Install Mailcow with Docker on Ubuntu

Mailcow guide series: Part 3 of 7. Start with Part 1.

Next: Configure Route 53 DNS for Mailcow: MX, SPF, DKIM, DMARC, and PTR

This is Part 3 of the Mailcow self-hosted email series. At the end, Mailcow’s containers will be running and its secure administration page will open. Do not change your domain’s MX record yet; we’ll finish DNS and outbound relay first.

Install Docker and the required tools

SSH to the Ubuntu VM created in Part 2. Enter a root shell for the installation commands:

sudo -i
apt update
apt install -y git openssl curl gawk coreutils grep jq

Install a current Docker Engine and Compose plugin using the official Docker instructions for Ubuntu. Mailcow requires Docker Engine 24 or newer and Docker Compose 2 or newer. The upstream Mailcow install page currently documents this convenience installer:

curl -sSL https://get.docker.com/ | CHANNEL=stable sh
systemctl enable --now docker
docker --version
docker compose version

For a long-lived production server, review the Docker install method and package repository details before executing it. Do not install Docker from an unrelated script copied from a forum.

Download Mailcow and generate its configuration

Mailcow’s official project repository contains the Compose stack and helper scripts. Clone it in /opt, the usual place for optional server applications:

umask 0022
cd /opt
git clone https://github.com/mailcow/mailcow-dockerized
cd /opt/mailcow-dockerized
./generate_config.sh

When asked for the fully qualified host name, enter the permanent name you chose, for example mail.example.com. A fully qualified name is the complete internet name of the server, including the domain suffix. Mailcow uses it for its web interface, mail protocols, and TLS certificate.

Open the configuration file and review it:

nano /opt/mailcow-dockerized/mailcow.conf

Keep the generated database and service passwords private. Do not replace them with simple example passwords or add this file to Git. For a standard public installation, keep the default HTTP and HTTPS bindings and let Mailcow obtain its certificate. If you deliberately put a reverse proxy in front, follow Mailcow’s dedicated reverse-proxy guide and bind Mailcow’s web ports to a private/local address; do not expose the same web ports twice.

Start the containers

From the Mailcow directory, pull the required images and start the stack:

cd /opt/mailcow-dockerized
docker compose pull
docker compose up -d
docker compose ps

The first startup takes time because Docker downloads many services. Check status and the certificate client logs:

docker compose ps
docker compose logs --tail=100 acme-mailcow

If a container is still starting, inspect its logs before restarting the whole server. A certificate cannot be issued until mail.example.com points to the VM and HTTP validation can reach it on port 80. The Mailcow SSL guide covers alternatives such as DNS challenges.

Sign in and secure the administrator account

Open https://mail.example.com/admin. A fresh Mailcow install initially uses username admin and password moohoo. This is a public default, not a safe long-term password: change it immediately, store the new one in a password manager, and enable administrator two-factor authentication. Never publish or reuse a Mailcow admin password as a mailbox password.

If the login page does not open, check these in order:

1. Does mail.example.com resolve to the VM’s public IP?
2. Are OCI ingress rules open for TCP 80 and 443?
3. Is the nginx-mailcow container running? Use docker compose ps.
4. What does docker compose logs --tail=100 nginx-mailcow acme-mailcow report?

Do not disable TLS checks in a browser to “fix” a certificate error. Correct DNS, port reachability, and certificate setup instead.

Add a domain, but do not cut over mail

In the Mailcow admin UI, open Configuration and Details → Mail Setup → Domains and add the domain you own, such as example.com. Select a sensible mailbox quota and domain send limit. Generate a DKIM key in the domain settings; Part 4 explains how to publish the exact record Mailcow shows.

You can create a test mailbox now, but do not change the production MX record until Parts 4–6 are complete. Continue with Part 4: Route 53 DNS and email authentication.

Official references: Mailcow install guide, system requirements, default password reset guide.