01 Hostname und Reverse-DNS zuerst festlegen
Do this before installing anything. The PTR must resolve to the hostname the server announces, and that hostname must have a forward record pointing back to the same address.
hostnamectl set-hostname mail.example.com
# then set the PTR to mail.example.com in the OnionVPS panel02 Den Stack installieren
Mailcow gives you a complete Docker-based stack. Stalwart is a single Rust binary if you prefer fewer moving parts.
git clone https://github.com/mailcow/mailcow-dockerized /opt/mailcow
cd /opt/mailcow && ./generate_config.sh
docker compose up -d03 SPF, DKIM und DMARC veröffentlichen
All three are DNS records. DKIM keys are generated by the mail stack; copy the public key from its admin interface.
example.com. TXT "v=spf1 mx -all"
dkim._domainkey TXT "v=DKIM1; k=rsa; p=MIGfMA0..."
_dmarc TXT "v=DMARC1; p=none; rua=mailto:[email protected]"04 Die Adresse aufwärmen
A few dozen messages a day for the first week, then roughly double weekly. A volume spike from a new IP is indistinguishable from a compromised host, and receivers treat it accordingly.
05 DMARC verschärfen, sobald die Berichte sauber sind
Read aggregate reports for a fortnight at p=none, fix whatever is failing, then move to p=quarantine and eventually p=reject. Going straight to reject reliably breaks systems you forgot were sending mail.