mailcow Configuration

iali

Hello everyone,

after configuring mailcow, setting the flag impose incoming and outgoing tls on mailboxes, it slows me down sending mails and doesn’t allow me to receive mails despite from the recipient there is no error, also i currently reach sogo in https by setting the ssl certificate directly on the firewall.

I would like support on the following points:

1) how do i enable encryption on mailcow without decreasing the performance of the sogo user interface/email sending?

2) currently when i search for webmail.domain.com it sends me to the home to login to the management page, after that i have to click on webmail to go to sogo, is it possible to change the nginx configuration of mailcow, so that searching for webmail.domain.com sends me directly to webmail.domain.com/SOGo and searching for webmail.domain.com/u-panel sends me to the management page dedicated to end users and not to the admin part that should remain active only via private ip and not via fqdn?

3) is it possible to enable the 2fa massively for multiple users so that at the next sogo login the qr appears to everyone?

Thanks

aaronsmith

I do not utilize these settings personally because most clients will default to encrypted communications with an email server before falling back to an insecure method. So to that end, here’s my best attempt to answer your questions:

Encryption/decryption is very CPU intensive, and increases at scale with the number of users. So performance is largely tied to the underlying resources of your server. This effect is compounded with rspamd and clamd for anti-spam and antivirus checks.
Not sure personally, but you can easily direct users to https://<mail server>/SOGo and they will immediately see the web interface. You can also customize this interface if you’re so inclined: https://docs.mailcow.email/manual-guides/SOGo/u_e-sogo/
I don’t see such an option with the domain settings, only for individual mailbox/user settings. Perhaps a people/process matter, you can direct users on how to setup MFA to increase their mailbox security, but that’ll only work for the Web UI anyhow. IMAP/POP3 will still work as-is with the usual ID/PW combination. So arguably not much is gained by trying to globally enforce MFA here because if a user’s credentials are compromised, a savvy and shady individual will just bypass MFA by using IMAP/POP3 anyhow to get the data, which is at the heart of the problem.

Hope this helps a little!