A reliable VPS mail server needs three cooperating services: Exim4 transfers messages over SMTP, Dovecot lets users retrieve them over IMAP or POP3, and ClamAV scans message content for malware. The safest build order is to establish a correct fully qualified hostname and DNS, configure Exim and TLS, make Dovecot use the same mailbox format as Exim, connect Exim to the ClamAV daemon, then test each protocol locally before attempting internet delivery.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide covers a Debian or Ubuntu VPS, the documented Dovecot ports, authenticated SMTP, certificate requirements, split and single Exim configurations, mbox and Maildir choices, firewall exposure, and the limits of local testing.
As an Amazon Associate I earn from qualifying purchases.
How the three services fit together
Mail moves through several roles. A mail user agent submits a message to a mail transfer agent; the MTA transfers it; a final delivery agent places it in the recipient’s mailbox; and the recipient retrieves it with IMAP or POP3. In this setup, Exim4 is the MTA, Dovecot provides mailbox access, and ClamAV supplies malware scanning.
- Exim4: accepts SMTP mail, authenticates submitting users, transfers messages to other MTAs, and performs local delivery.
- Dovecot: serves IMAP and POP3 so desktop, mobile, and webmail clients can read the mailbox.
- ClamAV: examines message content through its
clamdscanning daemon.
Exim and Dovecot must agree on where mail is stored and whether that storage is mbox or Maildir. ClamAV must be able to read the Exim spool and Exim must call the correct ClamAV socket. A failure in any one hand-off can look like a general mail outage, so configure and test each boundary separately.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Prepare the VPS before installing packages
Use a supported operating system and stable identity
Use a supported Debian or Ubuntu release and give the VPS a stable fully qualified domain name (FQDN), such as mail.example.net. The system hostname, the name presented by Exim in TLS, and the name on the certificate should agree. Ubuntu specifically warns that the Exim TLS Server name must be correct; otherwise TLS will not work correctly for the server.
- Choose the mail domain that users will send from, such as
example.net. - Set the VPS hostname to the intended mail host, such as
mail.example.net. - Configure the domain’s DNS and verify that the provider permits outbound and inbound mail traffic.
- Arrange a trusted certificate whose name matches the FQDN before enabling production TLS.
- Decide whether this server will deliver directly to recipient domains or submit through a smarthost. Direct delivery gives more control but makes your server’s reputation and DNS configuration your responsibility; a smarthost adds provider dependence but can reduce direct-delivery reputation work.
Do not assume a successful local test proves internet delivery. Reverse DNS, SPF, DKIM, DMARC, IP reputation, recipient policies, and provider port restrictions are separate concerns.
Plan firewall exposure
Open only the services you intend to use. Exim’s server-to-server SMTP listener is conventionally port 25. If you enable authenticated message submission, expose the submission listener you configure, commonly port 587. Dovecot’s documented client ports are:
| Service | Port | Use | Encryption guidance |
|---|---|---|---|
| IMAP | 143 | IMAP with a later TLS upgrade | Require TLS before allowing credentials |
| IMAPS | 993 | IMAP over SSL/TLS | Preferred encrypted IMAP endpoint |
| POP3 | 110 | POP3 with a later TLS upgrade | Require TLS before allowing credentials |
| POP3S | 995 | POP3 over SSL/TLS | Preferred encrypted POP3 endpoint |
Ubuntu Server documentation states that IMAPS and POP3S are more secure because they use SSL encryption to connect. If your clients do not need POP3, leave ports 110 and 995 closed and provide IMAP only.
Install and configure Exim4
Install the MTA and choose a configuration layout
Update package metadata and install Exim4:
sudo apt update
sudo apt install exim4Run the Debian configuration wizard:
sudo dpkg-reconfigure exim4-configThe wizard establishes the system’s mail name, listening behavior, relay policy, and delivery mode. Select settings that match your direct-delivery or smarthost plan. You can use a split configuration, with modular files under /etc/exim4/conf.d, or a single generated template. Split configuration is easier to maintain when you need separate ACL, router, transport, and authentication changes; a single template keeps the configuration in one place and may be simpler for a very small installation.
| Exim layout | Where it fits | Trade-off |
|---|---|---|
| Split configuration | Multiple maintainable files under /etc/exim4/conf.d |
Cleaner changes and easier review, but more files to understand |
| Single template | One consolidated configuration | Fewer files, but larger edits are harder to isolate |
Start the service after the wizard completes:
sudo service exim4 startSet the Exim hostname and TLS identity
Exim’s TLS identity depends on the FQDN. Install or generate a certificate whose subject name or subject alternative name covers that exact hostname. A self-signed certificate can help during an isolated test, but production clients and remote MTAs should receive a certificate issued by a trusted authority.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Enable Exim TLS in the generated configuration with:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
MAIN_TLS_ENABLE = yesRegenerate the active configuration and restart Exim:
sudo update-exim4.conf
sudo service exim4 restartAfter every configuration edit, regenerate the configuration before restarting. If the certificate name does not match the FQDN clients use, they will report a name mismatch even when encryption itself is functioning.
Enable authenticated SMTP safely
Exim can authenticate users through PAM-backed saslauthd or through an Exim password database. Both approaches can expose credentials as clear text unless the client connection is protected by TLS. Therefore, do not permit password authentication on an unencrypted connection. Configure the authentication mechanism, enable TLS, and require clients to negotiate encryption before accepting credentials.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Keep authenticated submission separate from unauthenticated server-to-server delivery. Your relay policy should allow authenticated users to submit mail while preventing arbitrary unauthenticated relaying. Test both paths: a local authenticated submission should be accepted, while an unauthenticated attempt to relay to an unrelated domain should be refused.
Install Dovecot for IMAP and POP3
Install packages and inspect the mailbox model
Install the protocol packages:
sudo apt install dovecot-imapd dovecot-pop3dReview the main file and included fragments:
/etc/dovecot/dovecot.conf
/etc/dovecot/conf.d/Choose mbox or Maildir deliberately. Exim’s local-delivery transport and Dovecot’s mailbox settings must point to the same format and location.
| Mailbox format | Layout | Operational implication |
|---|---|---|
| mbox | Messages are kept in a mailbox file | Use when your Exim and Dovecot configuration already expects mbox and you want to avoid changing the established layout |
| Maildir | Each message is a separate file in mailbox directories | Use when your deployment is designed around Maildir paths; every delivery and retrieval setting must use those paths consistently |
There is no universal winner documented by Ubuntu or Debian. The correct choice is the one both services implement consistently and that your backup, quota, and maintenance procedures understand.
Configure encrypted client access
Dovecot documents IMAP on port 143, IMAPS on 993, POP3 on 110, and POP3S on 995. Configure the TLS settings in the Dovecot fragments, including 10-ssl.conf, and use the trusted certificate for production. Keep plaintext protocol ports only when you need a STARTTLS workflow and enforce TLS before authentication.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Restart Dovecot after changing its configuration:
sudo service dovecot restartVerify that the certificate’s hostname matches the name configured in clients. A valid certificate on Exim does not automatically configure Dovecot; each service needs its own certificate paths and TLS settings.
Install ClamAV and its signature updater
Install the scanner, daemon, and signature updater:
sudo apt install clamav clamav-daemon clamav-freshclamclamav-freshclam updates the malware signature database, while clamav-daemon provides the long-running clamd service that Exim will call. Ensure the updater can refresh signatures and that the daemon is running before wiring Exim to it.
Connect Exim to clamd
Point Exim at the ClamAV socket
In a split Exim configuration, set the antivirus scanner to the Unix socket used by the daemon:
av_scanner = clamd:/var/run/clamav/clamd.ctlThe socket path must match the path created by your ClamAV configuration. A typo, a stopped daemon, or a permissions mismatch will make scanning fail even though both packages are installed.
Reject malware in the DATA ACL
Add a DATA-stage ACL that rejects a message when ClamAV reports malware. The exact surrounding file depends on your split configuration, but the policy needs the equivalent of:
deny malware = *
message = This message contains malware: $malware_namePlace the rule in the DATA ACL, after the message body is available for scanning. Rejecting at this stage prevents a detected message from being accepted into the normal delivery path.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Fix spool permissions and restart the daemon
The ClamAV process must be able to read the Exim spool while Exim must be able to access the ClamAV socket. Add the clamav user to the Debian-exim group:
sudo adduser clamav Debian-eximRestart the scanner after changing group membership:
sudo service clamav-daemon restartThen regenerate and restart Exim so the scanner definition and ACL are active:
sudo update-exim4.conf
sudo service exim4 restartDo not treat a successful package installation as proof of integration. The socket, ACL, user permissions, and daemon state all have to be correct at the same time.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesChoose direct delivery or a smarthost
Exim can deliver directly to recipient MTAs or hand outbound mail to a smarthost. Direct delivery gives you control over routing and avoids dependence on a relay provider, but you must manage reputation, DNS alignment, TLS behavior, retries, and remote-provider acceptance. A smarthost centralizes outbound delivery and may be easier when your VPS provider restricts mail traffic, but your system then depends on that provider’s credentials, limits, and policies.
Make the choice during Exim’s configuration wizard and document it. A server configured as a smarthost should not be tested as though it were responsible for direct internet delivery; conversely, direct delivery still requires correct DNS and reputation work even when local tests pass.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Validate each layer locally
Check service state and listening sockets
After restarting services, confirm that Exim, Dovecot, and ClamAV are running and that the intended ports are listening. Check locally before changing public firewall rules. A service that is not listening cannot be fixed by DNS or a mail client.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Test Dovecot POP3 readiness
Ubuntu’s Dovecot guide demonstrates a basic localhost POP3 check with telnet:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →telnet localhost 110A working POP3 service should return a greeting containing:
+OK Dovecot readyThis confirms that Dovecot is answering on the local POP3 port. It does not prove that TLS, authentication, mailbox paths, or remote access are correct. Repeat equivalent checks against the encrypted endpoint and IMAP endpoint using a TLS-capable client or diagnostic tool.
Test SMTP authentication and local delivery
- Submit a message from an authenticated local account over the encrypted submission path.
- Confirm that Exim accepts the message without treating the sender as an unauthorized relay.
- Confirm that Exim places the message in the mailbox format selected for Dovecot.
- Log in through IMAP or POP3 and verify that the message appears.
- Test an unauthenticated relay attempt to an unrelated domain and verify that Exim refuses it.
Run the EICAR antivirus test
The Exim and ClamAV integration guidance recommends sending the EICAR test virus. It is a standard test signature rather than live malware. With the DATA ACL active, Exim should reject the message immediately. If the message is accepted, inspect the scanner socket, ClamAV daemon status, spool permissions, ACL placement, and Exim’s regenerated configuration.
These tests validate local service wiring and antivirus behavior. They do not establish global deliverability, reverse-DNS reputation, SPF, DKIM, DMARC, or acceptance by remote providers.
Recommended Free Tools
Troubleshoot by symptom
| Symptom | Likely cause | What to check |
|---|---|---|
| TLS name mismatch | Certificate name and Exim or Dovecot FQDN differ | Confirm the system FQDN, configured Server name, and certificate names are identical |
| Authentication works only without encryption | Credentials are being offered before TLS or TLS is disabled | Enable TLS and require encrypted authentication; never send passwords over plaintext |
| Dovecot starts but shows no messages | Exim and Dovecot use different mailbox formats or paths | Compare Exim’s delivery transport with Dovecot’s mbox or Maildir settings |
| Exim accepts a test virus | clamd is stopped, the socket path is wrong, permissions are insufficient, or the DATA ACL is not active | Check /var/run/clamav/clamd.ctl, restart clamav-daemon, verify group membership, regenerate Exim, and inspect the ACL |
| Remote servers cannot connect | Firewall rules, provider restrictions, DNS, or listener settings block traffic | Confirm the intended SMTP and Dovecot ports are exposed and that the VPS provider permits mail traffic |
| Local delivery succeeds but remote delivery fails | Internet-wide reputation or DNS requirements are incomplete | Check reverse DNS, SPF, DKIM, DMARC, IP reputation, and the recipient’s policy; local protocol tests cannot prove these |
Production checklist
- Use a supported Debian or Ubuntu release and a stable FQDN.
- Make the Exim TLS Server name match the FQDN and certificate.
- Use a trusted production certificate for Exim and Dovecot.
- Protect every authenticated SMTP login with TLS.
- Choose split or single Exim configuration intentionally and regenerate after edits.
- Make Exim and Dovecot use the same mbox or Maildir layout.
- Install both ClamAV’s daemon and signature updater.
- Configure the correct
clamdsocket, DATA ACL, and spool permissions. - Open only the SMTP and Dovecot ports your deployment needs.
- Test local POP3 or IMAP readiness, authenticated submission, mailbox retrieval, relay refusal, and EICAR rejection.
- Treat DNS alignment, reverse DNS, reputation, and remote-provider acceptance as separate production tasks.
What this setup proves—and what it does not
A successful build proves that Exim can transfer or locally deliver messages according to its routing policy, Dovecot can expose the selected mailbox format, and ClamAV can scan and reject a recognized test signature. It does not guarantee that major recipient providers will accept your mail, that your IP has favorable reputation, or that every DNS authentication record is correct. Keep those external checks in your launch plan, and monitor queues, service health, certificate expiry, mailbox storage, and ClamAV signature updates after deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
