Mail Servers

Mail Servers

A mail server on Ubuntu combines three components: an MTA (Mail Transfer Agent, typically Postfix) for sending and receiving email, an MDA (Mail Delivery Agent) for storing mail in user mailboxes, and an IMAP server (Dovecot) for clients to access their mail. Running your own mail server is complex — you are responsible for deliverability, spam filtering, and security. For most organizations, a hosted solution (Google Workspace, Microsoft 365) is more practical. This guide covers Postfix + Dovecot for cases where self-hosting is required.

Mail server architecture

Email flow:

  Sender (Gmail) → DNS MX record lookup for example.com
                → Connects to mail.example.com:25
                → SMTP delivery to Postfix

  Postfix (MTA): Receives inbound, sends outbound
       |
       v
  Dovecot (IMAP/POP3): Stores and serves mailboxes
       |
       v
  User's mail client (Thunderbird, Apple Mail)
       connects to mail.example.com:993 (IMAP over TLS)

  Required DNS records:
    MX  example.com  → mail.example.com
    A   mail.example.com → 203.0.113.10
    SPF → TXT "v=spf1 ip4:203.0.113.10 -all"
    DKIM, DMARC for deliverability

Postfix installation and configuration

sudo apt update
sudo apt install -y postfix
# Select "Internet Site" during setup wizard
# Enter your mail hostname: mail.example.com

sudo nano /etc/postfix/main.cf

/etc/postfix/main.cf — key settings

myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, $mydomain, localhost

# TLS settings (use Let's Encrypt certificates):
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file  = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_use_tls = yes
smtpd_tls_security_level = may

# Mailbox format (Maildir for Dovecot compatibility):
home_mailbox = Maildir/

# Restrict relaying (do not become an open relay!):
smtpd_relay_restrictions = permit_sasl_authenticated, reject_unauth_destination

sudo systemctl restart postfix
sudo systemctl enable postfix

# Test sending mail:
echo "Test message" | mail -s "Test" recipient@example.com

# Check mail queue:
mailq

# View Postfix logs:
sudo journalctl -u postfix -f

Dovecot IMAP server

sudo apt install -y dovecot-core dovecot-imapd dovecot-pop3d
sudo nano /etc/dovecot/conf.d/10-mail.conf

/etc/dovecot/conf.d/10-mail.conf — key settings

mail_location = maildir:~/Maildir    # Must match Postfix home_mailbox

# Enable protocols:
protocols = imap pop3

# SSL/TLS (IMAP over TLS on port 993):
ssl = required
ssl_cert = 

sudo systemctl restart dovecot
sudo systemctl enable dovecot

# Test IMAP connection:
openssl s_client -connect mail.example.com:993

Spam prevention and authentication

# Install SpamAssassin:
sudo apt install -y spamassassin spamc

# Add SPF record in DNS (prevents email spoofing):
# TXT record: v=spf1 ip4:203.0.113.10 -all
# "-all" = reject mail from any IP not listed

# Install OpenDKIM for DKIM signing:
sudo apt install -y opendkim opendkim-tools
# Generate DKIM key:
opendkim-genkey -t -s mail -d example.com
# Add public key to DNS as TXT record: mail._domainkey.example.com

Conclusion

The hardest part of running a mail server is deliverability — getting your outbound email to land in recipients' inboxes instead of spam folders. This requires correct SPF, DKIM, and DMARC DNS records, a dedicated IP address with good reputation, and reverse DNS (PTR record) matching your mail server hostname. Test your configuration at mail-tester.com before relying on it for production. For most organizations, the operational burden of maintaining deliverability justifies using a hosted mail service instead.