---
name: Mailu
description: "Simple yet full-featured self-hosted mail server as a Docker Compose stack. Postfix + Dovecot + Rspamd + ClamAV + Let's Encrypt + web admin + webmail (Roundcube/Snappymail). Advanced: DKIM/DMARC/SPF/DANE/MTA-STS. MIT."
---

# Mailu

Mailu is the **opinionated, beginner-friendly way to self-host email** — a full mail server (SMTP, IMAP, webmail, antispam, antivirus, LetsEncrypt, admin UI) packaged as a ~10-container Docker Compose stack with a single `mailu.env` config file driving everything.

If you've ever looked at "how do I run my own email" and seen the rabbit hole of Postfix + Dovecot + SpamAssassin + DKIM + DMARC + SPF + reverse DNS + port 25 + IP reputation + Let's Encrypt + webmail… Mailu wraps all of that in a validated preset and walks you through it.

> **Email self-hosting is HARD. Before starting:**
>
> - You need a **static public IP** or at least a stable one with reverse DNS you can set (most residential ISPs don't provide this; port 25 is often blocked outbound).
> - You need **control over DNS** for your domain (MX, SPF, DKIM, DMARC records).
> - **IP reputation** matters — new IPs often land in junk folders at Google/Microsoft until they warm up; there is no fast fix.
> - Plan for **permanent operational commitment** — email servers require ongoing attention (cert renewals, blocklist checks, spam tuning).
> - Consider a **SMTP relay** (Mailgun, SES, Postmark, Fastmail) for outbound sending to sidestep reputation hassles while keeping inbound on your domain.

Features:

- **IMAP + IMAP+ + POP3 + SMTP + Submission** — standard client support
- **Webmail** — Roundcube or Snappymail built-in
- **Web admin** — create users/aliases/domains via UI
- **Antispam** — Rspamd (plus greylisting, auto-learning Bayesian)
- **Antivirus** — ClamAV (optional; heavy)
- **Strong security defaults** — DKIM signing, SPF check, DMARC, DANE, MTA-STS, TLS enforcement
- **Let's Encrypt** — automatic certs for web + SMTP/IMAP
- **Per-domain delegation** — admins can manage single domain
- **Multi-domain** on one install
- **Fetchmail** — pull mail from other accounts
- **Managesieve** — server-side mail filters
- **Auto-reply, auto-forward, quotas, aliases, domain aliases, custom routes**
- **Sieve** for filter rules

- Upstream repo: <https://github.com/Mailu/Mailu>
- Website / docs: <https://mailu.io>
- Demo: <https://mailu.io/master/demo.html>
- Matrix: `#mailu:tedomum.net`

## Architecture in one minute

Mailu ships ~10-12 Docker containers:

1. **front** — Nginx (reverse proxy for web + mail-proxy for SMTP/IMAP)
2. **admin** — Flask web admin + user DB
3. **postfix** (smtp) — MTA
4. **dovecot** (imap) — IMAP + LMTP
5. **rspamd** (antispam) — milter + web UI
6. **clamav** (antivirus, optional) — scans attachments
7. **webmail** — Roundcube / Snappymail
8. **fetchmail** (optional) — pull mail from external accounts
9. **resolver** — unbound DNS resolver (for DNSSEC/DANE validation)
10. **redis** — cache + rate limits
11. **postgres** or **mysql** (or sqlite default) — user DB

All orchestrated via `docker-compose.yml` generated by the Mailu setup wizard at <https://setup.mailu.io>.

## Compatible install methods

| Infra       | Runtime                                              | Notes                                                          |
| ----------- | ---------------------------------------------------- | -------------------------------------------------------------- |
| Single VM   | **Docker Compose** (generated via setup wizard)         | **The only supported way**                                          |
| Kubernetes  | Official Helm chart (community)                              | Possible; less-tested                                                 |
| Bare metal  | — (Mailu is Docker-first)                                        |                                                                              |
| Managed     | Use any commercial email service if you don't want to ops                 | No Mailu SaaS                                                                         |

## Inputs to collect (BEFORE install)

| Input                | Example                       | Phase      | Notes                                                              |
| -------------------- | ----------------------------- | ---------- | ------------------------------------------------------------------ |
| Mail domain          | `example.com`                    | DNS        | Primary domain for addresses                                             |
| Hostname             | `mail.example.com`                 | DNS        | `A/AAAA` record pointing to your IP                                                |
| Public IPv4 / v6     | static or DDNS                          | Network    | With reverse DNS (PTR) pointing to `mail.example.com`                               |
| Ports                | `25, 465, 587, 143, 993, 110, 995, 4190, 80, 443` | Network    | Port 25 must be reachable for inbound mail                                                  |
| MX record            | `example.com. MX 10 mail.example.com.` | DNS        | Required                                                                                          |
| SPF record           | `example.com. TXT "v=spf1 mx -all"`             | DNS        | Declare who can send                                                                                           |
| DKIM                 | generated by Mailu; publish TXT                           | DNS        | Public-key signature                                                                                                       |
| DMARC                | `_dmarc.example.com. TXT "v=DMARC1; p=none; rua=..."` | DNS        | Align + report                                                                                                                         |
| Admin password       | set in setup wizard                                                       | Bootstrap  | For web admin                                                                                                                                       |
| DB backend           | sqlite / postgres / mysql                                                             | Storage    | Postgres recommended for >50 users                                                                                                                            |
| Relay (opt)          | e.g., `smtp.mailgun.org:587`                                                                  | Outbound   | If port 25 outbound is blocked; smart host                                                                                                                                    |

## Install via setup wizard

1. Visit **<https://setup.mailu.io>**
2. Choose Mailu version (stable recommended)
3. Enter: mail domain, hostname, admin password, subnet, storage path, webmail choice, TLS strategy, antivirus on/off
4. Wizard generates `docker-compose.yml` + `mailu.env` + config
5. Copy-paste onto your server; `mkdir /mailu && cd /mailu; place files`
6. `docker compose pull && docker compose up -d`
7. Set up DNS (MX, SPF, DKIM — see admin UI for DKIM public key), PTR with your hosting provider
8. Log in to admin UI at `https://mail.example.com/admin`
9. Create users; configure alias/forward/quotas

## First boot

1. Admin UI → Domains → confirm default domain
2. Users → + new user → set quota + password
3. DKIM → Admin shows the DKIM public key TXT record → publish in DNS
4. **Test**: send email from a personal Gmail to your new address; check it arrives.
5. **Test reverse**: send from your Mailu user to Gmail; check Gmail marks it "Received: signed-by: example.com" and doesn't go to spam.
6. **Mail-tester.com** → send an email to the tester address → aim for 10/10.

## Data & config layout

- `/mailu/` (or wherever you placed it)
  - `docker-compose.yml` + `mailu.env` (config + secrets)
  - `data/dkim/` — DKIM private keys
  - `data/certs/` — Let's Encrypt certs
  - `mail/` — **Maildir** storage (user mail; can be HUGE)
  - `filter/` — Rspamd state
  - `redis/` — Redis dump
  - `postfix/` — Postfix spool
  - `webmail/` — Roundcube data (addressbooks, drafts)

## Backup

```sh
# Stop for consistency (brief)
docker compose stop
tar czf mailu-config-$(date +%F).tgz mailu.env docker-compose.yml data/
tar czf mailu-mail-$(date +%F).tgz mail/            # user Maildirs — the big one
docker compose start
```

Rotate offsite. Lost Mailu = lost mail history (unless users have IMAP clients caching locally).

## Upgrade

1. Read release notes: <https://github.com/Mailu/Mailu/releases>.
2. **Re-run the setup wizard** for your current version to regenerate compose files if the stack changed.
3. **Back up mail/ + data/ first.**
4. `docker compose pull && docker compose up -d`.
5. Major-version upgrades (1.x → 2.x) involve DB migrations + sometimes Dovecot format changes. Test on staging.

## Gotchas

- **Port 25 outbound**: many residential + cloud providers block :25 outbound. Solutions:
  - **DigitalOcean, Hetzner, OVH, Contabo**: port 25 usually open; request unblock if not
  - **AWS/GCP/Azure**: port 25 blocked by default; use SMTP relay (Mailgun/SES/Postmark)
  - **Residential ISP**: almost always blocked; use a relay
- **Reverse DNS (PTR) is critical.** Without it, Gmail/Microsoft mark you as spam. Set PTR via your hosting provider control panel.
- **IP reputation "warm-up"**: new IPs get sent to junk initially. Send real email slowly; ask friends to mark "Not spam"; it improves over weeks. Some IPs are permanently on RBLs (check at <https://mxtoolbox.com/blacklists.aspx>).
- **SPF / DKIM / DMARC** — all three required for modern email deliverability. Mailu handles DKIM signing; you publish the TXT records. Missing any = lower deliverability.
- **MTA-STS + DANE** — strong TLS policies; Mailu supports both; publish MTA-STS policy + DNS TLSA records. Optional but modern.
- **TLS certs**: Mailu does ACME automatically if you point `mail.example.com` A record at your host. Requires port 80 inbound reachable during issuance.
- **Antivirus** (ClamAV) uses ~2 GB RAM and heavy CPU at startup (signature update). For <50-user instances, often disabled.
- **Rspamd WebUI** at `https://mail.example.com/rspamd/` — monitor spam stats, tune rules.
- **Greylisting** delays first delivery from unknown senders by minutes — intentional + effective but confusing to new users ("why didn't I get the email?").
- **Backups are non-negotiable.** Lost Maildirs = lost email. Restic/Borg with offsite backup on a weekly cadence minimum.
- **Full-text email search**: Mailu supports it via Dovecot fts_xapian plugin; enable in `mailu.env`. Without it, Dovecot search is slow on big mailboxes.
- **Multi-domain**: all domains share same server + same IP reputation. Risky if one domain gets marked as spammer — pollutes the rest.
- **Per-domain admin delegation** — admin of `company.com` can manage their users without seeing `personal.com` users. Good for shared hosting.
- **Email clients auto-config**: Mailu publishes `autoconfig.example.com` + `autodiscover.example.com` XML endpoints — Thunderbird/Outlook can auto-detect settings.
- **iPhone/Android**: use IMAP + SMTP with TLS; most clients work out of the box once autoconfig is set.
- **Fetchmail** feature lets you pull from Gmail/old accounts; useful during migration.
- **Legal + privacy**: you now control your users' email. Respect their privacy; document retention + access policies if multi-tenant.
- **GDPR**: complying with subject-access-requests for email data is on you.
- **Scale limits**: Mailu is great for personal/family/small-org (<500 users). For enterprise (thousands of users, clustered), look at Mailcow, iRedMail, or commercial.
- **Recovery**: if you lose root access or forget admin password, there's a CLI tool (`docker compose exec admin flask mailu admin ...`) to reset.
- **Don't mix mail servers on same IP** — two different mail servers on one IP = reputation nightmares.
- **License**: MIT.
- **Alternatives worth knowing:**
  - **Mailcow: dockerized** — similar Docker-stack approach; broader features; heavier
  - **iRedMail** — older classic full-stack installer; CentOS/Debian
  - **Poste.io** — commercial-leaning Docker mail stack; free tier
  - **Modoboa** — Django-based mail admin
  - **Postal** — mostly transactional/API mail
  - **Stalwart Mail** — modern Rust-based integrated mail server; rising in popularity
  - **Mail-in-a-Box** — Ubuntu-based opinionated installer; one-command
  - **Managed alternatives**: Fastmail, Migadu, ProtonMail, Mailbox.org, your domain + Gmail Workspace
  - **Choose Mailu if:** you want a clean Docker-first setup with strong security defaults + modern UI.
  - **Choose Mailcow if:** you want the most features + willing to run a bigger stack.
  - **Choose Mail-in-a-Box if:** you want "one command, Ubuntu, done" — at the cost of less flexibility.
  - **Choose Stalwart if:** you want cutting-edge integrated Rust.
  - **Choose managed email if:** "run my own mail" sounds like Mon-Fri-of-ops forever.

## Links

- Repo: <https://github.com/Mailu/Mailu>
- Website / Docs: <https://mailu.io>
- Setup wizard: <https://setup.mailu.io>
- Demo: <https://mailu.io/master/demo.html>
- Matrix: <https://matrix.to/#/#mailu:tedomum.net>
- Releases: <https://github.com/Mailu/Mailu/releases>
- mail-tester.com (deliverability test): <https://www.mail-tester.com>
- MXToolbox (blacklist check): <https://mxtoolbox.com/blacklists.aspx>
- Mailcow alternative: <https://mailcow.email>
- Mail-in-a-Box alternative: <https://mailinabox.email>
- Stalwart alternative: <https://stalw.art>
- iRedMail alternative: <https://www.iredmail.org>
- DKIM/DMARC explainer: <https://dmarc.org>
- MTA-STS: <https://datatracker.ietf.org/doc/html/rfc8461>
