Setting up a mail server on Ubuntu with Postfix and Dovecot
Hosting email on your own Ubuntu machine gives you control over mailboxes, filtering and storage. Postfix handles the SMTP conversations that move messages between servers, while Dovecot provides IMAP or POP3 access to incoming mail. Together they form the core of a Linux mail server, but DNS, encryption and authentication determine whether those messages are trusted and delivered.
This guide builds a single-domain server for a small team or family. It assumes a dedicated Ubuntu host, a domain you control and shell access with sudo. A virtual machine is suitable for learning, while a small virtual private server is generally better for public mail because Australian home connections can change address and filter the outbound port used by mail servers.
Choose the server's role and domain
Start by deciding whether the machine will receive mail directly or simply forward it. A fully qualified domain name, or FQDN, identifies the server unambiguously; these examples use mail.example.com.au and example.com.au. Set the domain’s mail exchanger record to that hostname and give the host a fixed public address. If mail is forwarded to Microsoft 365 or Google Workspace, Postfix is acting as a smart host rather than the final store.
For an Australian direct-domain namespace, confirm the current eligibility and naming rules with the registrar before deployment. The hypothetical example.com.au follows the familiar .com.au convention, while the newer .au direct namespace has separate registration requirements. The technical process is unchanged for an existing business domain, including one already used for website hosting.
If the server shares a disk with Windows, turn off Windows 10 Fast Startup before using Ubuntu on that disk. Its hibernation mechanism can leave a Windows volume in a state that Linux mounts unsafely. Separate disks or partitions are preferable, and the mail hostname must also appear correctly in the Ubuntu hosts file.
Install the software and set the hostname
Install the required packages on an updated Ubuntu server. The mail utilities provide useful command-line tools, while the Dovecot packages include IMAP, POP3 and the authentication service that Postfix will use.
sudo apt update
sudo apt install postfix postfix-pcre mailutils \
dovecot-imapd dovecot-pop3d
Give the machine a matching hostname and local name resolution. A mismatch between /etc/hostname, /etc/hosts and Postfix’s myhostname can produce warnings whose real cause is easy to overlook.
sudo hostnamectl set-hostname mail.example.com.au
printf '%s\n' 'example.com.au' | sudo tee /etc/mailname
sudoedit /etc/hosts
Add an entry such as 127.0.1.1 mail.example.com.au to /etc/hosts, then confirm it with getent hosts mail.example.com.au. During the Postfix package installation, choose “Internet Site” and enter mail.example.com.au when prompted.
Ubuntu Server images normally run the daemons through systemd. On a Framework notebook, check the Framework Laptop 16 compatibility review first; sleep, Wi-Fi and power behaviour can affect a long-running server even when Linux itself performs well.
Configure Postfix for incoming mail
Postfix needs to know which names it owns, where local mailboxes live and which networks it may trust. Apply the basic settings with postconf, which edits /etc/main.cf without replacing the complete configuration.
sudo postconf -e \
'myhostname = mail.example.com.au' \
'mydomain = example.com.au' \
'myorigin = $mydomain' \
'mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain' \
'inet_interfaces = all' \
'inet_protocols = ipv4' \
'home_mailbox = Maildir/' \
'mynetworks = 127.0.0.0/8 [::1]/128'
These values make addresses at example.com.au local, store messages in each user’s Maildir directory and limit trusted relaying to the server itself. IPv6 is deliberately omitted here; enable it only if the host has working IPv6 connectivity and you are prepared to publish and monitor an AAAA record.
Create a system account for each mailbox owner and redirect administrative addresses to a real account. The aliases database is separate from Dovecot’s user database.
sudo adduser alex
sudo passwd alex
sudo install -d -m 700 -o alex -g alex /home/alex/Maildir
sudoedit /etc/aliases
sudo newaliases
sudo postfix reload
In /etc/aliases, entries such as postmaster: alex and abuse: alex ensure those standard addresses reach a monitored inbox. Validate the configuration with sudo postfix check, inspect the effective settings with postconf -n and send a local test message to alex@example.com.au.
Configure Dovecot for mailbox access
Dovecot reads the Maildir folders created by Postfix and presents them to users through IMAP or POP3. Modern clients should use the encrypted IMAP port 993 or POP3 port 995 rather than sending credentials over plain connections.
Create or update /etc/dovecot/conf.d/10-mail.conf with the mailbox location, supported protocols and modern security settings.
protocols = imap pop3
mail_location = maildir:~/Maildir
namespace inbox {
inbox = yes
separator = /
}
ssl = required
ssl_min_protocol = TLSv1.2
disable_plaintext_auth = yes
auth_mechanisms = plain login
The certificate paths must exist before Dovecot is restarted. They are completed in the next section, so keep ports 993 and 995 closed until the certificate has been issued and the service has been validated.
Postfix also needs a way to ask Dovecot whether an authenticated user exists. Inside Dovecot’s existing service auth block in /etc/dovecot/conf.d/10-auth.conf, add a socket owned by the Postfix user.
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
The default Dovecot password and user databases can use Ubuntu’s system accounts. Ensure the mail account has a valid password with passwd, rather than leaving the account locked. After the TLS certificate is available, run sudo doveadm auth test alex and sudo systemctl restart dovecot; the first command should report successful authentication for the account.
Secure clients with TLS and authenticated submission
Install Certbot and request a certificate for the mail hostname. The domain’s address record must already resolve publicly, and TCP port 80 must be reachable for the standard web challenge.
sudo apt install certbot
sudo certbot certonly --standalone -d mail.example.com.au
If Apache or Nginx already occupies port 80, use Certbot’s webroot method instead of stopping the web server. The resulting certificate and key are stored under /etc/letsencrypt/live/mail.example.com.au/. Point Postfix at them and require TLS for incoming SMTP connections.
sudo postconf -e \
'smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com.au/fullchain.pem' \
'smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com.au/privkey.pem' \
'smtpd_tls_security_level = encrypt'
Configure submission on port 587 in /etc/master.cf. This gives mail clients a dedicated authenticated route for sending messages without exposing the local transport to the internet.
submission inet n - y - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_sasl_type=dovecot
-o smtpd_sasl_path=private/auth
-o smtpd_sasl_security_options=noanonymous
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject_unauth_destination
Allow only the necessary public ports: 25 for incoming mail, 587 for authenticated submission, 80 for certificate renewal, and 993 or 995 for encrypted mailbox access. If SSH is enabled and UFW is being activated, allow OpenSSH first to avoid locking yourself out.
Certbot’s timer can renew the certificate automatically, but services must reload to use the renewed files. A small deployment hook can handle that, while sudo systemctl enable --now certbot.timer confirms scheduled renewal is active.
#!/bin/sh
systemctl reload postfix
systemctl reload dovecot
Store the script in /etc/letsencrypt/renewal-hooks/deploy/, make it executable and reload both services. Test port 587 with openssl s_client -starttls smtp -connect mail.example.com.au:587 -servername mail.example.com.au, then test IMAP on port 993 using the same server name with openssl s_client.
Publish DNS and verify the service
External mail servers begin with public DNS. Publish an A record for mail.example.com.au pointing to the server’s stable IPv4 address, then add an MX record for example.com.au pointing to that hostname. Add AAAA only when IPv6 is configured and monitored correctly. The hosting provider must also configure the address’s reverse DNS, or PTR record, to resolve back to mail.example.com.au.
Start with an SPF record that authorises the mail exchanger, such as v=spf1 mx -all, but amend it if another service also sends mail for the domain. Postfix and Dovecot do not generate DKIM signatures by themselves, so add DKIM through a signing service or a component such as rspamd and publish its selector record. A DMARC record at _dmarc.example.com.au tells recipients how to handle messages that fail SPF or DKIM.
Many Australian households receive their internet through NBN, FTTP or ADSL services with dynamic addresses, some behind carrier-grade NAT, and many providers block outbound port 25. A VPS in Sydney, Melbourne or Brisbane with a fixed address and unrestricted port 25 is usually more predictable for a public server. Reverse DNS changes may need to be requested from the provider, so keep the hostname and IP handy.
Many Australian small businesses already use Microsoft 365 or Google Workspace. If the new server must coexist with an existing provider, decide whether it sends directly or acts as a relay, and ensure the SPF record authorises every legitimate sender. Duplicate or contradictory records can send outgoing mail straight to spam folders.
Check DNS with dig +short MX example.com.au and dig +short A mail.example.com.au. Send a test message from an outside mailbox to the server, submit another through port 587 and inspect failures with sudo journalctl -u postfix -u dovecot -f. When comparing logs with Australian support, remember that UTC is common in system logs while Sydney, Melbourne and Brisbane alternate between AEST and AEDT; dates in DD/MM/YYYY with an explicit timezone help everyone sort out the same event.
Once the pieces are working, the arrangement is straightforward: Postfix accepts and routes mail, Dovecot serves each mailbox, TLS protects the connection and DNS tells the internet where everything lives. A healthy daemon cannot compensate for a stale MX record, an incorrect PTR entry or a certificate that failed to renew.
Reliable self-hosted email depends on a complete chain rather than one clever setting: a stable public address, correct DNS, valid encryption, authenticated submission and recoverable mailbox storage. When those parts agree, the server behaves predictably for local users and remote recipients alike.