Before You Install¶

You have a server. Before you install anything, three things decide whether this works at all, and none of them are software you can fix later:

1. Can your server send on port 25? Most providers say no by default.
2. Does your IP have correct reverse DNS? Without it, Gmail and Outlook distrust you no matter what else you do.
3. Is your IP's reputation clean? You inherit whatever the last tenant did.

Sorting these out first takes an afternoon of waiting on support tickets. Finding out afterwards costs you a weekend of debugging a stack that was never broken.

The server itself¶

Mail storage is whatever your users will keep, plus room for the database, indexes and backups. Postfix, Dovecot, Rspamd, MySQL, Redis and a dozen small services all run on one host, so 2 GB is genuinely the floor rather than a conservative estimate.

1. Port 25 outbound¶

This is the single most common reason a new install cannot send mail.

Outbound port 25 is blocked by default on almost every cloud provider, because that is how they stop their address space being used for spam. Your stack will start perfectly, accept a message, queue it, and then fail to deliver — with connection timeouts in the logs and no clue that the network is the cause.

Check before you install:

# If this connects, port 25 outbound is open.
# A timeout means it is blocked -- open a ticket with your provider.
timeout 10 bash -c 'cat < /dev/null > /dev/tcp/gmail-smtp-in.l.google.com/25' \
  && echo "port 25 outbound: OPEN" \
  || echo "port 25 outbound: BLOCKED — you cannot deliver mail until this is fixed"

Inbound ports¶

Inbound matters too, though it is rarely blocked. Your firewall and any provider firewall need these open:

2. Reverse DNS (PTR)¶

The second most common reason mail lands in spam.

A PTR record maps your IP back to a hostname. Receiving servers check that the name your server introduces itself with resolves back to the IP it connected from. When it does not, you look like a compromised machine, because that is what compromised machines look like.

Set it so that:

your IP  →  PTR  →  mail.yourdomain.com
mail.yourdomain.com  →  A  →  your IP

Both directions must agree, and the name must be the same one you put in HOSTNAME in .env.

PTR is set at your provider, not at your DNS host — it is a property of the IP, and only whoever owns the address block can publish it. Look for "reverse DNS", "PTR record" or "rDNS" in the server's network settings.

# Replace with your server's public IP.
dig +short -x 203.0.113.10
# Should print: mail.yourdomain.com.
# Empty, or the provider's default like 203-0-113-10.provider.net, means it is unset.

3. IP reputation¶

You inherit the address, and its history. Before committing to a server, check whether it is already listed:

# Spamhaus ZEN covers the lists that matter most.
# Reverse the octets: 203.0.113.10 -> 10.113.0.203
dig +short 10.113.0.203.zen.spamhaus.org
# No output = not listed, which is what you want.
# A 127.0.0.x answer = listed; ask for a different IP rather than a delisting.

Also worth a look: mxtoolbox.com/blacklists.aspx checks around a hundred lists at once.

What you need before starting¶

A domain you control DNS for, and the ability to add MX, TXT and A records. You do not need them published yet — Installation gets the stack running first, and Your First Steps publishes the records once the server can tell you its DKIM key.

Pre-flight check¶

Run this on the server before installing. Everything should say OK.

#!/usr/bin/env bash
# Replace these two.
MAIL_HOST="mail.yourdomain.com"
MY_IP="$(curl -s https://api.ipify.org)"

echo "Public IP: $MY_IP"

timeout 10 bash -c 'cat < /dev/null > /dev/tcp/gmail-smtp-in.l.google.com/25' 2>/dev/null \
  && echo "OK   port 25 outbound is open" \
  || echo "FAIL port 25 outbound blocked — open a provider ticket first"

PTR="$(dig +short -x "$MY_IP" | sed 's/\.$//')"
[ "$PTR" = "$MAIL_HOST" ] \
  && echo "OK   PTR is $PTR" \
  || echo "FAIL PTR is '${PTR:-unset}', should be $MAIL_HOST"

REVIP="$(echo "$MY_IP" | awk -F. '{print $4"."$3"."$2"."$1}')"
[ -z "$(dig +short "$REVIP.zen.spamhaus.org")" ] \
  && echo "OK   not listed on Spamhaus ZEN" \
  || echo "FAIL listed on Spamhaus — request a different IP"

command -v docker >/dev/null \
  && echo "OK   docker $(docker --version | grep -oE '[0-9]+\.[0-9]+' | head -1)" \
  || echo "FAIL docker not installed"

Three OKs and Docker present means nothing on this page will surprise you later.

Next¶

Installation — clone, generate secrets, start the stack.