Cannot receive emails on a new installation

ash

I have setup mailcow on my local Ubuntu server.
I have followed the guide to configure the DNS and Mailcow configuration.

So far I cannot receive (nor send) emails. I believe the sending part might be due to my ISP blocking the ports, and I am fine with that, but I would like to receive emails.

I have looked on this forum, reddit, google, youtube, and I have not found a solution.

I’m sure it is something stupid on my side but I have no idea where to look at this point.

I am using Traefik v3 as my reverse proxy and it is responsible to provide the SSL certificates.

Some error when sending emails:

05/13/2025, 01:15:34 PM	info	1A26DCD7F1: to=<some-email@gmail.com>, relay=none, delay=3345, delays=3280/0.02/65/0, dsn=4.4.1, status=deferred (connect to alt2.gmail-smtp-in.l.google.com[2607:f8b0:4003:c04::1b]:25: Network is unreachable)
05/13/2025, 01:15:34 PM	info	connect to alt2.gmail-smtp-in.l.google.com[2607:f8b0:4003:c04::1b]:25: Network is unreachable
05/13/2025, 01:15:33 PM	info	connect to alt1.gmail-smtp-in.l.google.com[142.251.186.27]:25: Connection timed out

But I don’t see any error in the mailcow logs about receiving emails. I don’t see anything in traefik either.

DNS Configuration (Cloudflare):

domain.com	3600	IN	SOA	evan.ns.cloudflare.com. dns.cloudflare.com. 2049884481 10000 2400 604800 3600

;; NS Records
domain.com.	86400	IN	NS	evan.ns.cloudflare.com.
domain.com.	86400	IN	NS	tara.ns.cloudflare.com.

;; A Records
*.domain.com.	1	IN	A	x.x.x.x ; cf_tags=cf-proxied:false
domain.com.	1	IN	A	x.x.x.x ; cf_tags=cf-proxied:false
mail.domain.com.	1	IN	A	x.x.x.x ; cf_tags=cf-proxied:false

;; CNAME Records
autoconfig.domain.com.	1	IN	CNAME	mail.domain.com. ; cf_tags=cf-proxied:false
autodiscover.domain.com.	1	IN	CNAME	mail.domain.com. ; cf_tags=cf-proxied:false

;; MX Records
domain.com.	1	IN	MX	10 mail.domain.com.

;; TXT Records
domain.com.	1	IN	TXT	"v=spf1 mx a -all"
dkim._domainkey.domain.com.	1	IN	TXT	"v=DKIM1;k=rsa;t=s;s=email;p=key"
_dmarc.domain.com.	1	IN	TXT	"v=DMARC1; p=reject; rua=mailto:dmarc@domain.com"

Result of a nmap (Port forwarding is correctly setup on the router):

Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-13 16:15 PDT
Nmap scan report for mail.domain.com (x.x.x.x)
Host is up (0.0055s latency).
Not shown: 990 closed tcp ports (reset)
PORT    STATE SERVICE
22/tcp  open  ssh
25/tcp  open  smtp
80/tcp  open  http
110/tcp open  pop3
143/tcp open  imap
443/tcp open  https
465/tcp open  smtps
587/tcp open  submission
993/tcp open  imaps
995/tcp open  pop3s

Nmap done: 1 IP address (1 host up) scanned in 0.34 seconds

Traefik config:

http:
  routers:
    # mail
    mail-public:
      entryPoints:
        - "https"
      rule: "Host(`mail.domain.com`)"
      middlewares:
        - default-headers
        - https-redirectscheme
      tls: { }
      service: mail

    autoconfig-public:
      entryPoints:
        - "https"
      rule: "Host(`autoconfig.domain.com`)"
      middlewares:
        - default-headers
        - https-redirectscheme
      tls: { }
      service: mail

    autodiscover-public:
      entryPoints:
        - "https"
      rule: "Host(`autodiscover.domain.com`)"
      middlewares:
        - default-headers
        - https-redirectscheme
      tls: { }
      service: mail


  services:
    mail:
      loadBalancer:
        servers:
          - url: "http://x.x.x.x:80"
        passHostHeader: true

  middlewares:
    https-redirectscheme:
      redirectScheme:
        scheme: https
        permanent: true

    default-headers:
      headers:
        frameDeny: true
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 15552000
        customFrameOptionsValue: SAMEORIGIN
        customRequestHeaders:
          X-Forwarded-Proto: https

Mailcow Config file:

# ------------------------------
# mailcow web ui configuration
# ------------------------------
# example.org is _not_ a valid hostname, use a fqdn here.
# Default admin user is "admin"
# Default password is "moohoo"

MAILCOW_HOSTNAME=mail.domain.com

# Password hash algorithm
# Only certain password hash algorithm are supported. For a fully list of supported schemes,
# see https://docs.mailcow.email/models/model-passwd/
MAILCOW_PASS_SCHEME=BLF-CRYPT

# ------------------------------
# SQL database configuration
# ------------------------------

DBNAME=mailcow
DBUSER=mailcow

# Please use long, random alphanumeric strings (A-Za-z0-9)

DBPASS=asdf
DBROOT=asdf

# ------------------------------
# REDIS configuration
# ------------------------------

REDISPASS=asdf

# ------------------------------
# HTTP/S Bindings
# ------------------------------

# You should use HTTPS, but in case of SSL offloaded reverse proxies:
# Might be important: This will also change the binding within the container.
# If you use a proxy within Docker, point it to the ports you set below.
# Do _not_ use IP:PORT in HTTP(S)_BIND or HTTP(S)_PORT
# IMPORTANT: Do not use port 8081, 9081, 9082 or 65510!
# Example: HTTP_BIND=1.2.3.4
# For IPv4 leave it as it is: HTTP_BIND= & HTTPS_PORT=
# For IPv6 see https://docs.mailcow.email/post_installation/firststeps-ip_bindings/

HTTP_PORT=80
HTTP_BIND=

HTTPS_PORT=443
HTTPS_BIND=

# Redirect HTTP connections to HTTPS - y/n
HTTP_REDIRECT=n

# ------------------------------
# Other bindings
# ------------------------------
# You should leave that alone
# Format: 11.22.33.44:25 or 12.34.56.78:465 etc.

SMTP_PORT=25
SMTPS_PORT=465
SUBMISSION_PORT=587
IMAP_PORT=143
IMAPS_PORT=993
POP_PORT=110
POPS_PORT=995
SIEVE_PORT=4190
DOVEADM_PORT=127.0.0.1:19991
SQL_PORT=127.0.0.1:13306
REDIS_PORT=127.0.0.1:7654

# Your timezone
# See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for a list of timezones
# Use the column named 'TZ identifier' + pay attention for the column named 'Notes'

TZ=America/Los_Angeles

# Fixed project name
# Please use lowercase letters only

COMPOSE_PROJECT_NAME=mailcowdockerized

# Used Docker Compose version
# Switch here between native (compose plugin) and standalone
# For more informations take a look at the mailcow docs regarding the configuration options.
# Normally this should be untouched but if you decided to use either of those you can switch it manually here.
# Please be aware that at least one of those variants should be installed on your machine or mailcow will fail.

DOCKER_COMPOSE_VERSION=native

# Set this to "allow" to enable the anyone pseudo user. Disabled by default.
# When enabled, ACL can be created, that apply to "All authenticated users"
# This should probably only be activated on mail hosts, that are used exclusivly by one organisation.
# Otherwise a user might share data with too many other users.
ACL_ANYONE=disallow

# Garbage collector cleanup
# Deleted domains and mailboxes are moved to /var/vmail/_garbage/timestamp_sanitizedstring
# How long should objects remain in the garbage until they are being deleted? (value in minutes)
# Check interval is hourly

MAILDIR_GC_TIME=7200

# Additional SAN for the certificate
#
# You can use wildcard records to create specific names for every domain you add to mailcow.
# Example: Add domains "example.com" and "example.net" to mailcow, change ADDITIONAL_SAN to a value like:
#ADDITIONAL_SAN=imap.*,smtp.*
# This will expand the certificate to "imap.example.com", "smtp.example.com", "imap.example.net", "smtp.example.net"
# plus every domain you add in the future.
#
# You can also just add static names...
#ADDITIONAL_SAN=srv1.example.net
# ...or combine wildcard and static names:
#ADDITIONAL_SAN=imap.*,srv1.example.com
#

ADDITIONAL_SAN=

# Obtain certificates for autodiscover.* and autoconfig.* domains.
# This can be useful to switch off in case you are in a scenario where a reverse proxy already handles those.
# There are mixed scenarios where ports 80,443 are occupied and you do not want to share certs
# between services. So acme-mailcow obtains for maildomains and all web-things get handled
# in the reverse proxy.
AUTODISCOVER_SAN=n

# Additional server names for mailcow UI
#
# Specify alternative addresses for the mailcow UI to respond to
# This is useful when you set mail.* as ADDITIONAL_SAN and want to make sure mail.maildomain.com will always point to the mailcow UI.
# If the server name does not match a known site, Nginx decides by best-guess and may redirect users to the wrong web root.
# You can understand this as server_name directive in Nginx.
# Comma separated list without spaces! Example: ADDITIONAL_SERVER_NAMES=a.b.c,d.e.f

ADDITIONAL_SERVER_NAMES=

# Skip running ACME (acme-mailcow, Let's Encrypt certs) - y/n

SKIP_LETS_ENCRYPT=y

# Create seperate certificates for all domains - y/n
# this will allow adding more than 100 domains, but some email clients will not be able to connect with alternative hostnames
# see https://doc.dovecot.org/admin_manual/ssl/sni_support
ENABLE_SSL_SNI=n

# Skip IPv4 check in ACME container - y/n

SKIP_IP_CHECK=n

# Skip HTTP verification in ACME container - y/n

SKIP_HTTP_VERIFICATION=n

# Skip Unbound (DNS Resolver) Healthchecks (NOT Recommended!) - y/n

SKIP_UNBOUND_HEALTHCHECK=n

# Skip ClamAV (clamd-mailcow) anti-virus (Rspamd will auto-detect a missing ClamAV container) - y/n

SKIP_CLAMD=n

# Skip Olefy (olefy-mailcow) anti-virus for Office documents (Rspamd will auto-detect a missing Olefy container) - y/n

SKIP_OLEFY=n

# Skip SOGo: Will disable SOGo integration and therefore webmail, DAV protocols and ActiveSync support (experimental, unsupported, not fully implemented) - y/n

SKIP_SOGO=n

# Skip FTS (Fulltext Search) for Dovecot on low-memory, low-threaded systems or if you simply want to disable it.
# Dovecot inside mailcow use Flatcurve as FTS Backend.

SKIP_FTS=n

# Dovecot Indexing (FTS) Process maximum heap size in MB, there is no recommendation, please see Dovecot docs.
# Flatcurve (Xapian backend) is used as the FTS Indexer. It is supposed to be efficient in CPU and RAM consumption.
# However: Please always monitor your Resource consumption!

FTS_HEAP=128

# Controls how many processes the Dovecot indexing process can spawn at max.
# Too many indexing processes can use a lot of CPU and Disk I/O.
# Please visit: https://doc.dovecot.org/configuration_manual/service_configuration/#indexer-worker for more informations

FTS_PROCS=1

# Allow admins to log into SOGo as email user (without any password)

ALLOW_ADMIN_EMAIL_LOGIN=n

# Enable watchdog (watchdog-mailcow) to restart unhealthy containers

USE_WATCHDOG=y

# Send watchdog notifications by mail (sent from watchdog@MAILCOW_HOSTNAME)
# CAUTION:
# 1. You should use external recipients
# 2. Mails are sent unsigned (no DKIM)
# 3. If you use DMARC, create a separate DMARC policy ("v=DMARC1; p=none;" in _dmarc.MAILCOW_HOSTNAME)
# Multiple rcpts allowed, NO quotation marks, NO spaces

#WATCHDOG_NOTIFY_EMAIL=a@example.com,b@example.com,c@example.com
#WATCHDOG_NOTIFY_EMAIL=

# Send notifications to a webhook URL that receives a POST request with the content type "application/json".
# You can use this to send notifications to services like Discord, Slack and others.
#WATCHDOG_NOTIFY_WEBHOOK=https://discord.com/api/webhooks/XXXXXXXXXXXXXXXXXXX/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
# JSON body included in the webhook POST request. Needs to be in single quotes.
# Following variables are available: SUBJECT, BODY
#WATCHDOG_NOTIFY_WEBHOOK_BODY='{"username": "mailcow Watchdog", "content": "****\n"}'

# Notify about banned IP (includes whois lookup)
WATCHDOG_NOTIFY_BAN=n

# Send a notification when the watchdog is started.
WATCHDOG_NOTIFY_START=y

# Subject for watchdog mails. Defaults to "Watchdog ALERT" followed by the error message.
#WATCHDOG_SUBJECT=

# Checks if mailcow is an open relay. Requires a SAL. More checks will follow.
# https://www.servercow.de/mailcow?lang=en
# https://www.servercow.de/mailcow?lang=de
# No data is collected. Opt-in and anonymous.
# Will only work with unmodified mailcow setups.
WATCHDOG_EXTERNAL_CHECKS=n

# Enable watchdog verbose logging
WATCHDOG_VERBOSE=n

# Max log lines per service to keep in Redis logs

LOG_LINES=9999

# Internal IPv4 /24 subnet, format n.n.n (expands to n.n.n.0/24)
# Use private IPv4 addresses only, see https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses

IPV4_NETWORK=172.22.1

# Internal IPv6 subnet in fc00::/7
# Use private IPv6 addresses only, see https://en.wikipedia.org/wiki/Private_network#Private_IPv6_addresses

IPV6_NETWORK=fd4d:6169:6c63:6f77::/64

# Use this IPv4 for outgoing connections (SNAT)

#SNAT_TO_SOURCE=

# Use this IPv6 for outgoing connections (SNAT)

#SNAT6_TO_SOURCE=

# Create or override an API key for the web UI
# You _must_ define API_ALLOW_FROM, which is a comma separated list of IPs
# An API key defined as API_KEY has read-write access
# An API key defined as API_KEY_READ_ONLY has read-only access
# Allowed chars for API_KEY and API_KEY_READ_ONLY: a-z, A-Z, 0-9, -
# You can define API_KEY and/or API_KEY_READ_ONLY

#API_KEY=
#API_KEY_READ_ONLY=
#API_ALLOW_FROM=172.22.1.1,127.0.0.1

# mail_home is ~/Maildir
MAILDIR_SUB=Maildir

# SOGo session timeout in minutes
SOGO_EXPIRE_SESSION=480

# DOVECOT_MASTER_USER and DOVECOT_MASTER_PASS must both be provided. No special chars.
# Empty by default to auto-generate master user and password on start.
# User expands to DOVECOT_MASTER_USER@mailcow.local
# LEAVE EMPTY IF UNSURE
DOVECOT_MASTER_USER=
# LEAVE EMPTY IF UNSURE
DOVECOT_MASTER_PASS=

# Let's Encrypt registration contact information
# Optional: Leave empty for none
# This value is only used on first order!
# Setting it at a later point will require the following steps:
# https://docs.mailcow.email/troubleshooting/debug-reset_tls/
ACME_CONTACT=

# WebAuthn device manufacturer verification
# After setting WEBAUTHN_ONLY_TRUSTED_VENDORS=y only devices from trusted manufacturers are allowed
# root certificates can be placed for validation under mailcow-dockerized/data/web/inc/lib/WebAuthn/rootCertificates
WEBAUTHN_ONLY_TRUSTED_VENDORS=n

# Spamhaus Data Query Service Key
# Optional: Leave empty for none
# Enter your key here if you are using a blocked ASN (OVH, AWS, Cloudflare e.g) for the unregistered Spamhaus Blocklist.
# If empty, it will completely disable Spamhaus blocklists if it detects that you are running on a server using a blocked AS.
# Otherwise it will work normally.
SPAMHAUS_DQS_KEY=

# Prevent netfilter from setting an iptables/nftables rule to isolate the mailcow docker network - y/n
# CAUTION: Disabling this may expose container ports to other neighbors on the same subnet, even if the ports are bound to localhost
DISABLE_NETFILTER_ISOLATION_RULE=n

esackbauer

Outgoing it looks like port 25 is blocked by your ISP
Could be that incoming is also blocked.
Test your mail server with e.g. https://mxtoolbox.com/SuperTool.aspx

ash

Sorry I forgot to post that

esackbauer

If you have any firewall on your mailcow host like ufw or firewalld then disable them. Otherwise it seems your ISP is blocking inbount traffic on port 25 too

ash

$ sudo ufw status
Status: inactive

Also I can telnet on all the ports: 25,110,143,465,587,993,995,4190

esackbauer

ash Also I can telnet on all the ports: 25,110,143,465,587,993,995,4190

maybe internally, but not externally from internet. mxtoolbox was not able to connect to port 25 at all.
Without giving more information like your public IP address we cannot help you.

ash

esackbauer

Sorry, you are right, 25 is failing externally. I am using my phone to test.

for port in 25 110 143 465 587 993 995 4190; do
    echo "Checking port $port..."
    echo 'exit' | telnet x.x.x.x $port
    if [ $? -eq 0 ]; then
        echo "Port $port is open"
    else
        echo "Port $port is closed"
    fi
done

Checking port 25...
Trying x.x.x.x...
telnet: connect to address x.x.x.x: Operation timed out
telnet: Unable to connect to remote host
Port 25 is closed

Checking port 110...
Trying x.x.x.x...
Connected to x-x-x-x.tukw.qwest.net.
Escape character is '^]'.
Connection closed by foreign host.
Port 110 is closed

Checking port 143...
Trying x.x.x.x...
Connected to x-x-x-x.tukw.qwest.net.
Escape character is '^]'.
Connection closed by foreign host.
Port 143 is closed

Checking port 465...
Trying x.x.x.x...
Connected to x-x-x-x.tukw.qwest.net.
Escape character is '^]'.
Connection closed by foreign host.
Port 465 is closed

Checking port 587...
Trying x.x.x.x...
Connected to x-x-x-x.tukw.qwest.net.
Escape character is '^]'.
Connection closed by foreign host.
Port 587 is closed

Checking port 993...
Trying x.x.x.x...
Connected to x-x-x-x.tukw.qwest.net.
Escape character is '^]'.
Connection closed by foreign host.
Port 993 is closed

Checking port 995...
Trying x.x.x.x...
Connected to x-x-x-x.tukw.qwest.net.
Escape character is '^]'.
Connection closed by foreign host.
Port 995 is closed

Checking port 4190...
Trying x.x.x.x...
Connected to x-x-x-x.tukw.qwest.net.
Escape character is '^]'.
Connection closed by foreign host.
Port 4190 is closed

esackbauer

It seems the problem is the firewall in front of mailcow. Contact your ISP, or configure NAT on your external firewall.

ash

Finally reached the ISP and they confirm that they block the port 25.

ash

Ok, so far I have been able to fix the outbound issue using mailgun for the SMTP.

For the inbound issue, I have a temporary solution that uses mailgun to send a webhook on received email and I use n8n (in my homelab) to forward it to the local SMTP server.

I don’t think it’s the case, but, does Mailcow support getting email from a webhook like Mailgun, or do you have any other idea on how to get it to work?

I’ve seen people talking about setting up a VPS to tunnel the port 25 in and out of my local network.

tracy

ash if you are going to go to that extreme, I’d just set up Mailcow on the VPS itself.
I use a Contabo VPS (about $15USD a month) and it has plenty of resources to run Mailcow. And the US location I am using with Contabo surprisingly has clean IP range so I get good mail delivery.

esackbauer

That is all a very bad workaround for mailcow. Why not installing mailcow right onto the VPS and not having such troubles…

ash

My goal was just to get a mail server for my homelab so I don’t spam my gmail account with all the internal stuff I do.
Paying and maintaning a VPS is not really what I was looking for just for a homelab setup.

Just trying to find a workaround to the ISP blocking the port 25 in & out