Running your own mail server in 2026

Running Your Own Mail Server in 2026

This article explains how to set up a privacy-friendly mail server of your own using Docker Mailserver (v13.2+) or Mailcow, including SPF, DKIM, DMARC, and TLS. For system administrators who want control over their email infrastructure.

Requirements

- VPS or dedicated server with Ubuntu 24.04 LTS or Debian 12+, 2 GB RAM minimum - Docker (24.0+) and Docker Compose (v2.23+) installed - Your own domain with DNS access (A, AAAA, MX, TXT records) - Reverse DNS (PTR record) pointing back to your hostname - IPv6 address – required for deliverability to Gmail and Outlook - Server in EU location (Germany or the Netherlands) for GDPR compliance

Steps

1. Prepare DNS: set the MX record Point mail traffic to your server. Replace `mail.yourdomain.com` with your full hostname.

`@ IN MX 10 mail.yourdomain.com.`

2. Install Docker Mailserver Clone the repository and generate the configuration.

git clone https://github.com/docker-mailserver/docker-mailserver.git
cd docker-mailserver
cp docker-compose.yml docker-compose.yml.orig

3. Create the configuration file Create `mailserver.env` with the minimum requirements.

echo "OVERRIDE_HOSTNAME=mail.yourdomain.com
POSTMASTER_ADDRESS=postmaster@yourdomain.com
PERMIT_DOCKER=host
SSL_TYPE=letsencrypt" > mailserver.env

4. Generate DKIM keys Run the setup script to create DKIM keys.

./setup.sh config dkim

The keys are located in `docker-data/dms/config/opendkim/keys/`.

5. Add DNS records Retrieve the DKIM TXT record and add it to your DNS zone.

cat docker-data/dms/config/opendkim/keys/yourdomain.com/mail.txt

Also add SPF and DMARC records: - SPF: `@ IN TXT "v=spf1 mx ~all"` - DMARC: `_dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:postmaster@yourdomain.com"`

6. Start the containers Start the mail server stack.

docker compose up -d

7. Request a TLS certificate Use Certbot for a valid Let's Encrypt certificate.

docker compose exec -ti mailserver setup email add admin@yourdomain.com
docker compose exec -ti mailserver setup certbot

8. Activate Fail2Ban and backups Protect against brute-force attacks and set up automatic backups.

Activate Fail2Ban
docker compose exec -ti mailserver setup fail2ban
BorgBackup for backups
borg init --encryption=repokey ssh://user@backupserver/./mailserver-backup
borg create --stats /mnt/backup::mailserver-{now} /var/mail

Verification

Check that all services are running correctly.

docker compose ps

Test deliverability with an external tool.

dig TXT mail.yourdomain.com | grep -E "spf1|dkim|dmarc"

Send a test email to `check-auth@verifier.port25.com` and check the report for SPF/DKIM/DMARC pass.

Frequently asked questions

1. Emails end up in spam - Check the DKIM record is correct: `dig TXT dkim._domainkey.yourdomain.com` - Increase the DMARC policy to `p=reject` after 48 hours without errors

2. Connection refused on port 25 - VPS providers often block port 25. Ask support to disable the block (OVH, DigitalOcean, Linode)

3. SPF error when sending from external clients - Add your client's IP: `v=spf1 mx ip4:1.2.3.4 ~all` or enable SMTP-auth on port 587

Running your own mail server requires continuous monitoring. Automate updates with unattended-upgrades and check your deliverability weekly with `mxtoolbox.com`.