Hardening Mailcow Security

Lock down your Mailcow server against spam, brute-force, and unauthorized access.

Lock down your Mailcow server with TLS hardening, fail2ban, and firewall rules.

Change Default Admin Password

Login to the Mailcow UI and immediately change the default admin / moohoo credentials.

Enforce TLS on All Connections

# Edit mailcow.conf
sudo nano /opt/mailcow-dockerized/mailcow.conf

# Set TLS version minimum
SKIP_LETS_ENCRYPT=n
ADDITIONAL_SAN=

Configure UFW Firewall

sudo ufw allow 22/tcp    # SSH
sudo ufw allow 25/tcp    # SMTP
sudo ufw allow 80/tcp    # HTTP (redirect)
sudo ufw allow 443/tcp   # HTTPS
sudo ufw allow 465/tcp   # SMTP TLS
sudo ufw allow 587/tcp   # SMTP submission
sudo ufw allow 993/tcp   # IMAP TLS
sudo ufw allow 995/tcp   # POP3 TLS
sudo ufw allow 4190/tcp  # Sieve
sudo ufw enable

Enable fail2ban

Mailcow ships with built-in fail2ban via its netfilter-mailcow container, which automatically bans IPs with repeated authentication failures. Verify it’s running:

cd /opt/mailcow-dockerized
sudo docker compose ps netfilter-mailcow

Rotate API Keys and DKIM Keys

In the Mailcow UI, regularly rotate DKIM keys under Email → Configuration → ARC/DKIM Keys and regenerate the Rspamd password.

FAQ

What are the first Mailcow security steps?

Enable 2FA for the admin, keep Mailcow updated, use strong mailbox passwords and keep the host firewall tight.

Should the Mailcow admin page be public?

Limit it where you can, for example by IP or VPN, and always use 2FA.