Send Mailcow Mail Through Oracle Cloud Email Delivery

Mailcow guide series: Part 5 of 7. Start with Part 1.

Next: Create Your First Mailcow Mailbox, Stop Abuse, and Test Delivery

This is Part 5 of the Mailcow self-hosted email series. An outbound relay, or smarthost, accepts outgoing mail from Mailcow and delivers it to the recipient. It is useful when your cloud provider blocks direct outbound port 25. This guide uses Oracle Cloud Infrastructure (OCI) Email Delivery; another provider’s relay can be configured similarly.

OCI Email Delivery sends outbound email. It does not host your mailboxes and it does not replace the inbound MX record. Mailcow still receives incoming messages directly on TCP 25.

Create a dedicated sender identity

In the OCI Console, select the same region where you will use Email Delivery. Create a compartment for the service, then a dedicated IAM user and group for sending. Keep this user separate from your everyday OCI administrator. Give the sender group only the permission needed to use approved senders in the compartment, following OCI’s current Email Delivery IAM policy guide. For example, OCI documents the policy form:

Allow group <sender-group> to use approved-senders in compartment <mail-compartment>

Your administrator may need a separate, temporary policy to create and configure the Email Delivery domain. Do not put the SMTP user in the tenancy-wide Administrators group. Oracle recommends separate SMTP users and secure storage/rotation of their credentials in its Email Delivery security guidance.

Configure the sender domain and authorization

In the Email Delivery console, complete these tasks in order:

1. Create an Email Domain for the domain you own, such as example.com.
2. Configure OCI DKIM. Copy the generated CNAME record names and values into Route 53. Wait until OCI marks the DKIM configuration active.
3. Create an approved sender for each address that will appear in the From header, such as you@example.com and noreply@example.com. OCI rejects From addresses that are not approved. An approved sender is regional, so create it in the same region as the relay endpoint.
4. Enable Email Delivery logs so you can see acceptance, delivery, bounce, and suppression events.
5. Publish the regional SPF include from OCI’s SPF guide, merging it with existing SPF mechanisms as Part 4 describes.

Generate an SMTP credential

Create or open the dedicated sender user and generate an SMTP credential. Copy the generated username and password directly to a password manager. OCI does not show the SMTP password again after you close the credential dialog, and it is not the user’s OCI Console password. If it is lost, generate a new one and replace the old credential in Mailcow.

In the Email Delivery Configuration screen, copy the public SMTP endpoint for your region. The endpoint has a region-specific name; do not guess it. For example, the Sydney endpoint follows smtp.email.ap-sydney-1.oci.oraclecloud.com; replace the region with your own. OCI accepts secured submission on port 587 and also supports implicit TLS on port 465. For port 587, use STARTTLS; for 465, use implicit TLS. Never disable TLS to make a connection work.

Add the relay in Mailcow

Sign into the Mailcow admin UI. Open Configuration and Details → Routing and add a sender-dependent transport. Use the OCI regional endpoint and SMTP port, enable authentication, and enter the generated OCI SMTP username and password. Save and use Mailcow’s relay test for a sender address that is on OCI’s approved-senders list.

Mailcow’s relayhost UI stores relay credentials in its configuration database; limit admin access, use a dedicated least-privilege SMTP user, and include the Mailcow database/configuration in protected backups. See the upstream Mailcow relayhost guide.

Then connect the relay to the mail domain:

1. Go to Mail Setup → Domains in Mailcow.
2. Edit example.com.
3. Choose the new relay under Sender-dependent transports and save.

This tells Mailcow to send mail for that domain through OCI. Do not change the route for unrelated domains unless you mean to.

How to read a relay test

A successful SMTP relay test ends with a 250 response, meaning the relay accepted the test transaction. It does not prove that a recipient’s inbox accepted or displayed the message. Use the Mailcow queue/logs and OCI Email Delivery logs to follow actual messages. OCI exposes separate accepted and relayed events; its logging guide explains them.

If authentication fails, check the region endpoint, SMTP username (not the OCI console login), password, and approved sender. If authentication succeeds but the sender is rejected, add the exact From address to OCI’s approved senders. If OCI accepts the message but the recipient never sees it, check OCI relay/bounce logs, the recipient’s spam folder, and SPF/DKIM/DMARC alignment.

Continue with Part 6: mailbox security and end-to-end tests.