to deliver email through the relay specified in RELAY_HOST env variable, authenticating as relay_user_1 when sent from domain1.com and authenticating as relay_user_2 when sending from domain2.com.
relay_user_1
domain1.com
relay_user_2
domain2.com
To activate the configuration you must either restart the container, or you can also trigger an update by modifying a mail account.
Sender dependent relay hosts are configured in docker-data/dms/config/postfix-relaymap.cf. You can create this file manually, or use:
docker-data/dms/config/postfix-relaymap.cf
setup.sh relay add-domain <domain> <host> [<port>]\n
@domain1.com [relay1.org]:587\n@domain2.com [relay2.org]:2525\n
Combined with the previous configuration in docker-data/dms/config/postfix-sasl-password.cf, this will cause Postfix to deliver mail sent from domain1.com via relay1.org:587, authenticating as relay_user_1, and mail sent from domain2.com via relay2.org:2525 authenticating as relay_user_2.
relay1.org:587
relay2.org:2525
You still have to define RELAY_HOST to activate the feature
If you want mail sent from some domains to be delivered directly, you can exclude them from being delivered via the default relay by adding them to docker-data/dms/config/postfix-relaymap.cf with no destination. You can also do this via:
setup.sh relay exclude-domain <domain>\n
Extending the configuration file from above:
@domain1.com [relay1.org]:587\n@domain2.com [relay2.org]:2525\n@domain3.com\n
This will cause email sent from domain3.com to be delivered directly.
domain3.com
containrrr/watchtower is a service that monitors Docker images for updates, automatically applying them to running containers.
containrrr/watchtower
Automatic image updates + cleanup
Run a watchtower container with access to docker.sock, enabling the service to manage Docker:
watchtower
docker.sock
services:\n watchtower:\n image: containrrr/watchtower:latest\n # Automatic cleanup (removes older image pulls from wasting disk space):\n environment:\n - WATCHTOWER_CLEANUP=true\n volumes:\n - /var/run/docker.sock:/var/run/docker.sock\n
The image tag used for a container is monitored for updates (eg: :latest, :edge, :13)
:edge
:13
The automatic update support is only for updates to that specific image tag.
13
v13
Updating only specific containers
By default the watchtower service will check every 24 hours for new image updates to pull, based on currently running containers (not restricted to only those running within your compose.yaml).
Images eligible for updates can configured with a custom command that provides a list of container names, or via other supported options (eg: labels). This configuration is detailed in the watchtower docs.
command
Manual cleanup
watchtower also supports running on-demand with docker run or compose.yaml via the --run-once option.
--run-once
You can alternatively invoke cleanup of Docker storage directly with:
docker image prune --all
docker system prune --all
If you omit the --all option, this will instead only remove \"dangling\" content (eg: Orphaned images).
--all
The Dovecot default configuration can easily be extended providing a docker-data/dms/config/dovecot.cf file. Dovecot documentation remains the best place to find configuration options.
Your DMS folder structure should look like this example:
\u251c\u2500\u2500 docker-data/dms/config\n\u2502 \u251c\u2500\u2500 dovecot.cf\n\u2502 \u251c\u2500\u2500 postfix-accounts.cf\n\u2502 \u2514\u2500\u2500 postfix-virtual.cf\n\u251c\u2500\u2500 compose.yaml\n\u2514\u2500\u2500 README.md\n
One common option to change is the maximum number of connections per user:
mail_max_userip_connections = 100\n
Another important option is the default_process_limit (defaults to 100). If high-security mode is enabled you'll need to make sure this count is higher than the maximum number of users that can be logged in simultaneously.
default_process_limit
100
This limit is quickly reached if users connect to DMS with multiple end devices.
For major configuration changes it\u2019s best to override the dovecot configuration files. For each configuration file you want to override, add a list entry under the volumes key.
services:\n mailserver:\n volumes:\n - ./docker-data/dms/mail-data/:/var/mail/\n - ./docker-data/dms/config/dovecot/10-master.conf:/etc/dovecot/conf.d/10-master.conf\n
You will first need to obtain the configuration from the running container (where mailserver is the container name):
mailserver
mkdir -p ./docker-data/dms/config/dovecot\ndocker cp mailserver:/etc/dovecot/conf.d/10-master.conf ./docker-data/dms/config/dovecot/10-master.conf\n
To debug your dovecot configuration you can use:
./setup.sh debug login doveconf | grep <some-keyword>
docker exec -it mailserver doveconf | grep <some-keyword>
setup.sh is included in the DMS repository. Make sure to use the one matching your image version release.
The file docker-data/dms/config/dovecot.cf is copied internally to /etc/dovecot/local.conf. To verify the file content, run:
docker exec -it mailserver cat /etc/dovecot/local.conf\n
Our default Postfix configuration can easily be extended to add parameters or modify existing ones by providing a docker-data/dms/config/postfix-main.cf. This file uses the same format as Postfix main.cf does (See official docs for all parameters and syntax rules).
One can easily increase the backwards-compatibility level and set new Postscreen options:
# increase the compatibility level from 2 (default) to 3\ncompatibility_level = 3\n# set a threshold value for Spam detection\npostscreen_dnsbl_threshold = 4\n
How are your changes applied?
The custom configuration you supply is appended to the default configuration located at /etc/postfix/main.cf, and then postconf -nf is run to remove earlier duplicate entries that have since been replaced. This happens early during container startup before Postfix is started.
postconf -nf
Similarly, it is possible to add a custom docker-data/dms/config/postfix-master.cf file that will override the standard master.cf. Note: Each line in this file will be passed to postconf -P, i.e. the file is not appended as a whole to /etc/postfix/master.cf like docker-data/dms/config/postfix-main.cf! The expected format is <service_name>/<type>/<parameter>, for example:
docker-data/dms/config/postfix-master.cf
master.cf
postconf -P
/etc/postfix/master.cf
<service_name>/<type>/<parameter>
# adjust the submission \"reject_unlisted_recipient\" option\nsubmission/inet/smtpd_reject_unlisted_recipient=no\n
There should be no space between the parameter and the value.
Run postconf -Mf in the container without arguments to see the active master options.
postconf -Mf
If you'd like to change, patch or alter files or behavior of DMS, you can use a script.
In case you cloned this repository, you can copy the file user-patches.sh.dist (under config/) with cp config/user-patches.sh.dist docker-data/dms/config/user-patches.sh in order to create the user-patches.sh script.
user-patches.sh.dist
config/
cp config/user-patches.sh.dist docker-data/dms/config/user-patches.sh
If you are managing your directory structure yourself, create a docker-data/dms/config/ directory and add the user-patches.sh file yourself.
# 1. Either create the docker-data/dms/config/ directory yourself\n# or let docker-mailserver create it on initial startup\n/tmp $ mkdir -p docker-data/dms/config/ && cd docker-data/dms/config/\n\n# 2. Create the user-patches.sh file and edit it\n/tmp/docker-data/dms/config $ touch user-patches.sh\n/tmp/docker-data/dms/config $ nano user-patches.sh\n
The contents could look like this:
#!/bin/bash\n\ncat >/etc/amavis/conf.d/50-user << \"END\"\nuse strict;\n\n$undecipherable_subject_tag = undef;\n$admin_maps_by_ccat{+CC_UNCHECKED} = undef;\n\n#------------ Do not modify anything below this line -------------\n1; # ensure a defined return\nEND\n
And you're done. The user patches script runs right before starting daemons. That means, all the other configuration is in place, so the script can make final adjustments.
Many \"patches\" can already be done with the Docker Compose-/Stack-file. Adding hostnames to /etc/hosts is done with the extra_hosts: section, sysctl commands can be managed with the sysctls: section, etc.
/etc/hosts
extra_hosts:
sysctl
sysctls:
Email auto-discovery means a client email is able to automagically find out about what ports and security options to use, based on the mail server URI. It can help simplify the tedious / confusing task of adding own's email account for non-tech savvy users.
Email clients will search for auto-discoverable settings and prefill almost everything when a user enters its email address
There exists autodiscover-email-settings on which provides IMAP/POP/SMTP/LDAP autodiscover capabilities on Microsoft Outlook/Apple Mail, autoconfig capabilities for Thunderbird or kmail and configuration profiles for iOS/Apple Mail.
Cloudflare has written an article about DKIM, DMARC and SPF that we highly recommend you to read to get acquainted with the topic.
Rspamd vs Individual validators
With v12.0.0, Rspamd was integrated into DMS. It can perform validations for DKIM, DMARC and SPF as part of the spam-score-calculation for an email. DMS provides individual alternatives for each validation that can be used instead of deferring to Rspamd:
spam-score-calculation
opendkim
opendmarc
smtpd_recipient_restrictions
In a future release Rspamd will become the default for these validations, with a deprecation notice issued prior to the removal of the above alternatives.
We encourage everyone to prefer Rspamd via ENABLE_RSPAMD=1.
DNS Caches & Propagation
While modern DNS providers are quick, it may take minutes or even hours for new DNS records to become available / propagate.
What is DKIM
DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect forged sender addresses in email (email spoofing), a technique often used in phishing and email spam.
Source
When DKIM is enabled:
DKIM requires a public/private key pair to enable signing (via private key) your outgoing mail, while the receiving end must query DNS to verify (via public key) that the signature is trustworthy.
You'll need to repeat this process if you add any new domains.
You should have:
Creating DKIM Keys
DKIM keys can be generated with good defaults by running:
docker exec -it <CONTAINER NAME> setup config dkim\n
If you need to generate your keys with different settings, check the help output for supported config options and examples:
help
docker exec -it <CONTAINER NAME> setup config dkim help\n
As described by the help output, you may need to use the domain option explicitly when you're using LDAP or Rspamd.
domain
The keypair generated for using with DKIM presently defaults to RSA-2048. This is a good size but you can lower the security to 1024-bit, or increase it to 4096-bit (discouraged as that is excessive).
1024-bit
4096-bit
To generate a key with different size (for RSA 1024-bit) run:
setup config dkim keysize 1024\n
RSA Key Sizes >= 4096 Bit
According to RFC 8301, keys are preferably between 1024 and 2048 bits. Keys of size 4096-bit or larger may not be compatible to all systems your mail is intended for.
You should not need a key length beyond 2048-bit. If 2048-bit does not meet your security needs, you may want to instead consider adopting key rotation or switching from RSA to ECC keys for DKIM.
Required when using LDAP and Rspamd.
setup config dkim will generate DKIM keys for what is assumed as the primary mail domain (derived from the FQDN assigned to DMS, minus any subdomain).
setup config dkim
When the DMS FQDN is mail.example.com or example.com, by default this command will generate DKIM keys for example.com as the primary domain for your users mail accounts (eg: hello@example.com).
The DKIM generation does not have support to query LDAP for additionanl mail domains it should know about. If the primary mail domain is not sufficient, then you must explicitly specify any extra domains via the domain option:
# ENABLE_OPENDKIM=1 (default):\nsetup config dkim domain 'example.com,another-example.com'\n\n# ENABLE_RSPAMD=1 + ENABLE_OPENDKIM=0:\nsetup config dkim domain example.com\nsetup config dkim domain another-example.com\n
OpenDKIM with ACCOUNT_PROVISIONER=FILE
ACCOUNT_PROVISIONER=FILE
When DMS uses this configuration, it will by default also detect mail domains (from accounts added via setup email add), generating additional DKIM keys.
setup email add
DKIM is currently supported by either OpenDKIM or Rspamd:
OpenDKIM is currently enabled by default.
After running setup config dkim, your new DKIM key files (and OpenDKIM config) have been added to /tmp/docker-mailserver/opendkim/.
/tmp/docker-mailserver/opendkim/
Restart required
After restarting DMS, outgoing mail will now be signed with your new DKIM key(s)
Requires opt-in via ENABLE_RSPAMD=1 (and disable the default OpenDKIM: ENABLE_OPENDKIM=0).
ENABLE_OPENDKIM=0
Rspamd provides DKIM support through two separate modules:
If you have multiple domains, you need to:
docker exec -it <CONTAINER NAME> setup config dkim domain <DOMAIN>
dkim_signing.conf
About the Helper Script
The script will persist the keys in /tmp/docker-mailserver/rspamd/dkim/. Hence, if you are already using the default volume mounts, the keys are persisted in a volume. The script also restarts Rspamd directly, so changes take effect without restarting DMS.
/tmp/docker-mailserver/rspamd/dkim/
The script provides you with log messages along the way of creating keys. In case you want to read the complete log, use -v (verbose) or -vv (very verbose).
-v
-vv
In case you have not already provided a default DKIM signing configuration, the script will create one and write it to /etc/rspamd/override.d/dkim_signing.conf. If this file already exists, it will not be overwritten.
/etc/rspamd/override.d/dkim_signing.conf
When you're already using the rspamd/override.d/ directory, the file is created inside your volume and therefore persisted correctly. If you are not using rspamd/override.d/, you will need to persist the file yourself (otherwise it is lost on container restart).
rspamd/override.d/
An example of what a default configuration file for DKIM signing looks like can be found by expanding the example below.
A simple configuration could look like this:
# documentation: https://rspamd.com/doc/modules/dkim_signing.html\n\nenabled = true;\n\nsign_authenticated = true;\nsign_local = true;\n\nuse_domain = \"header\";\nuse_redis = false; # don't change unless Redis also provides the DKIM keys\nuse_esld = true;\ncheck_pubkey = true; # you want to use this in the beginning\n\nselector = \"mail\";\n# The path location is searched for a DKIM key with these variables:\n# - `$domain` is sourced from the MIME mail message `From` header\n# - `$selector` is configured for `mail` (as a default fallback)\npath = \"/tmp/docker-mailserver/dkim/keys/$domain/$selector.private\";\n\n# domain specific configurations can be provided below:\ndomain {\n example.com {\n path = \"/tmp/docker-mailserver/rspamd/dkim/mail.private\";\n selector = \"mail\";\n }\n}\n
As shown next:
domain { ... }
example.org
selectors [ ... ]
# ...\n\ndomain {\n example.com {\n path = /tmp/docker-mailserver/rspamd/example.com/ed25519.private\";\n selector = \"dkim-ed25519\";\n }\n example.org {\n selectors [\n {\n path = \"/tmp/docker-mailserver/rspamd/dkim/example.org/rsa.private\";\n selector = \"dkim-rsa\";\n },\n {\n path = \"/tmp/docker-mailserver/rspamd/dkim/example.org/ed25519.private\";\n selector = \"dkim-ed25519\";\n }\n ]\n }\n}\n
This modern elliptic curve is supported by Rspamd, but support by third-parties for verifying Ed25519 DKIM signatures is unreliable.
If you sign your mail with this key type, you should include RSA as a fallback, like shown in the above example.
When check_pubkey = true; is set, Rspamd will query the DNS record for each DKIM selector, verifying each public key matches the private key configured.
check_pubkey = true;
If there is a mismatch, a warning will be emitted to the Rspamd log /var/log/mail/rspamd.log.
/var/log/mail/rspamd.log
When mail signed with your DKIM key is sent from your mail server, the receiver needs to check a DNS TXT record to verify the DKIM signature is trustworthy.
TXT
Configuring DNS - DKIM record
When you generated your key in the previous step, the DNS data was saved into a file <selector>.txt (default: mail.txt). Use this content to update your DNS via Web Interface or directly edit your DNS Zone file:
<selector>.txt
mail.txt
Create a new record:
<selector>._domainkey
mail._domainkey
( ... )
When using Rspamd, the helper script has already provided you with the contents (the \"Data\" field) of the DNS record you need to create - you can just copy-paste this text.
<selector>.txt is already formatted as a snippet for adding to your DNS Zone file.
Just copy/paste the file contents into your existing DNS zone. The TXT value has been split into separate strings every 255 characters for compatibility.
This file was generated for use within a DNS zone file. The file name uses the DKIM selector it was generated with (default DKIM selector is mail, which creates mail.txt_).
mail
For your DNS setup, DKIM support needs to create a TXT record to store the public key for mail clients to use. TXT records with values that are longer than 255 characters need to be split into multiple parts. This is why the generated <selector>.txt file (containing your public key for use with DKIM) has multiple value parts wrapped within double-quotes between ( and ).
(
)
A DNS web-interface may handle this separation internally instead, and could expect the value provided all as a single line instead of split. When that is required, you'll need to manually format the value as described below.
Your generated DNS record file (<selector>.txt) should look similar to this:
mail._domainkey IN TXT ( \"v=DKIM1; k=rsa; \"\n\"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqQMMqhb1S52Rg7VFS3EC6JQIMxNDdiBmOKZvY5fiVtD3Z+yd9ZV+V8e4IARVoMXWcJWSR6xkloitzfrRtJRwOYvmrcgugOalkmM0V4Gy/2aXeamuiBuUc4esDQEI3egmtAsHcVY1XCoYfs+9VqoHEq3vdr3UQ8zP/l+FP5UfcaJFCK/ZllqcO2P1GjIDVSHLdPpRHbMP/tU1a9mNZ\"\n\"5QMZBJ/JuJK/s+2bp8gpxKn8rh1akSQjlynlV9NI+7J3CC7CUf3bGvoXIrb37C/lpJehS39KNtcGdaRufKauSfqx/7SxA0zyZC+r13f7ASbMaQFzm+/RRusTqozY/p/MsWx8QIDAQAB\"\n) ;\n
Take the content between ( ... ), and combine all the quote wrapped content and remove the double-quotes including the white-space between them. That is your TXT record value, the above example would become this:
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqQMMqhb1S52Rg7VFS3EC6JQIMxNDdiBmOKZvY5fiVtD3Z+yd9ZV+V8e4IARVoMXWcJWSR6xkloitzfrRtJRwOYvmrcgugOalkmM0V4Gy/2aXeamuiBuUc4esDQEI3egmtAsHcVY1XCoYfs+9VqoHEq3vdr3UQ8zP/l+FP5UfcaJFCK/ZllqcO2P1GjIDVSHLdPpRHbMP/tU1a9mNZ5QMZBJ/JuJK/s+2bp8gpxKn8rh1akSQjlynlV9NI+7J3CC7CUf3bGvoXIrb37C/lpJehS39KNtcGdaRufKauSfqx/7SxA0zyZC+r13f7ASbMaQFzm+/RRusTqozY/p/MsWx8QIDAQAB\n
To test that your new DKIM record is correct, query it with the dig command. The TXT value response should be a single line split into multiple parts wrapped in double-quotes:
dig
$ dig +short TXT mail._domainkey.example.com\n\"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqQMMqhb1S52Rg7VFS3EC6JQIMxNDdiBmOKZvY5fiVtD3Z+yd9ZV+V8e4IARVoMXWcJWSR6xkloitzfrRtJRwOYvmrcgugOalkmM0V4Gy/2aXeamuiBuUc4esDQEI3egmtAsHcVY1XCoYfs+9VqoHEq3vdr3UQ8zP/l+FP5UfcaJFCK/ZllqcO2P1GjIDVSHLdPpRHbMP/tU1a9mNZ5QMZBJ/JuJK/s+2bp8gpxKn8rh1akSQjlynlV9NI+7J3CC7CUf3bGvoXIrb37C/lpJehS39\" \"KNtcGdaRufKauSfqx/7SxA0zyZC+r13f7ASbMaQFzm+/RRusTqozY/p/MsWx8QIDAQAB\"\n
MxToolbox has a DKIM Verifier that you can use to check your DKIM DNS record(s).
When using Rspamd, we recommend you turn on check_pubkey = true; in dkim_signing.conf. Rspamd will then check whether your private key matches your public key, and you can check possible mismatches by looking at /var/log/mail/rspamd.log.
With DMS, DMARC is pre-configured out of the box. You may disable extra and excessive DMARC checks when using Rspamd via ENABLE_OPENDMARC=0.
ENABLE_OPENDMARC=0
The only thing you need to do in order to enable DMARC on a \"DNS-level\" is to add new TXT. In contrast to DKIM, DMARC DNS entries do not require any keys, but merely setting the configuration values. You can either handcraft the entry by yourself or use one of available generators (like this one).
Typically something like this should be good to start with:
_dmarc.example.com. IN TXT \"v=DMARC1; p=none; sp=none; fo=0; adkim=r; aspf=r; pct=100; rf=afrf; ri=86400; rua=mailto:dmarc.report@example.com; ruf=mailto:dmarc.report@example.com\"\n
Or a bit more strict policies (mind p=quarantine and sp=quarantine):
p=quarantine
sp=quarantine
_dmarc.example.com. IN TXT \"v=DMARC1; p=quarantine; sp=quarantine; fo=0; adkim=r; aspf=r; pct=100; rf=afrf; ri=86400; rua=mailto:dmarc.report@example.com; ruf=mailto:dmarc.report@example.com\"\n
The DMARC status may not be displayed instantly due to delays in DNS (caches). Dmarcian has a few tools you can use to verify your DNS records.
What is SPF
Sender Policy Framework (SPF) is a simple email-validation system designed to detect email spoofing by providing a mechanism to allow receiving mail exchangers to check that incoming mail from a domain comes from a host authorized by that domain's administrators.
Disabling policyd-spf?
As of now, policyd-spf cannot be disabled. This is WIP.
To add a SPF record in your DNS, insert the following line in your DNS zone:
example.com. IN TXT \"v=spf1 mx ~all\"\n
This enables the Softfail mode for SPF. You could first add this SPF record with a very low TTL. SoftFail is a good setting for getting started and testing, as it lets all email through, with spams tagged as such in the mailbox.
After verification, you might want to change your SPF record to v=spf1 mx -all so as to enforce the HardFail policy. See http://www.open-spf.org/SPF_Record_Syntax for more details about SPF policies.
v=spf1 mx -all
In any case, increment the SPF record's TTL to its final value.
For whitelisting an IP Address from the SPF test, you can create a config file (see policyd-spf.conf) and mount that file into /etc/postfix-policyd-spf-python/policyd-spf.conf.
policyd-spf.conf
/etc/postfix-policyd-spf-python/policyd-spf.conf
Example: Create and edit a policyd-spf.conf file at docker-data/dms/config/postfix-policyd-spf.conf:
docker-data/dms/config/postfix-policyd-spf.conf
debugLevel = 1\n#0(only errors)-4(complete data received)\n\nskip_addresses = 127.0.0.0/8,::ffff:127.0.0.0/104,::1\n\n# Preferably use IP-Addresses for whitelist lookups:\nWhitelist = 192.168.0.0/31,192.168.1.0/30\n# Domain_Whitelist = mx1.not-example.com,mx2.not-example.com\n
Then add this line to compose.yaml:
volumes:\n - ./docker-data/dms/config/postfix-policyd-spf.conf:/etc/postfix-policyd-spf-python/policyd-spf.conf\n
MTA-STS is an optional mechanism for a domain to signal support for STARTTLS.
Enable this feature via the ENV setting ENABLE_MTA_STS=1.
ENABLE_MTA_STS=1
If you have configured DANE
Enabling MTA-STS will by default override DANE if both are configured for a domain.
This can be partially addressed by configuring a dane-only policy resolver before the MTA-STS entry in smtp_tls_policy_maps. See the postfix-mta-sts-resolver documentation for further details.
smtp_tls_policy_maps
postfix-mta-sts-resolver
While this feature in DMS supports ensuring STARTTLS is used when mail is sent to another mail server, you may setup similar for mail servers sending mail to DMS.
This requires configuring your DNS and hosting the MTA-STS policy file via a webserver. A good introduction can be found on dmarcian.com.
What is Fail2Ban (F2B)?
Fail2ban is an intrusion prevention software framework. Written in the Python programming language, it is designed to prevent against brute-force attacks. It is able to run on POSIX systems that have an interface to a packet-control system or firewall installed locally, such as [NFTables] or TCP Wrapper.
DMS must be launched with the NET_ADMIN capability in order to be able to install the NFTables rules that actually ban IP addresses. Thus, either include --cap-add=NET_ADMIN in the docker run command, or the equivalent in the compose.yaml:
NET_ADMIN
--cap-add=NET_ADMIN
Running Fail2Ban on Older Kernels
DMS configures F2B to use NFTables, not IPTables (legacy). We have observed that older systems, for example NAS systems, do not support the modern NFTables rules. You will need to configure F2B to use legacy IPTables again, for example with the fail2ban-jail.cf, see the section on configuration further down below.
fail2ban-jail.cf
DMS will automatically ban IP addresses of hosts that have generated 6 failed attempts over the course of the last week. The bans themselves last for one week. The Postfix jail is configured to use mode = extra in DMS.
mode = extra
What is docker-data/dms/config/?
This following configuration files inside the docker-data/dms/config/ volume will be copied inside the container during startup
/etc/fail2ban/jail.d/user-jail.local
fail2ban-fail2ban.cf
/etc/fail2ban/fail2ban.local
When just running
setup fail2ban\n
the script will show all banned IP addresses.
To get a more detailed status view, run
status
setup fail2ban status\n
You can manage F2B with the setup script. The usage looks like this:
docker exec <CONTAINER NAME> setup fail2ban [<ban|unban> <IP>]\n
docker exec <CONTAINER NAME> setup fail2ban log\n
RootlessKit is the fakeroot implementation for supporting rootless mode in Docker and Podman. By default, RootlessKit uses the builtin port forwarding driver, which does not propagate source IP addresses.
RootlessKit
builtin
It is necessary for F2B to have access to the real source IP addresses in order to correctly identify clients. This is achieved by changing the port forwarding driver to slirp4netns, which is slower than the builtin driver but does preserve the real source IPs.
For rootless mode in Docker, create ~/.config/systemd/user/docker.service.d/override.conf with the following content:
~/.config/systemd/user/docker.service.d/override.conf
Danger
This changes the port driver for all rootless containers managed by Docker. Per container configuration is not supported, if you need that consider Podman instead.
[Service]\nEnvironment=\"DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=slirp4netns\"\n
And then restart the daemon:
$ systemctl --user daemon-reload\n$ systemctl --user restart docker\n
Rootless Podman requires adding the value slirp4netns:port_handler=slirp4netns to the --network CLI option, or network_mode setting in your compose.yaml:
services:\n mailserver:\n network_mode: \"slirp4netns:port_handler=slirp4netns\"\n environment:\n - ENABLE_FAIL2BAN=1\n - NETWORK_INTERFACE=tap0\n ...\n
You must also add the ENV NETWORK_INTERFACE=tap0, because Podman uses a hard-coded interface name for slirp4netns. slirp4netns is not compatible with user-defined networks!
The Mail crypt plugin is used to secure email messages stored in a Dovecot system. Messages are encrypted before written to storage and decrypted after reading. Both operations are transparent to the user.
In case of unauthorized access to the storage backend, the messages will, without access to the decryption keys, be unreadable to the offending party.
There can be a single encryption key for the whole system or each user can have a key of their own. The used cryptographical methods are widely used standards and keys are stored in portable formats, when possible.
Official Dovecot documentation: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/
Create 10-custom.conf and populate it with the following:
10-custom.conf
# Enables mail_crypt for all services (imap, pop3, etc)\nmail_plugins = $mail_plugins mail_crypt\nplugin {\n mail_crypt_global_private_key = </certs/ecprivkey.pem\n mail_crypt_global_public_key = </certs/ecpubkey.pem\n mail_crypt_save_version = 2\n}\n
Shutdown your mailserver (docker compose down)
You then need to generate your global EC key. We named them /certs/ecprivkey.pem and /certs/ecpubkey.pem in step #1.
/certs/ecprivkey.pem
/certs/ecpubkey.pem
The EC key needs to be available in the container. I prefer to mount a /certs directory into the container:
services:\n mailserver:\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n volumes:\n . . .\n - ./certs/:/certs\n . . .\n
While you're editing the compose.yaml, add the configuration file:
services:\n mailserver:\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n volumes:\n . . .\n - ./config/dovecot/10-custom.conf:/etc/dovecot/conf.d/10-custom.conf\n - ./certs/:/certs\n . . .\n
Start the container, monitor the logs for any errors, send yourself a message, and then confirm the file on disk is encrypted:
[root@ip-XXXXXXXXXX ~]# cat -A /mnt/efs-us-west-2/maildata/awesomesite.com/me/cur/1623989305.M6v\ufffdz\ufffd@\ufffd\ufffd m}\ufffd\ufffd,\ufffd\ufffd9\ufffd\ufffd\ufffd\ufffdB*\ufffd247.us-west-2.compute.inE\ufffd\ufffd\\Ck*\ufffd@7795,W=7947:2,\nT\ufffd9\ufffd8t\ufffd6\ufffd\ufffd t\ufffd\ufffd\ufffde\ufffdW\ufffd\ufffdS `\ufffdH\ufffd\ufffdC\ufffd\u06a4 \ufffdyeY\ufffd\ufffdXZ\ufffd\ufffd^\ufffdd\ufffd/\ufffd\ufffd+\ufffdA\n
This should be the minimum required for encryption of the mail while in storage.
Rspamd is a \"fast, free and open-source spam filtering system\". DMS integrates Rspamd like any other service. We provide a very simple but easy to maintain setup of Rspamd.
If you want to have a look at the default configuration files for Rspamd that DMS packs, navigate to target/rspamd/ inside the repository. Please consult the section \"The Default Configuration\" section down below for a written overview.
target/rspamd/
The following environment variables are related to Rspamd:
ENABLE_RSPAMD_REDIS
RSPAMD_CHECK_AUTHENTICATED
RSPAMD_GREYLISTING
RSPAMD_HFILTER
RSPAMD_HFILTER_HOSTNAME_UNKNOWN_SCORE
RSPAMD_LEARN
MOVE_SPAM_TO_JUNK
MARK_SPAM_AS_READ
With these variables, you can enable Rspamd itself, and you can enable / disable certain features related to Rspamd.
Read this section carefully if you want to understand how Rspamd is integrated into DMS and how it works (on a surface level).
Rspamd is integrated as a milter into DMS. When enabled, Postfix's main.cf configuration file includes the parameter rspamd_milter = inet:localhost:11332, which is added to smtpd_milters. As a milter, Rspamd can inspect incoming and outgoing e-mails.
rspamd_milter = inet:localhost:11332
smtpd_milters
Each mail is assigned what Rspamd calls symbols: when an e-mail matches a specific criterion, the mail receives a symbol. Afterwards, Rspamd applies a spam score (as usual with anti-spam software) to the e-mail.
Rspamd then adds (a few) headers to the e-mail based on the spam score. Most important are X-Spamd-Result, which contains an overview of which symbols were applied. It could look like this:
X-Spamd-Result
X-Spamd-Result default: False [-2.80 / 11.00]; R_SPF_NA(1.50)[no SPF record]; R_DKIM_ALLOW(-1.00)[example.com:s=dtag1]; DWL_DNSWL_LOW(-1.00)[example.com:dkim]; RWL_AMI_LASTHOP(-1.00)[192.0.2.42:from]; DMARC_POLICY_ALLOW(-1.00)[example.com,none]; RWL_MAILSPIKE_EXCELLENT(-0.40)[192.0.2.42:from]; FORGED_SENDER(0.30)[noreply@example.com,some-reply-address@bounce.example.com]; RCVD_IN_DNSWL_LOW(-0.10)[192.0.2.42:from]; MIME_GOOD(-0.10)[multipart/mixed,multipart/related,multipart/alternative,text/plain]; MIME_TRACE(0.00)[0:+,1:+,2:+,3:+,4:~,5:~,6:~]; RCVD_COUNT_THREE(0.00)[3]; RCPT_COUNT_ONE(0.00)[1]; REPLYTO_DN_EQ_FROM_DN(0.00)[]; ARC_NA(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; RCVD_TLS_LAST(0.00)[]; DKIM_TRACE(0.00)[example.com:+]; HAS_ATTACHMENT(0.00)[]; TO_DN_NONE(0.00)[]; FROM_NEQ_ENVFROM(0.00)[noreply@example.com,some-reply-address@bounce.example.com]; FROM_HAS_DN(0.00)[]; REPLYTO_DOM_NEQ_FROM_DOM(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[receiver@anotherexample.com]; ASN(0.00)[asn:3320, ipnet:192.0.2.0/24, country:DE]; MID_RHS_MATCH_FROM(0.00)[]; MISSING_XM_UA(0.00)[]; HAS_REPLYTO(0.00)[some-reply-address@dms-reply.example.com]\n
And then there is a corresponding X-Rspamd-Action header, which shows the overall result and the action that is taken. In our example, it would be:
X-Rspamd-Action
X-Rspamd-Action no action\n
Since the score is -2.80, nothing will happen and the e-mail is not classified as spam. Our custom actions.conf defines what to do at certain scores:
-2.80
actions.conf
[SPAM]
There is more to spam analysis than meets the eye: we have not covered the Bayes training and filters here, nor have we talked about Sieve rules for e-mails that are marked as spam.
Even the calculation of the score with the individual symbols has been presented to you in a simplified manner. But with the knowledge from above, you're equipped to read on and use Rspamd confidently. Keep on reading to understand the integration even better - you will want to know about your anti-spam software, not only to keep the bad e-mail out, but also to make sure the good e-mail arrive properly!
The proxy worker operates in self-scan mode. This simplifies the setup as we do not require a normal worker. You can easily change this though by overriding the configuration by DMS.
DMS does not set a default password for the controller worker. You may want to do that yourself. In setups where you already have an authentication provider in front of the Rspamd webpage, you may want to set the secure_ip option to \"0.0.0.0/0\" for the controller worker to disable password authentication inside Rspamd completely.
secure_ip
\"0.0.0.0/0\"
When Rspamd is enabled, we implicitly also start an instance of Redis in the container:
Redis uses /etc/redis/redis.conf for configuration:
/etc/redis/redis.conf
ENABLE_RSPAMD_REDIS=0
Rspamd provides a web interface, which contains statistics and data Rspamd collects. The interface is enabled by default and reachable on port 11334.
DMS does not supply custom values for DNS servers to Rspamd. If you need to use custom DNS servers, which could be required when using DNS-based black/whitelists, you need to adjust options.inc yourself.
options.inc
Making DNS Servers Configurable
If you want to see an environment variable (like RSPAMD_DNS_SERVERS) to support custom DNS servers for Rspamd being added to DMS, please raise a feature request issue.
RSPAMD_DNS_SERVERS
While we do not provide values for custom DNS servers by default, we set soft_reject_on_timeout = true; by default. This setting will cause a soft reject if a task (presumably a DNS request) timeout takes place.
soft_reject_on_timeout = true;
This setting is enabled to not allow spam to proceed just because DNS requests did not succeed. It could deny legitimate e-mails to pass though too in case your DNS setup is incorrect or not functioning properly.
You can find the Rspamd logs at /var/log/mail/rspamd.log, and the corresponding logs for Redis, if it is enabled, at /var/log/supervisor/rspamd-redis.log. We recommend inspecting these logs (with docker exec -it <CONTAINER NAME> less /var/log/mail/rspamd.log) in case Rspamd does not work as expected.
/var/log/supervisor/rspamd-redis.log
docker exec -it <CONTAINER NAME> less /var/log/mail/rspamd.log
You can find a list of all Rspamd modules on their website.
DMS disables certain modules (clickhouse, elastic, neural, reputation, spamassassin, url_redirector, metric_exporter) by default. We believe these are not required in a standard setup, and they would otherwise needlessly use system resources.
clickhouse
elastic
neural
reputation
spamassassin
url_redirector
metric_exporter
You can choose to enable ClamAV, and Rspamd will then use it to check for viruses. Just set the environment variable ENABLE_CLAMAV=1.
ENABLE_CLAMAV=1
The RBL module is enabled by default. As a consequence, Rspamd will perform DNS lookups to a variety of blacklists. Whether an RBL or a DNSBL is queried depends on where the domain name was obtained: RBL servers are queried with IP addresses extracted from message headers, DNSBL server are queried with domains and IP addresses extracted from the message body [source].
Rspamd and DNS Block Lists
When the RBL module is enabled, Rspamd will do a variety of DNS requests to (amongst other things) DNSBLs. There are a variety of issues involved when using DNSBLs. Rspamd will try to mitigate some of them by properly evaluating all return codes. This evaluation is a best effort though, so if the DNSBL operators change or add return codes, it may take a while for Rspamd to adjust as well.
If you want to use DNSBLs, try to use your own DNS resolver and make sure it is set up correctly, i.e. it should be a non-public & recursive resolver. Otherwise, you might not be able (see this Spamhaus post) to make use of the block lists.
DMS brings sane default settings for Rspamd. They are located at /etc/rspamd/local.d/ inside the container (or target/rspamd/local.d/ in the repository).
/etc/rspamd/local.d/
target/rspamd/local.d/
If you want to overwrite the default settings and / or provide your own settings, you can place files at docker-data/dms/config/rspamd/override.d/. Files from this directory are copied to /etc/rspamd/override.d/ during startup. These files forcibly override Rspamd and DMS default settings.
docker-data/dms/config/rspamd/override.d/
/etc/rspamd/override.d/
What is the local.d directory and how does it compare to override.d?
local.d
override.d
Clashing Overrides
Note that when also using the custom-commands.conf file, files in override.d may be overwritten in case you adjust them manually and with the help of the file.
custom-commands.conf
DMS provides the ability to do simple adjustments to Rspamd modules with the help of a single file. Just place a file called custom-commands.conf into docker-data/dms/config/rspamd/. If this file is present, DMS will evaluate it. The structure is very simple. Each line in the file looks like this:
docker-data/dms/config/rspamd/
COMMAND ARGUMENT1 ARGUMENT2 ARGUMENT3\n
where COMMAND can be:
COMMAND
disable-module
ARGUMENT1
enable-module
set-option-for-module
ARGUMENT2
ARGUMENT3
set-option-for-controller
set-option-for-proxy
set-common-option
add-line
/etc/rspamd/override.d/<ARGUMENT1>
An Example Is Shown Down Below
File Names & Extensions
For command 1 - 3, we append the .conf suffix to the module name to get the correct file name automatically. For commands 4 - 6, the file name is fixed (you don't even need to provide it). For command 7, you will need to provide the whole file name (including the suffix) yourself!
.conf
You can also have comments (the line starts with #) and blank lines in custom-commands.conf - they are properly handled and not evaluated.
#
Adjusting Modules This Way
These simple commands are meant to give users the ability to easily alter modules and their options. As a consequence, they are not powerful enough to enable multi-line adjustments. If you need to do something more complex, we advise to do that manually!
You want to start using Rspamd? Rspamd is disabled by default, so you need to set the following environment variables:
ENABLE_RSPAMD=1\nENABLE_OPENDKIM=0\nENABLE_OPENDMARC=0\nENABLE_POLICYD_SPF=0\nENABLE_AMAVIS=0\nENABLE_SPAMASSASSIN=0\n
This will enable Rspamd and disable services you don't need when using Rspamd.
Rspamd is running, but you want or need to adjust it? First, create a file named custom-commands.conf under docker-data/dms/config/rspamd (which translates to /tmp/docker-mailserver/rspamd/ inside the container). Then add you changes:
docker-data/dms/config/rspamd
/tmp/docker-mailserver/rspamd/
set-option-for-controller secure_ip \"0.0.0.0/0\"
set-option-for-module classifier-bayes autolearn true
disable-module chartable
Here is what the file looks like in the end:
# See 1.\n# ATTENTION: this disables authentication on the website - make sure you know what you're doing!\nset-option-for-controller secure_ip \"0.0.0.0/0\"\n\n# See 2.\nset-option-for-module classifier-bayes autolearn true\n\n# See 3.\ndisable-module chartable\n
There is a dedicated section for setting up DKIM with Rspamd in our documentation.
This subsection gives information about the integration of Abusix, \"a set of blocklists that work as an additional email security layer for your existing mail environment\". The setup is straight-forward and well documented:
<APIKEY>
We recommend mounting the files directly into the container, as they are rather big and not manageable with the modules script. If mounted to the correct location, Rspamd will automatically pick them up.
While Abusix can be integrated into Postfix, Postscreen and a multitude of other software, we recommend integrating Abusix only into a single piece of software running in your mail server - everything else would be excessive and wasting queries. Moreover, we recommend the integration into suitable filtering software and not Postfix itself, as software like Postscreen or Rspamd can properly evaluate the return codes and other configuration.
There are multiple options to enable SSL (via SSL_TYPE):
After installation, you can test your setup with:
checktls.com
testssl.sh
Exposure of DNS labels through Certificate Transparency
All public Certificate Authorities (CAs) are required to log certificates they issue publicly via Certificate Transparency. This helps to better establish trust.
When using a public CA for certificates used in private networks, be aware that the associated DNS labels in the certificate are logged publicly and easily searchable. These logs are append only, you cannot redact this information.
You could use a wildcard certificate. This avoids accidentally leaking information to the internet, but keep in mind the potential security risks of wildcard certs.
An FQDN (Fully Qualified Domain Name) such as mail.example.com is required for DMS to function correctly, especially for looking up the correct SSL certificate to use.
*.example.com
SSL_TYPE=letsencrypt
/etc/letsencrypt/live/example.com
Setting the hostname correctly
Change mail.example.com below to your own FQDN.
# CLI:\ndocker run --hostname mail.example.com\n
or
# compose.yaml\nservices:\n mailserver:\n hostname: mail.example.com\n
To enable Let's Encrypt for DMS, you have to:
For your DMS container:
/etc/letsencrypt
You don't have to do anything else. Enjoy!
/etc/letsencrypt/live stores provisioned certificates in individual folders named by their FQDN.
/etc/letsencrypt/live
Make sure that the entire folder is mounted to DMS as there are typically symlinks from /etc/letsencrypt/live/mail.example.com to /etc/letsencrypt/archive.
/etc/letsencrypt/live/mail.example.com
/etc/letsencrypt/archive
Add these additions to the mailserver service in your compose.yaml:
services:\n mailserver:\n hostname: mail.example.com\n environment:\n - SSL_TYPE=letsencrypt\n volumes:\n - /etc/letsencrypt:/etc/letsencrypt\n
Certbot provisions certificates to /etc/letsencrypt. Add a volume to store these, so that they can later be accessed by DMS container. You may also want to persist Certbot logs, just in case you need to troubleshoot.
Getting a certificate is this simple! (Referencing: Certbot docker instructions and certonly --standalone mode):
certonly --standalone
# Requires access to port 80 from the internet, adjust your firewall if needed.\ndocker run --rm -it \\\n -v \"${PWD}/docker-data/certbot/certs/:/etc/letsencrypt/\" \\\n -v \"${PWD}/docker-data/certbot/logs/:/var/log/letsencrypt/\" \\\n -p 80:80 \\\n certbot/certbot certonly --standalone -d mail.example.com\n
Add a volume for DMS that maps the local certbot/certs/ folder to the container path /etc/letsencrypt/.
certbot/certs/
/etc/letsencrypt/
services:\n mailserver:\n hostname: mail.example.com\n environment:\n - SSL_TYPE=letsencrypt\n volumes:\n - ./docker-data/certbot/certs/:/etc/letsencrypt\n
The certificate setup is complete, but remember it will expire. Consider automating renewals.
Renewing Certificates
When running the above certonly --standalone snippet again, the existing certificate is renewed if it would expire within 30 days.
Alternatively, Certbot can look at all the certificates it manages, and only renew those nearing their expiry via the renew command:
renew
# This will need access to port 443 from the internet, adjust your firewall if needed.\ndocker run --rm -it \\\n -v \"${PWD}/docker-data/certbot/certs/:/etc/letsencrypt/\" \\\n -v \"${PWD}/docker-data/certbot/logs/:/var/log/letsencrypt/\" \\\n -p 80:80 \\\n -p 443:443 \\\n certbot/certbot renew\n
This process can also be automated via cron or systemd timers.
Using a different ACME CA
Certbot does support alternative certificate providers via the --server option. In most cases you'll want to use the default Let's Encrypt.
--server
certbot-dns-cloudflare
If you are unable get a certificate via the HTTP-01 (port 80) or TLS-ALPN-01 (port 443) challenge types, the DNS-01 challenge can be useful (this challenge can additionally issue wildcard certificates). This guide shows how to use the DNS-01 challenge with Cloudflare as your DNS provider.
HTTP-01
TLS-ALPN-01
DNS-01
Obtain a Cloudflare API token:
Click \"Create Token\", and choose the Edit zone DNS template (Certbot requires the ZONE:DNS:Edit permission).
Edit zone DNS
ZONE:DNS:Edit
Only include the necessary Zone resource configuration
Be sure to configure \"Zone Resources\" section on this page to Include -> Specific zone -> <your zone here>.
Include -> Specific zone -> <your zone here>
This restricts the API token to only this zone (domain) which is an important security measure.
Store the API token you received in a file cloudflare.ini with content:
cloudflare.ini
dns_cloudflare_api_token = YOUR_CLOUDFLARE_TOKEN_HERE\n
chmod 600
chown 0:0
docker-data/certbot/secrets/
Your compose.yaml should include the following:
services:\n mailserver:\n environments:\n # Set SSL certificate type.\n - SSL_TYPE=letsencrypt\n volumes:\n # Mount the cert folder generated by Certbot:\n - ./docker-data/certbot/certs/:/etc/letsencrypt/:ro\n\n certbot-cloudflare:\n image: certbot/dns-cloudflare:latest\n command: certonly --dns-cloudflare --dns-cloudflare-credentials /run/secrets/cloudflare-api-token -d mail.example.com\n volumes:\n - ./docker-data/certbot/certs/:/etc/letsencrypt/\n - ./docker-data/certbot/logs/:/var/log/letsencrypt/\n secrets:\n - cloudflare-api-token\n\n# Docs: https://docs.docker.com/engine/swarm/secrets/#use-secrets-in-compose\n# WARNING: In compose configs without swarm, the long syntax options have no effect,\n# Ensure that you properly `chmod 600` and `chown 0:0` the file on disk. Effectively treated as a bind mount.\nsecrets:\n cloudflare-api-token:\n file: ./docker-data/certbot/secrets/cloudflare.ini\n
Alternative using the docker run command (secrets feature is not available):
secrets
docker run \\\n --volume \"${PWD}/docker-data/certbot/certs/:/etc/letsencrypt/\" \\\n --volume \"${PWD}/docker-data/certbot/logs/:/var/log/letsencrypt/\" \\\n --volume \"${PWD}/docker-data/certbot/secrets/:/tmp/secrets/certbot/\"\n certbot/dns-cloudflare \\\n certonly --dns-cloudflare --dns-cloudflare-credentials /tmp/secrets/certbot/cloudflare.ini -d mail.example.com\n
Run the service to provision a certificate:
docker compose run certbot-cloudflare\n
You should see the following log output:
Saving debug log to /var/log/letsencrypt/letsencrypt. log | Requesting a certificate for mail.example.com\nWaiting 10 seconds for DNS changes to propagate\nSuccessfully received certificate.\nCertificate is saved at: /etc/letsencrypt/live/mail.example.com/fullchain.pem\nKey is saved at: /etc/letsencrypt/live/mail.example.com/privkey.pem\nThis certificate expires on YYYY-MM-DD.\nThese files will be updated when the certificate renews.\nNEXT STEPS:\n- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal instructions.\n
After completing the steps above, your certificate should be ready to use.
We've only demonstrated how to provision a certificate, but it will expire in 90 days and need to be renewed before then.
In the following example, add a new service (certbot-cloudflare-renew) into compose.yaml that will handle certificate renewals:
certbot-cloudflare-renew
services:\n certbot-cloudflare-renew:\n image: certbot/dns-cloudflare:latest\n command: renew --dns-cloudflare --dns-cloudflare-credentials /run/secrets/cloudflare-api-token\n volumes:\n - ./docker-data/certbot/certs/:/etc/letsencrtypt/\n - ./docker-data/certbot/logs/:/var/log/letsencrypt/\n secrets:\n - cloudflare-api-token\n
You can manually run this service to renew the cert within 90 days:
docker compose run certbot-cloudflare-renew\n
You should see the following output (The following log was generated with --dry-run options)
--dry-run
Saving debug log to /var/log/letsencrypt/letsencrypt.log\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nProcessing /etc/letsencrypt/renewal/mail.example.com.conf\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nAccount registered.\nSimulating renewal of an existing certificate for mail.example.com\nWaiting 10 seconds for DNS changes to propagate\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nCongratulations, all simulated renewals succeeded:\n /etc/letsencrypt/live/mail.example.com/fullchain.pem (success)\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n
It is recommended to automate this renewal via a task scheduler like a systemd timer or in crontab (crontab example: Checks every day if the certificate should be renewed)
crontab
0 0 * * * docker compose -f PATH_TO_YOUR_DOCKER_COMPOSE_YML up certbot-cloudflare-renew\n
nginx-proxy
acme-companion
If you are running a web server already, port 80 will be in use which Certbot requires. You could use the Certbot --webroot feature, but it is more common to leverage a reverse proxy that manages the provisioning and renewal of certificates for your services automatically.
--webroot
In the following example, we show how DMS can be run alongside the docker containers nginx-proxy and acme-companion (Referencing: acme-companion documentation):
Start the reverse proxy (nginx-proxy):
docker run --detach \\\n --name nginx-proxy \\\n --restart always \\\n --publish 80:80 \\\n --publish 443:443 \\\n --volume \"${PWD}/docker-data/nginx-proxy/html/:/usr/share/nginx/html/\" \\\n --volume \"${PWD}/docker-data/nginx-proxy/vhost.d/:/etc/nginx/vhost.d/\" \\\n --volume \"${PWD}/docker-data/acme-companion/certs/:/etc/nginx/certs/:ro\" \\\n --volume '/var/run/docker.sock:/tmp/docker.sock:ro' \\\n nginxproxy/nginx-proxy\n
Then start the certificate provisioner (acme-companion), which will provide certificates to nginx-proxy:
# Inherit `nginx-proxy` volumes via `--volumes-from`, but make `certs/` writeable:\ndocker run --detach \\\n --name nginx-proxy-acme \\\n --restart always \\\n --volumes-from nginx-proxy \\\n --volume \"${PWD}/docker-data/acme-companion/certs/:/etc/nginx/certs/:rw\" \\\n --volume \"${PWD}/docker-data/acme-companion/acme-state/:/etc/acme.sh/\" \\\n --volume '/var/run/docker.sock:/var/run/docker.sock:ro' \\\n --env 'DEFAULT_EMAIL=admin@example.com' \\\n nginxproxy/acme-companion\n
Start the rest of your web server containers as usual.
Start a dummy container to provision certificates for your FQDN (eg: mail.example.com). acme-companion will detect the container and generate a Let's Encrypt certificate for your domain, which can be used by DMS:
docker run --detach \\\n --name webmail \\\n --env 'VIRTUAL_HOST=mail.example.com' \\\n --env 'LETSENCRYPT_HOST=mail.example.com' \\\n --env 'LETSENCRYPT_EMAIL=admin@example.com' \\\n nginx\n
You may want to add --env LETSENCRYPT_TEST=true to the above while testing, to avoid the Let's Encrypt certificate generation rate limits.
--env LETSENCRYPT_TEST=true
Make sure your mount path to the letsencrypt certificates directory is correct. Edit your compose.yaml for the mailserver service to have volumes added like below:
volumes:\n - ./docker-data/dms/mail-data/:/var/mail/\n - ./docker-data/dms/mail-state/:/var/mail-state/\n - ./docker-data/dms/config/:/tmp/docker-mailserver/\n - ./docker-data/acme-companion/certs/:/etc/letsencrypt/live/:ro\n
Then from the compose.yaml project directory, run: docker compose up -d mailserver.
docker compose up -d mailserver
The following example is the basic setup you need for using nginx-proxy and acme-companion with DMS (Referencing: acme-companion documentation):
You should have an existing compose.yaml with a mailserver service. Below are the modifications to add for integrating with nginx-proxy and acme-companion services:
services:\n # Add the following `environment` and `volumes` to your existing `mailserver` service:\n mailserver:\n environment:\n # SSL_TYPE: Uses the `letsencrypt` method to find mounted certificates.\n # VIRTUAL_HOST: The FQDN that `nginx-proxy` will configure itself to handle for HTTP[S] connections.\n # LETSENCRYPT_HOST: The FQDN for a certificate that `acme-companion` will provision and renew.\n - SSL_TYPE=letsencrypt\n - VIRTUAL_HOST=mail.example.com\n - LETSENCRYPT_HOST=mail.example.com\n volumes:\n - ./docker-data/acme-companion/certs/:/etc/letsencrypt/live/:ro\n\n # If you don't yet have your own `nginx-proxy` and `acme-companion` setup,\n # here is an example you can use:\n reverse-proxy:\n image: nginxproxy/nginx-proxy\n container_name: nginx-proxy\n restart: always\n ports:\n # Port 80: Required for HTTP-01 challenges to `acme-companion`.\n # Port 443: Only required for containers that need access over HTTPS. TLS-ALPN-01 challenge not supported.\n - \"80:80\"\n - \"443:443\"\n volumes:\n # `certs/`: Managed by the `acme-companion` container (_read-only_).\n # `docker.sock`: Required to interact with containers via the Docker API.\n - ./docker-data/nginx-proxy/html/:/usr/share/nginx/html/\n - ./docker-data/nginx-proxy/vhost.d/:/etc/nginx/vhost.d/\n - ./docker-data/acme-companion/certs/:/etc/nginx/certs/:ro\n - /var/run/docker.sock:/tmp/docker.sock:ro\n\n acme-companion:\n image: nginxproxy/acme-companion\n container_name: nginx-proxy-acme\n restart: always\n environment:\n # When `volumes_from: [nginx-proxy]` is not supported,\n # reference the _reverse-proxy_ `container_name` here:\n - NGINX_PROXY_CONTAINER=nginx-proxy\n volumes:\n # `html/`: Write ACME HTTP-01 challenge files that `nginx-proxy` will serve.\n # `vhost.d/`: To enable web access via `nginx-proxy` to HTTP-01 challenge files.\n # `certs/`: To store certificates and private keys.\n # `acme-state/`: To persist config and state for the ACME provisioner (`acme.sh`).\n # `docker.sock`: Required to interact with containers via the Docker API.\n - ./docker-data/nginx-proxy/html/:/usr/share/nginx/html/\n - ./docker-data/nginx-proxy/vhost.d/:/etc/nginx/vhost.d/\n - ./docker-data/acme-companion/certs/:/etc/nginx/certs/:rw\n - ./docker-data/acme-companion/acme-state/:/etc/acme.sh/\n - /var/run/docker.sock:/var/run/docker.sock:ro\n
Optional ENV vars worth knowing about
Per container ENV that acme-companion will detect to override default provisioning settings:
LETSENCRYPT_TEST=true
ACME_CA_URI
LETSENCRYPT_EMAIL
DEFAULT_EMAIL
LETSENCRYPT_KEYSIZE
LETSENCRYPT_RESTART_CONTAINER=true
acme-companion ENV for default settings that apply to all containers using LETSENCRYPT_HOST:
LETSENCRYPT_HOST
CERTS_UPDATE_INTERVAL
DEBUG=1
CA_BUNDLE
https://acme-staging-v02.api.letsencrypt.org/directory
Alternative to required ENV on mailserver service
While you will still need both nginx-proxy and acme-companion containers, you can manage certificates without adding ENV vars to containers. Instead the ENV is moved into a file and uses the acme-companion feature Standalone certificates.
This requires adding another shared volume between nginx-proxy and acme-companion:
services:\n reverse-proxy:\n volumes:\n - ./docker-data/nginx-proxy/conf.d/:/etc/nginx/conf.d/\n\n acme-companion:\n volumes:\n - ./docker-data/nginx-proxy/conf.d/:/etc/nginx/conf.d/\n - ./docker-data/acme-companion/standalone.sh:/app/letsencrypt_user_data:ro\n
acme-companion mounts a shell script (standalone.sh), which defines variables to customize certificate provisioning:
standalone.sh
# A list IDs for certificates to provision:\nLETSENCRYPT_STANDALONE_CERTS=('mail')\n\n# Each ID inserts itself into the standard `acme-companion` supported container ENV vars below.\n# The LETSENCRYPT_<ID>_HOST var is a list of FQDNs to provision a certificate for as the SAN field:\nLETSENCRYPT_mail_HOST=('mail.example.com')\n\n# Optional variables:\nLETSENCRYPT_mail_TEST=true\nLETSENCRYPT_mail_EMAIL='admin@example.com'\n# RSA-4096 => `4096`, ECDSA-256 => `ec-256`:\nLETSENCRYPT_mail_KEYSIZE=4096\n
Unlike with the equivalent ENV for containers, changes to this file will not be detected automatically. You would need to wait until the next renewal check by acme-companion (every hour by default), restart acme-companion, or manually invoke the service loop:
docker exec nginx-proxy-acme /app/signal_le_service
Version 6.2 and later of the Synology NAS DSM OS now come with an interface to generate and renew letencrypt certificates. Navigation into your DSM control panel and go to Security, then click on the tab Certificate to generate and manage letsencrypt certificates.
Amongst other things, you can use these to secure your mail server. DSM locates the generated certificates in a folder below /usr/syno/etc/certificate/_archive/.
/usr/syno/etc/certificate/_archive/
Navigate to that folder and note the 6 character random folder name of the certificate you'd like to use. Then, add the following to your compose.yaml declaration file:
volumes:\n - /usr/syno/etc/certificate/_archive/<your-folder>/:/tmp/dms/custom-certs/\nenvironment:\n - SSL_TYPE=manual\n - SSL_CERT_PATH=/tmp/dms/custom-certs/fullchain.pem\n - SSL_KEY_PATH=/tmp/dms/custom-certs/privkey.pem\n
DSM-generated letsencrypt certificates get auto-renewed every three months.
For Caddy v2 you can specify the key_type in your server's global settings, which would end up looking something like this if you're using a Caddyfile:
key_type
Caddyfile
{\n debug\n admin localhost:2019\n http_port 80\n https_port 443\n default_sni example.com\n key_type rsa4096\n}\n
If you are instead using a json config for Caddy v2, you can set it in your site's TLS automation policies:
{\n \"apps\": {\n \"http\": {\n \"servers\": {\n \"srv0\": {\n \"listen\": [\n \":443\"\n ],\n \"routes\": [\n {\n \"match\": [\n {\n \"host\": [\n \"mail.example.com\",\n ]\n }\n ],\n \"handle\": [\n {\n \"handler\": \"subroute\",\n \"routes\": [\n {\n \"handle\": [\n {\n \"body\": \"\",\n \"handler\": \"static_response\"\n }\n ]\n }\n ]\n }\n ],\n \"terminal\": true\n },\n ]\n }\n }\n },\n \"tls\": {\n \"automation\": {\n \"policies\": [\n {\n \"subjects\": [\n \"mail.example.com\",\n ],\n \"key_type\": \"rsa2048\",\n \"issuer\": {\n \"email\": \"admin@example.com\",\n \"module\": \"acme\"\n }\n },\n {\n \"issuer\": {\n \"email\": \"admin@example.com\",\n \"module\": \"acme\"\n }\n }\n ]\n }\n }\n }\n}\n
The generated certificates can then be mounted:
volumes:\n - ${CADDY_DATA_DIR}/certificates/acme-v02.api.letsencrypt.org-directory/mail.example.com/mail.example.com.crt:/etc/letsencrypt/live/mail.example.com/fullchain.pem\n - ${CADDY_DATA_DIR}/certificates/acme-v02.api.letsencrypt.org-directory/mail.example.com/mail.example.com.key:/etc/letsencrypt/live/mail.example.com/privkey.pem\n
Traefik is an open-source application proxy using the ACME protocol. Traefik can request certificates for domains and subdomains, and it will take care of renewals, challenge negotiations, etc. We strongly recommend to use Traefik's major version 2.
Traefik's storage format is natively supported if the acme.json store is mounted into the container at /etc/letsencrypt/acme.json. The file is also monitored for changes and will trigger a reload of the mail services (Postfix and Dovecot).
/etc/letsencrypt/acme.json
Wildcard certificates are supported. If your FQDN is mail.example.com and your wildcard certificate is *.example.com, add the ENV: SSL_DOMAIN=example.com.
SSL_DOMAIN=example.com
DMS will select it's certificate from acme.json checking these ENV for a matching FQDN (in order of priority):
${SSL_DOMAIN}
${HOSTNAME}
${DOMAINNAME}
This setup only comes with one caveat: The domain has to be configured on another service for Traefik to actually request it from Let's Encrypt, i.e. Traefik will not issue a certificate without a service / router demanding it.
Here is an example setup for docker-compose:
services:\n mailserver:\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n container_name: mailserver\n hostname: mail.example.com\n volumes:\n - ./docker-data/traefik/acme.json:/etc/letsencrypt/acme.json:ro\n environment:\n SSL_TYPE: letsencrypt\n SSL_DOMAIN: mail.example.com\n # for a wildcard certificate, use\n # SSL_DOMAIN: example.com\n\n reverse-proxy:\n image: docker.io/traefik:latest #v2.5\n container_name: docker-traefik\n ports:\n - \"80:80\"\n - \"443:443\"\n command:\n - --providers.docker\n - --entrypoints.http.address=:80\n - --entrypoints.http.http.redirections.entryPoint.to=https\n - --entrypoints.http.http.redirections.entryPoint.scheme=https\n - --entrypoints.https.address=:443\n - --entrypoints.https.http.tls.certResolver=letsencrypt\n - --certificatesresolvers.letsencrypt.acme.email=admin@example.com\n - --certificatesresolvers.letsencrypt.acme.storage=/acme.json\n - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=http\n volumes:\n - ./docker-data/traefik/acme.json:/acme.json\n - /var/run/docker.sock:/var/run/docker.sock:ro\n\n whoami:\n image: docker.io/traefik/whoami:latest\n labels:\n - \"traefik.http.routers.whoami.rule=Host(`mail.example.com`)\"\n
Use self-signed certificates only for testing purposes!
This feature requires you to provide the following files into your docker-data/dms/config/ssl/ directory (internal location: /tmp/docker-mailserver/ssl/):
docker-data/dms/config/ssl/
/tmp/docker-mailserver/ssl/
<FQDN>-key.pem
<FQDN>-cert.pem
demoCA/cacert.pem
Where <FQDN> is the FQDN you've configured for your DMS container.
<FQDN>
Add SSL_TYPE=self-signed to your DMS environment variables. Postfix and Dovecot will be configured to use the provided certificate (.pem files above) during container startup.
SSL_TYPE=self-signed
.pem
One way to generate self-signed certificates is with Smallstep's step CLI. This is exactly what DMS does for creating test certificates.
step
For example with the FQDN mail.example.test, you can generate the required files by running:
mail.example.test
#! /bin/sh\nmkdir -p demoCA\n\nstep certificate create \"Smallstep Root CA\" \"demoCA/cacert.pem\" \"demoCA/cakey.pem\" \\\n --no-password --insecure \\\n --profile root-ca \\\n --not-before \"2021-01-01T00:00:00+00:00\" \\\n --not-after \"2031-01-01T00:00:00+00:00\" \\\n --san \"example.test\" \\\n --san \"mail.example.test\" \\\n --kty RSA --size 2048\n\nstep certificate create \"Smallstep Leaf\" mail.example.test-cert.pem mail.example.test-key.pem \\\n --no-password --insecure \\\n --profile leaf \\\n --ca \"demoCA/cacert.pem\" \\\n --ca-key \"demoCA/cakey.pem\" \\\n --not-before \"2021-01-01T00:00:00+00:00\" \\\n --not-after \"2031-01-01T00:00:00+00:00\" \\\n --san \"example.test\" \\\n --san \"mail.example.test\" \\\n --kty RSA --size 2048\n
If you'd rather not install the CLI tool locally to run the step commands above; you can save the script above to a file such as generate-certs.sh (and make it executable chmod +x generate-certs.sh) in a directory that you want the certs to be placed (eg: docker-data/dms/custom-certs/), then use docker to run that script in a container:
generate-certs.sh
chmod +x generate-certs.sh
docker-data/dms/custom-certs/
# '--user' is to keep ownership of the files written to\n# the local volume to use your systems User and Group ID values.\ndocker run --rm -it \\\n --user \"$(id -u):$(id -g)\" \\\n --volume \"${PWD}/docker-data/dms/custom-certs/:/tmp/step-ca/\" \\\n --workdir \"/tmp/step-ca/\" \\\n --entrypoint \"/tmp/step-ca/generate-certs.sh\" \\\n smallstep/step-ca\n
You can also provide your own certificate files. Add these entries to your compose.yaml:
volumes:\n - ./docker-data/dms/custom-certs/:/tmp/dms/custom-certs/:ro\nenvironment:\n - SSL_TYPE=manual\n # Values should match the file paths inside the container:\n - SSL_CERT_PATH=/tmp/dms/custom-certs/public.crt\n - SSL_KEY_PATH=/tmp/dms/custom-certs/private.key\n
This will mount the path where your certificate files reside locally into the read-only container folder: /tmp/dms/custom-certs.
/tmp/dms/custom-certs
The local and internal paths may be whatever you prefer, so long as both SSL_CERT_PATH and SSL_KEY_PATH point to the correct internal file paths. The certificate files may also be named to your preference, but should be PEM encoded.
SSL_ALT_CERT_PATH and SSL_ALT_KEY_PATH are additional ENV vars to support a 2nd certificate as a fallback. Commonly known as hybrid or dual certificate support. This is useful for using a modern ECDSA as your primary certificate, and RSA as your fallback for older connections. They work in the same manner as the non-ALT versions.
ALT
You may have to restart DMS once the certificates change.
From your host:
docker exec mailserver openssl s_client \\\n -connect 0.0.0.0:25 \\\n -starttls smtp \\\n -CApath /etc/ssl/certs/\n
Or:
docker exec mailserver openssl s_client \\\n -connect 0.0.0.0:143 \\\n -starttls imap \\\n -CApath /etc/ssl/certs/\n
And you should see the certificate chain, the server certificate and: Verify return code: 0 (ok)
Verify return code: 0 (ok)
In addition, to verify certificate dates:
docker exec mailserver openssl s_client \\\n -connect 0.0.0.0:25 \\\n -starttls smtp \\\n -CApath /etc/ssl/certs/ \\\n 2>/dev/null | openssl x509 -noout -dates\n
Not recommended for purposes other than testing.
Add this to docker-data/dms/config/dovecot.cf:
ssl = yes\ndisable_plaintext_auth=no\n
These options in conjunction mean:
If you have another source for SSL/TLS certificates you can import them into the server via an external script. The external script can be found here: external certificate import script.
This is a community contributed script, and in most cases you will have better support via our Change Detection service (automatic for SSL_TYPE of manual and letsencrypt) - Unless you're using LDAP which disables the service.
Script Compatibility
/etc/dms/tls/cert
/etc/dms/tls/key
fullchain.key
privkey.pem
The steps to follow are these:
./docker-data/dms/custom-certs/
/tmp/ssl/
chmod +x tomav-renew-certs.sh
docker exec mailserver /tmp/docker-mailserver/tomav-renew-certs.sh
If an error occurs the script will inform you. If not you will see both postfix and dovecot restart.
After the certificates have been loaded you can check the certificate:
openssl s_client \\\n -servername mail.example.com \\\n -connect 192.168.0.72:465 \\\n 2>/dev/null | openssl x509\n\n# or\n\nopenssl s_client \\\n -servername mail.example.com \\\n -connect mail.example.com:465 \\\n 2>/dev/null | openssl x509\n
Or you can check how long the new certificate is valid with commands like:
export SITE_URL=\"mail.example.com\"\nexport SITE_IP_URL=\"192.168.0.72\" # can also use `mail.example.com`\nexport SITE_SSL_PORT=\"993\" # imap port dovecot\n\n##works: check if certificate will expire in two weeks\n#2 weeks is 1209600 seconds\n#3 weeks is 1814400\n#12 weeks is 7257600\n#15 weeks is 9072000\n\ncertcheck_2weeks=`openssl s_client -connect ${SITE_IP_URL}:${SITE_SSL_PORT} \\\n -servername ${SITE_URL} 2> /dev/null | openssl x509 -noout -checkend 1209600`\n\n####################################\n#notes: output could be either:\n#Certificate will not expire\n#Certificate will expire\n####################\n
What does the script that imports the certificates do:
/tmp/ssl
You can of course run the script by cron once a week or something. In that way you could automate cert renewal. If you do so it is probably wise to run an automated check on certificate expiry as well. Such a check could look something like this:
# This script is run inside docker-mailserver via 'docker exec ...', using the 'mail' command to send alerts.\n## code below will alert if certificate expires in less than two weeks\n## please adjust variables!\n## make sure the 'mail -s' command works! Test!\n\nexport SITE_URL=\"mail.example.com\"\nexport SITE_IP_URL=\"192.168.2.72\" # can also use `mail.example.com`\nexport SITE_SSL_PORT=\"993\" # imap port dovecot\n# Below can be from a different domain; like your personal email, not handled by this docker-mailserver:\nexport ALERT_EMAIL_ADDR=\"external-account@gmail.com\"\n\ncertcheck_2weeks=`openssl s_client -connect ${SITE_IP_URL}:${SITE_SSL_PORT} \\\n -servername ${SITE_URL} 2> /dev/null | openssl x509 -noout -checkend 1209600`\n\n####################################\n#notes: output can be\n#Certificate will not expire\n#Certificate will expire\n####################\n\n#echo \"certcheck 2 weeks gives $certcheck_2weeks\"\n\n##automated check you might run by cron or something\n## does the certificate expire within two weeks?\n\nif [ \"$certcheck_2weeks\" = \"Certificate will not expire\" ]; then\n echo \"all is well, certwatch 2 weeks says $certcheck_2weeks\"\n else\n echo \"Cert seems to be expiring pretty soon, within two weeks: $certcheck_2weeks\"\n echo \"we will send an alert email and log as well\"\n logger Certwatch: cert $SITE_URL will expire in two weeks\n echo \"Certwatch: cert $SITE_URL will expire in two weeks\" | mail -s \"cert $SITE_URL expires in two weeks \" $ALERT_EMAIL_ADDR\nfi\n
By default DMS uses ffdhe4096 from IETF RFC 7919. These are standardized pre-defined DH groups and the only available DH groups for TLS 1.3. It is discouraged to generate your own DH parameters as it is often less secure.
ffdhe4096
Despite this, if you must use non-standard DH parameters or you would like to swap ffdhe4096 for a different group (eg ffdhe2048); Add your own PEM encoded DH params file via a volume to /tmp/docker-mailserver/dhparams.pem. This will replace DH params for both Dovecot and Postfix services during container startup.
ffdhe2048
/tmp/docker-mailserver/dhparams.pem
Prefer ports with Implicit TLS ports, they're more secure than ports using Explicit TLS, and if you use a Reverse Proxy should be less hassle.
STARTTLS
There is a common misconception of this port due to it's history detailed by various communities and blogs articles on the topic (including by popular mail relay services).
Port 465 was briefly assigned the role of SMTPS in 1997 as an secure alternative to Port 25 between MTA exchanges. Then RFC 2487 (STARTTLS) while still in a draft status in late 1998 had IANA revoke the SMTPS assignment. The draft history was modified to exclude all mention of port 465 and SMTPS.
In 2018 RFC 8314 was published which revives Port 465 as an Implicit TLS alternative to Port 587 for mail submission. It details very clearly that gaining adoption of 465 as the preferred port will take time. IANA reassigned port 465 as the submissions service. Any unofficial usage as SMTPS is legacy and has been for over two decades.
submissions
Understand that port 587 is more broadly supported due to this history and that lots of software in that time has been built or configured with that port in mind. STARTTLS is known to have various CVEs discovered even in recent years, do not be misled by any advice implying it should be preferred over implicit TLS. Trust in more official sources, such as the config Postfix has which acknowledges the submissions port (465).
flowchart LR\n subgraph your-server [\"Your Server\"]\n in_25(25) --> server\n in_465(465) --> server\n server((\"docker-mailserver<br/>hello@world.com\"))\n server --- out_25(25)\n server --- out_465(465)\n end\n\n third-party(\"Third-party<br/>(sending you email)\") ---|\"Receive email for<br/>hello@world.com\"| in_25\n\n subgraph clients [\"Clients (MUA)\"]\n mua-client(Thunderbird,<br/>Webmail,<br/>Mutt,<br/>etc)\n mua-service(Backend software<br/>on another server)\n end\n clients ---|\"Send email as<br/>hello@world.com\"| in_465\n\n out_25(25) -->|\"Direct<br/>Delivery\"| tin_25\n out_465(465) --> relay(\"MTA<br/>Relay Server\") --> tin_25(25)\n\n subgraph third-party-server[\"Third-party Server\"]\n third-party-mta(\"MTA<br/>friend@example.com\")\n tin_25(25) --> third-party-mta\n end
Mail arriving at your server will be processed and stored in a mailbox, or sent outbound to another mail server.
When submitting mail (inbound) to be sent (outbound), this involves two separate connections to negotiate and secure. There may be additional intermediary connections which DMS is not involved in, and thus unable to ensure encrypted transit throughout delivery.
Mail being sent from your server is either being relayed through another MTA (eg: SendGrid), or direct to an MTA responsible for an email address (eg: Gmail).
DMS can function as a relay too, but professional relay services have a trusted reputation (which increases success of delivery).
An MTA with low reputation can affect if mail is treated as junk, or even rejected.
At best, you can only ensure a secure connection between the MTA you directly connect to. The receiving MTA may relay that mail to another MTA (and so forth), each connection may not be enforcing TLS.
Communication on these ports begin in cleartext. Upgrading to an encrypted connection must be requested explicitly through the STARTTLS protocol and successfully negotiated.
Sometimes a reverse-proxy is involved, but is misconfigured or lacks support for the STARTTLS negotiation to succeed.
STARTTLS continues to have vulnerabilities found (Nov 2021 article), as per RFC 8314 (Section 4.1) you are encouraged to prefer Implicit TLS where possible.
Support for STARTTLS is not always implemented correctly, which can lead to leaking credentials (like a client sending too early) prior to a TLS connection being established. Third-parties such as some ISPs have also been known to intercept the STARTTLS exchange, modifying network traffic to prevent establishing a secure connection.
Communication on these ports are always encrypted (enforced, thus implicit), avoiding the potential risks with STARTTLS (Explicit TLS).
While Explicit TLS can provide the same benefit (when STARTTLS is successfully negotiated), Implicit TLS more reliably avoids concerns with connection manipulation and compatibility.
This section should provide any related configuration advice, and probably expand on and link to resources about DANE, DNSSEC, MTA-STS and STARTTLS Policy list, with advice on how to configure/setup these added security layers.
A related section or page on ciphers used may be useful, although less important for users to be concerned about.
Unlike with HTTP where a web browser client communicates directly with the server providing a website, a secure TLS connection as discussed below does not provide the equivalent safety that HTTPS does when the transit of email (receiving or sending) is sent through third-parties, as the secure connection is only between two machines, any additional machines (MTAs) between the MUA and the MDA depends on them establishing secure connections between one another successfully.
Other machines that facilitate a connection that generally aren't taken into account can exist between a client and server, such as those where your connection passes through your ISP provider are capable of compromising a cleartext connection through interception.
cleartext
When refactoring, writing or altering scripts or other files, adhere to these rules:
shellcheck
make lint
.editorconfig
/bin/bash
/bin/sh
Make sure to select edge in the dropdown menu at the top. Navigate to the page you would like to edit and click the edit button in the top right. This allows you to make changes and create a pull-request.
Alternatively you can make the changes locally. For that you'll need to have Docker installed. Navigate into the docs/ directory. Then run:
docs/
docker run --rm -it -p 8000:8000 -v \"${PWD}:/docs\" squidfunk/mkdocs-material\n
This serves the documentation on your local machine on port 8000. Each change will be hot-reloaded onto the page you view, just edit, save and look at the result.
8000
This project is Open Source. That means that you can contribute on enhancements, bug fixing or improving the documentation.
Before opening an issue, read the README carefully, study the docs for your version (maybe latest), the Postfix/Dovecot documentation and your search engine you trust. The issue tracker is not meant to be used for unrelated questions!
README
When opening an issue, please provide details use case to let the community reproduce your problem. Please start DMS with the environment variable LOG_LEVEL set to debug or trace and paste the output into the issue.
Use the issue templates to provide the necessary information. Issues which do not use these templates are not worked on and closed.
By raising issues, I agree to these terms and I understand, that the rules set for the issue tracker will help both maintainers as well as everyone to find a solution.
Maintainers take the time to improve on this project and help by solving issues together. It is therefore expected from others to make an effort and comply with the rules.
Thank you for participating in this project and reporting a bug. Docker Mail Server (DMS) is a community-driven project, and each contribution counts!
Maintainers and moderators are volunteers. We greatly appreciate reports that take the time to provide detailed information via the template, enabling us to help you in the best and quickest way. Ignoring the template provided may seem easier, but discourages receiving any support (via assignment of the label meta/no template - no support).
meta/no template - no support
Markdown formatting can be used in almost all text fields (unless stated otherwise in the description).
Be as precise as possible, and if in doubt, it's best to add more information that too few.
When an option is marked with \"not officially supported\" / \"unsupported\", then support is dependent on availability from specific maintainers.
Motivation
You want to add a feature? Feel free to start creating an issue explaining what you want to do and how you're thinking doing it. Other users may have the same need and collaboration may lead to better results.
The development workflow is the following:
git clone --recurse-submodules ...
git submodule update --init --recursive
Pull requests are automatically tested against the CI and will be reviewed when tests pass. When your changes are validated, your branch is merged. CI builds the new :edge image immediately and your changes will be includes in the next version release.
Program testing can be used to show the presence of bugs, but never to show their absence!
\u2013 Edsger Wybe Dijkstra
DMS employs a variety of unit and integration tests. All tests and associated configuration is stored in the test/ directory. If you want to change existing functionality or integrate a new feature into DMS, you will probably need to work with our test suite.
test/
Can I use macOS?
We do not support running linting, tests, etc. on macOS at this time. Please use a Linux VM, Debian/Ubuntu is recommended.
We use BATS (Bash Automated Testing System) and additional support libraries. BATS is very similar to Bash, and one can easily and quickly get an understanding of how tests in a single file are run. A test file template provides a minimal working example for newcomers to look at.
The test/ directory contains multiple directories. Among them is the bats/ directory (which is the BATS git submodule) and the helper/ directory. The latter is especially interesting because it contains common support functionality used in almost every test. Actual tests are located in test/tests/.
bats/
helper/
test/tests/
Test suite undergoing refactoring
We are currently in the process of restructuring all of our tests. Tests will be moved into test/tests/parallel/ and new tests should be placed there as well.
test/tests/parallel/
There are many functions that aid in writing tests. We urge you to use them! They will not only ease writing a test but they will also do their best to ensure there are no race conditions or other unwanted side effects. To learn about the functions we provide, you can:
test/helper/
We encourage you to try both of the approaches mentioned above. To make understanding and using the helper functions easy, every function contains detailed documentation comments. Read them carefully!
Tests are split into two categories:
test/tests/serial/
Parallel tests are further partitioned into smaller sets. If your system has the resources to support running more than one of those sets at a time this is perfectly ok (our CI runs tests by distributing the sets across multiple test runners). Care must be taken not to mix running the serial tests while a parallel set is also running; this is handled for you when using make tests.
make tests
To run the test suite, you will need to:
jq
parallel
file
sudo apt-get -y install jq parallel file
We use make to run commands.
make
make build
mailserver-testing:ci
Dockerfile
make clean tests
make clean generate-accounts test/<TEST NAME WITHOUT .bats SUFFIX>
make clean generate-accounts test/<TEST NAME WITHOUT .bats SUFFIX>,<TEST NAME WITHOUT .bats SUFFIX>
,
make clean generate-accounts tests/parallel/setX
X
make clean generate-accounts tests/serial
If your machine is capable, you can increase the amount of tests that are run simultaneously by prepending the make clean all command with BATS_PARALLEL_JOBS=X (i.e. BATS_PARALLEL_JOBS=X make clean all). This wil speed up the test procedure. You can also run all tests in serial by setting BATS_PARALLEL_JOBS=1 this way.
make clean all
BATS_PARALLEL_JOBS=X
BATS_PARALLEL_JOBS=X make clean all
BATS_PARALLEL_JOBS=1
The default value of BATS_PARALLEL_JOBS is 2. This can be increased if your system has the resources spare to support running more jobs at once to complete the test suite sooner.
BATS_PARALLEL_JOBS
Test Output when Running in Parallel
When running tests in parallel (with make clean generate-accounts tests/parallel/setX), BATS will delay outputting the results until completing all test cases within a file.
This likewise delays the reporting of test-case failures. When troubleshooting parallel set tests, you may prefer to run specific tests you're working on serially (as demonstrated in the example below).
When writing tests, ensure that parallel set tests still pass when run in parallel. You need to account for other tests running in parallel that may interfere with your own tests logic.
You may use make run-local-instance to run a version of the image built locally to test and edit your changes in a running DMS instance.
make run-local-instance
In this example, you've made a change to the Rspamd feature support (or adjusted it's tests). First verify no regressions have been introduced by running it's specific test file:
$ make clean generate-accounts test/rspamd\nrspamd.bats\n \u2713 [Rspamd] Postfix's main.cf was adjusted [12]\n \u2713 [Rspamd] normal mail passes fine [44]\n \u2713 [Rspamd] detects and rejects spam [122]\n \u2713 [Rspamd] detects and rejects virus [189]\n
As your feature work progresses your change for Rspamd also affects ClamAV. As your change now spans more than just the Rspamd test file, you could run multiple test files serially:
$ make clean generate-accounts test/rspamd,clamav\nrspamd.bats\n \u2713 [Rspamd] Postfix's main.cf was adjusted [12]\n \u2713 [Rspamd] normal mail passes fine [44]\n \u2713 [Rspamd] detects and rejects spam [122]\n \u2713 [Rspamd] detects and rejects virus [189]\n\nclamav.bats\n \u2713 [ClamAV] log files exist at /var/log/mail directory [68]\n \u2713 [ClamAV] should be identified by Amavis [67]\n \u2713 [ClamAV] freshclam cron is enabled [76]\n \u2713 [ClamAV] env CLAMAV_MESSAGE_SIZE_LIMIT is set correctly [63]\n \u2713 [ClamAV] rejects virus [60]\n
You're almost finished with your change before submitting it as a PR. It's a good idea to run the full parallel set those individual tests belong to (especially if you've modified any tests):
$ make clean generate-accounts tests/parallel/set1\ndefault_relay_host.bats\n \u2713 [Relay] (ENV) 'DEFAULT_RELAY_HOST' should configure 'main.cf:relayhost' [88]\n\nspam_virus/amavis.bats\n \u2713 [Amavis] SpamAssassin integration should be active [1165]\n\nspam_virus/clamav.bats\n \u2713 [ClamAV] log files exist at /var/log/mail directory [73]\n \u2713 [ClamAV] should be identified by Amavis [67]\n \u2713 [ClamAV] freshclam cron is enabled [76]\n...\n
Even better, before opening a PR run the full test suite:
$ make clean tests\n
This example provides you only with a basic example of what a minimal setup could look like. We strongly recommend that you go through the configuration file yourself and adjust everything to your needs. The default compose.yaml can be used for the purpose out-of-the-box, see the Usage chapter.
services:\n mailserver:\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n container_name: mailserver\n # Provide the FQDN of your mail server here (Your DNS MX record should point to this value)\n hostname: mail.example.com\n ports:\n - \"25:25\"\n - \"465:465\"\n - \"587:587\"\n - \"993:993\"\n volumes:\n - ./docker-data/dms/mail-data/:/var/mail/\n - ./docker-data/dms/mail-state/:/var/mail-state/\n - ./docker-data/dms/mail-logs/:/var/log/mail/\n - ./docker-data/dms/config/:/tmp/docker-mailserver/\n - /etc/localtime:/etc/localtime:ro\n environment:\n - ENABLE_RSPAMD=1\n - ENABLE_CLAMAV=1\n - ENABLE_FAIL2BAN=1\n cap_add:\n - NET_ADMIN # For Fail2Ban to work\n restart: always\n
Note There are currently no LDAP maintainers. If you encounter issues, please raise them in the issue tracker, but be aware that the core maintainers team will most likely not be able to help you. We would appreciate and we encourage everyone to actively participate in maintaining LDAP-related code by becoming a maintainer!
services:\n mailserver:\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n container_name: mailserver\n # Provide the FQDN of your mail server here (Your DNS MX record should point to this value)\n hostname: mail.example.com\n ports:\n - \"25:25\"\n - \"465:465\"\n - \"587:587\"\n - \"993:993\"\n volumes:\n - ./docker-data/dms/mail-data/:/var/mail/\n - ./docker-data/dms/mail-state/:/var/mail-state/\n - ./docker-data/dms/mail-logs/:/var/log/mail/\n - ./docker-data/dms/config/:/tmp/docker-mailserver/\n - /etc/localtime:/etc/localtime:ro\n environment:\n - ACCOUNT_PROVISIONER=LDAP\n - LDAP_SERVER_HOST=ldap # your ldap container/IP/ServerName\n - LDAP_SEARCH_BASE=ou=people,dc=localhost,dc=localdomain\n - LDAP_BIND_DN=cn=admin,dc=localhost,dc=localdomain\n - LDAP_BIND_PW=admin\n - LDAP_QUERY_FILTER_USER=(&(mail=%s)(mailEnabled=TRUE))\n - LDAP_QUERY_FILTER_GROUP=(&(mailGroupMember=%s)(mailEnabled=TRUE))\n - LDAP_QUERY_FILTER_ALIAS=(|(&(mailAlias=%s)(objectClass=PostfixBookMailForward))(&(mailAlias=%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE)))\n - LDAP_QUERY_FILTER_DOMAIN=(|(&(mail=*@%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE))(&(mailGroupMember=*@%s)(objectClass=PostfixBookMailAccount)(mailEnabled=TRUE))(&(mailalias=*@%s)(objectClass=PostfixBookMailForward)))\n - DOVECOT_PASS_FILTER=(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))\n - DOVECOT_USER_FILTER=(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%n))\n - ENABLE_SASLAUTHD=1\n - SASLAUTHD_MECHANISMS=ldap\n - SASLAUTHD_LDAP_SERVER=ldap\n - SASLAUTHD_LDAP_BIND_DN=cn=admin,dc=localhost,dc=localdomain\n - SASLAUTHD_LDAP_PASSWORD=admin\n - SASLAUTHD_LDAP_SEARCH_BASE=ou=people,dc=localhost,dc=localdomain\n - SASLAUTHD_LDAP_FILTER=(&(objectClass=PostfixBookMailAccount)(uniqueIdentifier=%U))\n - POSTMASTER_ADDRESS=postmaster@localhost.localdomain\n restart: always\n
This was originally a community contributed guide. Please let us know via a Github Issue if you're having any difficulty following the guide so that we can update it.
This guide is focused on only using SMTP ports (not POP3 and IMAP) with the intent to relay mail received from another service to an external email address (eg: user@gmail.com). It is not intended for mailbox storage of real users.
user@gmail.com
In this setup DMS is not intended to receive email from the outside world, so no anti-spam or anti-virus software is needed, making the service lighter to run.
The setup command used below is to be run inside the container.
Open Relays
Adding the docker network's gateway to the list of trusted hosts (eg: using the network or connected-networks option), can create an open relay. For instance if IPv6 is enabled on the host machine, but not in Docker.
Create the file compose.yaml with a content like this:
services:\n mailserver:\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n container_name: mailserver\n # Provide the FQDN of your mail server here (Your DNS MX record should point to this value)\n hostname: mail.example.com\n ports:\n - \"25:25\"\n - \"587:587\"\n - \"465:465\"\n volumes:\n - ./docker-data/dms/mail-data/:/var/mail/\n - ./docker-data/dms/mail-state/:/var/mail-state/\n - ./docker-data/dms/mail-logs/:/var/log/mail/\n - ./docker-data/dms/config/:/tmp/docker-mailserver/\n - /etc/localtime:/etc/localtime:ro\n environment:\n - ENABLE_FAIL2BAN=1\n # Using letsencrypt for SSL/TLS certificates:\n - SSL_TYPE=letsencrypt\n # Allow sending emails from other docker containers:\n # Beware creating an Open Relay: https://docker-mailserver.github.io/docker-mailserver/latest/config/environment/#permit_docker\n - PERMIT_DOCKER=network\n # You may want to enable this: https://docker-mailserver.github.io/docker-mailserver/latest/config/environment/#spoof_protection\n # See step 6 below, which demonstrates setup with enabled/disabled SPOOF_PROTECTION:\n - SPOOF_PROTECTION=0\n cap_add:\n - NET_ADMIN # For Fail2Ban to work\n restart: always\n
The docs have a detailed page on Environment Variables for reference.
If you have a firewall running, you may need to open ports 25, 587 and 465.
25
587
465
For example, with the firewall ufw, run:
ufw
ufw allow 25\nufw allow 587\nufw allow 465\n
Caution: This may not be sound advice.
Configure your DNS service to use an MX record for the hostname (eg: mail) you configured in the previous step and add the SPF TXT record.
If you manually manage the DNS zone file for the domain
It would look something like this:
$ORIGIN example.com\n@ IN A 10.11.12.13\nmail IN A 10.11.12.13\n\n; mail server for example.com\n@ IN MX 10 mail.example.com.\n\n; Add SPF record\n@ IN TXT \"v=spf1 mx -all\"\n
Then don't forget to change the SOA serial number, and to restart the service.
SOA
Generate DKIM keys for your domain via setup config dkim.
Copy the content of the file docker-data/dms/config/opendkim/keys/example.com/mail.txt and add it to your DNS records as a TXT like SPF was handled above.
docker-data/dms/config/opendkim/keys/example.com/mail.txt
I use bind9 for managing my domains, so I just paste it on example.com.db:
example.com.db
mail._domainkey IN TXT ( \"v=DKIM1; h=sha256; k=rsa; \"\n \"p=MIIBIjANBgkqhkiG9w0BAQEFACAQ8AMIIBCgKCAQEAaH5KuPYPSF3Ppkt466BDMAFGOA4mgqn4oPjZ5BbFlYA9l5jU3bgzRj3l6/Q1n5a9lQs5fNZ7A/HtY0aMvs3nGE4oi+LTejt1jblMhV/OfJyRCunQBIGp0s8G9kIUBzyKJpDayk2+KJSJt/lxL9Iiy0DE5hIv62ZPP6AaTdHBAsJosLFeAzuLFHQ6USyQRojefqFQtgYqWQ2JiZQ3\"\n \"iqq3bD/BVlwKRp5gH6TEYEmx8EBJUuDxrJhkWRUk2VDl1fqhVBy8A9O7Ah+85nMrlOHIFsTaYo9o6+cDJ6t1i6G1gu+bZD0d3/3bqGLPBQV9LyEL1Rona5V7TJBGg099NQkTz1IwIDAQAB\" ) ; ----- DKIM key mail for example.com\n
Get an SSL certificate, we have a guide for you here (Let's Encrypt is a popular service to get free SSL certificates).
Start DMS and check the terminal output for any errors: docker compose up.
Create email accounts and aliases:
With SPOOF_PROTECTION=0
SPOOF_PROTECTION=0
setup email add admin@example.com passwd123\nsetup email add info@example.com passwd123\nsetup alias add admin@example.com external-account@gmail.com\nsetup alias add info@example.com external-account@gmail.com\nsetup email list\nsetup alias list\n
Aliases make sure that any email that comes to these accounts is forwarded to your third-party email address (external-account@gmail.com), where they are retrieved (eg: via third-party web or mobile app), instead of connecting directly to docker-mailserer with POP3 / IMAP.
external-account@gmail.com
docker-mailserer
With SPOOF_PROTECTION=1
setup email add admin.gmail@example.com passwd123\nsetup email add info.gmail@example.com passwd123\nsetup alias add admin@example.com admin.gmail@example.com\nsetup alias add info@example.com info.gmail@example.com\nsetup alias add admin.gmail@example.com external-account@gmail.com\nsetup alias add info.gmail@example.com external-account@gmail.com\nsetup email list\nsetup alias list\n
This extra step is required to avoid the 553 5.7.1 Sender address rejected: not owned by user error (the accounts used for submitting mail to Gmail are admin.gmail@example.com and info.gmail@example.com)
553 5.7.1 Sender address rejected: not owned by user
admin.gmail@example.com
info.gmail@example.com
Send some test emails to these addresses and make other tests. Once everything is working well, stop the container with ctrl+c and start it again as a daemon: docker compose up -d.
ctrl+c
docker compose up -d
This site lists blog entries that write about the project. If you blogged about DMS let us know so we can add it here!
What is Crowdsec?
Crowdsec is an open source software that detects and blocks attackers using log analysis. It has access to a global community-wide IP reputation database.
Crowdsec supports multiple installation methods, however this page will use the docker installation.
In your compose.yaml for the DMS service, add a bind mount volume for /var/log/mail. This is to share the DMS logs to a separate crowdsec container.
/var/log/mail
services:\n mailserver:\n - /docker-data/dms/mail-logs/:/var/log/mail/\n
The crowdsec container should also bind mount the same host path for the DMS logs that was added in the DMS example above.
services:\n image: crowdsecurity/crowdsec\n restart: unless-stopped\n ports:\n - \"8080:8080\"\n - \"6060:6060\"\n volumes:\n - /docker-data/dms/mail-logs/:/var/log/dms:ro\n - ./acquis.d:/etc/crowdsec/acquis.d\n - crowdsec-db:/var/lib/crowdsec/data/\n environment:\n # These collection contains parsers and scenarios for postfix and dovecot\n COLLECTIONS: crowdsecurity/postfix crowdsecurity/dovecot\n TZ: Europe/Paris\nvolumes:\n crowdsec-db:\n
Configure crowdsec to read and parse DMS logs file.
Create the file dms.yml in ./acquis.d/
dms.yml
./acquis.d/
---\nsource: file\nfilenames:\n - /var/log/dms/mail.log\nlabels:\n type: syslog\n
Crowdsec on its own is just a detection software, the remediation is done by components called bouncers. This page does not explain how to install or configure a bouncer. It can be found in crowdsec documentation.
You'll need to retrieve the git submodules prior to building your own Docker image. From within your copy of the git repo run the following to retrieve the submodules and build the Docker image:
git submodule update --init --recursive\ndocker build --tag <YOUR CUSTOM IMAGE NAME> .\n
Or, you can clone and retrieve the submodules in one command:
git clone --recurse-submodules https://github.com/docker-mailserver/docker-mailserver\n
We make use of build features that require a recent version of Docker. v23.0 or newer is advised, but earlier releases may work.
DOCKER_BUILDKIT=1
The Dockerfile includes several build ARG instructions that can be configured:
ARG
DOVECOT_COMMUNITY_REPO
DMS_RELEASE
VCS_REVISION
ENABLE_UPDATE_CHECK=1
opencontainers
LABEL
If you are hiding your container behind a proxy service you might have discovered that the proxied requests from now on contain the proxy IP as the request origin. Whilst this behavior is technical correct it produces certain problems on the containers behind the proxy as they cannot distinguish the real origin of the requests anymore.
To solve this problem on TCP connections we can make use of the proxy protocol. Compared to other workarounds that exist (X-Forwarded-For which only works for HTTP requests or Tproxy that requires you to recompile your kernel) the proxy protocol:
X-Forwarded-For
Tproxy
There is only one condition: both endpoints of the connection MUST be compatible with proxy protocol.
Luckily dovecot and postfix are both Proxy-Protocol ready softwares so it depends only on your used reverse-proxy / loadbalancer.
The configuration depends on the used proxy system. I will provide the configuration examples of traefik v2 using IMAP and SMTP with implicit TLS.
Feel free to add your configuration if you achieved the same goal using different proxy software below:
Truncated configuration of traefik itself:
services:\n reverse-proxy:\n image: docker.io/traefik:latest # v2.5\n container_name: docker-traefik\n restart: always\n command:\n - \"--providers.docker\"\n - \"--providers.docker.exposedbydefault=false\"\n - \"--providers.docker.network=proxy\"\n - \"--entrypoints.web.address=:80\"\n - \"--entryPoints.websecure.address=:443\"\n - \"--entryPoints.smtp.address=:25\"\n - \"--entryPoints.smtp-ssl.address=:465\"\n - \"--entryPoints.imap-ssl.address=:993\"\n - \"--entryPoints.sieve.address=:4190\"\n ports:\n - \"25:25\"\n - \"465:465\"\n - \"993:993\"\n - \"4190:4190\"\n[...]\n
Truncated list of necessary labels on the DMS container:
services:\n mailserver:\n image: ghcr.io/docker-mailserver/docker-mailserver:latest\n container_name: mailserver\n hostname: mail.example.com\n restart: always\n networks:\n - proxy\n labels:\n - \"traefik.enable=true\"\n - \"traefik.tcp.routers.smtp.rule=HostSNI(`*`)\"\n - \"traefik.tcp.routers.smtp.entrypoints=smtp\"\n - \"traefik.tcp.routers.smtp.service=smtp\"\n - \"traefik.tcp.services.smtp.loadbalancer.server.port=25\"\n - \"traefik.tcp.services.smtp.loadbalancer.proxyProtocol.version=1\"\n - \"traefik.tcp.routers.smtp-ssl.rule=HostSNI(`*`)\"\n - \"traefik.tcp.routers.smtp-ssl.entrypoints=smtp-ssl\"\n - \"traefik.tcp.routers.smtp-ssl.tls.passthrough=true\"\n - \"traefik.tcp.routers.smtp-ssl.service=smtp-ssl\"\n - \"traefik.tcp.services.smtp-ssl.loadbalancer.server.port=465\"\n - \"traefik.tcp.services.smtp-ssl.loadbalancer.proxyProtocol.version=1\"\n - \"traefik.tcp.routers.imap-ssl.rule=HostSNI(`*`)\"\n - \"traefik.tcp.routers.imap-ssl.entrypoints=imap-ssl\"\n - \"traefik.tcp.routers.imap-ssl.service=imap-ssl\"\n - \"traefik.tcp.routers.imap-ssl.tls.passthrough=true\"\n - \"traefik.tcp.services.imap-ssl.loadbalancer.server.port=10993\"\n - \"traefik.tcp.services.imap-ssl.loadbalancer.proxyProtocol.version=2\"\n - \"traefik.tcp.routers.sieve.rule=HostSNI(`*`)\"\n - \"traefik.tcp.routers.sieve.entrypoints=sieve\"\n - \"traefik.tcp.routers.sieve.service=sieve\"\n - \"traefik.tcp.services.sieve.loadbalancer.server.port=4190\"\n[...]\n
Keep in mind that it is necessary to use port 10993 here. More information below at dovecot configuration.
10993
The following changes can be achieved completely by adding the content to the appropriate files by using the projects [function to overwrite config files][docs-optionalconfig].
Changes for postfix can be applied by adding the following content to docker-data/dms/config/postfix-main.cf:
postscreen_upstream_proxy_protocol = haproxy\n
and to docker-data/dms/config/postfix-master.cf:
submission/inet/smtpd_upstream_proxy_protocol=haproxy\nsubmissions/inet/smtpd_upstream_proxy_protocol=haproxy\n
Changes for dovecot can be applied by adding the following content to docker-data/dms/config/dovecot.cf:
haproxy_trusted_networks = <your-proxy-ip>, <optional-cidr-notation>\nhaproxy_timeout = 3 secs\nservice imap-login {\n inet_listener imaps {\n haproxy = yes\n ssl = yes\n port = 10993\n }\n}\n
Port 10993 is used here to avoid conflicts with internal systems like postscreen and amavis as they will exchange messages on the default port and obviously have a different origin then compared to the proxy.
postscreen
Dovecot has the ability to let users create their own custom user provisioning and authentication providers in Lua. This allows any data source that can be approached from Lua to be used for authentication, including web servers. It is possible to do more with Dovecot and Lua, but other use cases fall outside of the scope of this documentation page.
Community contributed guide
Dovecot authentication via Lua scripting is not officially supported in DMS. No assistance will be provided should you encounter any issues.
DMS provides the required packages to support this guide. Note that these packages will be removed should they introduce any future maintenance burden.
The example in this guide relies on the current way in which DMS works with Dovecot configuration files. Changes to this to accommodate new authentication methods such as OpenID Connect will likely break this example in the future. This guide is updated on a best-effort base.
Dovecot's Lua support can be used for user provisioning (userdb functionality) and/or password verification (passdb functionality). Consider using other userdb and passdb options before considering Lua, since Lua does require the use of additional (unsupported) program code that might require maintenance when updating DMS.
Each implementation of Lua-based authentication is custom. Therefore it is impossible to write documentation that covers every scenario. Instead, this page describes a single example scenario. If that scenario is followed, you will learn vital aspects that are necessary to kickstart your own Lua development:
This scenario starts with DMS being configured to use LDAP for mailbox identification, user authorization and user authentication. In this scenario, Nextcloud is also a service that uses the same LDAP server for user identification, authorization and authentication.
The goal of this scenario is to have Dovecot not authenticate the user against LDAP, but against Nextcloud using an application password. The idea behind this is that a compromised mailbox password does not compromise the user's account entirely. To make this work, Nextcloud is configured to deny the use of account passwords by clients and to disable account password reset through mail verification.
If the application password is configured correctly, an adversary can only use it to access the user's mailbox on DMS, and CalDAV and CardDAV data on Nextcloud. File access through WebDAV can be disabled for the application password used to access mail. Having CalDAV and CardDAV compromised by the same password is a minor setback. If an adversary gets access to a Nextcloud application password through a device of the user, it is likely that the adversary also gets access to the user's calendars and contact lists anyway (locally or through the same account settings used for mail and CalDAV/CardDAV synchronization). The user's stored files in Nextcloud, the LDAP account password and any other services that rely on it would still be protected. A bonus is that a user is able to revoke and renew the mailbox password in Nextcloud for whatever reason, through a friendly user interface with all the security measures with which the Nextcloud instance is configured (e.g. verification of the current account password).
A drawback of this method is that any (compromised) Nextcloud application password can be used to access the user's mailbox. This introduces a risk that a Nextcloud application password used for something else (e.g. WebDAV file access) is compromised and used to access the user's mailbox. Discussion of that risk and possible mitigations fall outside of the scope of this scenario.
To answer the questions asked earlier for this specific scenario:
While it is possible to extend the authentication methods which Nextcloud can facilitate with Nextcloud apps, there is currently a mismatch between what DMS supports and what Nextcloud applications can provide. This might change in the future. For now, Lua will be used to bridge the gap between DMS and Nextcloud for authentication only (Dovecot passdb), while LDAP will still be used to identify mailboxes and verify authorization (Dovecot userdb).
# All new volumes are marked :ro to configure them as read-only, since their contents are not changed from inside the container\n volumes:\n # Configuration override to disable LDAP authentication\n - ./docker-data/dms/config/dovecot/auth-ldap.conf.ext:/etc/dovecot/conf.d/auth-ldap.conf.ext:ro\n # Configuration addition to enable Lua authentication\n - ./docker-data/dms/config/dovecot/auth-lua-httpbasic.conf:/etc/dovecot/conf.d/auth-lua-httpbasic.conf:ro\n # Directory containing Lua scripts\n - ./docker-data/dms/config/dovecot/lua/:/etc/dovecot/lua/:ro\n
Create a directory for Lua scripts:
mkdir -p ./docker-data/dms/config/dovecot/lua\n
Create configuration file ./docker-data/dms/config/dovecot/auth-ldap.conf.ext for LDAP user provisioning:
./docker-data/dms/config/dovecot/auth-ldap.conf.ext
userdb {\n driver = ldap\n args = /etc/dovecot/dovecot-ldap.conf.ext\n}\n
Create configuration file ./docker-data/dms/config/dovecot/auth-lua-httpbasic.conf for Lua user authentication:
./docker-data/dms/config/dovecot/auth-lua-httpbasic.conf
passdb {\n driver = lua\n args = file=/etc/dovecot/lua/auth-httpbasic.lua blocking=yes\n}\n
That is all for configuring Dovecot.
Create Lua file ./docker-data/dms/config/dovecot/lua/auth-httpbasic.lua with contents:
./docker-data/dms/config/dovecot/lua/auth-httpbasic.lua
local http_url = \"https://nextcloud.example.com/remote.php/dav/\"\nlocal http_method = \"PROPFIND\"\nlocal http_status_ok = 207\nlocal http_status_failure = 401\nlocal http_header_forwarded_for = \"X-Forwarded-For\"\n\npackage.path = package.path .. \";/etc/dovecot/lua/?.lua\"\nlocal base64 = require(\"base64\")\n\nlocal http_client = dovecot.http.client {\n timeout = 1000;\n max_attempts = 1;\n debug = false;\n}\n\nfunction script_init()\n return 0\nend\n\nfunction script_deinit()\nend\n\nfunction auth_passdb_lookup(req)\n local auth_request = http_client:request {\n url = http_url;\n method = http_method;\n }\n auth_request:add_header(\"Authorization\", \"Basic \" .. (base64.encode(req.user .. \":\" .. req.password)))\n auth_request:add_header(http_header_forwarded_for, req.remote_ip)\n local auth_response = auth_request:submit()\n local resp_status = auth_response:status()\n local reason = auth_response:reason()\n\n local returnStatus = dovecot.auth.PASSDB_RESULT_INTERNAL_FAILURE\n local returnDesc = http_method .. \" - \" .. http_url .. \" - \" .. resp_status .. \" \" .. reason\n if resp_status == http_status_ok\n then\n returnStatus = dovecot.auth.PASSDB_RESULT_OK\n returnDesc = \"nopassword=y\"\n elseif resp_status == http_status_failure\n then\n returnStatus = dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH\n returnDesc = \"\"\n end\n return returnStatus, returnDesc\nend\n
Replace the hostname in the URL to the actual hostname of Nextcloud.
Dovecot provides an HTTP client for use in Lua. Aside of that, Lua by itself is pretty barebones. It chooses library compactness over included functionality. You can see that in that a separate library is referenced to add support for Base64 encoding, which is required for HTTP basic access authentication. This library (also a Lua script) is not included. It must be downloaded and stored in the same directory:
cd ./docker-data/dms/config/dovecot/lua\ncurl -JLO https://raw.githubusercontent.com/iskolbin/lbase64/master/base64.lua\n
Only use native (pure Lua) libraries as dependencies if possible, such as base64.lua from the example. This ensures maximum compatibility. Performance is less of an issue since Lua scripts written for Dovecot probably won't be long or complex, and there won't be a lot of data processing by Lua itself.
base64.lua
To see which Lua version is used by Dovecot if you plan to do something that is version dependent, run:
docker exec CONTAINER_NAME strings /usr/lib/dovecot/libdovecot-lua.so|grep '^LUA_'\n
While Dovecot logs the status of authentication attempts for any passdb backend, Dovecot will also log Lua scripting errors and messages sent to Dovecot's Lua API log functions. The combined DMS log (including that of Dovecot) can be viewed using docker logs CONTAINER_NAME. If the log is too noisy (due to other processes in the container also logging to it), docker exec CONTAINER_NAME cat /var/log/mail/mail.log can be used to view the log of Dovecot and Postfix specifically.
docker logs CONTAINER_NAME
docker exec CONTAINER_NAME cat /var/log/mail/mail.log
If working with HTTP in Lua, setting debug = true; when initiating dovecot.http.client will create debug log messages for every HTTP request and response.
debug = true;
dovecot.http.client
Note that Lua runs compiled bytecode, and that scripts will be compiled when they are initially started. Once compiled, the bytecode is cached and changes in the Lua script will not be processed automatically. Dovecot will reload its configuration and clear its cached Lua bytecode when running docker exec CONTAINER_NAME dovecot reload. A (changed) Lua script will be compiled to bytecode the next time it is executed after running the Dovecot reload command.
docker exec CONTAINER_NAME dovecot reload
Advice not extensively tested
This configuration advice is a community contribution which has only been verified as a solution when using network: host, where you have direct access to the host interfaces.
network: host
It may be applicable in other network modes if the container has control of the outbound IPs to bind to. This is not the case with bridge networks that typically bind to a private range network for containers which are bridged to a public interface via Docker.
If your Docker host is running multiple IPv4 and IPv6 IP-addresses, it may be beneficial to bind outgoing SMTP connections to specific IP-address / interface.
reject_unknown_sender
This can be configured by overriding the default Postfix configurations DMS provides. Create postfix-master.cf and postfix-main.cf files for your config volume (docker-data/dms/config).
postfix-master.cf
docker-data/dms/config
In postfix-main.cf you'll have to set the smtp_bind_address and smtp_bind_address6 to the respective IP-address on the server you want to use.
smtp_bind_address
smtp_bind_address6
smtp_bind_address = 198.51.100.42\nsmtp_bind_address6 = 2001:DB8::42\n
Inheriting the bind from main.cf can misconfigure services
One problem when setting smtp_bind_address in main.cf is that it will be inherited by any services in master.cf that extend the smtp transport. One of these is smtp-amavis, which is explicitly configured to listen / connect via loopback (localhost / 127.0.0.1).
smtp
smtp-amavis
127.0.0.1
A postfix-master.cf override can workaround that issue by ensuring smtp-amavis binds to the expected internal IP:
smtp-amavis/unix/smtp_bind_address=127.0.0.1\nsmtp-amavis/unix/smtp_bind_address6=::1\n
A potentially better solution might be to instead explicitly set the smtp_bind_address override on the smtp transport service:
smtp/inet/smtp_bind_address = 198.51.100.42\nsmtp/inet/smtp_bind_address6 = 2001:DB8::42\n
If that avoids the concern with smtp-amavis, you may still need to additionally override for the relay transport as well if you have configured DMS to relay mail.
relay
IP addresses for documentation
IP addresses shown in above examples are placeholders, they are IP addresses reserved for documentation by IANA (RFC-5737 (IPv4) and RFC-3849 (IPv6)). Replace them with the IP addresses you want DMS to send mail through.
A forward-only mail server does not have any local mailboxes. Instead, it has only aliases that forward emails to external email accounts (for example to a Gmail account). You can also send email from the localhost (the computer where DMS is installed), using as sender any of the alias addresses.
The important settings for this setup (on mailserver.env) are these:
PERMIT_DOCKER=host\nENABLE_POP3=\nENABLE_CLAMAV=0\nSMTP_ONLY=1\nENABLE_SPAMASSASSIN=0\nENABLE_FETCHMAIL=0\n
Since there are no local mailboxes, we use SMTP_ONLY=1 to disable dovecot. We disable as well the other services that are related to local mailboxes (POP3, ClamAV, SpamAssassin, etc.)
POP3
ClamAV
SpamAssassin
We can create aliases with ./setup.sh, like this:
./setup.sh alias add <alias-address> <external-email-account>\n
If you want to send emails from outside the mail server you have to authenticate somehow (with a username and password). One way of doing it is described in this discussion. However if there are many user accounts, it is better to use authentication with LDAP. The settings for this on mailserver.env are:
ACCOUNT_PROVISIONER=LDAP\nLDAP_START_TLS=yes\nLDAP_SERVER_HOST=ldap.example.org\nLDAP_SEARCH_BASE=ou=users,dc=example,dc=org\nLDAP_BIND_DN=cn=mailserver,dc=example,dc=org\nLDAP_BIND_PW=pass1234\n\nENABLE_SASLAUTHD=1\nSASLAUTHD_MECHANISMS=ldap\nSASLAUTHD_LDAP_SERVER=ldap.example.org\nSASLAUTHD_LDAP_START_TLS=yes\nSASLAUTHD_LDAP_BIND_DN=cn=mailserver,dc=example,dc=org\nSASLAUTHD_LDAP_PASSWORD=pass1234\nSASLAUTHD_LDAP_SEARCH_BASE=ou=users,dc=example,dc=org\nSASLAUTHD_LDAP_FILTER=(&(uid=%U)(objectClass=inetOrgPerson))\n
My LDAP data structure is very basic, containing only the username, password, and the external email address where to forward emails for this user. An entry looks like this:
add uid=username,ou=users,dc=example,dc=org\nuid: username\nobjectClass: inetOrgPerson\nsn: username\ncn: username\nuserPassword: {SSHA}abcdefghi123456789\nemail: external-account@gmail.com\n
This structure is different from what is expected/assumed from the configuration scripts of DMS, so it doesn't work just by using the LDAP_QUERY_FILTER_... settings. Instead, I had to use a custom configuration (via user-patches.sh). I created the script docker-data/dms/config/user-patches.sh, with content like this:
LDAP_QUERY_FILTER_...
docker-data/dms/config/user-patches.sh
#!/bin/bash\n\nrm -f /etc/postfix/{ldap-groups.cf,ldap-domains.cf}\n\npostconf \\\n \"virtual_mailbox_domains = /etc/postfix/vhost\" \\\n \"virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf texthash:/etc/postfix/virtual\" \\\n \"smtpd_sender_login_maps = ldap:/etc/postfix/ldap-users.cf\"\n\nsed -i /etc/postfix/ldap-users.cf \\\n -e '/query_filter/d' \\\n -e '/result_attribute/d' \\\n -e '/result_format/d'\ncat <<EOF >> /etc/postfix/ldap-users.cf\nquery_filter = (uid=%u)\nresult_attribute = uid\nresult_format = %s@example.org\nEOF\n\nsed -i /etc/postfix/ldap-aliases.cf \\\n -e '/domain/d' \\\n -e '/query_filter/d' \\\n -e '/result_attribute/d'\ncat <<EOF >> /etc/postfix/ldap-aliases.cf\ndomain = example.org\nquery_filter = (uid=%u)\nresult_attribute = mail\nEOF\n\npostfix reload\n
You see that besides query_filter, I had to customize as well result_attribute and result_format.
query_filter
result_attribute
result_format
See also
For more details about using LDAP see: LDAP managed mail server with Postfix and Dovecot for multiple domains
Another solution that serves as a forward-only mail server is this.
INBOX is setup as the private inbox namespace. By default target/dovecot/15-mailboxes.conf configures the special IMAP folders Drafts, Sent, Junk and Trash to be automatically created and subscribed. They are all assigned to the private inbox namespace (which implicitly provides the INBOX folder).
inbox
target/dovecot/15-mailboxes.conf
These IMAP folders are considered special because they add a \"SPECIAL-USE\" attribute, which is a standardized way to communicate to mail clients that the folder serves a purpose like storing spam/junk mail (\\Junk) or deleted mail (\\Trash). This differentiates them from regular mail folders that you may use for organizing.
\\Junk
\\Trash
See target/dovecot/15-mailboxes.conf for existing mailbox folders which you can modify or uncomment to enable some other common mailboxes. For more information try the official Dovecot documentation.
The Archive special IMAP folder may be useful to enable. To do so, make a copy of target/dovecot/15-mailboxes.conf and uncomment the Archive mailbox definition. Mail clients should understand that this folder is intended for archiving mail due to the \\Archive \"SPECIAL-USE\" attribute.
\\Archive
With the provided compose.yaml example, a volume bind mounts the host directory docker-data/dms/config/ to the container location /tmp/docker-mailserver/. Config file overrides should instead be mounted to a different location as described in Overriding Configuration for Dovecot:
volumes:\n - ./docker-data/dms/config/dovecot/15-mailboxes.conf:/etc/dovecot/conf.d/15-mailboxes.conf:ro\n
Handling of newly added mailbox folders can be inconsistent across mail clients:
SPECIAL-USE
Not all mail clients support the SPECIAL-USE attribute for mailboxes (defined in RFC 6154). These clients will treat the mailbox folder as any other, using the name assigned to it instead.
Some clients may still know to treat these folders for their intended purpose if the mailbox name matches the common names that the SPECIAL-USE attributes represent (eg Sent as the mailbox name for \\Sent).
\\Sent
Usually the mail client will know via context such as the SPECIAL-USE attribute or common English mailbox names, to provide a localized label for the users preferred language.
Take care to test localized names work well as well.
Archives
Windows Mail
Windows Mail has been said to ignore SPECIAL-USE attribute and look only at the mailbox folder name assigned.
Needs citation
This information is provided by the community.
It presently lacks references to confirm the behavior. If any information is incorrect please let us know!
iOS Mail currently does not support the IMAP idle extension. Therefore users can only either check manually or configure intervals for fetching mails in their mail account preferences when using the default configuration.
To support mail push Dovecot needs to advertise the XAPPLEPUSHSERVICE IMAP extension as well as sending the actual push notifications to the Apple Push Notification service (APNs) which will forward them to the device.
XAPPLEPUSHSERVICE
This can be done with two components:
dovecot-xaps-plugin
dovecot-xaps-daemon
Both components will be built using Docker and included into a custom docker-mailserver image. Afterwards the required configuration is added to docker-data/dms/config. The registration data is stored in /var/mail-state/lib-xapsd.
/var/mail-state/lib-xapsd
Create a Dockerfile to build a docker-mailserver image that includes the dovecot-xaps-plugin as well as the dovecot-xaps-daemon. This is required to ensure that the Dovecot plugin is built against the same Dovecot version. The :edge tag is used here, but you might want to use a released version instead.
FROM mailserver/docker-mailserver:edge AS dovecot-plugin-xaps\nWORKDIR /tmp/dovecot-xaps-plugin\nRUN <<EOF\n apt-get update\n apt-get -y --no-install-recommends install git cmake make build-essential dovecot-dev\n git clone --single-branch --depth=1 https://github.com/freswa/dovecot-xaps-plugin.git .\n mkdir build && cd build\n cmake .. -DCMAKE_BUILD_TYPE=Release\n make install\nEOF\n\n# Use an older Go version as Go >= 1.20 causes this issue: https://github.com/freswa/dovecot-xaps-daemon/issues/24#issuecomment-1483876081\n# Note that the underlying issue are non-standard-compliant Apple http servers which might get fixed at some point\nFROM golang:1.19-alpine AS dovecot-xaps-daemon\nENV GOPROXY=https://proxy.golang.org,direct\nENV CGO_ENABLED=0\nWORKDIR /go/dovecot-xaps-daemon\nRUN <<EOF\n apk add --no-cache --virtual build-dependencies git\n git clone --single-branch --depth=1 https://github.com/freswa/dovecot-xaps-daemon .\n go build ./cmd/xapsd\nEOF\n\nFROM mailserver/docker-mailserver:edge\nCOPY --from=dovecot-plugin-xaps /usr/lib/dovecot/modules/*_xaps_* /usr/lib/dovecot/modules/\nCOPY --from=dovecot-xaps-daemon /go/dovecot-xaps-daemon/xapsd /usr/bin/xapsd\n\n# create a non-root user for the daemon process as well as configuration and run state directories\nRUN <<EOF\n adduser --quiet --system --group --disabled-password --home /var/mail-state/lib-xapsd --no-create-home xapsd\n mkdir -p /var/run/xapsd /etc/xapsd\nEOF\n
Build the new image:
docker build -t yourname/docker-mailserver .\n
Modify your compose.yaml to use the newly created image:
services:\n mailserver:\n image: yourname/docker-mailserver:latest\n
Recreate the container:
Create a hash of your Apple developer account password using the provided xapsd -pass command:
xapsd -pass
docker exec -it mailserver xapsd -pass\n
Add configuration for both components:
Create a folder named xaps in docker-data/dms/config.
xaps
Create a file named xapsd.yaml in docker-data/dms/config/xaps.
xapsd.yaml
docker-data/dms/config/xaps
appleId
appleIdHashedPassword
# set the loglevel to either\n# trace, debug, error, fatal, info, panic or warn\n# Default: info\nloglevel: info\n\n# xapsd creates a json file to store the registration persistent on disk.\n# This sets the location of the file.\ndatabaseFile: /var/mail-state/lib-xapsd/database.json\n\n# xapsd listens on a socket for http/https requests from the dovecot plugin.\n# This sets the address and port number of the listen socket.\nlistenAddr: '127.0.0.1'\nport: 11619\n\n# xapsd is able to listen on a HTTPS Socket to allow HTTP/2 to be used\n# SSL is enabled implicitly when certfile and keyfile exist\n# !!! only use HTTPS for connection pooling with a proxy e.g. nginx or HaProxy\n# !!! direct usage with the plugin is discouraged and unsupported\ntlsCertfile:\ntlsKeyfile:\ntlsListenAddr:\ntlsPort: 11620\n\n# Notifications that are not initiated by new messages are not sent immediately for two reasons:\n# 1. When you move/copy/delete messages you most likely move/copy/delete more messages within a short period of time.\n# 2. You don't need your mailboxes to synchronize immediately since they are automatically synchronized when opening\n# the app\n# If a new message comes and the move/copy/delete notification is still on hold it will be sent with the notification\n# for the new message.\n# This sets the interval to check for delayed messages.\ncheckInterval: 20\n\n# Set the time how long notifications for not-new messages should be delayed until they are sent.\n# Whenever checkInterval runs, it checks if \"delay\" <= \"waiting time\" and sends the notification if the expression is\n# true.\ndelay: 30\n\n# To retrieve certificates from Apple, we need to login with a valid Apple ID\n# The accounts email must be given in cleartext, but the password has to\n# be hashed before sending it. To not leak working credentials on running servers,\n# we do not accept the cleartext password here.\nappleId: foo@example.com\n\n# use `xaps -pass` to calculate the hash of the apple id password\nappleIdHashedPassword: bar\n
Create a file named 95-xaps.conf in docker-data/dms/config/xaps. For reference see also here. 95-xaps.conf
95-xaps.conf
protocol imap {\n mail_plugins = $mail_plugins notify push_notification xaps_push_notification xaps_imap\n}\n\nprotocol lda {\n mail_plugins = $mail_plugins notify push_notification xaps_push_notification\n}\n\nprotocol lmtp {\n mail_plugins = $mail_plugins notify push_notification xaps_push_notification\n}\n\nplugin {\n # xaps_config contains xaps specific configuration parameters\n # url: protocol, hostname and port under which xapsd listens\n # user_lookup: Use if you want to determine the username used for PNs from environment variables provided by\n # login mechanism. Value is variable name to look up.\n # max_retries: maximum num of retries the http client connects to the xaps daemon\n # timeout_msecs http timeout of the http connection\n xaps_config = url=http://127.0.0.1:11619 user_lookup=theattribute max_retries=6 timeout_msecs=5000\n push_notification_driver = xaps\n}\n
Create a supervisord file named xapsd.conf in docker-data/dms/config/xaps with the following content: xapsd.conf
xapsd.conf
[program:xapsd]\nstartsecs=0\nautostart=false\nautorestart=true\nstdout_logfile=/var/log/supervisor/%(program_name)s.log\nstderr_logfile=/var/log/supervisor/%(program_name)s.log\nuser=xapsd\ncommand=/usr/bin/xapsd\npidfile=/var/run/xapsd/xapsd.pid\n
Create or update your user-patches.sh in docker-data/dms/config to move the files to their final location as well as starting the daemon service: user-patches.sh
#!/bin/bash\n\n# Copy the configs to internal locations:\ncp /tmp/docker-mailserver/xaps/95-xaps.conf /etc/dovecot/conf.d/95-xaps.conf\ncp /tmp/docker-mailserver/xaps/xapsd.yaml /etc/xapsd/xapsd.yaml\ncp /tmp/docker-mailserver/xaps/xapsd.conf /etc/supervisor/conf.d/xapsd.conf\n\n# Setup data persistence and ensure ownership is always for xapsd:\nmkdir -p /var/mail-state/lib-xapsd\nchown -R xapsd:xapsd /var/mail-state/lib-xapsd\n\n# Start the xaps daemon:\nsupervisorctl update\nsupervisorctl start xapsd\n
Recreate the container again to apply the new configuration:
Recreate your mail account on your iOS device and check the logs in /var/log/supervisor/dovecot.log and /var/log/supervisor/xapsd.log for any errors.
/var/log/supervisor/dovecot.log
/var/log/supervisor/xapsd.log
Both device registration and notifications send a username to the daemon to lookup the device. While the registration and other IMAP operations in Dovecot will send the Dovecot username, LMTP will send the provided authentication username.
The format of that username is specified by the auth_username_format Dovecot setting. If you are not using mail addresses as Dovecot usernames - e.g. when using LDAP - you can either change the auth_username_format or add the mail address as property to the user account and use the lookup feature (see below).
auth_username_format
sed -i -r \"s|^#?(auth_username_format =).*|\\1 %Ln|\" /etc/dovecot/conf.d/10-auth.conf\n
You can also use notifications for Dovecot alias mailboxes. Depending on your server configuration, this might require to add the original Dovecot username as Dovecot attribute to the login user as well as changing the user_lookup=theattribute in 95-xaps.conf to perform the lookup of that attribute.
user_lookup=theattribute