Mailcow expects these inbound ports open from the internet:
| Port | Service |
|---|---|
| 25 | SMTP (inbound MX) |
| 465 | SMTPS submission |
| 587 | Submission with STARTTLS |
| 993 | IMAPS |
| 995 | POP3S |
| 4190 | ManageSieve |
| 80 | HTTP (ACME challenge + redirect) |
| 443 | HTTPS (admin UI + webmail) |
UFW example:
ufw allow 25,80,443,465,587,993,995,4190/tcp
fail2ban inside Mailcow: the netfilter-mailcow container already runs fail2ban-style banning. Don't run host-level fail2ban on the same ports — it fights the container's NFTables rules.
Block port 110 and 143 (cleartext IMAP/POP3). Mailcow leaves them open by default for legacy clients; close them at the firewall unless you need them.
Sign in to keep track of what you have read.