Skip to content
MailVitals Email deliverability
EN

Language

Sign in

Beat and the Academy have separate accounts.

Get Beat
The Academy · Intermediate

Mailcow: Self-Hosted Mail Server Mastery

12-module Mailcow course: install, configure, harden, scale, and troubleshoot the Dockerized Postfix + Dovecot + Rspamd + SOGo mail stack.

Start lesson 1See all 26 lessons
12
Modules
26
Lessons
8h
Estimated

Curriculum

12 modules, 26 lessons

Follow them in order or jump to the one you need. Each lesson is its own page, with the next one waiting at the end.

Module 013 lessons

Introduction to Mailcow

What Mailcow is, why it exists, and how the Dockerized stack fits together.

  1. 01What is Mailcow: Dockerized?Mailcow is a Docker bundle of Postfix, Dovecot, Rspamd, SOGo and friends
  2. 02When (and when not) to self-host with MailcowMailcow solves ops, not deliverability; IP reputation is still on you
  3. 03Mailcow vs Mail-in-a-Box vs iRedMailMailcow's edge: Docker isolation, Rspamd, multi-domain, polished UI
Module 023 lessons

Server Prerequisites & DNS

What to provision before you install: OS, IP, rDNS, firewall, DNS records.

  1. 04VPS sizing and OS choiceDebian 12 + ext4 is the safest baseline
  2. 05DNS records every Mailcow host needsSet A, PTR, and MX before the install, because Let's Encrypt needs A working
  3. 06Firewall and fail2ban basicsOpen 25, 80, 443, 465, 587, 993, 4190; close 110/143 if not needed
Module 032 lessons

Installation & First-Run Configuration

Clone, generate config, bring the stack up, and finish the web installer.

  1. 07Installing Docker and MailcowInstall Docker Engine via get.docker.com, not Desktop
  2. 08First login and admin setupChange the default admin:moohoo immediately
Module 042 lessons

Domains, Mailboxes, Aliases & ACLs

Multi-domain hosting, aliases, mailbox quotas, and per-user permissions.

  1. 09Managing multiple domainsEach domain has its own DKIM key, quotas, and ACLs
  2. 10Aliases, catch-alls, and ACLsCatch-all aliases are spam magnets, so use specific aliases instead
Module 052 lessons

Rspamd Tuning

How Rspamd scores mail and how to safely adjust thresholds, modules, and maps.

  1. 11Rspamd architecture inside MailcowThe default reject threshold is 15.0; don't lower it blindly
  2. 12Safe customization with local.d overridesEdit local.d/, never the shipped configs
Module 062 lessons

SOGo, ActiveSync & Mobile Clients

Webmail, calendar sync, contacts, and mobile device provisioning.

  1. 13SOGo as the webmail and groupware layerSOGo = webmail + CalDAV + CardDAV + ActiveSync, all in one
  2. 14Mobile autoconfig and app passwordsAutodiscover + Autoconfig CNAMEs save 90% of provisioning pain
Module 072 lessons

Backups, Snapshots & Disaster Recovery

What to back up, how, and how to test restores before you need them.

  1. 15What Mailcow stores and whereUse Mailcow's backup_and_restore.sh instead of tarballing live volumes
  2. 16Restore drills and PITRAn untested backup is only a wish; drill quarterly
Module 082 lessons

Upgrades, Migrations & Version Pinning

Stay current without breaking your stack, and move Mailcow between hosts.

  1. 17The update.sh workflowAlways run update.sh -c first to read the changelog
  2. 18Migrating Mailcow to a new serverLower DNS TTLs days before an IP-change migration
Module 092 lessons

Monitoring (Watchdog, Netdata, Prometheus)

Built-in Watchdog plus external metrics, alerts, and dashboards.

  1. 19Watchdog: the built-in health probeWatchdog covers 80% of monitoring out of the box
  2. 20External metrics: Netdata, Prometheus, GrafanaNetdata is the fast win; Prometheus is the long-term play
Module 102 lessons

Anti-Spam + SPF/DKIM/DMARC in Mailcow

Outbound authentication done right: signing, alignment, and ARC for forwards.

  1. 21Outbound DKIM with RspamdAlways use 2048-bit RSA; 1024 is below modern best practice
  2. 22DMARC enforcement progressionAlways start at p=none and watch aggregate reports for 2–4 weeks
Module 112 lessons

Hardening, fail2ban, TLS, MTA-STS

Lock down the server against brute-force, downgrades, and weak ciphers.

  1. 23Tightening fail2ban and rate limitsTighten fail2ban max attempts to 3 and ban time to 24 h
  2. 24TLS hardening and MTA-STSUse minimum TLS 1.2 and the Intermediate cipher profile; Modern breaks too much
Module 122 lessons

Scaling, Multi-Server & Troubleshooting Playbook

Beyond a single host, plus the diagnostic flow when things go sideways.

  1. 25Scaling patterns for MailcowScale vertically as long as you can; clustering is a maintenance tax
  2. 26Diagnostic flow when delivery breaksRead logs before you restart anything, because restarts hide root causes
Pulse · cold-email sending

Sending infrastructure that is yours alone.

Every domain gets its own MX host, IP, DKIM selector and certificate. Take it managed, and we run it for you, or buy a licence and run it on your own servers.

Book a demoSee Pulse
# on a fresh Ubuntu server
$ cd pulse && sudo ./install.sh
→ docker compose up · kumomta · stalwart · caddy
→ dashboard ready on https://pulse.yourdomain.com
$

Also from us:Beat: monitoring that tells you the fixConsulting: $65/hr, no retainer