Priority Listing: Self-Hosted Email Service on AWS EC2

This document outlines the step-by-step priority list to deploy and verify a self-hosted, Docker-based email server on AWS EC2.

Phase 1: AWS Configuration & Requests (Immediate Priority)

Before writing any configuration files or launching servers, you must set up the AWS infrastructure and submit request forms to AWS Support. AWS manually reviews these requests, which can take 24–48 hours.

1. Provision AWS Resources

EC2 Instance: Launch a t3.medium (or larger) instance running Ubuntu 24.04 LTS.
Elastic IP: Allocate a static Elastic IP and associate it with the EC2 instance. (Note the IP address).
Security Group: Configure the security group to allow inbound traffic on:
- Port 25 (SMTP)
- Port 143 / 993 (IMAP / IMAPS)
- Port 587 / 465 (Submission / SMTPS)
- Port 80 / 443 (HTTP / HTTPS for Webmail & SSL certificates)

2. Request Port 25 Unblocking & Reverse DNS (PTR)

You cannot send emails from EC2 without removing the default Port 25 limit.

Action: Submit the Request to Remove Sending Limitations form in the AWS Support Center.
Provide the following details:
- Your Elastic IP address.
- Your email domain (e.g., yourdomain.com).
- The Reverse DNS (PTR) record you want associated with the IP (e.g., mail.yourdomain.com).
- A clear explanation of your use case (e.g., "Hosting our company email service for internal staff communications").

Phase 2: Development & Infrastructure Setup

Once AWS approves your request, proceed with the software installation.

1. Host Setup

Install Docker and Docker Compose on the EC2 instance.
Set up a swap file if memory usage is tight (especially if using Mailcow).

2. Mail Server Installation (Example: Mailcow)

Clone the repository: git clone https://github.com/mailcow/mailcow-dockerized
Generate configuration: ./generate_config.sh
- Enter your mail subdomain (e.g., mail.yourdomain.com).
Adjust configurations in mailcow.conf (e.g., timezone, HTTP/S ports).
Spin up the containers: docker compose up -d

3. DNS Configuration

Add the following records at your Domain Registrar or DNS manager (Route 53, Cloudflare, etc.):

Record Type	Host / Name	Value	Purpose
A	`mail`	`<Your EC2 Elastic IP>`	Points to your mail server
MX	`@` (Root)	`10 mail.yourdomain.com.`	Directs incoming mail to the mail server
TXT	`@`	`v=spf1 ip4:<Your Elastic IP> -all`	SPF: Authorizes EC2 to send mail
TXT	`dkim._domainkey`	Generated by Mailcow UI	DKIM: Cryptographic mail signing
TXT	`_dmarc`	`v=DMARC1; p=quarantine; pct=100;`	DMARC: Action policy for failures

Phase 3: Testing & Verification Plan

Run these verification checks before onboarding your organization.

1. Inbound Connection Port Check

Verify that the firewall/security groups are open to the public internet:

# From a remote machine, test SMTP
nc -zv <Your Elastic IP> 25

# Test IMAPS
nc -zv <Your Elastic IP> 993

2. Inbound & Outbound Email Delivery

Outbound Test: Create an inbox in your new mail server and send an email to an external address (e.g., a personal Gmail or Outlook account). Verify it arrives and does not go to spam.
Inbound Test: Reply to that email from Gmail/Outlook and verify it is received on your self-hosted server.

3. Comprehensive Deliverability & Trust Test

Use a service like Mail-Tester or MxToolbox.
Send a test email from your mail server to the address provided by Mail-Tester.
Target Score: 10/10. Ensure SPF, DKIM, DMARC, and Reverse DNS (PTR) alignment are all marked green.

3.8 KiB Raw Blame History Unescape Escape