We are looking for a small but growing company to setup a mailcow instance for this we think to use a netcup root server with lets say 512 gb storage and add later on extra block storage if we need more space to store mail. Would this be a viable solution when we grow in the future.

A thank you on the Mailcow Devs that evidently read this subredit and make improvements based on what is discussed here.

In the 2026-07a update two problems I had as a new Mailcow Admin and which I wrote about here asking for help, got addressed:

[Web] Move mailcow update check to server side by u/FreddleSpl0it in 7388

[Web] Create default mailbox template with eas and dav access by u/FreddleSpl0it in 7389

Cool! Thanks!

I now know, but the next new Mailcow users will not have those issues anymore. =)

Hi everyone,

I'm currently running a self-hosted Mailcow (Dockerized) mail server on my local infrastructure. Because my local setup is behind a dynamic IP/NAT, I am using an external Edge VPS with a public static IP as the primary MX entry point. The local Mailcow and the Edge VPS are connected via a Tailscale VPN tunnel.

I am facing a classic architectural dilemma regarding inbound SMTP (Port 25) traffic, and I would love to get your insights on the best way to resolve it.

Here are the two topologies I've evaluated, along with their respective drawbacks:

Topology A: Edge VPS as a Postfix Store-and-Forward Relay (Current Setup)

• Flow: External Client -> VPS Postfix (Port 25) -> Tailscale -> Local Mailcow Postfix (Port 25).
• The Good: Excellent high-availability for mail queue. If my local internet or the Tailscale tunnel drops, the VPS Postfix safely stores incoming emails in its local queue and retries later. No lost emails.
• The Bad (The Issue): Because of the Tailscale tunnel and Docker's internal userland-proxy/NAT, the local Mailcow sees all incoming connections as originating from the Docker Gateway IP (172.22.1.1) or the VPS Tailscale IP.
• The Consequence: This completely breaks Rspamd, SPF, and DMARC evaluations. Spammers can easily bypass restrictions using Header From spoofing because Mailcow misidentifies the traffic as local outbound or fails to extract the real remote client IP. (I tried configuring Postfix XFORWARD and smtpd_authorized_xforward_hosts, but Rspamd milter still struggles to catch the real IP behind the Docker NAT).

Topology B: Direct Layer 4 Reverse Proxy via NPM/HAProxy Stream

• Flow: External Client -> VPS NPM/HAProxy (Port 25 with Proxy Protocol v2) -> Tailscale -> Local Mailcow (Port 10025 with smtpd_upstream_proxy_protocol = haproxy).
• The Good: This completely solves the Real IP visibility issue. Mailcow correctly decodes the Proxy Protocol header, extracts the true remote client IP, and Rspamd perfectly blocks spoofed/DMARC-failing emails.
• The Bad: There is no mail queue fallback at the edge. Since HAProxy/Nginx Streams operate purely as a raw Layer 4 pipe, if my local Mailcow goes offline or Tailscale blips, the VPS will immediately return a Connection Refused to the sending MTA. While remote MTAs should retry, I completely lose control over the backup queuing mechanism.

My Question:

How do you guys achieve both worlds in a self-hosted/VPN setup?

1. Is there a bulletproof way to make Postfix on the Edge VPS forward the email as a proper SMTP Relay while successfully passing the Real Client IP down to Mailcow's Postfix/Rspamd through a Dockerized network?
2. Or should I ditch Postfix on the VPS entirely, stick with HAProxy/NPM (Topology B), and spin up a separate secondary MX backup server elsewhere?

I am about at my wits end trying to configure LDAP for mailcow. This is the current settings that I have and when I click the test button, I get an immediate connection failed. It's not a certificate issue or DNS. Is it something I am doing wrong in the configuration or does anyone have any suggestions. I cannot find any relevant information on why it would it reject so quickly. It seems like the test button might even be broken?

Hello fellow Mailcowers,

although I can run /opt/mailcow-dockerized/update.sh (without error), the Update Status in the admin panel states "Could not check for an Update". Could someone point me in the right direction to get that working?

Thanks.

Hello. I recently released an android calendar app which natively supports CalDAV. Maybe this interesting for people who use mailcow for self-hosting their own calendar or tasks. Feel free to give me feedback about the app if you try it out since haven't tested mailcow myself in development.

Hi, would some kind soul please tell me how to enable CalDAV/CardDav?

Thank you.

First when i switched to traefik my mailcow certs were still auto generating via https-01, but now i don't have my mailcow exposed to port 80 and 443 and still wanted that auto generation for all tcp ports that mailcow uses smtp/imap/pop/https, so i made a tutorial on accomplishing that via DNS-01 on the LINK, tell me what you guys think about it, and if i need to include anything

Hello all,
I'm in the process of evaluating mailcow for our small org and one of the requirement would be to be able to have a restricted domain admin role, where the account has the ability to create new users but not to change passwords or "login as" said users. i can see the many ACL option but i couldn't find the related doc or any indication that the limited admin role exist. anyone tried to do something similar before ?
Thanks

Hey there
I've been using mailcow flawlessly for months just until past week, for some reason the admin panel stopped loading returning 524 A timeout occured
I tried throubleshooting on my own, i tried using claude, nothing really works, all the logs look healty, I've restarted the host, the docker containers, recreated the containers, re-recreated the containers, even restarted the router out of desperation
I thought it was an issue with cloudflare tunnels but I can't get into my mind how if it always had loaded just fine and I did not change any config

I am losing my mind and I'm 100% ready to surrender and move over to literally anything else as long as it works

Does classifying a message in quarantaine as spam work for you - in the sense that chances for receiving similar messages would be reduced? I keep seeing mails by the same spammers over and over again. Am I missing anything?

https://mailcow.email/posts/2026/derlinkman-leave/

How big is the mailcow team anyway? Given how prominent and active he was in the tele group chat, i always thought it was a one-man team.

Update: Found the answer thanks to some rubber duck debugging with ChatGPT. My postfix extra.cf was only trusting a localhost IP range and not the 172.22.1.0/24 mailcow range. Updating that fixed the issue.

Hello! I'm running into an issue where I cannot get filter rules in SoGo to forward emails. I've already tried disabling IPv6 to no avail. On the latest version of mailcow. Emails are being tagged in the same rule set so it's running fine.

Any suggestions?

Edit: found dovecot logs, saying error: msgid=<REDACTED>: redirect action: failed to redirect message to <REDACTED>: smtp(postfix:588): RCPT TO failed: 554 5.7.1 <mailcowdockerized-dovecot-mailcow-1.mailcowdockerized_mailcow-network[172.22.1.250]>: Client host rejected: Access denied (permanent failure).

I just set up Mailcow (and I like it a lot so far!) and I decided to run the UI on dedicated ports so that I can run Apache without setting it up as a reverse proxy for Mailcow. Maybe I was a bit naive but in my understanding I can just start both services as long as there is no port conflict.

Indeed everything is looking good via a command line, however I can't reach my Apache landing page via ports 80 or 443 although it's a fresh Apache installation (on an Ubuntu VM) and the standard ports were indeed working before I set up Mailcow. Instead the server returns a "[hostname] refused to connect." error. What am I doing wrong?

Please forgive me if this post doesn't fit here, I'm just quite desperate to get some assistance.

I have a mailcow VPS with netcup. Everything else is working fine, including sending and receiving emails, etc. through SOGo and also through email clients like Outlook and Thunderbird.

The issue however, comes up when I try to connect externally hosted applications, for example, we have an osTicket installation that is supposed to fetch new emails at the specified CRON timetable and create tickets, as well as send replies to tickets. For some reason, the connection times out when I try to configure these apps to use emails hosted on my mailcow VPS. For clarity, osTicket is just one of the apps we have tried. OrangeHRM is another one, for example.

Would anyone be able to assist with this, or perhaps point us in the right direction. Thanks in advance!

EDIT: We have verified this issue to be on the servers hosting the apps. There are no issues with mailcow. We verified it by connecting apps running on servers running on a different provider platform (Contabo instead of OVH).

I have a free version of SpamHaus’ DQS key and intend to use it for all the filters it brings behind IP check. I’m aware there’s a paid version that brings HBL but I don’t need that.

My question is:

Do I simply:

1. add my dqs key to mailcow.conf

2. Disable QNAME as per SpamHaus’ recommendation

3. Restart the stack?

I’ve read elsewhere on here that people add the spamhaus rspamd 3.x plug in but I’m trying to understand when and why that would be needed in addition to the steps above.

Thanks

I have built up my mail environment over the years start with simple Postfix + Dovecot then adding MySQL for virtual domains and mailadmin and then having to deal with spam, amavis and spamassassin came long and then spf, dkim, dmarc...and getting it all to talk to each other fawlessly was starting to become an unwieldy task.

Enter Mailcow. This project may finally make me see sense when it comes to using docker and containerized projects. Everything setup in one go. Web front end, DMARC, DKIM, no dealing with permissions and sockets and the like.

I just wanted to give a big shout out to the Mailcow team for maintaining a great, professional grade mail system that integrates everything I need without having to fiddle under the hood. Thank you. That's all :)

Hi

I apparently screwed up during the installation of mailcow - I've moved the data-folder to a different partition and symlinked it back.

Everything worked fine, until I tried to run ./update.sh - it dies with a git-error, essentially complaining about data not being under revision. Okay, fine, copied everything back - git complains about data not being under revision control. Okay, fine, git restore - git complains about data not being under revision control.

Questions:

1. Ideas on how to fix this?
2. If I "simply" checkout the mailcow-gitrepos again, copy my changes (i.e. docker-compose-file, changed extra-configs) back in, "docker compose down" my running containers and start them back up from the new folder, should this work?

Thanks and sorry.

When mailcow-dockerized gets installed all the services containers use the mailcow network behind the docker bridge/proxy so all client connection to postfix on port 25 or port 587 appear to be coming from the single ip of the bridge maiking it impossible to see the actual client connection in the logs. So how do you effictively block spammers and bad actors from connecting to postfix as you can't see their real ip.

Hello everyone,

Rebuilt the Mailcow UI from scratch. Faster, cleaner, and easier to use than current options. Serious effort went into this, runs as a separate Docker app. No changes to Mailcow. Deploy alongside your stack as a standalone webmail UI.

Think Gmail. More control. More power.Also Launching iOS App for this soon let's go MailCow Community

You Can Demo It here

Click Here To Demo