I currently have two domains, let's call them domain.com and something.org. I want to use both domains with mailcow. I understand that I must choose one main domain to use as the hostname, I've done that already. My question is about the certificates. I'm managing all my domains with Cloudflare and I already have an nginx (NPM) instance running. I see I can use my own certificate but that only allows for one single cert, isn't it? Since I have two domains I have two Let's Encrypt certificates, so how would I use them? I'm using mail.domain.com as the hostname but since I want to be able to use mail.something.org too I have to also add the cert for that domain, right? I'm using DNS challenges because port 80 and 443 are used by Cloudflare pages, so I have to generate the cert using Cloudflare API keys. I could let mailcow generate the certs but: 1. NPM doesn't have an option to use external certificates 2. I don't see anywhere in the mailcow's config file an option to use DNS challenges for the cert generation The simplest way to solve this would be by using my own cert but the problem about only being able to use one certificate is stopping me from doing that. The other option I can see is adding a custom cert to NPM and replace the NPM generated cert files with mailcow's, but again, I don't see how to do DNS challenges with mailcow.

If you use `mail.domain.com` and `mail.something.org`, you'd need to disable Cloudflare for these domains anyway as mail ports cannot be proxied without Cloudflare's Enterprise Plan. Then HTTPS challenge would work for these FQDNs anyway. Note - you can only have one main mailserver FQDN. For the PTR of the IP, only use one single FQDN: The main name of the mailcow instance.

@"pkernstock"#p18390 Thanks for your help! Sorry for the late reply, I've been reading about how to setup the email server and trying to do it. I've finally setup the mail server for the main domain and it's working in the sense that I can use Thunderbird to access the account and send mail, I've also tried receiving mail and it works well. My concern is about the mobile apps, I've tried with two mail apps, the one that comes with /e/ and K-9 Mail, when I added the account both told me that they couldn't find the configuration so I had to enter the details manually but I don't understand why they don't find the config? Thunderbird on desktop did it, I've tried different services to test the mail configuration (MX, SPF, etc) like checktls.com and mxtoolbox and they are successful, is this normal? That the apps don't automatically configure the account? The only thing missing right now is DNSSEC which is being enabled right now, I don't get why the mobile apps can't auto-configure the account.

Have you enabled and properly configured autodiscover/autoconfig as per the docs?

Yes, both CNAME records are pointing to `mail.domain.com`. I just tried with Thunderbird desktop adding another account and it detected the servers. It took it several seconds though, like ~10, I don't know if it matters? Mostly saying this because in the Android app, it takes like 1 second for the app to tell me it didn't found any configuration. EDIT: OK, it must be some issue with K9, I just tried FairEmail and it detect the configuration. The /e/ Mail app appears to be based on K9 (interface is pretty much the same). It actually seems K9 doesn't support autoconfig too well: https://forum.k9mail.app/t/autoconfig-url-emailaddress-not-supported/8336/6 It actually seems K9 doesn't support autoconfig too well: https://forum.k9mail.app/t/autoconfig-url-emailaddress-not-supported/8336/6 It actually seems K9 doesn't support autoconfig too well: https://forum .k9mail.app/t/autoconfig-url-emailaddress-not-supported/8336/6 It actually seems K9 doesn't support autoconfig too well: http s://forum.k9mail.app/t/autoconfig-url-emailaddress-not-supported/8336/6

Lol, I've been commenting the same thinking I couldn't post links because I received an error telling me to reload but the forum was actually merging my comments, sorry for that.

@"pkernstock"#p18503 Hey, I'm finally testing the second domain mail and it's not working quite right, I must be doing something wrong. Since I can only use a single cert and for one domain (I'm managing both domains using separated accounts) I'm using the cert for domain.com in mailcow (which I picked to be the main domain). Now something.org DNS records are set to use domain.com: - MX record points to mail.domain.com - pop, imap and smtp CNAME records point to the corresponding domain.com subdomain (like imap.something.org -> imap.domain.com) - SRV records point to mail.domain.com Using checktls.com shows all correct with 121 score for something.org, when I add a @something.org account to Thunderbird it auto-discovers the configuration (imap.something.org, smtp.something.org) but when I click on Continue to add the account I get a warning about invalid certificate, upon inspecting the certificate I see the certificate is valid for domain.com and since Thunderbird picks up imap.something.org and smtp.something.org it says is invalid. How could I fix this? Thanks!

You need to have all names like imap.something.org smtp... etc. in the certificate. for that domain. You probably need to [enable SNI in mailcow](https://docs.mailcow.email/post_installation/firststeps-ssl/#the-lets-encrypt-subjectaltname-limit-of-100-domains), because you seem to have separate certificates for both domains. This way the certs for each domain are stored in a subfolder. You need to have [private and public key](https://docs.mailcow.email/post_installation/firststeps-ssl/#how-to-use-your-own-certificate) for those certificates in those subfolders.

About multiple domains and certs

wontell

esackbauer thanks, can I enable SNI even when I’m not using mailcow’s cert generation? What is the structure I should follow for the filenames? since it says I should copy to cert.pem and key.pem but that’s for only the main domain, right?

esackbauer

Yes.
I guess it’s the same for the separate ones. There are threads here in the forum where you could find that info.

wontell

I think I found the “problem”.

Since I’m using a separate nginx instance as my main, I hadn’t added autoconfig and autodiscover to the proxy hosts. Now after adding them pointing to mailcow’s nginx, Thunderbird is almost instant at retrieving the configuration but now it detects the servers as “mail.domain.com”, is this normal? I mean it works but I would have liked more to have it using it’s correct subdomain for each protocol instead of mail but that’s purely esthetic.

So before Thunderbird took several seconds and detected (I guess by just trying):
IMAP: imap.something.org
SMTP: smtp.something.org

Now it detects:
IMAP: mail.domain.com
SMTP: mail.domain.com

And now I don’t have the cert problem.

Inspecting the PHP code for autodiscover I see it uses 'server' => $mailcow_hostname, for everything so I guess mail.domain.com it’s OK

esackbauer

using mail.domain.com for imap and smtp is the default, yes.
I see no added value and only problems in naming them imap.domain.com etc.

wontell

I’ve been using mailcow with the two domains without major problems sending and receiving mail, using them in mail clients does has some issues (and indeed are about certificates, fairemail complains about the cert when using something.org addresses), just now when I tried to use my second (something.org) domain in Immich for the smtp configuration I got an error about invalid alt names in the certificate, upon inspecting Immich’s logs I see that the certificate it retrieves is for domain.com and *.domain.com (The main certificates located in the root of data/assets/ssl) when I’m using mail.something.org, but I don’t understand what is wrong, and I guess I have a few questions:

Mailcow can handle several domains but it always exposes the main one for all of them, right? I don’t see any options for mailcow to respond with different autoconfig xml files for different domains and when I tried accessing autoconfig it sent the same file for the two domains.
With this, is it not possible to completely isolate all the configured domains? I mea, the main domain will always be linked to all the other configured domains but those domains will indeed be isolated from each other, so someone sending mails to domain2.org won’t know it is related to domain.org or domain3.org but it will know it’s related to domain.com, if I want to keep them all completely separated/unlinked I will have to use different servers? Is this something that mailcow doesn’t support or that is not possible to do unless using different mail servers?
I have tried searching for SNI discussions but I haven’t found any that shows me the structure I should follow to copy the certificates, I have tried copying the certs to assets/ssl/something.org and assets/ssl/mail.something.org but it didn’t worked, when I do openssl s_client -starttls smtp -connect mail.something.org:587 I still get the cert for domain.com. I’m not even sure it even works because if the structure is wrong then shouldn’t mailcow error because it doesn’t find the correct certificates? It looks like it’s only using the main cert in the root of assets/ssl

In a nutshell I want to use domain.com and something.org with the same mail server but want to keep them completely isolated, people sending mails to something.org should only see the something.org domain (and subdomains).
Though the main problem right now is the usage of only the main domain certificate.

thanks!

SimplyCorbett

The mail server is always going to show up in your DNS records and in the email itself, but nobody is going to be able to see that information unless they go digging for it.

I recommend using a white label domain for your mail server if privacy is a big concern.

Edit: And yes the mail server domain is what you need to use to connect to email clients.

wontell

SimplyCorbett Thanks, so I should be using mail.domain.com for both and all other domains I ever add? I thought I could use mail.* for each domain I add to mailcow.

If that’s the case, then the additional SAN are only for nginx-mailcow?

SimplyCorbett

wontell Correct, and maybe for IMAP? I’m not exactly a pro at mailcow yet.

But as far as sending goes its always going to use whatever your servers hostname is iirc.

If you really want to use a different mail server for sending you need to configure “Sender-dependent transports” on the domain itself in the mailcow admin UI.

DocFraggle

wontell I thought I could use mail.* for each domain I add to mailcow

Yes you can do that, I’m doing this myself. For every hosted domain I use an extra A record, so mail.domain1.tld, mail.domain2.tld etc., and the users use the according FQDN for their domain. So user1@domain3.tld uses mail.domain3.tld in their mail clients

wontell

DocFraggle Can you please share how to do this? Are you using mailcow to generate the certificates?

DocFraggle

https://docs.mailcow.email/post_installation/firststeps-ssl/

wontell

DocFraggle so I assume you are indeed using mailcow to generate the certificates? I’ve read the documentation, it doesn’t clarify what we should do for multi domain when we generate our certificates and don’t use mailcow for that. As I said before I’ve created sub-directories like mail.something.org and something.org inside the ssl folder and have copied over the certificate files but mailcow still returns the main certificate

DocFraggle

You have to replace the certificate and key, creating subdirectories won’t work. Didn’t you read the docs I posted?

How to use your own certificate