I currently have two domains, let's call them domain.com and something.org. I want to use both domains with mailcow. I understand that I must choose one main domain to use as the hostname, I've done that already. My question is about the certificates. I'm managing all my domains with Cloudflare and I already have an nginx (NPM) instance running. I see I can use my own certificate but that only allows for one single cert, isn't it? Since I have two domains I have two Let's Encrypt certificates, so how would I use them? I'm using mail.domain.com as the hostname but since I want to be able to use mail.something.org too I have to also add the cert for that domain, right? I'm using DNS challenges because port 80 and 443 are used by Cloudflare pages, so I have to generate the cert using Cloudflare API keys. I could let mailcow generate the certs but: 1. NPM doesn't have an option to use external certificates 2. I don't see anywhere in the mailcow's config file an option to use DNS challenges for the cert generation The simplest way to solve this would be by using my own cert but the problem about only being able to use one certificate is stopping me from doing that. The other option I can see is adding a custom cert to NPM and replace the NPM generated cert files with mailcow's, but again, I don't see how to do DNS challenges with mailcow.

If you use `mail.domain.com` and `mail.something.org`, you'd need to disable Cloudflare for these domains anyway as mail ports cannot be proxied without Cloudflare's Enterprise Plan. Then HTTPS challenge would work for these FQDNs anyway. Note - you can only have one main mailserver FQDN. For the PTR of the IP, only use one single FQDN: The main name of the mailcow instance.

@"pkernstock"#p18390 Thanks for your help! Sorry for the late reply, I've been reading about how to setup the email server and trying to do it. I've finally setup the mail server for the main domain and it's working in the sense that I can use Thunderbird to access the account and send mail, I've also tried receiving mail and it works well. My concern is about the mobile apps, I've tried with two mail apps, the one that comes with /e/ and K-9 Mail, when I added the account both told me that they couldn't find the configuration so I had to enter the details manually but I don't understand why they don't find the config? Thunderbird on desktop did it, I've tried different services to test the mail configuration (MX, SPF, etc) like checktls.com and mxtoolbox and they are successful, is this normal? That the apps don't automatically configure the account? The only thing missing right now is DNSSEC which is being enabled right now, I don't get why the mobile apps can't auto-configure the account.

Have you enabled and properly configured autodiscover/autoconfig as per the docs?

Yes, both CNAME records are pointing to `mail.domain.com`. I just tried with Thunderbird desktop adding another account and it detected the servers. It took it several seconds though, like ~10, I don't know if it matters? Mostly saying this because in the Android app, it takes like 1 second for the app to tell me it didn't found any configuration. EDIT: OK, it must be some issue with K9, I just tried FairEmail and it detect the configuration. The /e/ Mail app appears to be based on K9 (interface is pretty much the same). It actually seems K9 doesn't support autoconfig too well: https://forum.k9mail.app/t/autoconfig-url-emailaddress-not-supported/8336/6 It actually seems K9 doesn't support autoconfig too well: https://forum.k9mail.app/t/autoconfig-url-emailaddress-not-supported/8336/6 It actually seems K9 doesn't support autoconfig too well: https://forum .k9mail.app/t/autoconfig-url-emailaddress-not-supported/8336/6 It actually seems K9 doesn't support autoconfig too well: http s://forum.k9mail.app/t/autoconfig-url-emailaddress-not-supported/8336/6

Lol, I've been commenting the same thinking I couldn't post links because I received an error telling me to reload but the forum was actually merging my comments, sorry for that.

@"pkernstock"#p18503 Hey, I'm finally testing the second domain mail and it's not working quite right, I must be doing something wrong. Since I can only use a single cert and for one domain (I'm managing both domains using separated accounts) I'm using the cert for domain.com in mailcow (which I picked to be the main domain). Now something.org DNS records are set to use domain.com: - MX record points to mail.domain.com - pop, imap and smtp CNAME records point to the corresponding domain.com subdomain (like imap.something.org -> imap.domain.com) - SRV records point to mail.domain.com Using checktls.com shows all correct with 121 score for something.org, when I add a @something.org account to Thunderbird it auto-discovers the configuration (imap.something.org, smtp.something.org) but when I click on Continue to add the account I get a warning about invalid certificate, upon inspecting the certificate I see the certificate is valid for domain.com and since Thunderbird picks up imap.something.org and smtp.something.org it says is invalid. How could I fix this? Thanks!

You need to have all names like imap.something.org smtp... etc. in the certificate. for that domain. You probably need to [enable SNI in mailcow](https://docs.mailcow.email/post_installation/firststeps-ssl/#the-lets-encrypt-subjectaltname-limit-of-100-domains), because you seem to have separate certificates for both domains. This way the certs for each domain are stored in a subfolder. You need to have [private and public key](https://docs.mailcow.email/post_installation/firststeps-ssl/#how-to-use-your-own-certificate) for those certificates in those subfolders.

@"esackbauer"#p18761 thanks, can I enable SNI even when I'm not using mailcow's cert generation? What is the structure I should follow for the filenames? since it says I should copy to cert.pem and key.pem but that's for only the main domain, right?

Yes. I guess it's the same for the separate ones. There are threads here in the forum where you could find that info.

I think I found the "problem". Since I'm using a separate nginx instance as my main, I hadn't added autoconfig and autodiscover to the proxy hosts. Now after adding them pointing to mailcow's nginx, Thunderbird is almost instant at retrieving the configuration but now it detects the servers as "mail.domain.com", is this normal? I mean it works but I would have liked more to have it using it's correct subdomain for each protocol instead of mail but that's purely esthetic. So before Thunderbird took several seconds and detected (I guess by just trying): IMAP: `imap.something.org` SMTP: `smtp.something.org` Now it detects: IMAP: `mail.domain.com` SMTP: `mail.domain.com` And now I don't have the cert problem. Inspecting the PHP code for autodiscover I see it uses `'server' => $mailcow_hostname,` for everything so I guess `mail.domain.com` it's OK

About multiple domains and certs

DocFraggle

You have to replace the certificate and key, creating subdirectories won’t work. Didn’t you read the docs I posted?

How to use your own certificate

« Previous Page