Mailcow guide series: Part 6 of 7. Start with Part 1.
Next: Back Up, Update, and Recover a Mailcow Server
This is Part 6 of the Mailcow self-hosted email series. Now the server and DNS exist, and OCI Email Delivery is configured as an outbound relay. We’ll create a mailbox, check the security controls, test both directions, and only then move the domain’s MX record.
Create a mailbox with its own password
In Mailcow admin, open Mail Setup → Mailboxes and add a mailbox such as you@example.com. Use a long, unique password generated by a password manager. Do not reuse the Mailcow administrator password or OCI SMTP credential. Set a quota that fits the disk and your retention plan. Create aliases only for addresses you actually need; a catch-all mailbox accepts messages for every invented address and attracts spam.
Enable two-factor authentication in the webmail account and administrator account. For phones and desktop clients, Mailcow’s standard settings are:
| Service | Server | Port | Encryption |
|---|---|---|---|
| IMAP | mail.example.com |
993 | SSL/TLS |
| SMTP submission | mail.example.com |
587 | STARTTLS |
| Optional SMTPS | mail.example.com |
465 | SSL/TLS |
Use the full email address as the login name. For SMTP, require authentication and TLS. Mailcow’s client configuration guide lists the standard ports.
Keep the server from becoming a spam cannon
Mailcow includes spam filtering and can include antivirus, but software alone cannot protect a weakly secured mailbox. Before inviting users:
- Use unique mailbox passwords and enable two-factor authentication where supported.
- Set sensible per-domain and per-mailbox send limits; start low and raise them only for a real need.
- Do not expose admin, database, Redis, or Docker control interfaces to the public internet.
- Keep Mailcow updated and subscribe to security updates for the Linux host.
- Review sent-mail activity, Postfix logs, OCI Email Delivery logs, and suppression/bounce reports. Revoke an unknown app password or mailbox credential promptly.
- Do not allow open relay. Mailcow should require authentication for port 587 and must reject unauthorized third-party relay attempts on port 25.
- Use address confirmation and rate limits on any website signup/contact form; a mail server cannot repair a form that lets bots send unlimited messages.
- Honor unsubscribes and complaints. Do not send bulk marketing through a personal mailbox or to people who did not ask for it.
OCI automatically suppresses some permanently bounced or complaint addresses to protect sending reputation. See OCI suppression list guidance.
Check DNS and public ports
From Linux or macOS:
dig +short A mail.example.com
dig +short MX example.com
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig -x 203.0.113.10
nc -vz mail.example.com 25
nc -vz mail.example.com 587
nc -vz mail.example.com 993
From Windows PowerShell:
Resolve-DnsName mail.example.com
Resolve-DnsName example.com -Type MX
Resolve-DnsName 203.0.113.10 -Type PTR
Test-NetConnection mail.example.com -Port 25
Test-NetConnection mail.example.com -Port 587
Test-NetConnection mail.example.com -Port 993
The IP in these examples is documentation-only; use your real public IP. Do not share the output publicly if it includes your real server address.
Check that STARTTLS works on submission:
openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com
A certificate for mail.example.com should be presented. Type QUIT to close the test connection. Do not type a password into this diagnostic session.
Test outgoing and incoming mail
Send one plain test message from the Mailcow webmail mailbox to an address you control at a separate provider. Check the message’s headers for SPF, DKIM, and DMARC results. A Mailcow or OCI 250 Ok means that the next mail server accepted the message; it does not promise inbox placement. Check the recipient’s spam folder too.
For inbound testing before moving a production domain, use a separate test domain/subdomain or temporary test mailbox whose MX points at the new server. Send from an independent provider and verify that Mailcow receives it. Also verify that replies and attachments work and that mail is stored in the expected mailbox.
Move the MX record carefully
Only when inbound and outbound tests pass should you change the production MX record in Route 53 to:
10 mail.example.com
Keep the old mail service and mailbox data available during the change. DNS is cached; a sender may still use the old MX until its cache expires. Watch both mail systems during the transition and move old messages if needed. If delivery fails, restore the previous MX value and investigate before trying again.
Begin with DMARC p=none and check the reports. After every legitimate sender passes SPF or DKIM alignment, tighten the policy to quarantine or reject. Continue with Part 7: backups and disaster recovery.
Official references: Mailcow client setup, Mailcow DNS, OCI email logs.