Mailcow over VPN not sending emails.

apoorv569

I have self hosted Mailcow at home in a VM running on my Proxmox server. Because I don’t have a public IP, I have rented a VPS on which I have Wireguard VPN and NginxProxyManager installed. I have another instance of NginxProxyManager running at home which is connected to this VPN. So if I go to foo.MY_DOMAIN for example, the NPM on VPS forwards this request to the internal VPN IP of NPM at home, then NPM at home forwards the same foo.MY_DOMAIN to the respective app/service’s local IP on my local network, this is how I access my self hosted services from outside.

Now the Mailcow VM is connected to this VPN directly and only NPM on VPS forwards my mail.MY_DOMAIN to Mailcow's internal VPN IP on port 80. To install I ran the .generate_config.sh script typed my domain as mail.MY_DOMAIN added my TZ and ran docker compose up -d, I didn’t edit anything in the mailcow.conf file.

Now when go to mail.MY_DOMAIN I can access mailcow UI and I can login. After logging in, under Email -> Configuration, I added a domain entry for MY_DOMAIN left all options as default. Then I edited the DNS for this domain and added autodiscovery, autoconfig as CNAME records and added DKIM, DMARC, SPF as TXT record and a MX record that points to mail.MY_DOMAIN.

About DNS and my domain, I have a domain say example.com, for this domain I created an A record mail pointing to the VPS public IP. I use Cloudflare for DNS, here are screenshots of how I have setup my DNS entries,

Here is the DNS configuration from mailcow Domains page,

Then I added a Mailbox I used admin as username set a password for it and left everything as default. So the email address looks like, admin@MY_DOMAIN.

Then I added an Alias,

After this I logged in to SOGo via admin@MY_DOMAIN, which worked, then I sent a email to my real GMail account, the email showed as sent in SOGo, but I have not received any mail on my GMail account.

I followed this video on YouTube BTW for help with setting up Mailcow, https://www.youtube.com/watch?v=_z6do5BSJmg

Am I missing something?

esackbauer

apoorv569 Then I added a Mailbox I used admin as username

Not the smartest idea to create a mailbox with the same username as the internal admin account.
That could lead to unexpected results, because admin account is treated differently throughout mailcow.

More helpful would be the postfix logs for the attempt to try to forward the mail to the VPS.
Can you do a telnet on port 25 from your home server to the VPS via the tunnel?

apoorv569

esackbauer I see. Should I delete this mailbox and create new one with a different username?

How/Where do I check the postfix logs?

telnet from home server to VPS via tunnel, meaning from the mailcow VM at home to VPS public IP? so if the VPS public IP is 1.2.3.4, I do telnet 1.2.3.4 25 from the mailcow VM at home while I am connected to the VPN?

esackbauer

apoorv569 How/Where do I check the postfix logs?

In the mailcow UI if you log in with your admin account.
Alternatively:
https://docs.mailcow.email/troubleshooting/debug-logs/

apoorv569 from the mailcow VM at home to VPS public IP

No, that would be outside the tunnel. Can it be that you are very new to all this?
Seems you are overcomplicating things. You actually do not need 2 NPMs and a VPN tunnel.

apoorv569

esackbauer

esackbauer In the mailcow UI if you log in with your admin account.

I see this in the postfix logs,

esackbauer No, that would be outside the tunnel. Can it be that you are very new to all this?
Seems you are overcomplicating things. You actually do not need 2 NPMs and a VPN tunnel.

I am new to self hosting mail server, but not in self hosting in general. In the case of mailcow there is only one NPM involved the one on the VPS as mailcow VM is directly connected to the VPN.

I only do this (2 NPM with a VPN setup) because I don’t have a public IP and I want to be able to access my self hosted services from outside my home. I suppose I could connect every service to VPN on their own and remove NPM at home and only have NPM instance on the VPS?

esackbauer

It depends on what you have, I am also hosting my private mailcow at home.
My IPv4 address does not change so often, so I use a the ddns-updater container to update the DNS records.
You need ONLY for SMTP outgoing a static IP address in good state.
So I have everything pointed at my dynamically updated DNS records at home, and just use a relay (“sender dependent transport” in mailcow) to forward mails to a VPS. No need for VPN because you can force this connection to be encrypted via TLS.

apoorv569

esackbauer So I need enable/open port 25 on the VPS I am assuming (ufw)? There is no active firewall on the VM (at least I didn’t configure one).

esackbauer

Here is everything you need to know:
https://community.mailcow.email/d/1275-the-ultimate-guide-to-run-your-own-smtp-relay-server

apoorv569

esackbauer So I need a relay server? It won’t work with it in my case?

esackbauer

You need a relay server. Its all explained in that link.
You can host one yourself on a VPS, or you can use Sendgrid or Mailgun which have a free tier.

apoorv569

esackbauer Do you use a relay server as well? Asking because you said you also self host mailcow at home. Or is it specific to my scenario?

esackbauer

apoorv569 Do you use a relay server as well?

Yes I do.

apoorv569 Or is it specific to my scenario?

No.

apoorv569

esackbauer The person in the post you shared with me, mentions that I need to add relay info in the Routing page in mailcow admin UI using SASL. I don’t remember setting up anything called SASL. I don’t think they are using the docker version either.

The HOST would just be mail.MY_DOMAIN I guess and would the username and password be the current mailbox I have? admin@MY_DOMAIN the password for this mailbox?

They also talk about making sure postfix is running in chroot, not sure what that means? like it has write access?

Is a SMTP relay server, just another Postfix server?

Sorry as I mentioned I am new to mail servers, but willing to learn and understand, at least the required bits.

esackbauer

Oh boy you have to learn a lot… Mail servers are among the most complicated things to understand and properly operate. Mailcow makes just the installation easy, not the operations or configuration if you have nonstandard requirements.
You should really start with simple setup and use existing relay servers like mailgun or Sendgrid. Or pay for a static IP (if your ISP offers that) or even better install mailcow completely on a VPS.

Actually SASL is not necessarily needed, if you can lock down postfix on VPS (which is then your relay server), to not allow other parties to send spam. Can do on firewall level. That again depends on your abilities to configure firewalls and your hoster and/or your operating system.

apoorv569 Is a SMTP relay server, just another Postfix server?

SMTP is the protocol, not a server. Postfix is the server software (there are others like Exim) that speaks SMTP and is a so called Mail Transfer Agent (MTA). Please learn the differences between MTA and something like Dovecot. It makes the whole thing more clear.

apoorv569

esackbauer I see. So if I install mailcow on the VPS directly, I don’t need to do anything extra? just start the containers and it would work? This mail server is for my personal use only BTW, I will be using this for my other self hosted services, for things like, if a user requests for password reset on Nextcloud, or alerts from various self hosted services etc. I won’t be using this for public use. Do you think 1 core, 1G RAM and 25G disk space is enough to host mailcow for such a use case? as the VPS I rent is shared CPU one.

esackbauer

apoorv569 , I don’t need to do anything extra? just start the containers and it would work?

Yes. Maybe if the hoster has a firewall in front of it you need to open the ports there.

apoorv569 Do you think 1 core, 1G RAM and 25G disk space is enough to host mailcow for such a use case?

Mailcow is a groupware and so much more than just a postfix as MTA.
If you want something so basic, mailcow is actually too much for you, it needs at least 2 cores and 6 GB to work properly.
4 GB might be enough if you disable SOGo and ClamAV and Solr.
But if you do so you are better off using a different solution like Docker-mailserver or mailu.

apoorv569

esackbauer I see. Yes I actually don’t really need a full blown email suite, just a lightweight email server that can send users alert and password reset links etc..

So these 2 projects you mentioned they are much lightweight?

apoorv569

esackbauer OK, so trying to make all work for 2 days now. Haven’t gotten it to work. At one point used Luke Smith's emailwiz script to install postfix and dovecot directly on VPS which kind of worked, I could receive mail but could not send mail.

I opened a ticket on DigitalOcean where I have rented the VPS, they said port 25 is blocked and cannot be opened.
Now I wonder do I need to this port 25, if like I host like a relay server on VPS? Can I not change port 25 to something else in general?
They suggested I use SendGrid which they have partnership with as a relay.
In my case sending email is more important than receiving it. So its kind of useless if I can’t send mail.
I want to avoid third-party apps if possible, as it kind of defeats the purpose of self hosting.

What do you think?

esackbauer

apoorv569 Now I wonder do I need to this port 25,

You need port 25 outgoing. Otherwise it will not be able to talk to any other mail server.

apoorv569

esackbauer So I can’t avoid port 25 and because VPS can’t open it for me, I am out of luck for self hosting mail server?

I heard you can change port 25 to 587 or something.. something like, changing the link starting with smtp inet to 587 inet. is that not true?

There exact words to me are,

The suggestion was to use SMTP mail relay at Droplet on port 587 and when you send mail to any external mail servers from home it will be using port 25.

and gave me this link as a reference, https://reintech.io/blog/configuring-mail-relay-sendmail-ubuntu-20-04

I am very confused, I thought if you can’t access port 25 that’s when you use a relay, but looks like even a relay needs port 25?

If port 25 is required no matter if its relay or not, how would someone use GMail as relay for example?

esackbauer

apoorv569 but looks like even a relay needs port 25?

You sure need to learn a lot about SMTP and firewalls. Firewall rules have a source and destination. So it can apply to incoming and/or outgoing traffic. Outgoing Port 25 is what providers are blocking.
We posted already several solutions here in this thread, please pick one.
Sorry you have to learn the basics for running servers elsewhere. This is a mailcow specific forum.