docker-mailserver on Ubuntu 24.04 LTS

docker-mailserver is a production ready, full stack mail server. This cloudimg image turns a virtual machine into a complete mail system running entirely within your own subscription: a Postfix mail transfer agent for sending and receiving, Dovecot for IMAP mailbox access, Rspamd for spam scoring, DKIM signing and verification, SPF and DMARC, and Fail2ban for brute force protection. Accounts live in a plain file based store, so there is no database to operate and no web console to secure. The five standard mail ports are published: 25 for inbound SMTP, 143 and 993 for IMAP, and 587 and 465 for authenticated submission.

Please read this before you buy: Azure restricts outbound port 25. Microsoft blocks outbound TCP port 25 from Azure virtual machines on every subscription type except Enterprise Agreement and Microsoft Customer Agreement for enterprise. Enterprise Dev/Test subscriptions can be exempted through a self service diagnostic; pay as you go, CSP, MSDN, Education and Free Trial subscriptions are blocked with no exemption available. This is an Azure platform policy that applies to every VM based mail server, not a limitation of this image. What it means in practice: receiving mail, IMAP access and authenticated submission all work normally on any subscription, so this is a fully functional receiving and mailbox server as shipped. To send mail you relay through an authenticated smarthost on port 587, which Microsoft itself recommends and which is never blocked on any subscription type. The image is configured relay first for exactly this reason and ships a one command helper to set your relay host, port, user and password. The deployment guide covers this in full, including how to check whether your own subscription is affected.

Security is built in. The captured image contains no mailbox and no credential at all. On the first boot of every VM, a unique self signed TLS certificate carrying that VM's own hostname and a unique mailbox password are generated before the server is reachable, and recorded in a root only file; the password is stored by the mail server only as a SHA512-CRYPT hash. The server is verified not to be an open relay: an unauthenticated attempt to relay to an external domain is refused, and the image ships a self test that proves genuine end to end mail flow, submitting a message over authenticated TLS, confirming real delivery, retrieving it over IMAP and re running the open relay and bad credential checks on demand. Fail2ban is enabled with the capability it needs to actually enforce bans, and is configured never to lock the VM out of its own mail server. Mail storage sits on a dedicated, independently resizable data disk.

ClamAV is present in the image but disabled by default, matching the upstream default, because it loads its entire signature database into memory; a single command enables it once you have the RAM. docker-mailserver is distributed under the MIT License, free and open source with no per CPU or per deployment fee. The image bundles third party components under a range of licences including the GNU GPL v2; their copyright notices, the verbatim licence texts and a written offer for corresponding source are all shipped inside the image. cloudimg is not affiliated with or endorsed by The Docker Mailserver Organization; the name is used nominatively to identify the open source software shipped here. cloudimg provides packaging, secure by default per instance secret generation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.