A reliable self-hosted mail system separates four jobs: Postfix accepts and routes SMTP, MySQL stores virtual domains and mailbox identities, Dovecot authenticates users and serves IMAP while delivering through LMTP, and SpamAssassin scores messages before delivery. Build those boundaries in order, enable TLS before advertising authentication, and test every hand-off independently. The result is a server that can host multiple domains and mailboxes without becoming an open relay.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What this stack does
Postfix is the Internet-facing SMTP edge and policy engine. Its SQL maps ask MySQL whether a domain exists, where a mailbox is located, which aliases expand, and whether an address should be accepted. Dovecot provides IMAP access, SQL-backed passdb and userdb lookups, the SASL service used by authenticated SMTP submission, and LMTP delivery into each mailbox. SpamAssassin runs as a filtering stage through spamd and spamc, calculates a score, and adds headers that you can use for delivery or Sieve rules.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Component | Primary responsibility | Boundary to verify |
|---|---|---|
| Postfix | SMTP reception, routing, relay policy, SQL lookups and submission on port 587 | SMTP client to Postfix; Postfix to SQL maps, SASL and LMTP |
| MySQL | Virtual domains, mailboxes, password hashes, aliases and optional access controls | Read-only queries from the mail-service accounts |
| Dovecot | IMAP, authentication, user database and final LMTP mailbox delivery | Passdb/userdb lookups and UNIX sockets owned by the intended services |
| SpamAssassin | Message scoring and X-Spam-* headers |
Filter invocation, latency and header presence |
The normal message paths are:
- SMTP submission on port 587 → Postfix → Dovecot SASL socket → MySQL-backed passdb and userdb.
- Accepted mail → SpamAssassin stage → Postfix → Dovecot LMTP socket → virtual mailbox storage.
- Postfix SQL maps → MySQL tables for domains, mailboxes, aliases and optional policy data.
Set the deployment assumptions before installing packages
Package names, service units, configuration directories and confinement profiles differ by distribution. Record the following before copying any command from a distribution guide:
- Operating-system release and exact Postfix, Dovecot, MySQL and SpamAssassin package versions.
- The fully qualified mail hostname, such as
mail.example.net, and every hosted domain. - Public IPv4 and IPv6 addresses, the network provider responsible for reverse DNS, and the DNS provider.
- The certificate source, mailbox storage path, backup destination and expected mailbox growth.
- Firewall rules for SMTP (25), authenticated submission (587), IMAPS (993 if enabled) and administrative access.
Use a dedicated host or virtual machine with a stable public address. A residential or frequently changing address is likely to have poor reputation or blocked outbound port 25. Create an administrative account, apply security updates, restrict remote administration, and set a correct system clock before mail testing.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Publish DNS and establish identity
- Create an
Arecord for the mail hostname and anAAAArecord only when IPv6 is correctly routed and filtered. - Create an
MXrecord for each hosted domain that points to the mail hostname. The MX target must resolve directly; do not point it at an alias record. - Ask the network provider to set reverse DNS (PTR) for each sending address to the same mail hostname, then confirm forward and reverse resolution agree.
- Publish SPF, DKIM and DMARC records. They are outside Postfix, Dovecot and SpamAssassin, but they materially affect acceptance by other providers.
Lower DNS time-to-live values while commissioning the service, then raise them after the final records are verified. Do not test delivery until the MX, forward DNS and reverse DNS answers are consistent from an external resolver.
Create the MySQL data model and service account
Lock down MySQL first. Create a database dedicated to mail and a least-privilege account used only for the queries required by Postfix and Dovecot. Keep its password in root-readable configuration files, not in world-readable web directories or shell history. A read-only query proves connectivity without granting the mail services schema-changing privileges.
Free tools Windows power users keep installed
One-click scans. No signup required.
A minimal relational model can look like this:
CREATE TABLE domains ( domain_id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY, name VARCHAR(255) NOT NULL UNIQUE, active TINYINT(1) NOT NULL DEFAULT 1 ); CREATE TABLE mailboxes ( mailbox_id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY, domain_id INT UNSIGNED NOT NULL, local_part VARCHAR(128) NOT NULL, address VARCHAR(384) NOT NULL UNIQUE, password_hash VARCHAR(255) NOT NULL, maildir VARCHAR(512) NOT NULL, active TINYINT(1) NOT NULL DEFAULT 1, UNIQUE KEY domain_local (domain_id, local_part), FOREIGN KEY (domain_id) REFERENCES domains(domain_id) ); CREATE TABLE aliases ( alias_id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY, domain_id INT UNSIGNED NOT NULL, source VARCHAR(384) NOT NULL, destination VARCHAR(384) NOT NULL, active TINYINT(1) NOT NULL DEFAULT 1, INDEX source_idx (source), FOREIGN KEY (domain_id) REFERENCES domains(domain_id) );Use a password-hashing scheme supported by your Dovecot version, such as a salted modular hash. Never store or compare plaintext passwords. Normalize the login identity consistently: using the complete address, including its domain, avoids collisions between identical local parts on different domains. Decide whether addresses are case-sensitive and apply that decision in SQL, Postfix and Dovecot alike.
Store one mailbox path convention and use it everywhere. For example, a user database can return a home directory derived from the domain and local part, while Dovecot appends Maildir/. The path must be owned by the mailbox service account and writable by Dovecot, not by the SMTP listener.
Point Postfix at MySQL SQL maps
Postfix uses separate map definitions for virtual domains, mailbox destinations, aliases and optional access policies. Put each query in a root-readable file and reference that file from the main Postfix configuration. The following query shapes illustrate the required results; adapt table and column names to your schema.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
user = mailreader password = a-long-random-secret hosts = 127.0.0.1 dbname = mail query = SELECT 1 FROM domains WHERE name = '%s' AND active = 1The domain map must return a row only for an active hosted domain. A mailbox map should return the destination path for an active full address, and an alias map should return one or more destinations for an active source address. Keep unknown-recipient behavior strict: accepting arbitrary recipients creates backscatter and fills the queue with undeliverable mail.
Configure the corresponding Postfix parameters for virtual hosting, including virtual_mailbox_domains, virtual_mailbox_maps, virtual_alias_maps and any access maps you actually use. Set the virtual transport to Dovecot LMTP after that socket exists. On busy systems, each SQL map lookup can create a MySQL client; use Postfix proxymap where appropriate or size MySQL connection limits deliberately rather than discovering saturation under load.
Validate every map from Postfix’s map-testing utility or an equivalent read-only query before reloading the service. Test an existing domain, an existing mailbox, an alias with multiple destinations and an unknown address. A successful domain lookup must not imply that every address at that domain is valid.
Configure Dovecot SQL authentication and user data
Set Dovecot’s SQL driver to MySQL and define separate passdb and userdb queries. Passdb answers whether the supplied credentials are valid and returns the password hash. Userdb returns mailbox identity data such as the UID/GID policy, home directory and quota-related fields. Keeping those roles separate makes failures diagnosable.
A passdb query should select the stored hash by normalized full address and active status:
Recommended Free Tools
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
SELECT address AS username, password_hash FROM mailboxes WHERE address = '%u' AND active = 1A userdb query should return a stable home path and any fields your Dovecot version expects:
SELECT address AS user, maildir AS home FROM mailboxes WHERE address = '%u' AND active = 1Use Dovecot’s documented variable for the authenticated username consistently. If users can enter addresses in mixed case, normalize before lookup or store a canonical form and reject ambiguous duplicates. Test both a valid account and an unknown account with doveadm auth test [email protected]; the unknown account must fail without revealing whether a similar address exists.
Configure IMAP after authentication works. Restrict listeners to the interfaces you need, select a mailbox namespace, and ensure the storage path returned by userdb is writable. If you use quotas or Sieve, add those deliberately after basic delivery succeeds rather than debugging several plugins at once.
Connect Postfix to Dovecot SASL and enable port 587
Create a Dovecot authentication UNIX socket inside the Postfix queue, commonly /var/spool/postfix/private/auth. The socket must be readable by the Postfix process and by no unrelated users. In Postfix, select Dovecot SASL and reference the relative path private/auth; the relative path matters because Postfix resolves it from its queue directory.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Run authenticated submission as a separate Postfix service on TCP port 587. Require authentication there, apply a submission-specific restrictions chain, and permit relay only after successful SASL authentication. Keep ordinary port 25 reception for server-to-server mail and do not offer a path that lets unauthenticated clients relay to arbitrary destinations.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Typical submission policy includes:
- Require STARTTLS before accepting credentials or authenticated mail.
- Advertise AUTH only after TLS is active.
- Apply a message-size limit and a sender policy appropriate for your users.
- Use
reject_unauth_destinationon the relay path so a client cannot use your host as an open relay.
Reload Postfix only after checking the configuration syntax. Verify that the Postfix process can open the Dovecot socket, then authenticate with a test account over an encrypted session.
Deliver accepted mail through Dovecot LMTP
LMTP keeps final mailbox placement, indexing and quota behavior in Dovecot. Create a Dovecot LMTP UNIX socket in a location Postfix can access, such as /var/spool/postfix/private/dovecot-lmtp, and set Postfix’s virtual transport to that socket. Ensure the socket directory permissions survive service restarts and that the Postfix and Dovecot service accounts have only the access they need.
Send a message to a valid virtual mailbox and follow its queue ID through the logs. Successful SMTP acceptance is not proof of delivery: the LMTP transaction must return success, and Dovecot must create or append to the intended Maildir. Test a nonexistent recipient as well; Postfix should reject it during SMTP rather than accepting mail that can never be delivered.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsEnable TLS before advertising AUTH
Install a certificate covering the public mail hostname and protect the private key with restrictive ownership and permissions. Configure TLS separately in Postfix and Dovecot, disable obsolete protocol versions according to the supported versions of your packages, and plan certificate renewal before expiry.
For submission, require STARTTLS before authentication. Postfix’s TLS documentation describes the purpose precisely: an encrypted session protects information transmitted with SMTP mail or with SASL authentication. The Postfix SASL guidance likewise identifies TLS as the more secure way to protect plaintext usernames and passwords. Do not enable AUTH merely because the socket works; clients must be unable to send credentials over a clear connection.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Test the certificate name, chain and negotiated protocol from outside the server. Also test IMAP encryption on the listener you expose. If a certificate is renewed by an automated process, verify that the running services reload the new files and that the old private key is no longer used.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Add SpamAssassin without disrupting delivery
Run spamd as the long-lived daemon and invoke it with spamc or the content-filter integration supported by your Postfix deployment. The filter should receive a message, return the message or an explicit failure, and allow Postfix to apply its chosen policy. Keep site-wide rules in local.cf. Use SQL-backed SpamAssassin preferences only when individual users genuinely need different thresholds or rule settings.
SpamAssassin adds headers including X-Spam-Status and X-Spam-Level. Its documented default is to tag messages with a calculated score of 5.0 or higher as spam (Apache SpamAssassin documentation, version 4.0.x). Tagging is safer than silently deleting mail while you establish local false-positive rates. You can route tagged messages to a Junk folder with Dovecot Sieve or leave them in the inbox for review.
Choose where filtering occurs in the path and keep that choice consistent. A common arrangement is SMTP acceptance, SpamAssassin processing, then LMTP delivery. Monitor filter latency and define a failure policy: temporary failure and retry is safer for an unavailable filter than accepting mail with an assumption that it was scanned. Never run multiple independent filter passes unless you understand which headers and scores each pass will produce.
Test every boundary independently
Use a disposable external account and record timestamps, queue IDs and message IDs. Work through this checklist in order:
- Resolve the mail hostname, MX records and reverse DNS from outside the server. Confirm that the PTR name maps back to the sending address.
- Run the MySQL service-account read-only queries for one domain, mailbox and alias. Confirm that an inactive row is not returned.
- Run
doveadm auth testwith a valid account and an invalid account. Check that only the valid credentials succeed. - Verify that Postfix can open the Dovecot authentication socket and that the socket permissions remain correct after a restart.
- Open an SMTP STARTTLS session to
mail.example.net:587with an SMTP client such asopenssl s_client -starttls smtp. Confirm the certificate name and that AUTH is not advertised before TLS. - Submit an authenticated message to a local mailbox and an external destination. Confirm that unauthenticated clients cannot relay externally.
- Send inbound mail from an external system. Follow the queue ID through SpamAssassin and LMTP, then log in over IMAP and read the message.
- Inspect the delivered message for
X-Spam-Statusand related headers. Use a controlled test message rather than assuming every message was scanned. - Test alias expansion, an unknown recipient, an inactive mailbox and a domain that is not hosted. Unknown recipients should be rejected, not accepted and later discarded.
- Record queue length, authentication failures, SQL errors and filter response times during each test.
Troubleshoot by the failing hand-off
| Symptom | Likely boundary | Checks and corrective action |
|---|---|---|
| External senders cannot find the server | DNS or firewall | Check MX and A/AAAA records, TCP port 25 reachability and reverse DNS. Remove an unusable AAAA record rather than leaving clients to prefer a broken IPv6 path. |
| Postfix says a domain is not found | SQL domain map | Run the exact query as the mail database account, check spelling and active flags, and verify that Postfix is reading the intended map file. |
| Authentication always fails | Dovecot passdb or socket | Test the hash query directly, confirm the username normalization, inspect socket ownership and use doveadm auth test before testing SMTP. |
| AUTH is absent on port 587 | TLS or submission service | Confirm STARTTLS succeeds, that AUTH is configured on the submission service rather than only on port 25, and that the client reconnects after TLS. |
| SMTP accepts mail but the mailbox stays empty | LMTP or storage | Trace the queue ID, inspect the LMTP response, verify socket permissions and check the userdb home path and filesystem ownership. |
| Messages have no SpamAssassin headers | Filter invocation | Check that spamd is running, invoke spamc manually with a test message, inspect the filter log and verify that Postfix’s content-filter path is actually used. |
| Queue grows rapidly | Remote delivery, SQL or filter capacity | Separate deferred remote mail from local-delivery failures, inspect DNS and connection errors, watch MySQL client counts and measure SpamAssassin latency before increasing concurrency. |
Security and ongoing operations
- Use separate low-privilege MySQL accounts for the mail services where practical; neither Postfix nor Dovecot should have schema-admin rights.
- Protect SQL credentials, DKIM keys and TLS private keys with root-readable permissions and an audited backup process.
- Keep
reject_unauth_destinationand authenticated-submission restrictions active. Test open-relay behavior after every policy change. - Monitor queue growth, authentication failures, database connection saturation, disk usage, certificate expiry and SpamAssassin latency.
- Back up both the MySQL database and mailbox storage. Perform restore drills to a separate host; an untested backup is not a recovery plan.
- Apply Postfix, Dovecot, MySQL, SpamAssassin and operating-system updates, then repeat the boundary tests after upgrades.
- Prepare abuse handling: rate-limit compromised accounts, preserve relevant logs, respond to provider complaints and manage the sending IP’s DNS reputation.
Self-hosting versus managed mail
This architecture is appropriate when you need control over data, configuration, SQL-backed virtual domains or custom filtering and can operate the service continuously. A managed mail service or managed VPS shifts much of the platform maintenance and incident response elsewhere, but you give up some low-level control and still need to understand DNS, account security and data portability.
| Decision factor | Self-hosted stack | Managed alternative |
|---|---|---|
| Control | Full control of Postfix policy, Dovecot storage, SQL schema and filters | Limited to the provider’s supported settings and APIs |
| Deliverability | You must build reputation for the sending IP and maintain reverse DNS | Provider usually supplies established sending infrastructure, subject to its policies |
| Maintenance | You patch four major components, monitor capacity and handle abuse | Provider handles much of the platform work, while account and DNS administration remain yours |
| Backup and recovery | You design, fund and test database and mailbox restores | Retention and restore scope depend on the contract; verify them explicitly |
| Cost and portability | Predictable infrastructure cost but substantial operator time; data remains in your formats | Recurring service cost with less operational labor; migration options vary |
Choose self-hosting only if you can provide DNS administration, TLS renewal, backups, monitoring, updates and abuse response. Otherwise, the operational burden—not the initial package installation—is the decisive reason to use managed mail.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
