What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
You can run a complete iRedMail mail server on a VPS by starting with a clean supported Debian or Ubuntu installation, assigning it a correct mail hostname, allowing SMTP port 25, publishing matching DNS records, and replacing the installer’s self-signed certificate. The downloadable iRedMail 1.8.8 installer (released 8 September 2026) performs most package configuration through an interactive wizard, but delivery still depends on your VPS provider, reverse DNS, authentication records, firewall and account security.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide covers the full deployment path for a low-traffic production server: preparation, installation, DNS, firewall exposure, TLS, first login, verification and recovery of the most common failures.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Choose a supported VPS and prepare it
Use a clean operating-system image
Install iRedMail on a fresh supported Debian or Ubuntu system. The installer expects to configure Postfix, Dovecot, a database or LDAP backend, Amavisd and related services itself. Existing Postfix, Dovecot, database, LDAP or Amavisd packages can be overwritten or leave the machine in an unsupported state, so do not reuse a server that already provides those services.
iRedMail 1.8.8 lists Debian 12 and 13, Ubuntu 22.04, Ubuntu 24.04 (recommended), and Ubuntu 26.04 among its downloadable-installer platforms. The same release page says the iRedMail team recommends Enterprise Edition for new deployments; this procedure uses the classic downloadable installer because it is the documented VPS workflow.
#1 Best Overall
Size the machine for scanning
For a low-traffic production server with spam and virus scanning enabled, iRedMail specifies at least 4 GB of RAM. More memory is advisable if you select SOGo and expect many ActiveSync clients, because SOGo needs substantially more memory than a lightweight webmail-only setup.
Before installation, verify that UID and GID values 2000, 2001 and 2002 are not already in use. The installer relies on these identities for mail-related accounts. Also confirm that your VPS provider permits inbound and outbound SMTP on TCP port 25. Providers may block or throttle port 25; if it is unavailable, the server cannot receive normal inter-server SMTP traffic and direct delivery will not work.
Set a permanent fully qualified domain name
Choose a hostname such as mx.example.com. On Debian or Ubuntu, use a short hostname in /etc/hostname and place the fully qualified name first in /etc/hosts:
mx127.0.0.1 mx.example.com mx localhost localhost.localdomainCheck the result:
hostname -fThe command should return mx.example.com (or your chosen name). Reboot if the new hostname does not take effect immediately. Use this same hostname consistently for DNS, TLS, mail-client settings and the server’s public identity.
Install the downloadable iRedMail package
Install the prerequisites
Enable the official Debian or Ubuntu repositories, then install the tools used by the installer:
sudo apt-get install -y gzip dialogDownload the iRedMail 1.8.8 archive on a trusted workstation, upload it to the VPS, and place it under /root. Replace the archive and directory names below with the exact filename you downloaded.
Recommended Free Tools
cd /root
tar zxf iRedMail-x.y.z.tar.gz
cd /root/iRedMail-x.y.z/
bash iRedMail.shWork through the wizard deliberately
The installer is interactive. It asks for the mail-storage location, the account database backend, the first mail domain and an administrator password. The default mailbox path shown by the wizard is /var/vmail/.
Rank #2
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
- Mailbox location: Keep
/var/vmail/unless you have a specific storage layout and understand the resulting permissions and backup paths. - Account backend: Choose the backend you already know how to operate. The practical maintenance difference is usually more important than a theoretical feature difference; familiarity makes account creation, recovery and troubleshooting safer.
- Primary domain: Enter the domain that will own the first mailboxes, such as
example.com. - Administrator password: Use a unique, long password. Do not reuse a VPS, registrar or personal password.
- Webmail: Select only what your users need. Roundcube is the lighter option. SOGo provides webmail plus calendar, contacts and ActiveSync, but its memory demand rises substantially when many ActiveSync clients are connected.
Installing both Roundcube and SOGo is possible, but their mail-filter rule formats are not compatible. If both are installed, standardize users on one interface for filter management rather than editing rules in both applications.
Review the installer’s summary before it changes the system. Type y only after checking the hostname, storage directory, backend, domain and selected components. The installer then configures the selected services automatically.
Publish DNS that supports delivery and authentication
Do not treat DNS as an optional finishing step. The official guidance identifies A and MX records as required; PTR, SPF, DKIM and DMARC are optional in the narrow sense that SMTP can start without them, but they are highly recommended for reliable delivery and authentication.
| Record | Example | Purpose and qualification |
|---|---|---|
| A | mail.example.com points to the VPS public IP |
Gives the mail hostname a public address. The address must be the one used by your server. |
| PTR | VPS public IP maps back to mail.example.com |
Request this reverse-DNS mapping from the IP provider. Spam filters commonly inspect it, and a missing or mismatched PTR can damage delivery. |
| MX | example.com. 10 mail.example.com. |
Directs incoming mail for the domain to the mail hostname. The MX target must resolve to an address record. |
| SPF | v=spf1 mx -all |
Authorizes the servers listed in MX to send for the domain. Use this example only when those are genuinely all of your senders. |
| DKIM | dkim._domainkey.example.com |
Publishes the public key that recipients use to verify signatures generated by Amavisd. |
| DMARC | v=DMARC1; p=none; rua=mailto:[email protected] |
Reports authentication results while you validate SPF and DKIM alignment. Tighten the policy only after alignment is confirmed. |
A and reverse DNS
Create the A record for the exact hostname used by Postfix and by your certificate, such as mail.example.com. Then ask the VPS or IP provider to set the public IP’s PTR to that same name. Forward lookup and reverse lookup should agree: resolving the hostname should return the server IP, and reverse-resolving that IP should return the hostname.
MX and SPF
Point the domain’s MX record at the mail hostname, not directly at an IP address. A typical zone entry is:
example.com. 10 mail.example.com.Publish SPF as a TXT record. The policy v=spf1 mx -all is appropriate only when every legitimate sender for the domain is represented by its MX records. If you later add another sending service, update SPF rather than creating a second SPF record.
Generate and publish DKIM
After installation, display the public keys generated by Amavisd:
amavisd showkeysPublish the returned key at the selector and domain shown by the command, commonly dkim._domainkey.example.com. Check that DNS returns the complete TXT value:
dig -t txt dkim._domainkey.example.comThen ask Amavisd to validate the published key:
amavisd testkeysDo not truncate quoted TXT content when entering it into your DNS provider. A missing semicolon, line break or character can make the key unusable even though the record appears to exist.
Start DMARC in reporting mode
DMARC evaluates whether a message is legitimately from your domain and tells receivers what to do when it is not. DMARC.org describes it this way: “DMARC is a way to make it easier for email senders and receivers to determine whether or not a given message is legitimately from the sender, and what to do if it isn’t.”
A cautious starting record is:
v=DMARC1; p=none; rua=mailto:[email protected]p=none requests reporting without rejecting or quarantining mail. Review reports and correct SPF and DKIM alignment before moving to an enforcement policy. DMARC depends heavily on those two mechanisms; publishing DMARC first does not compensate for incorrect sender authorization or broken signatures.
Open only the ports the server needs
Apply the firewall rules at both layers that can block traffic: your VPS provider’s network firewall and the operating system firewall. The required public services are:
| Port | Transport | Use | Exposure |
|---|---|---|---|
| 25 | TCP | SMTP between mail servers | Publicly reachable for receiving and sending inter-server mail; confirm the provider does not block or throttle it. |
| 587 | TCP | Authenticated message submission | Publicly reachable for users and applications that submit mail. |
| 993 | TCP | IMAPS | Publicly reachable for secure mailbox retrieval. |
| 995 | TCP | POP3S | Open only if users require POP3 over TLS. |
| 80 | TCP | HTTP validation and web endpoints | Needed for webmail-related access and the webroot certificate challenge. |
| 443 | TCP | HTTPS webmail and related interfaces | Publicly reachable for browser access. |
Port 465 is deprecated in favor of authenticated submission on 587. Database ports 3306 and 5432, LDAP ports 389 and 636, Amavisd ports and iRedAPD management ports are localhost-only by default. Keep them private; exposing them creates services that mail clients do not need.
Replace the installer’s self-signed certificate
The initial installation creates a self-signed certificate. Browsers and mail clients consequently display trust warnings. Let’s Encrypt can provide a free publicly trusted certificate, provided the certificate hostname has a correct public A record and the webroot challenge can reach the server.
Rank #4
- Standard size: 6 pink server note pads, Each Book Comes with 50 bound order slips - that's 300 ticket sheets total! Check Pads Size 6.75 x 3.5 inch.
- Convenient Work: These guest check books for servers have a tear-free dotted line that is easy to rip off. You can give as a customer copy or keep for record keeping. We've provided extra rows on the back for additional note taking.Perfect For Restaurants, Lounges, Hotels, Cafes, And Waiters To Use.
- Record Important Information: These server note pads can record important information.Each ticket has a unique serial number printed at the top, dates, order details, number of guests, order amount, table numbers etc. They are lightweight, small and can fit most aprons. They can be used on-demand and can help decrease errors in orders, while improving work efficiency.
- High Quality: Sturdy, Not Drop Powder, It's Thick, You Can Write On The Back And Front Easily.Their whole page printing has clear handwriting and a reasonable layout. On the customer retention part of each guest check, "THANK YOU" on the back to make customers feel appreciated.
- Contact Us: We're confident that the quality of the server note pads will go beyond your expectation. If you experience an issue, feel free to contact us, we'll appreciate it to learn from your experience, and we'll make it better
Validate the webroot challenge first
Install Certbot and perform a dry run before requesting the real certificate:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11apt install -y certbot
certbot certonly --webroot --dry-run -w /opt/www/well_known -d mail.example.comIf the dry run fails, fix DNS, provider firewall rules, the VPS firewall or web-server reachability before continuing. A successful dry run is evidence that the challenge path works; it does not itself install a production certificate.
Request and install the live certificate
Repeat the command without --dry-run:
certbot certonly --webroot -w /opt/www/well_known -d mail.example.comCertbot stores the resulting files under /etc/letsencrypt/live/mail.example.com/. On Debian and Ubuntu, back up the iRedMail-generated certificate files, then link the current certificate and private key to the paths used by the mail services:
ln -sf /etc/letsencrypt/live/mail.example.com/fullchain.pem /etc/ssl/certs/iRedMail.crt
ln -sf /etc/letsencrypt/live/mail.example.com/privkey.pem /etc/ssl/private/iRedMail.key
systemctl restart postfix dovecot nginxUse the same hostname in mail clients that appears in the certificate. Connecting to an alternate name or an IP address can still produce a warning even when the certificate itself is valid.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Renew without leaving stale certificates in service
Certificate renewal is normally unattended only if you arrange a post-renewal action. Run certbot renew on a schedule and use a post-hook that refreshes the two links and restarts Postfix, Dovecot and Nginx after a successful renewal. The reload action must occur after Certbot updates the files; otherwise the services can continue presenting the old certificate until their next restart.
Log in and secure the first deployment
Read the generated notes immediately
Open the installation notes file:
less /root/iRedMail-x.y.z/iRedMail.tipsIt contains application URLs, generated credentials and configuration-file locations for the components you selected. Store the information in a password manager, then replace any temporary or weak passwords before creating additional accounts.
Depending on your choices, the documented interfaces are:
Best Value
- Roundcube:
https://your_server/mail/ - SOGo:
https://your_server/SOGo - iRedAdmin:
https://your_server/iredadmin/
Weak passwords are a major mail-server risk because attackers specifically seek compromised accounts that can be abused to send spam. Require strong, unique credentials for administrators and every mailbox. Do not publish the generated administrator password in a ticket, shell history or shared document.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRun functional checks before announcing the server
- Create a test mailbox in the administration interface.
- Configure a mail client to submit through port 587 with authentication and confirm that the server accepts the message.
- Connect through IMAPS on port 993, or POP3S on 995 if POP3 is enabled, and verify that the certificate hostname validates without a warning.
- Run
amavisd testkeysand confirm the DKIM key is accepted. - Check that the A record, MX record and PTR record resolve as intended and that forward and reverse DNS agree.
- Send test messages to external recipients and inspect authentication results for SPF, DKIM and DMARC alignment.
These checks should be performed on your own deployment; successful installation alone does not prove that a provider permits port 25 or that external recipients will accept your mail.
Choose components according to operational trade-offs
Downloadable installer or Enterprise Edition
The current release page recommends Enterprise Edition for new deployments. The downloadable installer remains a practical choice when you need the documented, self-managed VPS procedure and want the wizard to configure the classic component set. Decide before provisioning the server, because the management model and upgrade path differ.
Roundcube or SOGo
| Option | Best fit | Trade-off |
|---|---|---|
| Roundcube | Users who need lightweight browser mail | Lower resource demand and a focused webmail experience. |
| SOGo | Teams needing webmail, calendar, contacts and ActiveSync | Substantially higher memory demand when many ActiveSync clients are used. |
| Both | Mixed access requirements | Supported, but mail-filter rule formats are incompatible; users should manage filters in one interface only. |
Backend selection
The wizard offers more than one account backend. Select the one your administrators already understand. A familiar backend reduces the chance of incorrect account provisioning, failed password recovery and undocumented maintenance work, even when another backend appears attractive on paper.
Troubleshoot the failures that stop delivery
Port 25 is unreachable
First test the provider’s policy, not just your local firewall. A provider-level block or throttle cannot be repaired with an operating-system rule. If the provider permits port 25, check the VPS firewall, confirm that Postfix is listening and verify that the public IP is the one in your DNS A record. Without inbound port 25, other mail servers cannot deliver directly to your MX.
Free tools Windows power users keep installed
One-click scans. No signup required.
Mail clients report a certificate warning
Confirm that the client connects to the exact certificate name, normally mail.example.com. Check that the A record resolves publicly, the Certbot dry run succeeded, the links point to fullchain.pem and privkey.pem, and Postfix, Dovecot and Nginx were restarted after linking. A valid certificate presented on the wrong hostname still fails validation.
DKIM validation fails
Run amavisd showkeys again and compare the selector, domain and key character by character with the DNS TXT record returned by dig -t txt. Then run amavisd testkeys. Common causes are publishing the key under the wrong selector, truncating a long TXT value or creating multiple conflicting records.
Messages are rejected or classified as spam
Check the complete identity chain: the sending hostname’s A record, the IP’s PTR, the domain’s MX, SPF authorization, DKIM verification and DMARC alignment. A mismatch between the PTR name and the SMTP hostname, a provider-assigned IP with poor reputation or an SPF record that omits a legitimate sender can all reduce acceptance. Correct those records before increasing DMARC enforcement.
SOGo consumes the available memory
Review the number of ActiveSync clients and the VPS’s memory allocation. SOGo’s additional calendar, contacts and ActiveSync functionality comes with substantially higher memory requirements than lightweight webmail. Increase available RAM or standardize users on a lighter webmail choice when those features are not required.
Deployment sequence at a glance
The safest order is: provision a clean supported VPS; confirm 4 GB or more of RAM, unused UID/GID values and provider access to port 25; set and verify the FQDN; install the prerequisites and run the wizard; publish A, PTR and MX records; add SPF, DKIM and a monitoring-only DMARC policy; open only the required public ports; obtain and install a trusted certificate; read iRedMail.tips; change generated credentials; and complete authenticated-submission, retrieval, DNS and DKIM tests before accepting real traffic.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
