How secure is Mailcow for personal mail

gspe

I’ve discovered mailcow few days ago when I was looking for new email provider to switch to.
So I’m curious to know what the community think about how secure is to setup and run mailcow as personal mail provider.

heavygale

Depends on your server managing skills 😄

Hosting your own email service keeps you in control of your own data but this also means that you are responsible for securing the server, backing it up and regularly updating you system and the mailcow installation.

hlippke

If you commit yourself to running your own mail server using Mailcow you’ll find that it is actually quite easy to keep it updated and backed-up. So all you need is to take care of your installation by monitoring for updates and applying them regularly. Add a bit of common sense in systems security and you’re good to go, like strong passwords, SSH key authentication, no unneeded open ports, … etc,
Also, make sure to get all your DNS records straight.

gspe

hlippke This is what I mean, since Mailcow come prepackaged in a nice docker-compose with all services already configured, I suppose that the developers have already taken every necessary precaution to have a secure system.
A part closing unnecessary opened port and using SSH key authentication, I don’t think there is much more thing to do at system level configuration or am I wrong?
All configuration, eventually needed, have to be done inside each docker container right?

shiz0

gspe
Mailcows default settings are very good.
For a “normal” mailserver, here’s not much more to do from the application side IMHO. Choose strong passwords, enable 2FA on the Portal accounts and you’re good to go.
Of course, as with all things, you should always know what you are doing. there’s a lot of settings to customize to your liking and some of them might affect security as well!

Managing and securing the underlying system is up to you and the general rules and recommendations for server administration apply.
Also, you should get an idea about email mechanics, techniques and security and how to implement for example SPF/DMARC/DKIM for your domains.
A certain level of knowledge on these topics is strongly recommended!

hlippke

gspe Most of the configuration is done via a web gui and that takes you almost all the way. I did only change the configuration inside the config files (mounted into the containers) for one single setting, as I don’t need my vmail folder to be encrypted.