• HWIKI

    Build. Break. Explain.

    Setting Up Postfix and Dovecot with SMTPS, IMAPS, and a Catch-All – The Full Story

    By h0ag's avatar h0ag | On | 608 views

    So, I wanted to host my own mail server. Not Gmail, not Proton, just me, my server, and full control. The goal: get SMTP with TLS (SMTPS), IMAP with TLS (IMAPS), and a catch-all address to receive emails for anything@mydomain. Of course, nothing went as planned, but hey – here’s the full setup that’s now working like a charm.

    This post is part reminder-to-myself, part tutorial, and 100% personal.Let’s go.

    Context

    • Distro: Debian
    • Host: LXC container on Proxmox
    • Domain: mydomain.org (managed on Cloudflare)
    • Mail server hostname: mail.mydomain.org
    • Only one user for now: contact

    Groups for the contact user:

    bash
    sudo:x:27:contact
users:x:100:contact
contact:x:1000:
dovecot:x:112:contact

    DNS Configuration (Cloudflare)

    Here’s what I set in Cloudflare for the domain:

    Type Name Value
    MX @ mail.mydomain.org
    A mail < Your public IP >
    TXT @ v=spf1 ipv4:< Your public IP > a mx ~all
    TXT mail._domainkey DKIM (don't set it yet, see note below)
    TXT _dmarc v=DMARC1; p=quarantaine; aspf=r; sp=none

    ⚠️ Important: Make sure the A record for mail.mydomain.org is not proxied through Cloudflare (gray cloud).Otherwise, SMTP won’t work properly.

    About DKIM: I struggled here. Just follow the video I used (this one). Don't try to outsmart it, don’t ask ChatGPT about DKIM – it will send you in circles.

    Postfix Configuration

    Base install:

    bash
    apt install postfix

    Here’s my postconf -n output:

    alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
compatibility_level = 2
inet_interfaces = all
inet_protocols = ipv4
mailbox_size_limit = 0
maillog_file =
mydestination = mydomain.org, localhost.org, localhost
mynetworks = 127.0.0.0/8
myorigin = /etc/mailname
recipient_delimiter = +
relayhost =
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.mydomain.org/fullchain.pem
smtpd_tls_ciphers = high
smtpd_tls_key_file = /etc/letsencrypt/live/mail.mydomain.org/privkey.pem
smtpd_tls_loglevel = 1
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_security_level = may
virtual_alias_maps = hash:/etc/postfix/virtual

    And the /etc/postfix/virtual file:

    @mydomain.org contact@mydomain.org

    postmap /etc/postfix/virtual

    This sets up the catch-all: every email sent to anything@mydomain.org ends up in contact’s inbox.

    Dovecot Configuration

    apt install dovecot-core dovecot-imapd

    /etc/dovecot/dovecot.conf Just add this line at the end:

    conf
    protocols = imap

    /etc/dovecot/conf.d/10-auth.conf

    conf
    auth_username_format = %n

    /etc/dovecot/conf.d/10-master.conf just add these lines in service auth:

      unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }

    This part is what allows Postfix to ask Dovecot if credentials are OK.

    User Setup

    bash
    adduser contact

    No special setup, just set your password and ENTER !

    Certificates with Let’s Encrypt

    I followed this:

    bash
    apt install certbot
systemctl stop postfix dovecot
certbot certonly --standalone -d mail.mydomain.org
systemctl start postfix dovecot

    Of course, redirect the port 80/TCP from your firewall to your server.

    Certs go here: /etc/letsencrypt/live/mail.mydomain.org/

    Testing (iPhone mail app)

    IMAP:

    • mail.mydomain.org
    • Port 993
    • SSL/TLS

    Login: contact Password: The one you defined.

    SMTP:

    • mail.mydomain.org
    • Port 587
    • SSL/TLS

    Trials & Errors

    • First I tried ChatGPT. Mistake. It gave me a bunch of half-working suggestions and configs that made no sense.

    • Then I found this random YouTube video.

    • That guy explained it way better. I just followed along and then adjusted the stuff that didn’t fit my setup.

    • Eventually, I talked to ChatGPT again – but only for double-checking specific configs.

    • DKIM was a pain. Don’t try to set anything in DNS manually, the guy in the video shows the right way with OpenDKIM.

    It's not necessarily intuitive, there are traps everywhere, but when it works, it's your own mailbox.

    Now I get all the *@mydomain.org mail in my inbox. I can make as many aliases as I want, create addresses for each service, and even track leaks if my address gets spammed.

    Done. Mail works. Gmail who?

    Made by h0ag.