How to Easily Set Up a Mail Server on Debian 10 Buster with iRedMail

Setting up your own email server on Linux from scratch is a pain in the butt, if you are not a skilled server admin. This tutorial will be showing you how to use iRedMail to quickly set up a full-featured mail server on Debian 10, saving you lots of time and headaches.

What is iRedMail?

iRedMail is a shell script that automatically installs and configures all necessary mail server components on your Linux/BSD server, thus eliminating manual installation and configuration. With iRedMail, you can easily create unlimited mailboxes and unlimited mail domains in a web-based admin panel. Mailboxes can be stored in MariaDB/MySQL, PostreSQL database or OpenLDAP. The following is a list of open-source software that will be automatically installed and configured by iRedMail.

  • Postfix SMTP server
  • Dovecot IMAP server
  • Nginx web server to serve the admin panel and webmail
  • OpenLDAP, MySQL/MariaDB, or PostgreSQL for storing user information
  • Amavised-new for DKIM signing and verification
  • SpamAssassin for anti-spam
  • ClamAV for anti-virus
  • Roundcube webmail
  • SOGo groupware, providing webmail, calendar (CalDAV), contacts (CardDAV), tasks and ActiveSync services.
  • Fail2ban for protecting SSH
  • mlmmj mailing list manager
  • Netdata server monitoring
  • iRedAPD Postfix policy server for greylisting

Step 1: Choose the Right Hosting Provider and Buy a Domain Name

To set up a full-featured email server with iRedMail, you need a server with at least 3GB RAM, because after the installation, your server will use more than 2GB of RAM.

Note: You must install iRedMail on a clean fresh Debian 10 server.

This tutorial is done on a $9/month Kamatera VPS (virtual private server) with 1 CPU and 3GB RAM. They offer a 30-day free trial.

Kamatera is a very good option to run a mail server because

  • They don’t block port 25, so you can send unlimited emails (transactional email and newsletters) without spending money on SMTP relay service. Kamatera doesn’t have any SMTP limits. You can send a million emails per day.
  • The IP address isn’t on any email blacklist. (At least this is true in my case. I chose the Dallas data center.) You definitely don’t want to be listed on the dreaded Microsoft Outlook IP blacklist or the spamrats blacklist. Some blacklists block an entire IP range and you have no way to delist your IP address from this kind of blacklist.
  • You can edit PTR record to improve email deliverability.
  • They allow you to send newsletters to your email subscribers with no hourly limits or daily limits, whatsoever.
  • You can order multiple IP addresses for a single server. This is very useful for folks who need to send a large volume of emails. You can spread email traffic on multiple IP addresses to achieve better email deliverability.

Other VPS providers like DigitalOcean blocks port 25. DigitalOcean would not unblock port 25, so you will need to set up SMTP relay to bypass blocking, which can cost you additional money. If you use Vultr VPS, then port 25 is blocked by default. They can unblock it if you open a support ticket, but they may block it again at any time if they decide your email sending activity is not allowed. Vultr actually may re-block it if you use their servers to send newsletters.

Go to Kamatera website to create an account, then create your server in your account dashboard.

kamatera server types

I recommend following the tutorial linked below to properly set up your Linux VPS server on Kamatera.

Once you created a server, Kamatera will send you an email with the server SSH login details. To log into your server, you use an SSH client. If you are using Linux or macOS on your computer, then simply open up a terminal window and run the following command to log into your server. Replace 12.34.56.78 with your server’s IP address.

ssh [email protected]

You will be asked to enter the password.

You also need a domain name. I registered my domain name from NameCheap because the price is low and they give whois privacy protection free for life.

Step 2: Creating DNS MX Record

The MX record specifies which host or hosts handle emails for a particular domain name. For example, the host that handles emails for linuxbabe.com is mail.linuxbabe.com. If someone with a Gmail account sends an email to [email protected], then Gmail server will query the MX record of linuxbabe.com. When it finds out that mail.linuxbabe.com is responsible for accepting email, it then query the A record of mail.linuxbabe.com to get the IP address, thus the email can be delivered.

You can log in to your domain registrar’s website (such as NameCheap) to create DNS records.

In your DNS manager, create a MX record for your domain name. Enter @ in the Name field to represent the main domain name, then enter mail.your-domain.com in the Value field.

mail server DNS MX record

Note: The hostname for MX record can not be an alias to another name. Also, It’s highly recommended that you use hostnames, rather than bare IP addresses for MX record.

Your DNS manager may require you to enter a preference value (aka priority value). It can be any number between 0 and 65,356. A small number has higher priority than a big number. It’s recommended that you set the value to 0, so this mail server will have the highest priority for receiving emails. After creating MX record, you also need to create an A record for mail.your-domain.com , so that it can be resolved to an IP address. If your server uses IPv6 address, be sure to add AAAA record.

Hint: If you use Cloudflare DNS service, you should not enable the CDN feature when creating A record for mail.your-domain.com. Cloudflare does not support SMTP proxy.

Step 3: Configuring Hostname

Log into your server via SSH, then run the following command to update existing software packages.

sudo apt update;sudo apt upgrade

I strongly recommend creating a sudo user for managing your server rather than using the default root user. Run the following command to create a user. Replace username with your preferred username.

adduser username

adduser scalahosting

Then add the user to the sudo group.

adduser username sudo

Then switch to the new user.

su - username

Next, set a fully qualified domain name (FQDN) for your server with the following command.

sudo hostnamectl set-hostname mail.your-domain.com

We also need to update /etc/hosts file with a command line text editor like Nano.

sudo nano /etc/hosts

Edit it like below. (Use arrow keys to move the cursor in the file.)

127.0.0.1       mail.your-domain.com localhost

Save and close the file. (To save a file in Nano text editor, press Ctrl+O, then press Enter to confirm. To close the file, press Ctrl+X.)

To see the changes, log out and log back in, then run the following command to see your hostname.

hostname -f

Step 4: Setting up Mail Server on Debian 10 with iRedMail

Run the following commands to download the latest version of iRedMail script installer from its Github repository.

wget https://github.com/iredmail/iRedMail/archive/1.5.1.tar.gz

Extract the archived file.

tar xvf 1.5.1.tar.gz

Then cd into the newly-created directory.

cd iRedMail-1.5.1/

Add executable permission to the iRedMail.sh script.

chmod +x iRedMail.sh

Next, run the Bash script with sudo privilege.

sudo bash iRedMail.sh

The mail server setup wizard will appear. Use the tab key to select Yes and press Enter.

debian 10 buster-iredmail-server

The next screen will ask you to select the mail storage path. You can use the default one /var/vmail, so simply press Enter.

iredmail-1.0-default-storage-path

Then choose whether you want to run a web server. It’s highly recommended that you choose to run a web server because you need the web-based admin panel to add email accounts. Also it allows you to access the Roundcube webmail. By default, Nginx web server is selected, so you can simply press Enter. (An asterisk indicates the item is selected.)

iredmail-1.0-nginx-web-server

Then select the storage backend for email accounts. Choose one that you are familiar with. This tutorial chose MariaDB. Press up and down arrow key and press the space bar to select.

debian 10 email server

If you selected MariaDB or MySQL, then you will need to set the MySQL root password.

debian 10 mail server

Next, enter your first mail domain. You can add additional mail domains later in the web-based admin panel. This tutorial assumes that you want an email account like [email protected]. In that case, you need to enter your-domain.com here, without sub-domain. Do not press the space bar after your domain name. I think iRedMail will copy the space character along with your domain name, which can result in installation failure.

set-up-mail-server-on-debian-10-buster

Next, set a password for the mail domain administrator.

debian 10 email server step by step

Choose optional components. By default, 4 items are selected. If you like to have SOGo groupware, then select it and press Enter.

iredmail components

Now you can review your configurations. Type Y to begin the installation of all mail server components.

iredmail review

At the end of installation, choose y to use firewall rules provided by iRedMail and restart firewall.

iredmail-firewall-rules-fail2ban

Now iRedMail installation is complete. You will be notified the URL of webmail, SOGo groupware and web admin panel and the login credentials. The iRedMail.tips file contains important information about your iRedMail server.

iredmail-full-featured-mail-server

Reboot your Debian 10 server.

sudo shutdown -r now

Once your server is back online, you can visit the web admin panel.

https://mail.your-domain.com/iredadmin/

Note that in the above URL, the sub-directory for accessing the admin panel is /iredadmin/, not /iredmail/. And because it’s using a self-signed TLS certificate, you need to add security exception in your web browser.

Step 5: Installing Let’s Encrypt TLS Certificate

Since the mail server is using a self-signed TLS certificate, both desktop mail client users and webmail client users will see a warning. To fix this, we can obtain and install a free Let’s Encrypt TLS certificate.

Obtaining the Certificate

First, log into your server again via SSH and run the following command to install Let’s Encrypt (certbot) client on Debian 10.

sudo apt install certbot

iRedMail has already configured TLS settings in the default Nginx virtual host, so here I recommend using the webroot plugin, instead of nginx plugin, to obtain certificate. Run the following command. Replace red text with your actual data.

sudo certbot certonly --webroot --agree-tos --email [email protected] -d mail.your-domain.com -w /var/www/html/

When it asks you if you want to receive communications from EFF, you can choose No.

iredmail letsencrypt

If everything went well, you will see the following text indicating that you have successfully obtained a TLS certificate. Your certificate and chain have been saved at /etc/letsencrypt/live/mail.your-domain.com/ directory.

iredmail certbot

Failure to Obtain TLS Certificate

If certbot failed to obtain TLS certificate, maybe it’s because your DNS records are not propagated to the Internet. Depending on the domain registrar you use, your DNS record might be propagated instantly, or it might take up to 24 hours to propagate. You can go to https://dnsmap.io, enter your mail server’s hostname (mail.your-domain.com) to check DNS propagation.

If certbot failed to obtain a certificate and you saw the following message,

Failed authorization procedure. mail.linuxbabe.com (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching https://mail.linuxbabe.com/.well-known/acme-challenge/IZ7hMmRE4ZlGW7cXYoq2Lc_VrFzVFyfW6E0pzNlhiOA: Timeout during connect (likely firewall problem)

It might be that you have set AAAA record for mail.your-domain.com, but Nginx web server doesn’t listen on IPv6 address. To fix this error, edit the /etc/nginx/sites-enabled/00-default.conf file

sudo nano /etc/nginx/sites-enabled/00-default.conf

Find the following line.

#listen [::]:80;

Remove the # character to enable IPv6 for this Nginx virtual host.

listen [::]:80;

Save and close the file. Then edit the SSL virtual host /etc/nginx/sites-enabled/00-default-ssl.conf.

sudo nano /etc/nginx/sites-enabled/00-default-ssl.conf

Add the following line.

listen [::]:443 ssl http2;

iredmail certbot renew

Save and close the file. Then test Nginx configuration.

sudo nginx -t

If the test is successful, reload Nginx for the change to take effect.

sudo systemctl reload nginx

Run the following command again to obtain TLS certificate. Replace red text with your actual data.

sudo certbot certonly --webroot --agree-tos --email [email protected] -d mail.your-domain.com -w /var/www/html/

Now you should be able to successfully obtain TLS certificate.

Installing the Certificate in Nginx

After obtaining a TLS certificate, let’s configure Nginx web server to use it. Edit the SSL template file.

sudo nano /etc/nginx/templates/ssl.tmpl

Find the following 2 lines.

ssl_certificate /etc/ssl/certs/iRedMail.crt;
ssl_certificate_key /etc/ssl/private/iRedMail.key;

Replace them with:

ssl_certificate /etc/letsencrypt/live/mail.your-domain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mail.your-domain.com/privkey.pem;

Save and close the file. Then test nginx configuration and reload.

sudo nginx -t

sudo systemctl reload nginx

Visit iRedMail admin panel again (https://mail.your-domain.com/iredadmin/), your web browser won’t warn you any more because Nginx is now using a valid TLS certificate.

iredadmin

Installing TLS Certificate in Postfix and Dovecot

We also need to configure Postfix SMTP server and Dovecot IMAP server to use the Let’s Encrypt issued certificate so that desktop mail client won’t display security warning. Edit the main configuration file of Postfix.

sudo nano /etc/postfix/main.cf

Find the following 3 lines. (line 95, 96, 97).

smtpd_tls_key_file = /etc/ssl/private/iRedMail.key
smtpd_tls_cert_file = /etc/ssl/certs/iRedMail.crt
smtpd_tls_CAfile = /etc/ssl/certs/iRedMail.crt

Replace them with:

smtpd_tls_key_file = /etc/letsencrypt/live/mail.your-domain.com/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.your-domain.com/cert.pem
smtpd_tls_CAfile = /etc/letsencrypt/live/mail.your-domain.com/chain.pem

Save and close the file. Then reload Postfix.

sudo systemctl reload postfix

Next, edit the main configuration file of Dovecot.

sudo nano /etc/dovecot/dovecot.conf

Fine the following 2 lines. (line 47, 48)

ssl_cert = </etc/ssl/certs/iRedMail.crt
ssl_key = </etc/ssl/private/iRedMail.key

Replace them with:

ssl_cert = </etc/letsencrypt/live/mail.your-domain.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.your-domain.com/privkey.pem

Save and close the file. Then reload dovecot.

sudo systemctl reload dovecot

From now on, desktop mail users won’t see security warnings.

Step 6: Sending Test Email

Log into iredadmin panel with the postmaster mail account ([email protected]). In the Add tab, you can add additional domains or email addresses.

add email addresses in iredadmin

If you see “no domain under control” error, please refer to this article.

After you create a user, you can visit the Roundcube webmail address and login with the new mail user account.

https://mail.your-domain.com/mail/

iredmail roundcube webmail

Now you can test email sending and receiving. Please note that you may need to wait a few minutes to receive emails because iRedMail by default enables greylisting, which is a way to tell other sending SMTP servers to try again in a few minutes. The following line in mail log file /var/log/mail.log indicates greylisting is enabled.

Recipient address rejected: Intentional policy rejection, please try again later;

Adding Swap Space

ClamAV is used to scan viruses in email messages. ClamAV can use a fair amount of RAM. If there’s not enough RAM on your server, ClamAV won’t work properly, which will prevent your mail server from sending emails. You can add a swap file to your server to increase the total RAM on your server. (Note that using swap space on the server will degrade server performance. If you want better performance, you should upgrade the physical RAM instead of using swap space.)

To add swap space on the server, first, use the fallocate command to create a file. For example, create a file named swapfile with 1G capacity in root file system:

sudo fallocate -l 1G /swapfile

Then make sure only root can read and write to it.

sudo chmod 600 /swapfile

Format it to swap:

sudo mkswap /swapfile

Output:

Setting up swapspace version 1, size = 1024 MiB (1073737728 bytes)
no label, UUID=0aab5886-4dfb-40d4-920d-fb1115c67433

Enable the swap file

sudo swapon /swapfile

To mount the swap space at system boot time, edit the /etc/fstab file.

sudo nano /etc/fstab

Add the following line at the bottom of this file.

/swapfile    swap    swap     defaults    0   0

Save and close the file. Then reload systemd and restart ClamAV.

sudo systemctl daemon-reload

sudo systemctl restart clamav-daemon

Step 7: Checking If Port 25 (outbound) is blocked

Your ISP or hosting provider won’t block incoming connection to port 25 of your server, which means you can receive emails from other mail servers. However, many ISP/hosting providers block outgoing connection to port 25 of other mail servers, which means you can’t send emails.

If your email didn’t arrive at your other email address such as Gmail, then run the following command on your mail server to check if port 25 (outbound) is blocked.

telnet gmail-smtp-in.l.google.com 25

If it’s not blocked, you would see messages like below, which indicates a connection is successfully established. (Hint: Type in quit and press Enter to close the connection.)

Trying 74.125.68.26...
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP y22si1641751pll.208 - gsmtp

If port 25 (outbound) is blocked, you would see something like:

Trying 2607:f8b0:400e:c06::1a...
Trying 74.125.195.27...
telnet: Unable to connect to remote host: Connection timed out

In this case, your Postfix SMTP server can’t send emails to other SMTP servers. Ask your ISP/hosting provider to open it for you. If they refuse your request, you need to set up SMTP relay to bypass port 25 blocking.

Still Can’t Send Email?

If port 25 (outbound) is not blocked, but you still can’t send emails from your own mail server to your other email address like Gmail, then you should check the mail log (/var/log/mail.log).

sudo nano /var/log/mail.log

For example, some folks might see the following lines in the file.

host gmail-smtp-in.l.google.com[2404:6800:4003:c03::1b] said: 550-5.7.1 [2a0d:7c40:3000:b8b::2] Our system has detected that 550-5.7.1 this message does not meet IPv6 sending guidelines regarding PTR 550-5.7.1 records and authentication. Please review 550-5.7.1 https://support.google.com/mail/?p=IPv6AuthError for more information

This means your mail server is using IPv6 to send the email, but you didn’t set up IPv6 records. You should go to your DNS manager, set AAAA record for mail.your-domain.com, then you should set PTR record for your IPv6 address, which is discussed in step 9.

Step 8: Using Mail Clients on Your Computer or Mobile Device

Fire up your desktop email client such as Mozilla Thunderbird and add a mail account.

  • In the incoming server section, select IMAP protocol, enter mail.your-domain.com as the server name, choose port 143 and STARTTLS. Choose normal password as the authentication method.
  • In the outgoing section, select SMTP protocol, enter mail.your-domain.com as the server name, choose port 587 and STARTTLS. Choose normal password as the authentication method.

ubuntu postfix dovecot letsencrypt https

Fail2ban Blocking Your Own IP Address

If you made a mistake and failed to log in to mail server multiple times, then the Fail2ban service on the mail server might block your IP address. You can add your IP address to whitelist by editing the jail.local file.

sudo nano /etc/fail2ban/jail.local

Add your own IP address to the ignore list like below. Replace 12.34.56.78 with your real IP address.

ignoreip = 12.34.56.78 127.0.0.1 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16

Save and close the file. Then restart Fail2ban.

sudo systemctl restart fail2ban

Step 9: Improving Email Deliverablity

To prevent your emails from being flagged as spam, you should set PTR, SPF, DKIM and DMARC records.

PTR record

A pointer record, or PTR record, maps an IP address to a FQDN (fully qualified domain name). It’s the counterpart to the A record and is used for reverse DNS lookup, which can help with blocking spammers. Many SMTP servers reject emails if no PTR record is found for the sending server.

To check the PTR record for an IP address, run this command:

dig -x IP-address +short

or

host IP-address

PTR record isn’t managed by your domain registrar. It’s managed by the organization that gives you an IP address. Because you get IP address from your hosting provider or ISP, not from your domain registrar, so you must set PTR record for your IP in the control panel of your hosting provider, or ask your ISP. Its value should be your mail server’s hostname: mail.your-domain.com. If your server uses IPv6 address, be sure to add a PTR record for your IPv6 address as well.

To edit the reverse DNS record for your Kamatera VPS, log into the Kamatera client area, then open a support ticket and tell them to add PTR record for your server IP addresss to point the IP address to mail.your-domain.com. It’s not convenient, you might think, but this is to keep spammers away from the platform, so legitimate email senders like us will have a great IP reputation.

SPF Record

SPF (Sender Policy Framework) record specifies which hosts or IP address are allowed to send emails on behalf of a domain. You should allow only your own email server or your ISP’s server to send emails for your domain. In your DNS management interface, create a new TXT record like below.

iredmail SPF record

Explanation:

  • TXT indicates this is a TXT record.
  • Enter @ in the name field to represent the main domain name.
  • v=spf1 indicates this is a SPF record and the version is SPF1.
  • mx means all hosts listed in the MX records are allowed to send emails for your domain and all other hosts are disallowed.
  • ~all indicates that emails from your domain should only come from hosts specified in the SPF record. Emails that are from other hosts will be flagged as forged.

To check if your SPF record is propagated to the public Internet, you can use the dig utility on your Linux machine like below:

dig your-domain.com txt

The txt option tells dig that we only want to query TXT records.

DKIM Record

DKIM (DomainKeys Identified Mail) uses a private key to digitally sign emails sent from your domain. Receiving SMTP servers verify the signature by using the public key, which is published in the DNS DKIM record.

The iRedMail script automatically configured DKIM signing and verification for your server. The only thing left to do is creating DKIM record in DNS manager. Run the following command show the DKIM public key.

sudo amavisd-new showkeys

The DKIM public key is in the parentheses.

iredmail amavis dkim

Then in your DNS manager, create a TXT record, enter dkim._domainkey in the name field. Copy everything in the parentheses and paste into the value field. Delete all double quotes and line breaks.

amavisd-new debian

After saving your changes, run the following command to test if your DKIM record is correct.

sudo amavisd-new testkeys

If the DKIM record is correct, the test will pass. Note that your DKIM record may need sometime to propagate to the Internet. Depending on the domain registrar you use, your DNS record might be propagated instantly, or it might take up to 24 hours to propagate. You can go to https://www.dmarcanalyzer.com/dkim/dkim-check/, enter dkim as the selector and enter your domain name to check DKIM record propagation.

TESTING#1 linuxbabe.com: dkim._domainkey.linuxbabe.com => pass

DMARC Record

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. DMARC can help receiving email servers to identify legitimate emails and prevent your domain name from being used by email spoofing.

To create a DMARC record, go to your DNS manager and add a TXT record. In the name field, enter _dmarc. In the value field, enter the following. (You should create the [email protected] email address.)

v=DMARC1; p=none; pct=100; rua=mailto:[email protected]

create dmarc record txt

The above DMARC record is a safe starting point. To see the full explanation of DMARC, please check the following article.

Step 10: Testing Email Score and Placement

After creating PTR, SPF, DKIM record, go to https://www.mail-tester.com. You will see a unique email address. Send an email from your domain to this address and then check your score. As you can see, I got a perfect score. In the test result, you should check if your PTR record, SPF and DKIM record is valid.

Testing Email Score and PlacementMail-tester.com can only show you a sender score. There’s another service called GlockApps that allow you to check if your email is landed in the recipient’s inbox or spam folder, or rejected outright. It supports many popular email providers like Gmail, Outlook, Hotmail, YahooMail, iCloud mail, etc

glockapps-email-placement-test-scalahosting-vps

Email is Rejected by Microsoft Mailbox?

Microsoft uses an internal blacklist that blocks many legitimate IP addresses. If your emails are rejected by Outlook or Hotmail, you need to follow the tutorial linked below to bypass Microsoft Outlook blacklist.

Your Emails Are Still Being Marked as Spam?

I have more tips for you in this article: How to stop your emails being marked as spam. Although it will take some time and effort, your emails will eventually be placed in inbox after applying these tips.

Adding Multiple Mail Domains

I wrote this article to show you how to add multiple mail domains in iRedMail.

How to Disable Greylisting

By default, iRedMail has enabled greylisting, which tells other sending SMTP servers to try again in a few minutes. This is mainly useful to block spam, but it also degrades user experience. If you prefer to disable greylisting, follow the instructions below.

Add write permission to the /opt/iredapd/settings.py file.

sudo chmod 600 /opt/iredapd/settings.py

Then edit the configuration file.

sudo nano /opt/iredapd/settings.py

Find the following line.

plugins = ["reject_null_sender", "wblist_rdns", "reject_sender_login_mismatch", "greylisting", "throttle", "amavisd_wblist", "sql_alias_access_policy"]

Remove "greylisting" from the list. Save and close the file. Then restart iredapd.

sudo systemctl restart iredapd

Change the configuration file back to read only mode.

sudo chmod 400 /opt/iredapd/settings.py

Enabling SMTPS Port 465

If you are going to use Microsoft Outlook client, then you need to enable SMTPS port 465 in Postfix SMTP server.

Troubleshooting

First, please use a VPS with at least 4GB RAM. Running iRedMail on a 1GB RAM VPS will cause the database, SpamAssassin, or ClamAV to be killed because of out-of-memory problem. If you insist on using a 1GB RAM VPS, you are going to lose incoming emails and have other undesirable outcomes.

If the iRedMail web interface isn’t accessible, like a 502 gateway error, you should check the Nginx logs in /var/log/nginx/ directory to find clues. You may also want to check the mail log /var/log/mail.log.

Check if the various services are running.

systemctl status postfix

systemctl status dovecot

systemctl status nginx

systemctl status mariadb

systemctl status clamav-daemon

systemctl status amavis

systemctl status php7.3-fpm

systemctl status iredadmin

If you enabled the firewall, you should open the following ports in the firewall.

HTTP port:  80
HTTPS port: 443
SMTP port:  25
Submission port: 587 (and 465 if you are going to use Microsoft Outlook mail client)
IMAP port:  143 and 993

If you would like to use the UFW firewall, check my guide here: Getting started with UFW firewall on Debian and Debian.

How to Renew TLS Certificate

Let’s Encrypt issued TLS certificate is valid for 90 days only and it’s important that you set up a Cron job to automatically renew the certificate. You can run the following command to renew certificate.

sudo certbot renew -w /var/www/html

You can use the --dry-run option to test the renewal process, instead of doing a real renewal.

sudo certbot renew -w /var/www/html --dry-run

If you see the following error when renewing TLS certificate.

The client lacks sufficient authorization :: Invalid response

Then you need to create the hidden directory.

sudo mkdir -p /var/www/html/.well-known/acme-challenge

And set www-data as the owner of the webroot.

sudo chown www-data:www-data /var/www/html/ -R

Also, edit the SSL virtual host /etc/nginx/sites-enabled/00-default-ssl.conf. Add the following lines.

location ~ /.well-known/acme-challenge {
     root /var/www/html/;
     allow all;
}

iredmail letsencrypt renew

Save and close the file. Test Nginx configuration and reload.

sudo nginx -t
sudo systemctl reload nginx

Create Cron Job

If now the dry run is successful, you can create Cron job to automatically renew certificate. Simply open root user’s crontab file.

sudo crontab -e

Then add the following line at the bottom of the file.

@daily certbot renew -w /var/www/html --quiet && systemctl reload postfix dovecot nginx

Reloading Postfix, Dovecot and Nginx is necessary to make these programs pick up the new certificate and private key.

For Advanced Users

You may want to customize the SpamAssassin content filter to better detect spam.

If your website and mail server are running on two different VPS (virtual private server), you can set up SMTP relay between your website and mail server, so that your website can send emails through your mail server. See the following article. (It’s written for Ubuntu, but also works on Debian).

Wrapping Up

That’s it! I hope this tutorial helped you set up a mail server on Debian 10 with iRedMail. As always, if you found this post useful, then subscribe to our free newsletter to get more tips and tricks. Take care 🙂

Rate this tutorial
[Total: 15 Average: 5]

39 Responses to “How to Easily Set Up a Mail Server on Debian 10 Buster with iRedMail

  • This is a great tutorial, thanks for your effort.

  • rudy de haas
    3 years ago

    hi:

    This looks very nice – and I’d love to use it. However… I need apache2 for several of the other things that have to run.

    Any hope of an apache2 version?

    • Xiao Guoan (Admin)
      2 years ago

      The software author dropped Apache support years ago.

  • rudy de haas
    3 years ago

    hi:

    This worked very well – many thanks!

    One problem came up because I loaded debian buster from scratch and then ran your scripts. Debian’s default includes apache2 so your install faulted on nginx – to fix this just make a note early on that people should check to ensure that apache2 is not running:

    % systemctl stop apache2
    % systemctl disable apache2

    Other than that? whee…. (now I need to learn to work with nginx, but hey..)

  • This tutorial is absolutely brilliant! Thank you very much for this.

  • Nice guide. I am worried about security of it and i would like to ask about it. i got a system with a pubic IP address. Once iredmail is up and running i see in the logs a gazillion of IPs trying to get access to SMTP and other services. Is there a way to protect the system becoming a relay for spammers?

  • thank you so much, excellent writeup, worked for me first time round!
    just to ‘future-proof’ this; the current iRedMail release is v 1.3.2
    once a new version comes out, is there any way up upgrading? or would I need a new install?

  • again thank you , amazing tutorial, but just a comment re ‘What if Your Email is Rejected by Microsoft Mailbox?’
    you write ‘ If your emails are rejected by Outlook or Hotmail, you need to submit the sender information form. After that, your email will be accepted by Outlook/Hotmail.’

    I wish it was that simple, I did as you suggested, still emails not received by a friend who uses hotmail, so contacting Microsoft as per the link only to get this response:

    'Dear ...
    
    We have completed reviewing the IP(s) you submitted. The following table contains the results of our investigation.
    
    Not qualified for mitigation
    {my IP address}
    Our investigation has determined that the above IP(s) do not qualify for mitigation.
    
    Please ensure your emails comply with the Outlook.com policies, practices and guidelines found here: http://mail.live.com/mail/policies.aspx.
    
    To have Deliverability Support investigate further, please reply to this email with a detailed description of the problem you are having, including specific error messages, and an agent will contact you.
    unk Email Reporting program (JMRP) When an Outlook.com user marks an email as "junk", senders enrolled in this program get a copy of the mail forwarded to the email address of their choice. It allows senders to see which mails are being marked as junk and to identify mail traffic you did not intend to send. To join, please visit http://support.msn.com/eform.aspx?productKey=edfsjmrpp&page=support_home_options_form_byemail&ct=eformts.
    
    Smart Network Data Services program (SNDS). This program allows you to monitor the ‘health’ and reputation of your registered IPs by providing data about traffic such as mail volume and complaint rates seen originating from your IPs. To register, please visit http://postmaster.live.com/snds/.
    
    There is no silver bullet to maintaining or improving good IP reputation, but these programs help you proactively manage your email eco-system to help better ensure deliverability to Outlook.com users.
    
    Thank you,
    
    Outlook.com Deliverability Support'
    

    if you google ‘Our investigation has determined that the above IP(s) do not qualify for mitigation.’ you will find lots of people complaining about Microsoft regarding this issue, including people who say have been running a website with associated email and an IP address for many years but after change in IP address emails don’t get delivered to outlook/hotmail etc anymore.

  • apologies! I didn’t realise you had written an entire article on Microsoft and email deliverability!
    (link https://www.linuxbabe.com/mail-server/microsoft-outlook-ip-blacklist)

  • Psiu Cose
    3 years ago

    Ei amigo porque sempre menciona a porta 25 e diz configurar a 587 no Thunderbird?!

    • Xiao Guoan (Admin)
      3 years ago

      When you click the “send” button in an email client like Mozilla Thunderbird, the email client submits the email to your SMTP server, which then sends the email to the recipient’s SMTP server.

      Email submission uses ports 587 or 465. Port 25 is used for SMTP Server to SMTP server communication.

  • Psiu Cose
    3 years ago

    “Submission” requires port 25 unlocked?!

    • Xiao Guoan (Admin)
      3 years ago

      When you click the “send” button in an email client like Mozilla Thunderbird, the email client submits the email to your SMTP server, which then sends the email to the recipient’s SMTP server. The recipient can use his/her own email client to download the email from his/her own SMTP server via the POP3 protocol or IMAP protocol.

      Email submission uses ports 587 or 465. Port 25 is used for SMTP server to SMTP server communication.

  • Patrick L
    3 years ago

    I have a question, I am getting an error using the amavisd-new testkeys script.

    invalid (public key: not available)

    I’m not sure if something is not linking up properly, recieving a 6.9 score via mail-tester due to a DKIM key issue grade -3

    I do have a record setup through the domain name provider and is it correctly displayed in the header.

    • Xiao Guoan (Admin)
      3 years ago

      Your DKIM record may need sometime to propagate to the Internet. Depending on the domain registrar you use, your DNS record might be propagated instantly, or it might take up to 24 hours to propagate. You can go to https://www.dmarcanalyzer.com/dkim/dkim-check/, enter dkim as the selector and enter your domain name to check DKIM record propagation.

      • Patrick L
        3 years ago

        Hey thanks for the response Xiao, I actually found the problem. amavisd public key invalid due to not signing emails/DKIM_key. DNS record was fine too, so I generated a new RSA. The main problem for this is because of the sub-domain and domain conflict. It was signing emails for the following, “mydomain.org” when it should have been signing for “mail.mydomain.org”. The issue was found in the header file of an email under ‘d=’ area. Fixed with the following:
        –generated whole new key
        amavisd-new genrsa /var/lib/dkim/mail.newdomain.org.pem 2048
        chown amavis:amavis /var/lib/dkim/mail.newdomain.org.pem
        chmod 0400 /var/lib/dkim/mail.newdomain.org.pem
        –modify the following lines amavisd.conf file
        dkim_key(‘mydomain.com’, “dkim”, “/var/lib/dkim/mydomain.com.pem”);
        Add one line after above line like below:
        dkim_key(‘new_domain.com’, “dkim”, “/var/lib/dkim/new_domain.com.pem”);
        –find below setting in Amavisd config file
        @dkim_signature_options_bysender_maps = ( {

        “mydomain.com” => { d => “mydomain.com”, a => ‘rsa-sha256’, ttl => 10*24*3600 },

        });
        –Add one line after “mydomain.com” line like below:
        @dkim_signature_options_bysender_maps = ( {

        “mydomain.com” => { d => “mydomain.com”, a => ‘rsa-sha256’, ttl => 10*24*3600 },
        “new_domain.com” => { d => “new_domain.com”, a => ‘rsa-sha256’, ttl => 10*24*3600 },

        });
        –restart amavisd service, change the DNS record with new key (unless done so already) and wait for global changes, then test the new keys. More indepth guide(s) can be found directly from https://docs.iredmail.org/

  • SharamK
    3 years ago

    Ahhh, just noticed the “clean install of Debian 10 server” which was under how to setup Debian on a VPS and I already had Debian installed on my dedicated, have domain name registered with proper records, so I scrolled passed it. DUHH

    Will do this on a clean install before installing anything else

  • cabanni
    3 years ago

    Hello,
    how does it behave if you would run the mailserver not under “mail.your-server.com” but under “your-server.com” and at the same time run an apache webserver under “your-server.com”?

    • Xiao Guoan (Admin)
      3 years ago

      It would fail. Best practices for running iRedMail:

      1.) Use a clean fresh Debian server.

      2.) Make sure your server has at least 2GB RAM.

  • Chung Lung
    3 years ago

    RHEL 8.3

    all you get is this error no matter what version of the instructions on this site or iRedMail site:

    ********* ERROR *********
    Release version of the operating system on this server is unsupported by
    iRedMail, please access below link to get the latest iRedMail and a list
    of supported Linux/BSD distributions and release versions.

    http://www.iredmail.org/download.html

    • Xiao Guoan (Admin)
      3 years ago

      iRedMail doesn’t support RHEL 8.3. I just updated my setting up email server on CentOS 8/RHEL 8 from scratch tutorial series. You can follow this tutorial series.

      • Chung Lung
        3 years ago

        Did you test the tutorial using RHEL 8.3? or what version of RHEL did you test it on? I have been trying to follow numerous tutorials and with each one I run into a problem because the packages are ever changing. I am using RHEL 8.3 because Red Hat is giving away 16 free licenses for developer accounts rather than using Centos since it won’t be supported soon.

        https://arstechnica.com/gadgets/2020/12/centos-shifts-from-red-hat-unbranded-to-red-hat-beta/

        https://developers.redhat.com/articles/faqs-no-cost-red-hat-enterprise-linux

        Thank you.

    • Xiao Guoan (Admin)
      3 years ago

      I tested it with RHEL 8.3.

  • 1.4.2 is the last version that works with Debian 10. There is an issue with PHP-FPM that prevents later versions from working. Debian 11 is necessary to use later versions, 1.5.0 and 1.5.1. To install 1.4.2, you need to download and extract it then make the directory runtime inside the iRedMail-1.4.2 directory then inside that the file install.status (so it’s iRedMail-1.4.2/runtime/install.status) and the file needs “export status_check_new_iredmail=DONE” (no quotes) to trick the installer into skipping the new version check.

    • Also I should say that you can upgrade to later versions on Debian 10, 1.4.2 is just the latest that can be installed successfully.

  • Alejandro
    2 years ago

    this is only for nginx? or maybe can be for apache compatible?

  • Fernando
    2 years ago

    I installed version 1.5.1 over debian 11, I have the certs so I didn’t use the cerbot, I’ve installed the rest following this guide, which is very very usefull, great job. I had a problem with amavis that after some time it shutdowns and refuse to connect since then. After some struggling and google search I think I manage to overcome the problem. For that what I did was:

    Use 4GB of RAM(I think this can be reduced but still I didn’t test it) of ram and 4GB of swap.
    I did run sa-update –nogpg –channel updates.spamassassin.org following a comment, don’t know if it really helps
    The fix was to change in /etc/amavis/conf.d/50-user max_servers =1 to max_servers=2 . I still have to change master.cf or main.cf to match it, but since then it appears be running steady.

    Just sharing my experience as I struggled with it for some days

  • Fernando
    2 years ago

    After a week it is working fine, I edited master.cf to match the max_servers and all keep working fine

  • very buggy by following this tutorial.
    iredmail ALWAYS installs php 7.3 and 7.4
    i always get if i go to https://mail.mydomain/mail
    an 502 error.
    and port 578 is always closed.

    even i follow every steps correctly.
    even i try after with error logs to fix the issues, there is no fix to fix all the bugs.

    • Xiao Guoan (Admin)
      2 years ago

      1. As mentioned in step 1, it is highly recommended that you install iRedMail on a clean install of Debian 10 server. If your existing server has installed other applications, it might not work and even break your existing application.

      2. If you use the ufw firewall, open the HTTP ports with:

      sudo ufw allow 80/tcp
      
      sudo ufw allow 443/tcp
      

      And open the SMTP/IMAP ports.

      sudo ufw allow 25/tcp
      
      sudo ufw allow 587/tcp
      
      sudo ufw allow 143/tcp
      
      sudo ufw allow 993/tcp
      

      3. Edit the /etc/nginx/conf-available/php_fpm.conf file, make sure you have the following lines.

      upstream php_workers {
          server unix:/run/php/php7.3-fpm.sock;
      }
      

      Then restart Nginx.

      sudo systemctl restart nginx

      4. Yes, iRedMail will always install PHP7.3 on Debian 10. If you want to use PHP8.0 or PHP8.1, you need to configure it by yourself.

  • LordPsyan
    2 years ago

    Why can I not remotely connect to mysql? I commented out bind address 127.0.0.1 in 50-server.cnf and restarted mariadb, but still nothing.

    • LordPsyan
      2 years ago

      Never-mind. I had to add port 3306 to /etc/nftables.conf and it allowed access.

  • slotpg
    1 year ago

    Howdy! This post couldn’t be written much better! Reading through this article reminds me of my previous roommate!
    He constantly kept talking about this.
    I most certainly will send this information to him.
    Pretty sure he’ll have a great read. Thank you for
    sharing!

  • Hi Xiao Guoan, thanks for the excellent tutorial. I followed this guide and successfully installed iredmail about a year ago. Now I’m trying to upgrade iredmail to it’s latest version. Unfortunately, I’m stuck at upgrading Roundcube. Do you have a tutorial on how to do this? Thanks.

Leave a Comment

  • Comments with links are moderated by admin before published.
  • Your email address will not be published.
  • Use <pre> ... </pre> HTML tag to quote the output from your terminal/console.
  • Please use the community (https://community.linuxbabe.com) for questions unrelated to this article.
  • I don't have time to answer every question. Making a donation would incentivize me to spend more time answering questions.

The maximum upload file size: 2 MB. You can upload: image. Links to YouTube, Facebook, Twitter and other services inserted in the comment text will be automatically embedded. Drop file here