Building a Docker Mail Server on a Sakura VPS with a Freenom Domain

TL;DR

I tried building a mail server with Docker on a Sakura VPS
I will skip registering a domain on Freenom and how to use Cloudflare

• Linux(Debian10)
• Docker is assumed to be already installed
• A domain name has been obtained from Freenom and registered in a DNS such as Cloudflare
  Freenom : example.com (fictitious name)
• Sakura VPS: 11.22.33.44 (fictitious IP)

For this server build I referred to the sites below

Cloudflare:

First, register the custom domain to be used for mail and register the MX record
When registering, use DNS only and do not put it through the Cloudflare proxy

Mailserver on Docker

Download the necessary files

$ git clone https://github.com/docker-mailserver/docker-mailserver.git
$ cd docker-mailserver

Editing docker-compose.yml

Adjust the following parts to match your own environment

hostname: <HOSTNAME> # <-- CHANGE THIS
domainname: <DOMAINNAME> # <-- CHANGE THIS

hostname: mail
domainname: example.com

Creating accounts

Create one user account and postmaster

While I was at it, I also created dkim

$ ./setup.sh email add [email protected] password
$ ./setup.sh alias add [email protected] [email protected]
$ ./setup.sh config dkim
Creating DKIM private key /tmp/docker-mailserver/opendkim/keys/example.com/mail.private
Creating DKIM KeyTable
Creating DKIM SigningTable

Starting up and initial setup

$ docker-compose up -d

Checking sending and receiving

Check the connection with a mail client such as Thunderbird

Since the certificate is not valid, a security warning comes up, so proceed by doing セキュリティ例外の承認

With autodetection,

incoming on port 143  STARTTLS: normal password authentication
outgoing SMTP on port 587 STARTTLS: normal password authentication

I confirmed sending to Gmail, and receiving from Gmail to [email protected]
(note that when sending, the security warning comes up again and it fails, so press セキュリティ例外の承認 and try sending again)

If you can confirm sending and receiving up to this point, the build of a minimal mail server is complete

Trying a port change

Since I would rather use the SSL-related ports, I changed the ports and checked the connection

imap(143) to imaps(993)
smtp(587) to smtps(465)

For both, change STARTTLS to SSL/TLS in the security settings

For these too the certificate is not valid, so a security warning comes up; do セキュリティ例外の承認 and send and receive again

Once you can confirm sending and receiving normally up to this point, security is weak because almost everything is still at the initial settings, so bring it down (the sent and received mail data remains, so down is fine)

$ docker-compose down

Registering DKIM

Based on the contents of config/opendkim/keys/example.com/mail.txt, register a TXT record in DNS

The contents of mail.txt

mail._domainkey	IN	TXT	( "v=DKIM1; h=sha256; k=rsa; "
	  "p=MIICIjANxxxxxxx" )  ; ----- DKIM key mail for example.com

• Add a TXT record to Cloudflare

In the content, delete all the "" and write it on a single line
While I was at it, I also registered adsp and dmarc

TXT  _dmarc  v=DMARC1;p=none
TXT  _adsp.+domainkey  dkim=unkonwn

Wait a while for it to propagate to DNS, then confirm on the site below that DKIM and the rest are configured correctly

Obtaining a custom domain and configuring DNS take more effort than you would expect, but once that preparation is done, I confirmed that a mail server can be built easily in an environment where Docker is available.

For a mail server just for my family or myself the feature set is more than sufficient, but for practical use at a workplace, once you think about the fine-grained settings and redundancy, it somehow feels like there is a risk.

See also