Self-hosted email
Mailcow Support Guide: Common Issues and Fixes
Mailcow is a capable, all-in-one mail server, but running it to a business-grade standard takes more than the default install. This guide covers the issues that catch self-hosters most — queues, certificates, backups and deliverability — and how to keep it healthy.
Mailcow is a popular, container-based mail server suite that bundles Postfix, Dovecot, Rspamd, SOGo and a clean admin UI into one Docker Compose stack. It is genuinely good software, and it gives you the control and privacy of self-hosting without assembling every component by hand.
The catch is that self-hosting means you own the operations: deliverability, security, backups and uptime are all your responsibility. This guide focuses on the practical issues that most often go wrong in production, so you can run Mailcow as a reliable business system rather than a fragile hobby box.
In short
What keeps a Mailcow server healthy
Most Mailcow problems fall into these areas. Stay on top of them and the rest is usually quiet.
-
A clear mail queue
A growing Postfix queue is the earliest warning of a delivery or DNS problem. Watch it and investigate deferrals early.
-
Valid TLS certificates
Mailcow auto-renews Let's Encrypt certificates, but expiry and ACME failures still happen and break secure connections.
-
Tested backups
A backup you have never restored is a hope, not a backup. Mailcow ships a backup script; the discipline of testing restores is on you.
-
Solid deliverability
A fresh IP, missing reverse DNS or unconfigured authentication will send your mail to spam regardless of how well Mailcow runs.
-
Current updates
Mailcow updates frequently. Staying reasonably current closes security holes and avoids painful, long-overdue upgrades.
Mail queue problems
The mail queue is where Mailcow holds messages it has accepted but not yet delivered. Under Postfix, a few messages briefly queuing is normal; a queue that keeps growing is a symptom of a real problem. It is the single most useful thing to monitor.
Why messages get stuck
Common causes include a receiving server that is temporarily rejecting your mail (a deferral), a DNS resolution problem, your IP being blacklisted so remote servers refuse the connection, or an outbound rate limit. Mailcow exposes the queue in its admin UI and through the underlying postqueue tools, so you can see what is deferred and why.
When you spot a backlog, read the deferral reasons before flushing the queue. Blindly retrying does nothing if the cause is a blacklisting or a misconfiguration — you need to fix the underlying reason first, then let the queue drain.
TLS certificates and ACME
Mailcow obtains and renews TLS certificates from Let's Encrypt automatically using the ACME protocol, covering both the web UI and the mail services. When it works, you rarely think about it. When it fails, web access and secure mail connections break.
Common certificate failures
Renewal usually fails for predictable reasons: port 80 is blocked or in use so the ACME challenge cannot complete, the DNS for your hostname is wrong, or a rate limit was hit after repeated failed attempts. Mailcow logs the ACME container clearly, so the cause is normally visible in the logs.
Set up an external check that alerts you before a certificate expires, not after. An expired mail certificate can silently downgrade or break secure delivery to partners who require TLS.
Backups and restore discipline
Mailcow ships a helper script that backs up mailboxes, the databases, Rspamd data and configuration. Running it is the easy part. The discipline that actually protects you is testing restores and storing copies off the server.
- Back up regularly and automatically — a manual backup is one you will forget.
- Store at least one copy off the host, so a server loss does not take the backups with it.
- Test a restore periodically. A backup you have never restored is an untested assumption.
- Document the restore steps so recovery is calm, not improvised, during an incident.
Self-hosted mail holds years of irreplaceable business records. Treating backups as a tested, off-host process — not a hopeful cron job — is the difference between a bad day and a catastrophe.
Deliverability on a self-hosted server
A perfectly running Mailcow can still have all its mail land in spam. Deliverability depends on signals that a self-hoster must configure deliberately, and a brand-new server starts with none of the reputation a cloud platform brings.
- Configure SPF, DKIM and DMARC correctly — Mailcow generates DKIM keys, but the DNS publishing and DMARC policy are yours to manage.
- Set reverse DNS (PTR) for your sending IP so it resolves to a sensible hostname.
- Use a clean IP with no spam history, and warm it up by ramping volume gradually.
- Keep an eye on blacklists, because a new or shared-range IP can be listed through no fault of your own.
This is the area where self-hosted projects most often struggle, and where outside help pays off fastest. Reaching the inbox reliably from your own server is achievable, but it takes the same authentication and reputation discipline a cloud provider handles invisibly.
Updates, resources and security
Mailcow updates frequently, and the project moves quickly. Staying reasonably current closes security vulnerabilities and avoids the pain of a long-overdue, high-risk upgrade later. Read the release notes before each update, and back up first.
Give it enough resources
Rspamd, ClamAV and the Solr full-text search are memory-hungry. An under-resourced host leads to crashes, killed containers and odd, hard-to-diagnose failures. Provision enough RAM and disk, and monitor both, rather than running on the bare minimum.
Security basics still apply: firewall everything except the ports you need, secure administrative access with strong authentication, and keep the host operating system patched. Mailcow hardens the mail stack, but the server underneath is still yours to protect.
Avoid these
Common Mailcow mistakes
These are the errors that turn a good mail server into a fragile one.
-
Never testing a restore
Running backups but never restoring them means you discover they were incomplete during the one incident where it matters most.
-
Ignoring the mail queue
A quietly growing queue is the earliest sign of a delivery or DNS problem. Left unwatched, it becomes lost mail and angry customers.
-
Skipping reverse DNS and authentication
A self-hosted server with no PTR record and unconfigured SPF, DKIM or DMARC will land in spam no matter how well it runs.
-
Under-provisioning the host
Rspamd, ClamAV and search need real memory. Running on the minimum causes intermittent, baffling crashes.
-
Falling far behind on updates
Skipping updates for months turns a routine upgrade into a high-risk, all-or-nothing event — and leaves known vulnerabilities open.
When to call a specialist
When to get expert help
Self-hosting is rewarding when it is solid and stressful when it is not. Here is when expert support is worth it.
-
Your mail is going to spam
If a healthy Mailcow server still cannot reach the inbox, the cause is usually reputation or authentication — a specialist diagnoses and fixes it.
-
An update or migration went wrong
When an upgrade breaks the stack or a migration stalls, experienced hands recover it without losing mail.
-
You need someone watching it
A business mail server needs monitoring and a defined response when something breaks — not a single person who happens to be on holiday.
-
You want it production-grade
Taking a hobby install to a secured, deliverable, backed-up and monitored system is exactly the gap we close.
A note on honesty
Need it handled?
Related Mailoza services
We design, secure and operate Mailcow to a business-grade standard, so self-hosting gives you control without the fragility.
Keep reading
Related guides
A few more plain-English guides that connect to this one.
-
Email Deliverability Guide
Why self-hosted mail goes to spam, and the reputation and authentication signals that fix it.
-
Email Monitoring Guide
What to watch on a mail server — queues, certificates, blacklists and backups.
-
Stalwart Mail Server Guide
When a modern alternative like Stalwart is worth considering, and how to migrate.
Questions
Frequently asked questions
Why is my Mailcow mail going to spam?
Almost always because of reputation or authentication, not Mailcow itself. A new sending IP starts with no reputation, and self-hosters must configure SPF, DKIM, DMARC and reverse DNS deliberately. Get those right and warm the IP up gradually, and inbox placement improves.
How often should I back up Mailcow?
At least daily, automatically, with at least one copy stored off the server. More importantly, test a restore periodically — an untested backup is only an assumption. Mailcow ships a backup script, but the off-host storage and restore testing discipline is yours.
My TLS certificate expired — what happened?
Mailcow auto-renews via Let's Encrypt, so an expiry usually means the ACME challenge failed — often because port 80 was blocked, the hostname DNS was wrong, or a rate limit was hit. The ACME container logs show the cause. An external expiry alert lets you catch it before it breaks delivery.
How much server resource does Mailcow need?
More than people expect. Rspamd, ClamAV and the search index are memory-hungry, so an under-resourced host suffers intermittent crashes and killed containers. Provision generous RAM and disk and monitor both, rather than running on the minimum.
My mail queue keeps growing — what do I do?
A growing queue signals a delivery problem. Read the deferral reasons first: a temporary remote rejection, a DNS issue, a blacklisting, or a rate limit. Fix the underlying cause before flushing the queue — retrying alone does nothing if the cause persists.
Is Mailcow suitable for a business?
Yes, when it is run to a business-grade standard — secured, with correct authentication and deliverability, tested backups, monitoring and a defined response when something breaks. The software is capable; the operations discipline is what makes it reliable.