Welcome back to The Deep Dive. Today we are wrestling with a legendary beast of
Download transcript (.srt)
0:00
0:05
0:08
0:08
0:13
0:15
0:19
0:20
0:24
0:27
0:28
0:32
0:33
0:33
0:37
0:40
0:42
0:47
0:48
0:49
0:50
0:55
0:58
1:01
1:05
1:08
1:10
1:15
1:16
1:19
1:20
1:23
1:27
1:28
1:32
1:36
1:38
1:42
1:43
1:44
1:46
1:49
1:52
1:54
1:56
2:01
2:04
2:07
2:13
2:15
2:20
2:22
2:25
2:28
2:34
2:36
2:38
2:40
2:44
2:46
2:47
2:48
2:50
2:51
2:56
2:56
3:01
3:01
3:02
3:03
3:09
3:10
3:13
3:19
3:20
3:23
3:24
3:25
3:28
3:31
3:32
3:34
3:38
3:39
3:40
3:44
3:44
3:47
3:53
3:54
3:58
3:58
3:59
4:00
4:03
4:07
4:07
4:10
4:15
4:16
4:20
4:20
4:21
4:26
4:27
4:28
4:30
4:33
4:37
4:38
4:39
4:42
4:44
4:45
4:48
4:51
4:54
4:56
4:58
5:01
5:06
5:06
5:08
5:11
5:15
5:18
5:20
5:23
5:26
5:27
5:28
5:31
5:32
5:35
5:40
5:40
5:44
5:47
5:47
5:48
5:51
5:52
5:55
5:56
5:57
5:59
6:02
6:04
6:09
6:10
6:13
6:14
6:15
6:20
6:24
6:25
6:27
6:31
6:35
6:36
6:37
6:40
6:41
6:44
6:46
6:48
6:52
6:52
6:53
6:54
6:57
6:58
7:02
7:09
7:13
7:18
7:19
7:24
7:28
7:30
7:32
7:37
7:37
7:38
7:39
7:43
7:44
7:47
7:52
7:52
7:56
7:57
7:58
7:59
8:02
8:06
8:07
8:10
8:11
8:17
8:18
8:19
8:20
8:21
8:24
8:29
8:29
8:30
8:33
8:36
8:37
8:38
8:42
8:42
8:47
8:50
8:53
8:55
8:59
9:03
9:03
9:04
9:08
9:09
9:12
9:17
9:19
9:20
9:23
9:28
9:29
9:33
9:34
9:36
9:39
9:43
9:43
9:44
9:45
9:48
9:52
9:56
9:57
10:01
10:02
10:05
10:08
10:09
10:10
10:11
10:15
10:16
10:18
10:23
10:23
10:25
10:28
10:32
10:33
10:37
10:40
10:42
10:46
10:50
10:51
10:52
10:56
10:56
10:57
10:58
11:02
11:02
11:03
11:07
11:09
11:13
11:15
11:16
11:20
11:24
11:24
11:27
11:29
11:33
11:33
11:39
11:40
11:41
11:46
11:46
11:47
11:48
11:52
11:57
11:57
12:00
12:03
12:04
12:06
12:10
12:10
12:12
12:16
12:17
12:21
12:22
12:24
12:27
12:28
12:32
12:36
12:40
12:41
12:45
12:48
12:49
12:53
12:53
12:55
12:56
13:00
13:00
13:04
13:06
13:11
13:12
13:15
13:19
13:20
13:22
13:22
internet infrastructure, email.
Oh, yeah.
More specifically, we've taken a stack of sources that tackle one of the most notoriously
complex tasks in the tech world,
self-hosting your own email, and we found a surprising solution that makes it
accessible.
You know, for anyone who has ever even tried to run a professional-grade mail
server by hand, you know, it's not just one program.
Yeah.
It's a whole integrated system of, I don't know, half a dozen or more separate
applications.
Right.
I mean, you're talking about manually stitching together software for sending,
receiving, spam, filtering, virus checking, web access.
It just becomes this monster.
It truly becomes a Frankenstein's monster of dependency conflicts and just endless
configuration files.
It's a nightmare.
It sounds like a total nightmare.
And that's why our mission today is to deep dive into Mailcow, Dockerized.
This tool promises to tame that complexity.
We're going to explain what this open source suite is, why it uses the specific
technology it does, and what crucial components it brings together.
And we're going to make it accessible to you, even if you're an absolute beginner.
Exactly.
The core concept is, I have to say, wonderfully elegant, especially for a piece of
heavy infrastructure.
It's all represented by this charming little equation.
The cow plus the whale.
The cow plus a whale equals love.
The cow is male cow, obviously, the software suite itself, and the whale, that's
the logo for Docker.
The containerization technology that acts as the delivery vehicle.
It's a very, I mean, a very succinct way of saying, we've taken the most difficult
server task out there,
male management, and packaged it using the simplest, most reproducible technology
available today.
It just takes the pain away.
It absolutely does.
And before we start decoding that cow and that whale, we should probably thank our
supporter for making this deep dive possible.
We should.
This deep dive is brought to you by Safe Server.
Safe Server handles the hosting of powerful open source software, just like Mail
Cow, and supports your digital transformation journey.
They make sure your infrastructure keeps pace with your ambition.
You can find more information and support at www.safeserver.de.
OK, let's unpack this.
We've established a cute equation, but for someone coming in cold, what exactly is
Mail Cow Dockerized?
What problem does it solve right out of the box?
Simply put, it's an all-in-one mail server suite.
It's open source, released under the GNU general public license version three.
So you get all that transparency and community oversight.
And the Dockerized part?
The Dockerized part is the fundamental innovation.
It's what solves that Frankenstein's monster problem we were just talking about.
Let's focus on that for a second, because that's a magic trick we really need to
explain
for our audience.
What does using Docker actually mean for the administrator?
OK, think of it this way.
Traditionally, if you install, say, Postfix, you need a specific version of a
library.
Then if you install rspammed, it might need a conflicting version of that same
library.
And then everything breaks.
Everything breaks.
But Docker solves this by bundling each application, Postfix, rspammed, dubcot,
into its own separate
isolated environment, a container.
So if Postfix needs version 1.0 of a library and dubcot needs version 2.0, they can
just
peacefully coexist because they're sealed off from each other.
Precisely.
They're self-contained ecosystems.
And this means the components are portable.
They don't fight over dependencies on your operating system.
And this is crucial.
They are incredibly easy to update.
So instead of manually updating six different programs and just praying nothing
breaks.
Right.
They can essentially just pull a new pre-tested version of the entire MailCow
engine.
It's no wonder this project has such strong community adoption.
I mean, the GitHub source shows 11.9 thousand stars and 1.6 thousand forks.
That's a lot of interest.
That level of professional interest really confirms that they solved a fundamental
pain
point.
It does.
And you know, this isn't just a weekend hobby project.
It originated from the work of Andre, or at Andre Ashi, and it's actively managed
and
maintained by the infrastructure company GMBH.
So you get that blend of robust professional maintenance with that open source ethos.
That's it.
Okay, so now that we know what MailCow is and how it's packaged using containers,
let's
look inside the engine.
Since it's an all-in-one suite, it must replace every piece of that old, complex
mail server
puzzle.
What are those essential components?
This is where the scope of the project really comes into focus.
MailCow incorporates a pretty comprehensive stack, and we can break it down by
function.
Okay.
Let's start with the absolute basics of email transport.
The actual act of sending and receiving.
Right.
For sending mail, MailCow uses Postfix.
Think of Postfix as the post office truck, you know.
It implements the SMTP protocol and gets your email from point A to point B.
And for receiving.
For receiving and storing mail, it uses DoveCot.
DoveCot is like the sophisticated filing cabinet.
It handles IMAP and POP3, allowing your client, like your phone or desktop app, to
access
and store all those messages.
Okay, so we've got the delivery truck and the filing cabinet.
But I mean, modern email is utterly unusable without defense.
What about spam and malware?
That's probably the most complex layer.
And MailCow uses layered security here.
For advanced spam and filtering, it integrates spam.
That's a modern tool, right?
Yeah.
It's a modern spam filter that uses sophisticated rules, neural networks, all that
good stuff.
And for mandatory antivirus protection, it includes Clamov.
Our sources also mention Olify, which is often used to detect malicious macros in
documents.
So you can see their layering protection to catch different kinds of threats.
So we have the mail flow, we have the defense system, but I still need a user
interface,
right?
I need to check my mail from a browser, manage my calendar.
Exactly.
For web access and all those critical groupware features, calendars, contacts,
tasks, it includes
SoGo.
It gives you a polished web interface instantly.
And then there are the utilities, the unsung heroes.
The unsung heroes, precisely.
You need Docker Compose to orchestrate all those containers, making sure they start,
stop, and communicate correctly.
And the last one is probably the most important for security.
Oh yeah.
ACME.
ACME automates the management of your SSLTLS certificates.
If your certificates expire, your mail stops working securely, and that is a
massive headache.
MailCal just automates this entirely.
And that is the ultimate value proposition for you, the listener.
You are spared the headache of installing, configuring, and connecting seven
distinct
complex programs.
And hoping they all speak to each other perfectly and securely.
Yes.
MailCal just delivers a fully integrated, pre-calibrated engine.
It's the difference between buying a high-performance engine ready to drop into
your car versus
buying every single nut, bolt, piston, and carburetor separately and just hoping
they
fit together.
A much better proposition.
Now, let's talk about the project's pulse.
This isn't static software.
The source assurance is highly active with these fun-themed update names.
Yeah, like Moosember 2025, October 2025, and February 2025.
What does that steady stream of updates tell us about the quality of the product?
It tells us they're committed to both continuous improvement and, crucially, to
security.
The blog entries we review demonstrate a really immediate response culture.
For instance, the Muli update in July 2025 was a focused security patch.
So they prioritize vulnerabilities.
They prioritize them rapidly when they're discovered.
Can you walk us through a specific, recent security fix, something that shows their
attention
to detail?
Absolutely.
One critical fix they highlighted in the February 2025 update targeted potential
vulnerability
in how DoveCot was interacting with the firewall system, NetFilter.
Previously, if someone was trying to, say, brute force a password, DoveCot
sometimes
allowed multiple failed login attempts within a single session without being
properly detected.
So the firewall would miss it.
Exactly.
The attack could look like one single failed attempt when it was actually hundreds.
That loophole has now been closed, which is just foundational security work.
What about modernization?
I mean, email security standards are constantly shifting.
They're definitely keeping up.
A major step was detailed in the Mutember update 2025, the introduction of MTA STS
support.
Okay.
That sounds incredibly technical.
What's the simple translation?
It's a mechanism that forces secure delivery.
It basically tells other mail servers, do not talk to me unless you use a secure
encrypted
connection.
It prevents eavesdropping and guarantees encrypted delivery.
Which is pretty much a requirement now for professional email.
It's a standard requirement.
Yeah.
And they also mentioned ongoing work to roll out external authentication, like LDIP
and
OIDC, allowing Mailcow to integrate into larger company identity systems.
We also noticed significant infrastructural changes.
They're swapping out core parts inside the engine itself.
And that's the beauty of containerization.
They updated core dependencies like RSPAM, SOGO, MariaDB.
This constant refresh is vital for getting the latest security patches and
performance
boosts.
And the admin doesn't have to lift a finger for these massive component swaps.
Not a finger.
And it even extends to quality of life improvements.
I saw they fixed a tiny typo in an update script that was failing for some users.
That's an admin nightmare saved right there.
It is.
And a massive win for beginners.
They made enabling HTTPS redirect the default setting for new setups.
That's a great change.
That small default saves countless new administrators the headache of debugging why
their web interface
is only loading insecurely.
It shows they're anticipating user error.
Given this strong professional backing, what are the support options if you run
into a
tricky issue?
Well, there are three main layers.
First, there's comprehensive official documentation.
Second, a vibrant community, including active telegram channels.
They even have off-topic channels, which shows a healthy social side.
They do.
And third, for serious or professional users, they offer paid support options
through ServerCal,
like professional contracts or a one-time service assurance level.
So by supporting the company, you're directly investing in the development of the
open source
suite.
That's the idea.
OK, now we get to the real deep dive nuggets, the specific details that show the
level of
foresight this team has.
We noticed guidance for admins upgrading their operating system, Debian, that
addresses software
MailCow doesn't even use.
That's one of the most compelling pieces of information we found.
In their quick guide for upgrading Debian 12 to 13, they specifically warned
administrators
about a pitfall involving a competing mail server software called Exum.
Wait, MailCow uses Postfix.
Why are they warning about Exum?
Because the MailCow team knows that real-world server environments are messy.
An admin might have Exum installed for other legacy reasons, or it might have been
installed
by default.
So the MailCow team proactively warns their users about conflicts that aren't even
their
fault.
That is incredible.
They're looking at the admin's entire environment, anticipating problems external
to their own
product?
That, more than anything, demonstrates professional, comprehensive support.
That's the definition of going above and beyond.
And that attention to detail also extends to hardening their own code, right?
Right down to the cookies.
Exactly.
The changelogs show a focus on modern security best practices.
For instance, they updated the PHP session cookie to set the same site attribute to
lax.
A small but important change against certain attacks.
A very important one.
And they also standardized the name of that cookie to MCHesed and improved the
clarity
of the LDAP SSLTLS settings, making it much harder to accidentally misconfigure
secure
connections.
These small internal security fixes are what build trust in a platform that's
handling
mission-critical communication.
They are.
So if we zoom out, what have we learned about self-hosting email in the modern era?
I think we've learned that MailCal provides a simplified, actively maintained, and
fully
featured approach to running your own mail server.
By mastering the use of Docker, it successfully tames that inherent complexity of
components
like Postfix and Rspam.
It ultimately makes enterprise-grade mail management feasible for anyone with a
foundation
in server administration.
So what this all means for you, the learner, is that high-level open-source
infrastructure
doesn't have to be a nightmare to set up, provided you find the right containerized
solution.
It takes the heavy lifting off your plate.
But the journey of MailCal is one of constant focus and streamlining, and that
raises a
really fascinating final question for you to consider.
The January 2025 update notes a major decision.
Which changed the full-text search, and which kicked out Nextcloud?
That's powerful.
I mean, Nextcloud is a massive groupware suite in its own right.
Kicking it out suggests a really serious commitment to a narrow focus.
It does.
It points to this constant evaluation of the suite's core purpose, and it raises an
essential
question for any infrastructure project.
Which is?
Which features are truly essential for a focused, efficient mail server, and which
ones might
actually dilute its mission and introduce unnecessary complexity?
Where do you draw that line?
A question for you to mull over as you start your own deep dive into containerized
infrastructure.
We'd like to thank our supporter for this deep dive, SafeServer.
Find more information about hosting powerful software and support for your digital
transformation
at www.safeserver.de.
Join us next time for another deep dive into the source material that matters.
Join us next time for another deep dive into the source material that matters.