How to Easily Set up a Full-Fledged Mail Server on Ubuntu 20.04 with iRedMail

Setting up your own email server on Linux from scratch is a long and tedious process, a pain in the butt if you are not an advanced user. This tutorial will be showing you how to use iRedMail to quickly set up a full-featured mail server on Ubuntu 20.04, saving you lots of time and headaches.

What is iRedMail?

iRedMail is a shell script that automatically installs and configures all necessary mail server components on your Linux/BSD server, thus eliminating manual installation and configuration. With iRedMail, you can easily create unlimited mailboxes and unlimited mail domains in a web-based admin panel. Mailboxes can be stored in MariaDB/MySQL, PostgreSQL database, or OpenLDAP. The following is a list of open-source software that will be automatically installed and configured by iRedMail.

  • Postfix SMTP server
  • Dovecot IMAP server
  • Nginx web server to serve the admin panel and webmail
  • OpenLDAP, MySQL/MariaDB, or PostgreSQL for storing user information
  • Amavised-new for DKIM signing and verification
  • SpamAssassin for anti-spam
  • ClamAV for anti-virus
  • Roundcube webmail
  • SOGo groupware, providing webmail, calendar (CalDAV), contacts (CardDAV), tasks and ActiveSync services.
  • Fail2ban for protecting SSH
  • mlmmj mailing list manager
  • Netdata server monitoring
  • iRedAPD Postfix policy server for greylisting

Step 1: Choose the Right Hosting Provider and Buy a Domain Name

To set up a complete email server with iRedMail, you need a server with at least 2GB RAM, because after the installation, your server will use more than 1GB of RAM. This tutorial is done on a $8.99/month Hostwinds VPS (virtual private server). I recommend Hostwinds because it does not block port 25, so you can send unlimited emails (transactional email and newsletter) without spending money on SMTP relay service. Hostwinds doesn’t have any SMTP limits. You can send a million emails per day.

Other VPS providers like DigitalOcean blocks port 25. DigitalOcean would not unblock port 25, so you will need to set up SMTP relay to bypass blocking, which can cost you additional money. If you use Vultr VPS, then port 25 is blocked by default. They can unblock it if you open a support ticket, but they may block it again at any time if they decide your email sending activity is not allowed. Vultr actually may re-block it if you use their servers to send newsletters.

Go to Hostwinds website to create an account. Choose the 2GB unmanaged Linux VPS plan.

hostwinds mail server

Once you created an account, Hostwinds will send you an email with the server SSH login details. To log into your server, you use an SSH client. If you are using Linux or macOS on your computer, then simply open up a terminal window and run the following command to log into your server. Replace 12.34.56.78 with your server’s IP address.

ssh root@12.34.56.78

You will be asked to enter the password. If you are using Windows, please read the following article on how to use SSH client.

It is highly recommended that you follow the instructions below on a clean install of Ubuntu 20.04 system. Installing a piece of complex server software like iRedMail on a non-LTS Ubuntu is discouraged as you will probably encounter problems when upgrading your OS every 9 months. The software author doesn’t have time to support every Ubuntu release. It is far better for your mail server to stay stable for 2 or 5 years.

You also need a domain name. I registered my domain name from NameCheap because the price is low and they give whois privacy protection free for life.

Step 2: Creating DNS MX Record

The MX record specifies which host or hosts handle emails for a particular domain name. For example, the host that handles emails for linuxbabe.com is mail.linuxbabe.com. If someone with a Gmail account sends an email to somebody@linuxbabe.com, then Gmail server will query the MX record of linuxbabe.com. When it finds out that mail.linuxbabe.com is responsible for accepting email, it then query the A record of mail.linuxbabe.com to get the IP address, thus the email can be delivered.

You need to go to your DNS hosting service (usually your domain registrar) to create DNS records. In your DNS manager, create a MX record for your domain name. Enter @ in the Name field to represent the main domain name, then enter mail.your-domain.com in the Value field.

iredmail email server create MX record

Note: The hostname for MX record can not be an alias to another name. Also, It’s highly recommended that you use hostnames, rather than bare IP addresses for MX record.

Your DNS manager may require you to enter a preference value (aka priority value). It can be any number between 0 and 65,356. A small number has higher priority than a big number. It’s recommended that you set the value to 0, so this mail server will have the highest priority for receiving emails. After creating MX record, you also need to create an A record for mail.your-domain.com , so that it can be resolved to an IP address. If your server uses IPv6 address, be sure to add AAAA record.

Hint: If you use Cloudflare DNS service, you should not enable the CDN feature when creating A record for mail.your-domain.com. Cloudflare does not support SMTP proxy.

Step 3: Configuring Hostname

Log into your server via SSH, then run the following command to update existing software packages.

sudo apt update

sudo apt upgrade -y

And set a fully qualified domain name (FQDN) for your server with the following command.

sudo hostnamectl set-hostname mail.your-domain.com

We also need to update /etc/hosts file with a command line text editor like Nano.

sudo nano /etc/hosts

Edit it like below. (Use arrow keys to move the cursor in the file.)

127.0.0.1       mail.your-domain.com localhost

Save and close the file. (To save a file in Nano text editor, press Ctrl+O, then press Enter to confirm. To close the file, press Ctrl+X.)

To see the changes, re-login and then run the following command to see your hostname.

hostname -f

Step 4: Setting up Mail Server on Ubuntu 20.04 with iRedMail

Run the following commands to download the latest version of iRedMail script installer from its Github repository.

wget https://github.com/iredmail/iRedMail/releases/download/1.3.1/iRedMail-1.3.1.tar.gz

Extract the archived file.

tar xvf iRedMail-1.3.1.tar.gz

Then cd into the newly-created directory.

cd iRedMail-1.3.1/

Add executable permission to the iRedMail.sh script.

chmod +x iRedMail.sh

Next, run the Bash script with sudo privilege.

sudo bash iRedMail.sh

The mail server setup wizard will appear. Use the Tab key to select Yes and press Enter.

ubuntu-20.04-iredmail-server

The next screen will ask you to select the mail storage path. You can use the default path: /var/vmail, so simply press Enter.

iredmail-server-default-storage-path

Then choose whether you want to run a web server. It’s highly recommended that you choose to run a web server because you need the web-based admin panel to add email accounts. Also, it allows you to access the Roundcube webmail. By default, Nginx web server is selected, so you can simply press Enter. (An asterisk indicates the item is selected.)

iredmail-nginx-web-server

Then select the storage backend for email accounts. Choose one that you are familiar with. This tutorial chose MariaDB. Press up and down arrow key and press the space bar to select.

ubuntu-20.04-email-server

If you selected MariaDB or MySQL, then you will need to set the MySQL root password.

ubuntu-20.04-mail-server

Next, enter your first mail domain. You can add additional mail domains later in the web-based admin panel. This tutorial assumes that you want an email account like john.doe@your-domain.com. In that case, you need to enter your-domain.com here, without sub-domain. Do not press the space bar after your domain name. I think iRedMail will copy the space character along with your domain name, which can result in installation failure.

set-up-mail-server-on-ubuntu-20.04

Next, set a password for the mail domain administrator.

ubuntu-20.04-email-server-step-by-step

Choose optional components. By default, 4 items are selected. If you like to use the SOGo groupware (webmail, calendar, address book, ActiveSync), then press the down arrow key and space bar to select. Press Enter to the next screen.

iredmail-optional-components-sogo-groupware

Now you can review your configurations. Type Y to begin the installation of all mail server components.

ubuntu iredmail config review

At the end of installation, choose y to use firewall rules provided by iRedMail and restart firewall.

iredmail-firewall-rules-fail2ban

Now iRedMail installation is complete. You will be notified the URL of webmail, web admin panel and the login credentials. The iRedMail.tips file contains important information about your iRedMail server.

iredmail-full-featured-mail-server-setup-complete

Reboot your Ubuntu 20.04 server.

sudo shutdown -r now

Once your server is back online, you can visit the web admin panel.

https://mail.your-domain.com/iredadmin/

Note that in the above URL, the sub-directory for accessing the admin panel is /iredadmin/, not /iredmail/. And because it’s using a self-signed TLS certificate, you need to add security exception in your web browser.

Step 5: Installing Let’s Encrypt TLS Certificate

Since the mail server is using a self-signed TLS certificate, both desktop mail client users and webmail client users will see a warning. To fix this, we can obtain and install a free Let’s Encrypt TLS certificate.

Obtaining the Certificate

First, log in to your server again via SSH and run the following command to install Let’s Encrypt (certbot) client on Ubuntu 20.04.

sudo apt install certbot

iRedMail has already configured TLS settings in the default Nginx virtual host, so here I recommend using the webroot plugin, instead of nginx plugin, to obtain a certificate. Run the following command. Replace the red text with your actual data.

sudo certbot certonly --webroot --agree-tos --email you@example.com -d mail.your-domain.com -w /var/www/html/

When it asks you if you want to receive communications from EFF, you can choose No.

iredmail letsencrypt

If everything went well, you will see the following text indicating that you have successfully obtained a TLS certificate. Your certificate and chain have been saved at /etc/letsencrypt/live/mail.your-domain.com/ directory.

iredmail certbot

Failure to Obtain TLS Certificate

If certbot failed to obtain TLS certificate, maybe it’s because your DNS records are not propagated to the Internet. Depending on the domain registrar you use, your DNS record might be propagated instantly, or it might take up to 24 hours to propagate. You can go to https://dnsmap.io, enter your mail server’s hostname (mail.your-domain.com) to check DNS propagation.

If certbot failed to obtain a certificate and you saw the following message,

Failed authorization procedure. mail.linuxbabe.com (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching https://mail.linuxbabe.com/.well-known/acme-challenge/IZ7hMmRE4ZlGW7cXYoq2Lc_VrFzVFyfW6E0pzNlhiOA: Timeout during connect (likely firewall problem)

It might be that you have set AAAA record for mail.your-domain.com, but Nginx web server doesn’t listen on IPv6 address. To fix this error, edit the /etc/nginx/sites-enabled/00-default.conf file

sudo nano /etc/nginx/sites-enabled/00-default.conf

Find the following line.

#listen [::]:80;

Remove the # character to enable IPv6 for this Nginx virtual host.

listen [::]:80;

Save and close the file. Then edit the SSL virtual host /etc/nginx/sites-enabled/00-default-ssl.conf.

sudo nano /etc/nginx/sites-enabled/00-default-ssl.conf

Add the following line.

listen [::]:443 ssl http2;

iredmail certbot renew

Save and close the file. Then test Nginx configuration.

sudo nginx -t

If the test is successful, reload Nginx for the change to take effect.

sudo systemctl reload nginx

Run the following command again to obtain TLS certificate. Replace red text with your actual data.

sudo certbot certonly --webroot --agree-tos --email you@example.com -d mail.your-domain.com -w /var/www/html/

Now you should be able to successfully obtain TLS certificate.

Installing the Certificate in Nginx

After obtaining a TLS certificate, let’s configure Nginx web server to use it. Edit the SSL template file.

sudo nano /etc/nginx/templates/ssl.tmpl

Find the following 2 lines.

ssl_certificate /etc/ssl/certs/iRedMail.crt;
ssl_certificate_key /etc/ssl/private/iRedMail.key;

Replace them with:

ssl_certificate /etc/letsencrypt/live/mail.your-domain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mail.your-domain.com/privkey.pem;

Save and close the file. Then test nginx configuration and reload.

sudo nginx -t

sudo systemctl reload nginx

Visit iRedMail admin panel again, your web browser won’t warn you any more because Nginx is now using a valid TLS certificate.

iredadmin

Installing TLS Certificate in Postfix and Dovecot

We also need to configure Postfix SMTP server and Dovecot IMAP server to use the Let’s Encrypt issued certificate so that desktop mail client won’t display security warning. Edit the main configuration file of Postfix.

sudo nano /etc/postfix/main.cf

Find the following 3 lines. (line 95, 96, 97).

smtpd_tls_key_file = /etc/ssl/private/iRedMail.key
smtpd_tls_cert_file = /etc/ssl/certs/iRedMail.crt
smtpd_tls_CAfile = /etc/ssl/certs/iRedMail.crt

Replace them with:

smtpd_tls_key_file = /etc/letsencrypt/live/mail.your-domain.com/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.your-domain.com/cert.pem
smtpd_tls_CAfile = /etc/letsencrypt/live/mail.your-domain.com/chain.pem

Save and close the file. Then reload Postfix.

sudo systemctl reload postfix

Next, edit the main configuration file of Dovecot.

sudo nano /etc/dovecot/dovecot.conf

Fine the following 2 lines. (line 47, 48)

ssl_cert = </etc/ssl/certs/iRedMail.crt
ssl_key = </etc/ssl/private/iRedMail.key

Replace them with:

ssl_cert = </etc/letsencrypt/live/mail.your-domain.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.your-domain.com/privkey.pem

Save and close the file. Then reload dovecot.

sudo systemctl reload dovecot

From now on, desktop mail users won’t see security warnings.

Step 6: Sending Test Email

Log into iredadmin panel with the postmaster mail account (postmaster@your-domain.com). In the Add tab, you can add additional domains or email addresses.

add email addresses in iredadmin

If you see “no domain under control” error, please refer to this article.

After you create a user, you can visit the Roundcube webmail address and login with the new mail user account.

https://mail.your-domain.com/mail/

iredmail roundcube webmail

Now you can test email sending and receiving. Please note that you may need to wait a few minutes to receive emails because iRedMail by default enables greylisting, which is a way to tell other sending SMTP servers to try again in a few minutes. The following line in mail log file /var/log/mail.log indicates greylisting is enabled.

Recipient address rejected: Intentional policy rejection, please try again later;

Adding Swap Space

ClamAV is used to scan viruses in email messages. ClamAV can use a fair amount of RAM. If there’s not enough RAM on your server, ClamAV won’t work properly, which will prevent your mail server from sending emails. You can add a swap file to your server to increase the total RAM on your server. (Note that using swap space on the server will degrade server performance. If you want better performance, you should upgrade the physical RAM instead of using swap space.)

To add swap space on the server, first, use the fallocate command to create a file. For example, create a file named swapfile with 1G capacity in root file system:

sudo fallocate -l 1G /swapfile

Then make sure only root can read and write to it.

sudo chmod 600 /swapfile

Format it to swap:

sudo mkswap /swapfile

Output:

Setting up swapspace version 1, size = 1024 MiB (1073737728 bytes)
no label, UUID=0aab5886-4dfb-40d4-920d-fb1115c67433

Enable the swap file

sudo swapon /swapfile

To mount the swap space at system boot time, edit the /etc/fstab file.

sudo nano /etc/fstab

Add the following line at the bottom of this file.

/swapfile    swap    swap     defaults    0   0

Save and close the file. Then reload systemd.

sudo systemctl daemon-reload

Step 7: Checking If Port 25 (outbound) is blocked

Your ISP or hosting provider won’t block incoming connection to port 25 of your server, which means you can receive emails from other mail servers. However, many ISP/hosting providers block outgoing connection to port 25 of other mail servers, which means you can’t send emails.

If your email didn’t arrive at your other email address such as Gmail, then run the following command on your mail server to check if port 25 (outbound) is blocked.

telnet gmail-smtp-in.l.google.com 25

If it’s not blocked, you would see messages like below, which indicates a connection is successfully established. (Hint: Type in quit and press Enter to close the connection.)

Trying 74.125.68.26...
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP y22si1641751pll.208 - gsmtp

If port 25 (outbound) is blocked, you would see something like:

Trying 2607:f8b0:400e:c06::1a...
Trying 74.125.195.27...
telnet: Unable to connect to remote host: Connection timed out

In this case, your Postfix can’t send emails to other SMTP servers. Ask your ISP/hosting provider to open it for you. If they refuse your request, you need to set up SMTP relay to bypass port 25 blocking.

Still Can’t Send Email?

If port 25 (outbound) is not blocked, but you still can’t send emails from your own mail server to your other email address like Gmail, then you should check the mail log (/var/log/mail.log).

sudo nano /var/log/mail.log

For example, some folks might see the following lines in the file.

host gmail-smtp-in.l.google.com[2404:6800:4003:c03::1b] said: 550-5.7.1 [2a0d:7c40:3000:b8b::2] Our system has detected that 550-5.7.1 this message does not meet IPv6 sending guidelines regarding PTR 550-5.7.1 records and authentication. Please review 550-5.7.1 https://support.google.com/mail/?p=IPv6AuthError for more information

This means your mail server is using IPv6 to send the email, but you didn’t set up IPv6 records. You should go to your DNS manager, set AAAA record for mail.your-domain.com, then you should set PTR record for your IPv6 address, which is discussed in step 9.

Step 8: Using Mail Clients on Your Computer or Mobile Device

Fire up your desktop email client such as Mozilla Thunderbird and add a mail account.

  • In the incoming server section, select IMAP protocol, enter mail.your-domain.com as the server name, choose port 143 and STARTTLS. Choose normal password as the authentication method.
  • In the outgoing section, select SMTP protocol, enter mail.your-domain.com as the server name, choose port 587 and STARTTLS. Choose normal password as the authentication method.

ubuntu postfix dovecot letsencrypt https

Fail2ban Blocking Your Own IP Address

If you made a mistake and failed to log in to mail server multiple times, then the Fail2ban service on the mail server might block your IP address. You can add your IP address to whitelist by editing the jail.local file.

sudo nano /etc/fail2ban/jail.local

Add your own IP address to the ignore list like below. Replace 12.34.56.78 with your real IP address.

ignoreip = 12.34.56.78 127.0.0.1 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16

Save and close the file. Then restart Fail2ban.

sudo systemctl restart fail2ban

Step 9: Improving Email Deliverablity

To prevent your emails from being flagged as spam, you should set PTR, SPF, DKIM and DMARC records.

PTR record

A pointer record, or PTR record, maps an IP address to a FQDN (fully qualified domain name). It’s the counterpart to the A record and is used for reverse DNS lookup, which can help with blocking spammers. Many SMTP servers reject emails if no PTR record is found for the sending server.

To check the PTR record for an IP address, run this command:

dig -x IP-address +short

or

host IP-address

Because you get IP address from your hosting provider or ISP, not from your domain registrar, so you must set PTR record for your IP in the control panel of your hosting provider, or ask your ISP. Its value should be your mail server’s hostname: mail.your-domain.com. If your server uses IPv6 address, be sure to add a PTR record for your IPv6 address as well.

To edit the reverse DNS record for your Hostwinds VPS, log into Hostwinds client area, select Domains -> Manage rDNS, Then you can edit the reverse DNS record for both IPv4 and IPv6 address.

mail server reverse DNS record

SPF Record

SPF (Sender Policy Framework) record specifies which hosts or IP address are allowed to send emails on behalf of a domain. You should allow only your own email server or your ISP’s server to send emails for your domain. In your DNS management interface, create a new TXT record like below.

modoboa spf record

Explanation:

  • TXT indicates this is a TXT record.
  • Enter @ in the name field to represent the main domain name.
  • v=spf1 indicates this is a SPF record and the version is SPF1.
  • mx means all hosts listed in the MX records are allowed to send emails for your domain and all other hosts are disallowed.
  • ~all indicates that emails from your domain should only come from hosts specified in the SPF record. Emails that are from other hosts will be flagged as forged.

To check if your SPF record is propagated to the public Internet, you can use the dig utility on your Linux machine like below:

dig your-domain.com txt

The txt option tells dig that we only want to query TXT records.

DKIM Record

DKIM (DomainKeys Identified Mail) uses a private key to digitally sign emails sent from your domain. Receiving SMTP servers verify the signature by using the public key, which is published in the DNS DKIM record.

The iRedMail script automatically configured DKIM for your server. The only thing left to do is creating DKIM record in DNS manager. Run the following command to show the DKIM public key.

sudo amavisd-new showkeys

The DKIM public key is in the parentheses.

iredmail amavis dkim

Then in your DNS manager, create a TXT record, enter dkim._domainkey in the name field. Copy everything in the parentheses and paste into the value field. Delete all double quotes and line breaks.

amavisd-new ubuntu

After saving your changes, run the following command to test if your DKIM record is correct.

sudo amavisd-new testkeys

If the DKIM record is correct, the test will pass. Note that your DNS record may need sometime to propagate to the Internet.

TESTING#1 linuxbabe.com: dkim._domainkey.linuxbabe.com => pass

DMARC Record

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. DMARC can help receiving email servers to identify legitimate emails and prevent your domain name from being used by email spoofing.

To create a DMARC record, go to your DNS manager and add a TXT record. In the name field, enter _dmarc. In the value field, enter the following. (You should create the dmarc@your-domain.com email address.)

v=DMARC1; p=none; pct=100; rua=mailto:dmarc@your-domain.com

create dmarc record txt

The above DMARC record is a safe starting point. If you want to read the full explanation of DMARC, please check the following article. Note that this is optional.

Step 10: Testing Email Score and Placement

After creating PTR, SPF, DKIM record, go to https://www.mail-tester.com. You will see a unique email address. Send an email from your domain to this address and then check your score. As you can see, I got a perfect score. In the test result, you should check if your PTR record, SPF and DKIM record is valid.

Testing Email Score and PlacementMail-tester.com can only show you a sender score. There’s a another service called GlockApps that allow you to check if your email is landed in the recipient’s inbox or spam folder, or rejected outright. It supports many popular email providers like Gmail, Outlook, Hotmail, YahooMail, iCloud mail, etc

glockapps-email-placement-testing

What if Your Emails Are Still Being Marked as Spam?

I have more tips for you in this article: How to stop your emails being marked as spam. Although it will take some time and effort, your emails will eventually be placed in inbox after applying these tips.

What if Your Email is Rejected by Microsoft Mailbox?

Microsoft seems to be using an internal blacklist that blocks many legitimate IP addresses. If your emails are rejected by Outlook or Hotmail, you need to submit the sender information form. After that, your email will be accepted by Outlook/Hotmail.

Adding Multiple Mail Domains

I wrote this article to show you how to add multiple mail domains in iRedMail.

How to Disable Greylisting

By default, iRedMail has enabled greylisting, which tells other sending SMTP servers to try again in a few minutes. This is mainly useful to block spam, but it also degrades user experience. If you prefer to disable greylisting, follow the instructions below.

Add write permission to the /opt/iredapd/settings.py file.

sudo chmod 600 /opt/iredapd/settings.py

Then edit the configuration file.

sudo nano /opt/iredapd/settings.py

Find the following line.

plugins = ["reject_null_sender", "wblist_rdns", "reject_sender_login_mismatch", "greylisting", "throttle", "amavisd_wblist", "sql_alias_access_policy"]

Remove "greylisting" from the list. Save and close the file. Then restart iredapd.

sudo systemctl restart iredapd

Change the configuration file back to read only mode.

sudo chmod 400 /opt/iredapd/settings.py

Enabling SMTPS Port 465

If you are going to use Microsoft Outlook client, then you need to enable SMTPS port 465 in Postfix SMTP server.

Troubleshooting

First, please use a VPS with at least 2GB RAM. Running iRedMail on a 1GB RAM VPS will cause the database, SpamAssassin, or ClamAV to be killed because of out-of-memory problem. If you really want to use a 1GB RAM VPS, you are going to lose incoming emails and have other undesirable outcomes.

If the iRedMail web interface isn’t accessible, like a 502 gateway error, you should check the Nginx logs in /var/log/nginx/ directory to find clues. You may also want to check the mail log /var/log/mail.log.

Check if the various services are running.

systemctl status postfix

systemctl status dovecot

systemctl status nginx

systemctl status mariadb

systemctl status clamav-daemon

systemctl status amavis

If you enabled the firewall, you should open the following ports in the firewall.

HTTP port:  80
HTTPS port: 443
SMTP port:  25
Submission port: 587 (and 465 if you are going to use Microsoft Outlook mail client)
IMAP port:  143 and 993

If you would like to use the UFW firewall, check my guide here: Getting started with UFW firewall on Debian and Ubuntu.

How to Renew TLS Certificate

Let’s Encrypt issued TLS certificate is valid for 90 days only and it’s important that you set up a Cron job to automatically renew the certificate. You can run the following command to renew certificate.

sudo certbot renew

You can use the --dry-run option to test the renewal process, instead of doing a real renewal.

sudo certbot renew --dry-run

If you see the following error when renewing TLS certificate.

The client lacks sufficient authorization :: Invalid response

Then you need to create the hidden directory.

sudo mkdir -p /var/www/html/.well-known/acme-challenge

And set www-data as the owner of the webroot.

sudo chown www-data:www-data /var/www/html/ -R

Also, edit the SSL virtual host /etc/nginx/sites-enabled/00-default-ssl.conf. Add the following lines.

location ~ /.well-known/acme-challenge {
     root /var/www/html/;
     allow all;
}

iredmail letsencrypt renew

Save and close the file. Test Nginx configuration and reload.

sudo nginx -t
sudo systemctl reload nginx

Create Cron Job

If now the dry run is successful, you can create Cron job to automatically renew certificate. Simply open root user’s crontab file.

sudo crontab -e

Then add the following line at the bottom of the file.

@daily certbot renew --quiet && systemctl reload postfix dovecot nginx

Reloading Postfix, Dovecot and Nginx is necessary to make these programs pick up the new certificate and private key.

Setting Up Backup Mail Server

Your primary mail server could be down sometimes. If you host your mail server in a data center, then the downtime is very minimal, so you shouldn’t be worried about losing inbound emails. If you host your mail server at home, the downtime can’t be predicted so it’s a good practice for you to run a backup mail server in a data center to prevent losing inbound emails. The backup mail server needs just 512MB RAM to run. Please check the full detail in the following article.

For Advanced Users

iRedMail doesn’t include a DMARC verification service, you can check out the following tutorial to set up OpenDMARC to block email spoofing.

You may want to customize the SpamAssassin content filter to better detect spam.

If your website and mail server are running on two different VPS (virtual private server), you can set up SMTP relay between your website and mail server, so that your website can send emails through your mail server. See the following article.

Wrapping Up

That’s it! I hope this tutorial helped you set up a mail server on Ubuntu 20.04 with iRedMail. As always, if you found this post useful, then subscribe to our free newsletter to get more tips and tricks. Take care 🙂

Rate this tutorial
[Total: 93 Average: 4.2]

94 Responses to “How to Easily Set up a Full-Fledged Mail Server on Ubuntu 20.04 with iRedMail

  • Xiao, thank you so much for your process here. I got the mail server running. Wonderful write-up, plenty of great information.

  • Артем Артем
    4 months ago

    One of the best intructions I have ever seen. Thank you so much for you time and patience.

  • Paul Fisher
    4 months ago

    Can this be done on an 18.04 installation as well?

  • Hi Xiao,

    From your configuration, is there a way to change outgoing email port from 25 to 587 ? Actually i have installed the iredmail on the digital ocean droplet. My email server can accept inbound email but deferred all outgoing emails because DO is blocked port 25. I have asked them to open, but they cannot do it due to their policy. So, i’m searching if there is a solution for this problem and how to apply it to the iredmail configuration.

    Thanks
    Aris

  • Low Chan saechao
    3 months ago

    Thank you very much for this tutorial! I have successfully setup my self-hosted mail server using your instructions. They were clear and the screen shots were very helpful.

    Thank you for the Spam Tester website, it helped me troubleshoot that i needed another TXT entry for DKIM.

    Again thank you!

  • Chris Amow
    3 months ago

    Awesome post! Thanks Xiao Guoan!
    A setup like this has been long overdue – I’m planning to switch over.
    Would I be able to set this up before I switch the domain over? (So I can configure everything and make sure it is running smoothly by testing against the ip address and then finally doing the switch for minimal downtime.)

    • Xiao Guo-An (Admin)
      3 months ago

      I think you can use a sub-domain to test. Instead of creating name@your-domain.com, create an email address like name@test.your-domain.com

  • David Bucknell
    3 months ago

    Hello,
    Thank you very much Xiao Guoan!

  • zacgarby1
    3 months ago

    Hi, I’m wondering why I have to set my hostname to `mail.my-domain.com` instead of `my-domain.com` as it was previously. I’m not an expert, but since this is the same server I host a HTTP server on, won’t setting the hostname to `mail.my-domain.com` make it so people have to access my website using `mail.my-domain.com`?

    • Xiao Guo-An (Admin)
      3 months ago

      This hostname will be used by your mail server. It has nothing to do with website address. Please note that iRedMail will change the web server configuration directory. Your website may stop working. You can bring it up with a little work, but I recommend that you back up web server configurations.

      • zacgarby1
        3 months ago

        Ah okay, thanks. What I don’t get is: isn’t the hostname system-wide? It’s also a bit annoying when I ssh in and the prompt says zac@mail instead of zac@zacgarby (my previous hostname was zacgarby.co.uk)

        • Xiao Guo-An (Admin)
          3 months ago

          Yes, it’s system-wide, but almost always your Apache virtual host or Nginx server block is configured to use a different value. The Bash shell by default only shows the leftmost part of your hostname.

        • zacgarby1
          3 months ago

          Right, that makes sense! Thank you

  • Displace Ignorance with Facts
    3 months ago

    Hi, I’m curious. The guide was fantastic! But since you have a lot of experience doing this, how much would you charge to set it up? It would be a Hostwinds VPS and have domain name already. Very curious but extremely serious and will pay.

    • Xiao Guo-An (Admin)
      3 months ago

      Hi, it will be a fixed price of 35 USD. If interested, email xiao@linuxbabe.com

  • This broke my other ssl enabled sites. Don’t recommend using this on a server with existing website running.

    • I think maybe you overlooked the bold here:

      “It is highly recommended that you follow the instructions below on a CLEAN INSTALL of Ubuntu 20.04 system that has at least 2GB of RAM”

      You should read prerequisites before trying to discredit someone’s work.

      • zacgarby1
        3 months ago

        You don’t need to be so defensive, he’s just trying to be helpful :/

  • Hello,

    I tried to install iRedMail 0.9.8 on Amazon EC2 with OpsWorks Stack on Ubuntu 16.04.

    During the installation it shows the message that the user “iredadmin” isn’t available.
    After restarting server iRedAdmin page shows a 502 Bad Gateway

    Checking locks an running services shows that uwsgi service isn’t running.
    Starting this service shows following error:

    ● uwsgi.service - LSB: Start/stop uWSGI server instance(s)
       Loaded: loaded (/etc/init.d/uwsgi; bad; vendor preset: enabled)
       Active: failed (Result: exit-code) since Fri 2018-09-14 11:32:16 UTC; 3s ago
         Docs: man:systemd-sysv-generator(8)
      Process: 4194 ExecStart=/etc/init.d/uwsgi start (code=exited, status=1/FAILURE)
    

    I tried to add the default ubuntu source.list but it does not solve this problem.
    Did anyone have an idea?

    Thanks a lot.

    Chris

    • here the detail message during installation message:

      ********************************************************************
      * Start iRedMail Configurations
      ********************************************************************
      [ INFO ] Create self-signed SSL certification files (2048 bits).
      [ INFO ] Generate Diffie Hellman Group with openssl, please wait.
      [ INFO ] Create required system account: vmail, iredadmin, iredapd.
      [ INFO ] Configure Apache web server.
      [ INFO ] Configure PHP.
      [ INFO ] Configure MySQL database server.
      [ INFO ] Setup daily cron job to backup SQL databases with /var/vmail/backup/backup_mysql.sh
      [ INFO ] Configure Postfix (MTA).
      [ INFO ] Configure Dovecot (POP3/IMAP/Managesieve/LMTP/LDA).
      [ INFO ] Configure ClamAV (anti-virus toolkit).
      [ INFO ] Configure Amavisd-new (interface between MTA and content checkers).
      [ INFO ] Configure SpamAssassin (content-based spam filter).
      [ INFO ] Configure iRedAPD (postfix policy daemon).
      [ INFO ] Configure iRedAdmin (official web-based admin panel).
      chown: invalid user: 'iredadmin:iredadmin'
      chown: invalid user: 'iredadmin:iredadmin'
      [ INFO ] Configure Fail2ban (authentication failure monitor).
      [ INFO ] Configure Roundcube webmail.
      [ INFO ] Configure Awstats (logfile analyzer for mail and web server).
      
      *************************************************************************
      * iRedMail-0.9.7 installation and configuration complete.
      *************************************************************************
      
    • Check /etc/passwd file to see if iredadmin is there.

      cat /etc/passwd | grep iredadmin

      If the iredadmin user and group wasn’t created. You can manually create it with:

      sudo adduser --system --group iredadmin
    • sometimes it is so easy…

      thanks a lot, I added the user before installation.
      After that it works.

  • What is the best method to encrypt emails at rest on your server. Has anybody tried this, for example?

    https://wiki2.dovecot.org/Plugins/MailCrypt

  • BandidoPabs
    3 months ago

    Hi Xiao,

    Really apprecite you taking time to set this tutorial up. I’m getting this error when I’m trying to set up the certbort any idea on what I can do?

    IMPORTANT NOTES:
    – The following errors were reported by the server:

    Domain: mail.boltcorp.com
    Type: unauthorized
    Detail: Invalid response from
    http://mail.boltcorp.com/.well-known/acme-challenge/iZYPFWRimn9ocHXyFTI0hCbw1 VpSu-naxjRYhG6pmlM:
    “<html lang=\"en\"
    data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvj FUCsdFlb6TdQhxb9RXWX"

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A/AAAA record(s) for that domain
    contain(s) the right IP address.

    I've set up the MX and A record to point to the correct FQDN and IP address.

    Thanks.

  • BandidoPabs
    3 months ago

    Xiao,

    One more thing what email address do I put here?

    sudo certbot certonly –webroot –agree-tos –email your-email-address -d mail.your-domain.com -w /var/www/html/

    the postmaster one?

  • Xiao – This guide is excellent. I followed your steps and everything is working perfectly.

    Is there a simple way to backup the config for all the apps or even a snapshot of the entire OS? I’d like to be able to restore the settings in case i make a mistake and break this smooth running config. Thank you

    • Before editing a file, copy it to a new file. If you make a mistake, then restore the original file.

      If you are using a server hosting service, they should provide a snapshot function.

  • Michel1504
    3 months ago

    Thanks for the guide i installed it perfectly. got 10/10 out of mailtester. Next step is connection with ldap / ms ad or samba4. I tried to follow https://docs.iredmail.org/active.directory.html but got stuck at dovecot. and finding config files for rouncube (ngnix other place ?) and missing guide for sogo. do you have any plans to make a guide for that ?

  • Dave Kimble
    3 months ago

    The danger of following a tutorial like this that you are installing a whole bunch of packages (do you understand what they all do?) which need to be configured accurately and kept up to date for ever. It is true that it is supposed to be done on a clean install, and it will PROBABLY work, but if it doesn’t you will have to do another clean install. There is no “uninstall/unconfigure”.

    It worked OK for me on my first go, but in setting up a standby server, it failed and couldn’t be unscrambled. Beware.

    • Richard Whitney
      3 months ago
      ...in setting up a standby server, it failed and couldn’t be unscrambled.

      Is a fresh OS install on the standby server out of the question? Why not just try it again?

    • Could you let me know the error when setting up a standby server?

  • Dave Kimble
    3 months ago

    Richard, no, re-installing the OS is not out of the question, but its a whole heap more work if its doesn’t install and configure properly first time.

    Xiao, I don’t remember the error exactly – some server was unreachable at the time, I think.
    My point was, it’s great when it works, and a lot of extra work when it doesn’t.
    Testing with mail-tester.com is essential to get all the things right.

    Citadel-suite has a mail server, chat server and other features and is generally easier.

    Your mail server WILL be attacked on the first day and every day.

  • Harshil Gupta
    3 months ago

    I am not using any hosting service. The mail server is created in the lab. My os is ubuntu 20.04.
    How to achieve PTR stuff.

    • phishing frenzy
      3 months ago

      Harshil, the PTR record should be done by your ISP. For example ISP gave u an IP 123.123.123.123 and you bought a domain name gupta.com, but your host name is mail.gupta.com, you pass mail.gupta.com to your isp technician they should be able to configure for you

  • Ashutosh
    3 months ago

    It is not sending emails to godaddy mails also not receiving.

  • Ashutosh
    3 months ago

    i am getting

    relay=mailstore1.europe.secureserver.net[188.121.52.57]:25, delay=190284, delays=190283/0.05/1.5/0, dsn=4.0.0, status=deferred (host mailstore1.europe.secureserver.net[188.121.52.57] refused to talk to me: 421 n1plibsmtp01-02.prod.ams1.secureserver.net bizsmtp Temporarily rejected. Reverse DNS for 45.64.11.2 failed. IB108  )
  • Ashutosh
    3 months ago

    Hi,
    Can i change the smtp port from 25 to some other?
    currently i am getting

    Sep 22 16:42:49 mail postfix/qmgr[2195]: 507E241FA6: from=, size=1672, nrcpt=1 (queue active)                                                      
    Sep 22 16:42:50 mail postfix/smtp[3923]: connect to gmail-smtp-in.l.google.com[2404:6800:4003:c03::1a]:25: Network is unreachable          
    Sep 22 16:43:20 mail postfix/smtp[3923]: connect to gmail-smtp-in.l.google.com[74.125.24.26]:25: Connection timed out                                                   
    Sep 22 16:43:50 mail postfix/smtp[3923]: connect to alt1.gmail-smtp-in.l.google.com[74.125.195.27]:25: Connection timed out                                             Sep 22 16:43:50 mail postfix/smtp[3923]: connect to alt1.gmail-smtp-in.l.google.com[2607:f8b0:400e:c09::1b]:25: Network is unreachable 
    Sep 22 16:44:20 mail postfix/smtp[3923]: connect to alt2.gmail-smtp-in.l.google.com[64.233.179.27]:25: Connection timed out                                             Sep 22 16:44:20 mail postfix/smtp[3923]: 507E241FA6: to=, relay=none, delay=22948, delays=22857/0.03/91/0, dsn=4.4.1, status=deferred

    And is it possible to send mail through php code using SMTP

  • I don’t understand why it needs to install a web server? I just want email.

    Is this for configuration purposes? Why can’t I just do that via SSH and text configuration files?

    • The web server is needed to set up a webmail client, so you can access email in your web browser. If you don’t need that, you can disable the web server from running on your machine.

      This article did not say you can’t use SSH to install iRedMail on another machine.

    • I was looking at the screenshot of the install questions. It gave you a choice of which web server you want (nginx or Apache) but did not appear to offer the option of skipping the webserver all together.

    • iRedMail also comes with a web-based control panel that allows you to easily add email accounts, that also requires a web server. You may need this if you are not familiar with adding email accounts from the command line.

      You can disable or remove the web server after your email server is up and running, if you really don’t like having a web server on your machine.

  • I notice there is a step where you set a static IP address of the mail server.

    This is problematic. I was planning on running my server with a dynamic DNS service and not using IP addresses at all. Is this not possible?

    • With a dynamic IP address, you can’t set the PTR record, in which case you emails are more likely to land in spam folder or be rejected outright.

      If you plan to set up an email server in your home, ask your ISP if they can give you a static IP and if PTR record can be configured for your IP address, Or you can set up SMTP relay.

  • I can recieve emails but no sending, log shows:

    Sep 21 19:01:29 mail postfix/smtp[7562]: connect to gmail-smtp-in.l.google.com[2607:f8b0:400d:c0f::1b]:25: Connection timed out
    Sep 21 19:01:59 mail postfix/smtp[7562]: connect to gmail-smtp-in.l.google.com[172.217.197.26]:25: Connection timed out
    Sep 21 19:02:29 mail postfix/smtp[7562]: connect to alt1.gmail-smtp-in.l.google.com[2800:3f0:4003:c00::1b]:25: Connection timed out
    Sep 21 19:02:59 mail postfix/smtp[7562]: connect to alt1.gmail-smtp-in.l.google.com[64.233.186.27]:25: Connection timed out 
  • Thanks

  • Lidor Amrani
    3 months ago

    When i test my DKIM key on Putty of example, it shows success, but when i try to test it on a tool like mxtoolbox it shows it says:

    No DKIM found with the selector mail.

    How can i change that? I mean, my selector is dkim._domainkey

    Am i missing somehing?

    Thank you

    • You can send an email to me (xiao@linuxbabe.com), so that I can examine your situation.

    • Please run the following command on your email server to see what selector is being used for your domain.

      sudo amavisd-new showkeys

      Paste the output here.

      • Lidor Amrani
        3 months ago

        Output:

         root@box:~# sudo amavisd-new showkeys
        ; key#1 1024 bits, i=dkim, d=yogavoga.com, /var/lib/dkim/yogavoga.com.pem
        dkim._domainkey.yogavoga.com.   3600 TXT (
          "v=DKIM1; p="
          "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4BJx5OOUtXG/2rDmXj34tV+hF"
          "C7uT1I8URCv95/doYZozrdRFM00SPTgZ0sBlb8G5ivbc51XTlBGiZLFrLN/Sl+QY"
          "1C/RdppbQsx6wydp7BMu9UCiEHU0C9td3j/OpkSNByWb+3tlFDwe+3YOSTUCKRDS"
          "+lt3KDwOnhBSEHhzfQIDAQAB") 
        • The default DKIM selector is dkim, and your DKIM record is correct, but for some reason your email server is using mail as selector. Open the Amavis configuration file.

          sudo nano /etc/amavis/conf.d/50-user

          Find the following line.

          dkim_key('your-domain.com', 'dkim', '/var/lib/dkim/your-domain.com.pem');

          The second parameter in the parentheses is the selector used by Amavis. If it’s set to mail in your file, change it to dkim.
          Save and close the file. Then restart Amavis.

          sudo systemctl restart amavis
  • niranjan
    3 months ago
    Sep 25 12:22:22 mail postfix/postscreen[4450]: CONNECT from [68.178.252.103]:32841 to [172.31.31.99]:25
    Sep 25 12:22:23 mail postfix/postscreen[4450]: PASS OLD [68.178.252.103]:32841
    Sep 25 12:22:23 mail postfix/smtpd[4464]: connect from p3plsmtpa11-02.prod.phx3.secureserver.net[68.178.252.103]
    Sep 25 12:22:24 mail postfix/smtpd[4464]: Anonymous TLS connection established from p3plsmtpa11-02.prod.phx3.secureserver.net[68.178.252.103]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
    Sep 25 12:22:25 mail postfix/smtpd[4464]: NOQUEUE: reject: RCPT from p3plsmtpa11-02.prod.phx3.secureserver.net[68.178.252.103]: 451 4.7.1 : Recipient address rejected: Intentional policy rejection, please try again later; from= to= proto=ESMTP helo=
    li>Sep 25 12:23:26 mail postfix/smtpd[4464]: disconnect from p3plsmtpa11-02.prod.phx3.secureserver.net[68.178.252.103] ehlo=2 starttls=1 mail=1 rcpt=0/1 rset=1 quit=1 commands=6/7  
    
    •   Recipient address rejected: Intentional policy rejection, please try again later. 

      This indicates that your server has enabled greylisting. The sending server will try again in a few minutes and it will be accepted.

  • Hello,
    When i try to type the command to install the TLS certificate i reviecve this message:

     root@box:~# sudo certbot certonly --webroot --agree-tos --postmaster@yogavoga.com -d box.yogavoga.com -w /var/www/html/
    usage:
      certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...
    
    Certbot can obtain and install HTTPS/TLS/SSL certificates.  By default,
    it will attempt to use a webserver both for obtaining and installing the
    certificate.
    certbot: error: unrecognized arguments: --postmaster@yogavoga.com
    root@box:~# ^C
    root@box:~#

    What am i doing wrong

    • You left the --email option out. The correct command is

      sudo certbot certonly --webroot --agree-tos --email postmaster@yogavoga.com -d box.yogavoga.com -w /var/www/html/
  • HI, I’ve done everything with success but I can’t instatll certbot. I’m using debian 9.
    I follow the steps from certbot page but it wants to certificate my domain, I only have access to mail server. How can I do that?

    • Make sure you have set A record for the hostname of your mail server (mail.your-domain.com), follow the certbot instructions and you would fine.

  • Xiao thanks for the answer.
    I have another question.
    For dkim, I generate the public and private key and configure my dns server. Where I should copy my private key. I must install something in my email server? My dns server is another server.
    Best Regards.
    Carina

    • You need to copy the public key to your DNS, not the private key. You can find the public key in the iRedmail.tips file

      Under DNS record for DKIM support
      Basically it looks like this:

        "v=DKIM1; p="
        "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDgT90Ia+Zf7tkf0YyFlm2IdMZY"
        "NUHUoOoogQCBv+QrZJVBeKhjHBjtgMnsYnetJbZNmpMuM+MvyqjLVwUPrjGoJ1vI"
        "3vgjUDhfjLf4QjBtbhtSPb5LlveLxokEYnKDAbOZFILtW40IqxOYBGk9cnXzFoBZ"
        "78IssEGV/V8Idr1IbwIDAQAB"

      iRedmail already installed necessary software for you, so no need to install other software.

  • Mudassir Adili
    3 months ago

    Thank you for your guide. its the best i have come acrossed. Please i need your help, my mails are delivered to spam folders.

  • Just wanted to write a quick “thank you” for the iRedmail write-up and website in general. Your walkthroughs are, by far, the best I’ve found on the net and you are my favorite linux educator. Thank you!

  • Shubhankit Mishra
    3 months ago

    Hello

    i followed these steps now i can send the emails but when i am sending mails from gmail to this server mails are not coming in inbox. i created a @ mx record pointing to mail.mydomain.tld . Please help.

  • Shubhankit Mishra
    3 months ago

    Is it possible to create mx record without creating a record?? Obviously i created a A record mail.domain.tld. And delay after 6 hours i have not received any mail. How long??

    • If you created MX and A record correctly, then Gmail can find your mail server. Greylisting will delay emails no more than 15 minutes. Can you paste your mail log in the comments? Also can you tell me your domain just to make sure I can verify your MX and A records?

  • Shubhankit Mishra
    3 months ago

    You can find the log here:-
    https://pastebin.com/7318Bb7v

    • Shubhankit Mishra
      3 months ago

      and my domain is mail.devopshit.xyz
      thanks!

    • Hi, looks like you are using AWS. Please go to AWS web-based console and set firewall to allow incoming traffic to the following ports:

      TCP port 25 (smtp),
      TCP port 587 (submission)
      TCP port 993 (imaps)
      TCP port 995 (pop3s).

  • Shubhankit Mishra
    3 months ago

    I forgotten to take care of these.. now working thanks.. your tutorial was awesome…

  • if we wish to use with phpmailer library is it possible?
    if yes so,how use it?
    please tell me.

    • PHPMailer is used by a web application to connect to SMTP server. You can use PHPMailer with any SMTP server. It has nothing to do with iRedMail. You should ask a web developer.

  • Hi,
    I want my mail server to process a PHP script everytime it receives an incoming email (to any receipient).

    Is this possible with iRedMail? Any tips on where I can learn more on how to it?
    Many thanks.

  • Jack Bamford
    3 months ago

    Great guide. Happy Server life 🙂

  • Shanah Jr Suping
    2 months ago

    I followed the instructiuons. I faced my first error when it came to configure MariDB, that kept on failing so I used Postgres. But now I am getting an internal server error.

    And all the other server blocks that I had for my sub domains have also disappeared. Should that have happned?

    • Yes, that’s expected. I did say “it’s highly recommended to follow the instructions on a clean install of Ubuntu 20.04 system”.

  • t is possible to add other subdomains to nginx such as nextcloud.domain.com or wordpress.domain.com I searched the internet for some tutorials but none of them helped

    • Nicolas
      3 weeks ago

      Hi, I have the same question and also is it possible to use subdomain with iRedMail ? Is it possible to use webmail.domain.com instead of mail.domain.com/mail ? Same for netdata and admin ? Thank you !

  • Eric Brooks
    4 seconds ago

    I to would like to add additional web pages for the nginx to serve. i have tried some of the stuff i have found online but is now working for what ever reason… i used your AWSOME tutorial (thank you, thank you, thank you)… system is ubuntu server 20.04 and 1.3.1 version of IRedMail, NginX and Sogo… i hope this helps to let you know what i am setup with to help guide me how to add an additional web page to serve.

Leave a Comment

  • Comments with links are moderated by admin before published.
  • Your email address will not be published.
  • Use <pre> ... </pre> HTML tag to quote the output from your terminal/console.
  • Please use the community (https://community.linuxbabe.com) for questions unrelated to this article.
  • I don't have time to answer every question. Making a donation would incentivize me to spend more time answering questions.


The maximum upload file size: 2 MB.
You can upload: image.