There is a doc here as well if you wish to deploy Portainers alongside Mailcow on the same server (I don’t plan to do that vs. using the agent model to manage it):
https://docs.mailcow.email/third_party/portainer/third_party-portainer/
Regarding DNS, to maximize delivery you’ll want to do a few things:
Make sure your mail server hostname’s “A” record (IPV4) is set up. If your server also has a public IPV6 record, you should setup it’s “AAAA” record as well. The “A” records are what are using via “nslookup hostname.domain.com” to find out its IP.
Make sure you have reverse DNS setup. Basically for hostname.domain.com pointing to an IP address, ensure the reverse is also possible, so you can nslookup the IP and get the hostname.
Set up your MX record for your email domain. This maps “domain.com” to “hostname.domain.com” so email systems know which server(s) can receive messages for the domain.
Next will be your SPF, DKIM and DMARC records in DNS. I recommend setting up all 3:
https://docs.mailcow.email/prerequisite/prerequisite-dns/#dkim-spf-and-dmarc
- Set up your SPF record, which lists all the servers authorized to send emails from a particular domain. This ensures others cannot fake your domain:
https://www.cloudflare.com/learning/dns/dns-records/dns-spf-record/
http://www.open-spf.org/FAQ/Examples/
http://www.open-spf.org/SPF_Record_Syntax/
This the SPF (TXT) record I established. It basically says "check the MX record to validate who is allowed to send email on behalf of my domain, and from anywhere else, mark it as spam (soft-reject):
dig -t txt domain.com +short
“v=spf1 mx ~all”
- Set up your DKIM record (when you add a domain in Mailcow, it generates a DKIM private/public key. You can use the public key provided to setup your DKIM record. This is also a TXT record but uses dkim._domainkey.domain.com for setting up this record. Email messages sent from your email system are Digital signed with the private DKIM key that only mailcow knows, but can be verified as authentic by other systems using the public DKIM key published via DNS:
https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/
In my example below, “…PUBLIC KEY…” will be a long string of seemingly random letters and numbers:
dig -t txt dkim._domainkey.domain.com +short
“v=DKIM1;k=rsa;t=s;s=email;p=…PUBLIC KEY…”
- Finally, set up your DMARC record, which can be used for overall reporting and conformance for what to do when another system rejects an email message from you, and for providing reporting/stats back to your system on emails exchanged between domains. This requires you to setup a “DMARC” email inbox to receive the reports. This step is not done by all nor is as important as SPF and DKIM, but I recommend doing so:
https://www.cloudflare.com/learning/dns/dns-records/dns-dmarc-record/
This is mine … I’ve specified DMARC reports to be sent from other systems to dmac@domain.com and indicates any failed emails from the direct domain.com be soft-rejected (marked as spam), but if anyone tries to spoof my domain by faking a sub-domain like sender@important.domain.com then to reject it completely:
Finally, you can use these tools to help verify you do not have an open SMTP relay, and to verify your email server is not on any blacklists:
https://mxtoolbox.com/SuperTool.aspx
https://www.mail-tester.com