81 lines
3.8 KiB
Markdown
81 lines
3.8 KiB
Markdown
|
# Priority Listing: Self-Hosted Email Service on AWS EC2
|
|||
|
|
|
|||
|
|
This document outlines the step-by-step priority list to deploy and verify a self-hosted, Docker-based email server on AWS EC2.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Phase 1: AWS Configuration & Requests (Immediate Priority)
|
|||
|
|
|
|||
|
|
Before writing any configuration files or launching servers, you must set up the AWS infrastructure and submit request forms to AWS Support. **AWS manually reviews these requests, which can take 24–48 hours.**
|
|||
|
|
|
|||
|
|
### 1. Provision AWS Resources
|
|||
|
|
- **EC2 Instance**: Launch a `t3.medium` (or larger) instance running Ubuntu 24.04 LTS.
|
|||
|
|
- **Elastic IP**: Allocate a static Elastic IP and associate it with the EC2 instance. (Note the IP address).
|
|||
|
|
- **Security Group**: Configure the security group to allow inbound traffic on:
|
|||
|
|
* Port `25` (SMTP)
|
|||
|
|
* Port `143` / `993` (IMAP / IMAPS)
|
|||
|
|
* Port `587` / `465` (Submission / SMTPS)
|
|||
|
|
* Port `80` / `443` (HTTP / HTTPS for Webmail & SSL certificates)
|
|||
|
|
|
|||
|
|
### 2. Request Port 25 Unblocking & Reverse DNS (PTR)
|
|||
|
|
You cannot send emails from EC2 without removing the default Port 25 limit.
|
|||
|
|
- **Action**: Submit the [Request to Remove Sending Limitations](https://aws.amazon.com/premiumsupport/knowledge-center/ec2-port-25-throttle/) form in the AWS Support Center.
|
|||
|
|
- **Provide the following details**:
|
|||
|
|
* Your Elastic IP address.
|
|||
|
|
* Your email domain (e.g., `yourdomain.com`).
|
|||
|
|
* The Reverse DNS (PTR) record you want associated with the IP (e.g., `mail.yourdomain.com`).
|
|||
|
|
* A clear explanation of your use case (e.g., "Hosting our company email service for internal staff communications").
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Phase 2: Development & Infrastructure Setup
|
|||
|
|
|
|||
|
|
Once AWS approves your request, proceed with the software installation.
|
|||
|
|
|
|||
|
|
### 1. Host Setup
|
|||
|
|
- Install Docker and Docker Compose on the EC2 instance.
|
|||
|
|
- Set up a swap file if memory usage is tight (especially if using Mailcow).
|
|||
|
|
|
|||
|
|
### 2. Mail Server Installation (Example: Mailcow)
|
|||
|
|
- Clone the repository: `git clone https://github.com/mailcow/mailcow-dockerized`
|
|||
|
|
- Generate configuration: `./generate_config.sh`
|
|||
|
|
* Enter your mail subdomain (e.g., `mail.yourdomain.com`).
|
|||
|
|
- Adjust configurations in `mailcow.conf` (e.g., timezone, HTTP/S ports).
|
|||
|
|
- Spin up the containers: `docker compose up -d`
|
|||
|
|
|
|||
|
|
### 3. DNS Configuration
|
|||
|
|
Add the following records at your Domain Registrar or DNS manager (Route 53, Cloudflare, etc.):
|
|||
|
|
|
|||
|
|
| Record Type | Host / Name | Value | Purpose |
|
|||
|
|
| :--- | :--- | :--- | :--- |
|
|||
|
|
| **A** | `mail` | `<Your EC2 Elastic IP>` | Points to your mail server |
|
|||
|
|
| **MX** | `@` (Root) | `10 mail.yourdomain.com.` | Directs incoming mail to the mail server |
|
|||
|
|
| **TXT** | `@` | `v=spf1 ip4:<Your Elastic IP> -all` | SPF: Authorizes EC2 to send mail |
|
|||
|
|
| **TXT** | `dkim._domainkey` | *Generated by Mailcow UI* | DKIM: Cryptographic mail signing |
|
|||
|
|
| **TXT** | `_dmarc` | `v=DMARC1; p=quarantine; pct=100;` | DMARC: Action policy for failures |
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Phase 3: Testing & Verification Plan
|
|||
|
|
|
|||
|
|
Run these verification checks before onboarding your organization.
|
|||
|
|
|
|||
|
|
### 1. Inbound Connection Port Check
|
|||
|
|
Verify that the firewall/security groups are open to the public internet:
|
|||
|
|
```bash
|
|||
|
|
# From a remote machine, test SMTP
|
|||
|
|
nc -zv <Your Elastic IP> 25
|
|||
|
|
|
|||
|
|
# Test IMAPS
|
|||
|
|
nc -zv <Your Elastic IP> 993
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### 2. Inbound & Outbound Email Delivery
|
|||
|
|
* **Outbound Test**: Create an inbox in your new mail server and send an email to an external address (e.g., a personal Gmail or Outlook account). Verify it arrives and does not go to spam.
|
|||
|
|
* **Inbound Test**: Reply to that email from Gmail/Outlook and verify it is received on your self-hosted server.
|
|||
|
|
|
|||
|
|
### 3. Comprehensive Deliverability & Trust Test
|
|||
|
|
* Use a service like [Mail-Tester](https://www.mail-tester.com/) or [MxToolbox](https://mxtoolbox.com/).
|
|||
|
|
* Send a test email from your mail server to the address provided by Mail-Tester.
|
|||
|
|
* **Target Score**: 10/10. Ensure SPF, DKIM, DMARC, and Reverse DNS (PTR) alignment are all marked green.
|