Mailcow guide series: Part 2 of 7. Start with Part 1.
Next: Install Mailcow with Docker on Ubuntu
This is Part 2 of the Mailcow self-hosted email series. We’ll create a stable Ubuntu server and the network rules that let mail and web traffic reach it. These steps use Oracle Cloud Infrastructure (OCI); other providers use different names for their firewall screens.
Create the virtual machine
In OCI, create a Compute instance in the region where you want to operate. Select a current Ubuntu LTS image that Mailcow supports, choose ARM64 or x86-64, and size the machine for Mailcow rather than just the Linux base system. Mailcow lists 6 GiB RAM plus 1 GiB swap and 20 GiB disk as a minimum; 8 GiB RAM or more gives a small installation more breathing room. More active users, large mailboxes, antivirus, and full-text search need additional resources.
Create or select a VCN and subnet. A VCN is your cloud network; a subnet is the network segment where the VM lives. Assign a reserved public IPv4 address so a restart or replacement does not silently change your mail server’s address. Attach an SSH public key during VM creation. SSH keys let you administer Linux without enabling password login.
Record the public IP, region, instance name, disk size, and the location of the private SSH key. The private key must stay on your computer and should never be pasted into a web form or saved in a public repository.
Connect from Windows PowerShell, replacing the example values:
ssh -i "$HOME\.ssh\mail-server-key" ubuntu@203.0.113.10
On macOS or Linux, the same command works with a path such as ~/.ssh/mail-server-key. If SSH fails, check that the VCN rule allows TCP 22 from your current public IP and that you used the correct key and default user (ubuntu for the standard Ubuntu image).
Add ingress rules in the VCN
An ingress rule controls traffic entering your cloud network. Mailcow’s standard services use these ports:
| Port | Purpose | Recommended source |
|---|---|---|
| TCP 25 | Other mail servers deliver email to you | 0.0.0.0/0 for public inbound mail |
| TCP 80 | Web access and HTTP certificate checks | 0.0.0.0/0 |
| TCP 443 | Secure Mailcow admin/webmail access | 0.0.0.0/0 |
| TCP 587 | Authenticated SMTP submission from your apps/devices | Public only if you need remote submission; use strong passwords and TLS |
| TCP 993 | Secure IMAP mailbox access | Public only if you need remote mailbox access |
| TCP 465 | Optional implicit-TLS SMTP submission | Open only if you plan to use it |
| TCP 4190 | Optional ManageSieve filter management | Open only if you use remote sieve clients |
Also allow TCP 22 only from your own trusted IP address, not from the whole internet. Do not expose MySQL, Redis, Docker, or Mailcow’s internal service ports. Choose the smallest set of client protocols you need. Mailcow’s system requirements and port list explain the standard bindings.
In OCI, the rule can be attached to a Network Security Group (NSG) or a subnet security list. Stateful ingress rules automatically allow response traffic. Keep the default outbound rules while bringing the system up; if you later restrict egress, make sure DNS, time synchronization, HTTPS updates, and the SMTP relay remain reachable.
Understand Oracle’s port 25 restriction
Inbound TCP 25 and outbound TCP 25 are separate directions. Open inbound TCP 25 so other domains can deliver mail to your server. Do not assume that outbound TCP 25 works: OCI blocks internet-bound TCP 25 by default for many newer tenancies. Part 5 routes outbound mail through OCI Email Delivery using authenticated SMTP submission instead.
After SSH login, update the operating system and verify it has enough memory and disk:
sudo apt update
sudo apt full-upgrade -y
sudo reboot
Reconnect, then check:
free -h
df -h /
timedatectl status
The system clock should be synchronized; certificates, authentication, and mail logs all depend on correct time. If you need swap, follow Ubuntu’s current swap instructions and keep the swap file private.
Confirm the address is stable
Before installing Mailcow, confirm the reserved IP is attached to the instance and note which OCI firewall object controls it. You will add mail.example.com to Route 53 in Part 4 and request a reverse-DNS (PTR) record from OCI. PTR is configured by the provider that controls the IP address; Route 53 cannot set a PTR for an OCI-owned address.
Do not move on until you can SSH in, the VM has enough disk and memory, and the public IP will not change. Continue with Part 3: Install Mailcow on Ubuntu.
Official references: OCI Compute instance networking, OCI outbound SMTP restriction, Mailcow ports and requirements.