FERRAMENTAS LINUX: How to Set Up a Secure Mail Server with Dovecot & Postfix on Ubuntu

Learn how to set up a secure, self-hosted mail server using Postfix & Dovecot on Ubuntu 22.04 LTS. Follow our step-by-step guide with TLS encryption, spam filtering, and IMAP/POP3 support—perfect for businesses & privacy-focused users. Includes Firewall rules, Fail2Ban, and backup strategies.

Email remains the backbone of digital communication, handling everything from business correspondence to personal messages.

While cloud-based solutions like Gmail and Microsoft 365 dominate, self-hosting a mail server offers unparalleled control, privacy, and customization—ideal for businesses, developers, and privacy-conscious users.

In this step-by-step guide, we’ll configure a high-performance, secure mail server using Dovecot (IMAP/POP3) and Postfix (SMTP) on Ubuntu Server 22.04 LTS. By the end, you’ll have a fully encrypted, enterprise-grade email system with TLS, spam filtering, and user authentication—without relying on third-party providers.

Why Self-Host Your Mail Server?

Full data ownership – No vendor lock-in or privacy concerns.

Custom domain branding – Professional emails (e.g., you@yourdomain.com).

Cost-effective – Avoid recurring SaaS subscription fees.

Enhanced security – Control encryption, spam filters, and access policies.

Prerequisites

Before deployment, ensure you have:

✅ Ubuntu Server 22.04 LTS (or later)

✅ Root/sudo access

✅ Static IP address

✅ Fully Qualified Domain Name (FQDN)

✅ Proper DNS records (A, MX, SPF, DKIM, DMARC)

Update your system:

sudo apt update && sudo apt upgrade -y

Understanding the Mail Server Stack

A modern mail server consists of:

Postfix – SMTP server for sending/receiving emails.
Dovecot – IMAP/POP3 server for mailbox access.
SpamAssassin/ClamAV – Spam/malware filtering.
TLS/SSL – End-to-end encryption (Let’s Encrypt recommended).

Step 1: Install Postfix & Dovecot

Install Postfix (SMTP Server)

sudo apt install postfix -y

During setup, select:

Mail configuration type: Internet Site
System mail name: yourdomain.com

Install Dovecot (IMAP/POP3 Server)

sudo apt install dovecot-core dovecot-imapd dovecot-pop3d -y

Step 2: Configure Mail Storage (Maildir Format)

Maildir stores each email as a separate file, improving performance and reliability.

Edit Postfix config:

sudo nano /etc/postfix/main.cf

Add:

home_mailbox = Maildir/

Restart Postfix:

sudo systemctl restart postfix

Set up Maildir for users:

sudo mkdir /home/username/Maildir  
sudo maildirmake.dovecot /home/username/Maildir  
sudo chown -R username:username /home/username/Maildir

Step 3: Secure Dovecot Configuration

Mail Location & Authentication

Edit /etc/dovecot/conf.d/10-mail.conf:

mail_location = maildir:~/Maildir

Edit /etc/dovecot/conf.d/10-auth.conf:

disable_plaintext_auth = yes  
auth_mechanisms = plain login  
!include auth-system.conf.ext

Enable Secure Authentication

Edit /etc/dovecot/conf.d/10-master.conf:

unix_listener /var/spool/postfix/private/auth {  
    mode = 0660  
    user = postfix  
    group = postfix  
}

Restart Dovecot:

sudo systemctl restart dovecot

Step 4: Enable TLS Encryption (SSL/TLS)

For production, use Let’s Encrypt. For testing, generate a self-signed certificate:

sudo openssl req -new -x509 -days 365 -nodes -out /etc/ssl/certs/mailcert.pem -keyout /etc/ssl/private/mailkey.pem

Edit /etc/dovecot/conf.d/10-ssl.conf:

ssl = required  
ssl_cert = </etc/ssl/certs/mailcert.pem  
ssl_key = </etc/ssl/private/mailkey.pem

Restart Dovecot:

sudo systemctl restart dovecot

Step 5: Firewall & Port Configuration

Allow essential email ports:

sudo ufw allow 25,587,110,995,143,993/tcp  
sudo ufw enable

Key Ports:

25 (SMTP) – Email routing
587 (Submission) – Secure SMTP
993 (IMAPS) – Encrypted IMAP
995 (POP3S) – Encrypted POP3

Step 6: Testing & Troubleshooting

Test IMAP with OpenSSL

openssl s_client -connect yourdomain.com:993

Check Logs for Errors

sudo tail -f /var/log/mail.log

Advanced Security & Maintenance

1. Enable Fail2Ban for Brute-Force Protection

sudo apt install fail2ban -y

2. Set Up Automatic Updates

sudo apt install unattended-upgrades

3. Backup Strategy

Mailboxes: /home/*/Maildir
Configs: /etc/postfix, /etc/dovecot
Use rsnapshot or rsync for incremental backups

Conclusion

You’ve now built a secure, self-hosted mail server with Postfix (SMTP) and Dovecot (IMAP/POP3) on Ubuntu. This setup provides:

🔒 End-to-end encryption (TLS/SSL)
📧 Professional email hosting under your domain
🛡️ Spam & malware protection (expandable with SpamAssassin/ClamAV)

For further enhancements, consider:

Roundcube (Webmail interface)
SPF/DKIM/DMARC (Email authentication)
Automated backups (e.g., BorgBackup)

By self-hosting, you eliminate vendor lock-in, reduce costs, and gain full control over your email infrastructure—ideal for businesses, developers, and privacy advocates.