Tool in production

docker-mailserver

Your own mail server as a container. Postfix + Dovecot + Rspamd + ClamAV, fully configured, live in 1–2 days. A concrete alternative to Strato, Ionos and Google Workspace for SMBs that take mail sovereignty seriously.

Project profile

docker-mailserver

Production-ready full-stack mail server

As of: June 1, 2026

GitHub stars

18k

Forks

2.0k

Open issues

107

License

MIT

Latest version

v15.1.0

Language

Shell

First release

March 28, 2015

Last commit

May 28, 2026

→ GitHub repository → Official website → Documentation

What is docker-mailserver?

docker-mailserver is a pre-configured mail suite in a container: Postfix as the SMTP server, Dovecot as the IMAP server, Rspamd as a modern spam filter, ClamAV for attachment scanning, against brute force, OpenDKIM/SPF/DMARC for mail authentication. Everything from one source, everything administrable through one setup script.

Unlike Mailcow (an 11-container stack with its own UI), docker-mailserver is leaner: one container plus optionally a webmail surface (Roundcube, SOGo). MIT licensed, running in production since 2015, with a very active community and detailed documentation.

Why an engineering firm self-hosts its mail server

For an engineering firm with 30–50 active building projects, email is the lifeline: client correspondence, architect coordination, authority enquiries, subcontractor deliveries. Strato or Ionos mail works, but has three hard limits: typically only 20–50 aliases per domain, an average spam filter, no catch-all possible.

With your own mail server: unlimited aliases (project-2026-007@, project-2026-008@ per building project), Rspamd with Bayes learning trained by sales support filters better than any commercial filter after six months, catch-all for the domain lets you receive any address you can imagine. Plus: mail data stays in German legal space on your own .

Client case study

Statisches Büro Möllers

Engineering office for structural design, 8 people — owner Thomas Möllers, 2 structural engineers, 2 site managers, 1 designer, 2 sales support. 30–50 active building projects, on average 150 incoming emails per day. 14 months ago migrated from Strato web hosting to their own mail server on a Hetzner . Today: 0 spam complaints, 0 lost mail, 100 % mail sovereignty.

Unlimited project aliases

For every building project, a dedicated mail address should be possible (project-2026-007@firm.com). The client always replies to this address, internally it is routed to the structural engineer responsible for the project. With Strato that was capped at 50 aliases.

A spam filter that actually works

The Strato spam filter let 30 % of spam through and had 5 % false positives — a dangerous mix. Our own Rspamd with Bayes training by sales support reaches >99 % spam detection after 6 months with <0.1 % false positives.

GDPR-compliant mail routing

Client data, locations of structures, structural calculations are sensitive. Mail server on a Hetzner in Falkenstein/Nuremberg — no US hop, no US cloud provider, GDPR trivially demonstrable.

Webmail for browser access

Staff on the road (site, hotel) need browser access without configuring IMAP on every device. SOGo or Roundcube as a second container — same server, same authentication.

Anti-phishing for subcontractor mail

Construction subcontractors often have weak mail practices — spoofed senders, dubious attachments. SPF/DKIM/DMARC detect spoofing, ClamAV scans attachments, quarantine holds suspicious mail until manual review.

10-year archive

Client correspondence has a 10-year tax retention period. Archive mailbox with automatic move after 30 days, IMAP backup to a separate NAS — tamper-evident, fast to search with the Dovecot search index.

What the mail server actually delivers

Eight productive configuration patterns from 14 months of Möllers operation. Each replaces a sequence from the pre-Strato era that hosted mail either could not do or only with limits.

Catch-all for project aliases

Wildcard alias @engineering-firm.com → catchall@.... Every imagined address (kann@, kunde-mueller@, project-2027-001@) is received. Sales support sorts manually or by Sieve rule. Before: Strato bounced non-existent addresses — clients received bouncebacks on typos.

Rspamd with Bayes learning

Sales support marks spam in webmail (SOGo), Rspamd learns. After 4 weeks of training: 95 % spam detection; after 6 months >99 %. False positives go to a Junk folder, not into quarantine limbo. The owner can briefly skim the Junk folder daily if something slipped through.

DKIM/SPF/DMARC properly configured

Three DNS records at Hetzner: SPF (TXT 'v=spf1 mx -all'), DKIM (TXT with key), DMARC (TXT 'v=DMARC1; p=reject; rua=...'). Effect: mail to gmail.com, outlook.com reliably lands in the inbox, not spam. Delivery loss rate on send: from 8 % down to 0.2 %.

SOGo webmail + calendar + contacts

A second SOGo container offers webmail with calendar sync (CalDAV) and contact sync (CardDAV). Staff sync Outlook on laptops and iPhone against the same server. Appointments, tasks, address book in one source.

Fail2ban against brute force

Login attempts get banned after 5 failures in 10 minutes. On average: 50–200 banned IPs per week. SOGo login and IMAP/SMTP equally protected. Local staff are never locked out thanks to a whitelist.

ClamAV quarantine for attachments

Incoming mail with attachments is scanned by ClamAV. Suspicious attachments (macro XLS, packed EXE, JS files) go to a quarantine folder. The owner reviews once a week, mail is either released or discarded. So far: 7 real trojans caught.

Postfix routing for lists

Staff lists (all@, structural@, site@) as simple alias groups. A mail to all@ goes to all 8 staff. On personnel changes: update the alias entry, no Mailman complexity.

10-year archive on NAS

The 'Archive' mailbox is backed up daily to a Synology NAS via IMAP backup. Mail older than 30 days is moved to Archive automatically (Sieve rule). Full 14-month correspondence searchable immediately with Dovecot full-text search.

Core capabilities of docker-mailserver

What the software offers as a mail stack — and which capabilities actually carry an 8-person setup.

Postfix + Dovecot production setup

The proven standard mail stack: Postfix as the SMTP mail server, Dovecot as the IMAP mailbox server. Pre-configured with secure defaults — TLS enforcement, opportunistic encryption, correct headers.

Rspamd instead of SpamAssassin

Rspamd is noticeably more performant than classic SpamAssassin: faster, lower RAM, more modern heuristics (reputation, fuzzy hashing, greylisting). The Bayes filter learns from staff clicks in webmail.

ClamAV for attachment scanning

The ClamAV engine scans every mail attachment for known malware signatures. Signature updates happen automatically every few hours. On a hit: mail goes to quarantine, the owner is notified.

DKIM/SPF/DMARC + Fail2ban

Mail authentication out of the box: DKIM key generation by command, SPF/DMARC recommendations from the docs. protects login endpoints (SOGo, IMAP, SMTP) against brute force.

SOGo / Roundcube optional

Webmail is NOT included in docker-mailserver — a deliberate architectural decision. SOGo or Roundcube run as a separate container, speaking IMAP against the mail server. Cleanly separated, updatable independently.

setup.sh for every admin task

One central helper script: `setup email add`, `setup alias add`, `setup config dkim`, `setup debug ...`. No editing of /etc/postfix, no Dovecot magic. Workable for IT-affine staff or consulting support.

Honest alternatives

If docker-mailserver is not a fit — what else?

Three alternatives for SMB mail sovereignty. Each with its own trade-off between control, comfort and effort.

All-in-one stack

Mailcow

SerNet, GPL-3.0

+ Complete web UI for mail administration
+ SOGo + Sieve editor + quarantine integrated
− 11 containers, higher complexity
− RAM footprint ~2 GB

Script based

Mail-in-a-Box

Joshua Tauberer, CC0

+ One-command setup on Ubuntu
+ Very simple initial install
− Less flexible, no container
− Updates manual and less frequent

SaaS hosted mail

Strato/Ionos/Workspace

Various, proprietary

+ No own server, no setup
+ Ready-made mobile apps + web UI
− Limited aliases, catch-all rarely possible
− Mediocre spam filter, no Bayes training

Rule of thumb: anyone who wants control over the setup (DKIM keys, Postfix logs) and has IT-affine staff or consulting support is pragmatic on docker-mailserver. Anyone who wants a complete web UI for mail administration and is not afraid of 11 containers picks Mailcow. Hosted mail remains sensible when mail sovereignty is not the top concern.

Pricing

MIT. Postfix standard. No asterisks.

License

MIT — classic OSI open-source license without strings. Read the source, modify, use commercially — all permitted. Postfix, Dovecot, Rspamd themselves are also MIT or similarly permissively licensed.

Running costs

One VPS with its own IP (Hetzner CPX21 from €7/month in Falkenstein), DNS at Hetzner or your own provider. RAM footprint around 700 MB for 8 mailboxes + SOGo. Storage: 1–5 GB per mailbox depending on mail volume.

Effort

Initial setup: 1–2 days including DNS configuration (MX, SPF, DKIM, DMARC), mailbox creation, webmail container, migration of existing mail via IMAP sync. Full SMB setup with backup routine and staff training: 3–5 consulting days.

Important for clarity: running your own mail server needs either an IT-affine staff member or a consulting contract that steps in on issues. Anyone reluctant is better off with hosted mail. The last tagged release is from August 2025 — active development happens via the `:latest` tag with regular image updates. Stable for over 10 years.

setup.sh — account, alias, DKIM in 3 commands

# Create mail account
docker exec -ti mailserver setup email add \
  thomas.moellers@engineering-firm.com \
  ${ACCOUNT_PASSWORD}

# Alias for a project address
docker exec -ti mailserver setup alias add \
  project-2026-007@engineering-firm.com \
  thomas.moellers@engineering-firm.com

# Generate DKIM key (publish in DNS!)
docker exec -ti mailserver setup config dkim
# → returns TXT record for mail._domainkey.engineering-firm.com

# Check status
docker exec -ti mailserver setup debug fail2ban
docker exec -ti mailserver setup debug login thomas.moellers@...

docker-mailserver ships a central setup.sh that wraps every admin task. No /etc/postfix magic, no hand-written Dovecot config. Source: docker-mailserver.github.io.

docker-mailserver setup as Docker Compose

services:
  mailserver:
    image: ghcr.io/docker-mailserver/docker-mailserver:15.1.0
    container_name: mailserver
    hostname: mail.engineering-firm.com
    restart: always
    ports:
      - "25:25"
      - "143:143"
      - "465:465"
      - "587:587"
      - "993:993"
    volumes:
      - ./mail-data:/var/mail
      - ./mail-state:/var/mail-state
      - ./mail-logs:/var/log/mail
      - ./config:/tmp/docker-mailserver
      - /etc/letsencrypt:/etc/letsencrypt:ro
    environment:
      - SSL_TYPE=letsencrypt
      - ENABLE_RSPAMD=1
      - ENABLE_CLAMAV=1
      - ENABLE_FAIL2BAN=1
      - ENABLE_OPENDKIM=0
      - SPOOF_PROTECTION=1
      - PERMIT_DOCKER=none
    cap_add:
      - NET_ADMIN
    networks:
      - mail-net

networks:
  mail-net:

One container with every mail protocol: SMTP (25/465/587), IMAPS (993), Sieve (4190). Volumes for configuration, mail data and certificates. Source: docker-mailserver.github.io, MIT license.

A mail server needs a platform and monitoring

as the platform, Caddy as the HTTPS layer for webmail, for IMAP/SMTP monitoring:

→ Docker (container engine)→ Caddy (HTTPS for webmail)→ Uptime Kuma (mail server monitoring)

Ready for the next step?

Free intro call, no strings attached. In 30 minutes you'll know whether and how AI can help your business.

Book a call Check eligibility