Postfix and Dovecot mail server setup on a Linux VPS

This guide walks through a Postfix Dovecot mail server setup on a Linux VPS: one hostname, one mailbox, authenticated SMTP submission and IMAP over TLS. You install the two packages, wire them together so Dovecot handles authentication and Postfix handles delivery, then confirm that a message actually lands in a mailbox. Commands target Ubuntu 22.04/24.04 and Debian 12, with notes where AlmaLinux and Rocky differ.

Before you start

You need:

• A Linux VPS with sudo access, managed from your VPS provider's control panel if you need the browser console or an OS reinstall.
• A hostname such as mail.example.com with an A record pointing to your server, for example 203.0.113.10.
• Control over the DNS zone for example.com so you can add MX and SPF records.
• Inbound TCP ports 25, 587, 143 and 993 open to the internet.

Check whether outbound TCP port 25 is allowed before you invest time. Many networks block it to reduce spam. A quick test:

nc -vz gmail-smtp-in.l.google.com 25

If that hangs or is refused, ask your provider whether port 25 can be opened for your IP, or plan to send through a smarthost relay instead. You can open a ticket at /tickets/new.

Install Postfix and Dovecot

On Ubuntu and Debian:

sudo apt update
sudo apt install -y postfix dovecot-core dovecot-imapd dovecot-lmtpd mailutils

The Postfix installer asks two questions. Choose Internet Site as the general mail configuration type, and set the system mail name to example.com. If you get it wrong, rerun sudo dpkg-reconfigure postfix.

On AlmaLinux or Rocky Linux:

sudo dnf install -y postfix dovecot

SELinux is enforcing on those systems by default. If Postfix or Dovecot refuses to start, check sudo ausearch -m avc -ts recent and getenforce rather than disabling SELinux outright.

Create the mailbox user. Dovecot uses the system user's home directory for mail by default, which keeps this setup simple:

sudo adduser deploy

Postfix mail server setup

Apply the core settings with postconf, which edits /etc/postfix/main.cf safely:

sudo postconf -e 'myhostname = mail.example.com'
sudo postconf -e 'mydomain = example.com'
sudo postconf -e 'myorigin = $mydomain'
sudo postconf -e 'inet_interfaces = all'
sudo postconf -e 'inet_protocols = ipv4'
sudo postconf -e 'mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain'
sudo postconf -e 'mynetworks = 127.0.0.0/8'
sudo postconf -e 'home_mailbox = Maildir/'
sudo postconf -e 'smtpd_sasl_type = dovecot'
sudo postconf -e 'smtpd_sasl_path = private/auth'
sudo postconf -e 'smtpd_sasl_auth_enable = yes'
sudo postconf -e 'smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination'

Now enable the submission service in /etc/postfix/master.cf. Open the file and uncomment the existing submission block so it reads:

submission inet n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject

Leave port 25 plain: it is the inbound port for other mail servers, and most of them still negotiate STARTTLS on it.

Dovecot mail server setup

Edit /etc/dovecot/dovecot.conf and set the protocols you intend to serve:

protocols = imap lmtp

In /etc/dovecot/conf.d/10-mail.conf:

mail_location = maildir:~/Maildir

In /etc/dovecot/conf.d/10-auth.conf, confirm:

disable_plaintext_auth = yes
auth_mechanisms = plain login

That combination is fine because clients will connect over TLS. Then in /etc/dovecot/conf.d/10-master.conf, create the authentication socket Postfix connects to:

service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }
}

The socket path must sit under /var/spool/postfix/private/ because Postfix runs chrooted from /var/spool/postfix.

Restart both services and read back the effective configuration:

sudo systemctl restart postfix dovecot
sudo doveconf -n

Add TLS certificates

Mail clients and remote servers both expect valid TLS. With a DNS A record already pointing at the server:

sudo apt install -y certbot
sudo certbot certonly --standalone -d mail.example.com

Then point both services at the certificate. For Postfix:

sudo postconf -e 'smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem'
sudo postconf -e 'smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem'
sudo postconf -e 'smtpd_tls_security_level = may'
sudo postconf -e 'smtp_tls_security_level = may'
sudo postconf -e 'smtpd_tls_protocols = >=TLSv1.2'

For Dovecot, edit /etc/dovecot/conf.d/10-ssl.conf:

ssl = yes
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pem

Reload Dovecot, then open the firewall ports you need:

sudo systemctl reload dovecot
sudo ufw allow 25/tcp
sudo ufw allow 587/tcp
sudo ufw allow 143/tcp
sudo ufw allow 993/tcp

Finally, add DNS records at your registrar: an MX record for example.com pointing to mail.example.com, an SPF TXT record such as v=spf1 mx -all, and a PTR (reverse DNS) record for 203.0.113.10. Only your hosting provider can set the PTR, so request it through support.