How to Self-Host Your Own Email Server With Mailcow in 2026 — Complete Setup Guide

Gmail knows what bank you use. It knows your doctor's name, your insurance provider, your salary from the job offer you accepted in 2019, and the flight you took to your mother's funeral. You didn't give Google that information — you gave it to the people who emailed you. Google read those emails anyway.

This isn't paranoia. It's the documented product. Gmail scans every message to power Smart Reply, Nudge, category tabs, and the ad targeting that follows you around the web. Microsoft does the same with Outlook. Both companies store your emails on servers in jurisdictions where governments can compel disclosure without your knowledge. Both companies have had their systems compromised in incidents affecting millions of users. Microsoft's 2023 Exchange breach, attributed to Chinese state actors, gave attackers access to email accounts for US government officials. The emails were stored on Microsoft's infrastructure. Microsoft's customers had no control over what happened next.

Running your own email server puts you back in control. Your emails live on hardware you pay for, in a jurisdiction you choose, accessible only with credentials you hold. Nobody reads them without getting through you first.

This guide sets up a complete, production-ready email server using Mailcow on a NetCup VPS — the setup we run at CoderOasis. By the end, you'll have a server handling multiple domains, a webmail interface at your own URL, mobile client setup on iOS and Android, proper spam filtering, and every email authentication standard configured to reach inboxes instead of spam folders.

Why Is Mailcow the Best Self-Hosted Email Solution?

Running a raw Postfix/Dovecot stack is a week-long job. You configure each service individually, wire them together manually, handle TLS certificates yourself, build an admin interface from scratch, and debug cryptic MTA log formats when something breaks. Most people who try it give up before they send their first email.

Mailcow solves this by packaging everything in Docker containers that work together out of the box:

• Postfix — SMTP server for sending and receiving
• Dovecot — IMAP/POP3 for client connections
• SOGo — webmail interface with calendar and contacts
• Rspamd — spam filtering with machine learning
• ClamAV — antivirus scanning of attachments
• Unbound — local DNS resolver
• Nginx — web server and reverse proxy
• acme-mailcow — automatic Let's Encrypt certificate management
  One docker compose up -d starts all of them. Updates are a single script. The admin panel at https://mail.yourdomain.com handles everything: adding domains, creating mailboxes, configuring DKIM, reading Rspamd scores, blocking senders.

Alternatives exist. iRedMail is older and requires more manual configuration. Mailu is lighter but less featureful. Postal is built for high-volume sending. For a personal or small-team mail server with a usable admin interface, Mailcow has no real competition.

What Server Do You Need to Run Mailcow?

Why Does NetCup Work Well for Self-Hosted Email?

Mailcow's official documentation lists minimum requirements: 2 vCores, 2GB RAM, 20GB disk. The practical minimums for a server you'll actually rely on daily are higher.

We recommend NetCup because they meet the requirements that specifically matter for email hosting:

Port 25 is open by default. Most consumer cloud providers (AWS EC2, DigitalOcean) block port 25 on new instances to prevent spam abuse. Getting it unblocked requires a support ticket and explanation. NetCup's VPS plans come with port 25 open. Email hosting is a listed use case in their terms of service.

Hetzner is the price/performance alternative if NetCup is sold out in your preferred region. Their CX21 (2 vCores, 4GB RAM, 40GB SSD) at €3.29/month also has port 25 available on request. File a support ticket before configuring Mailcow.

The specific NetCup plan we use: NetCup VPS RS 2000 G10s — 4 vCores, 4GB RAM, 80GB NVMe SSD, 2.5Gbps uplink. Around €4-6/month depending on contract length. It handles Mailcow for multiple domains at CoderOasis without breaking a sweat.

Avoid shared hosting for this. Email servers need consistent port access and the ability to set custom PTR records. Shared hosting doesn't give you either.

What Operating System Should You Use for Mailcow?

Debian 12 (Bookworm) is the best choice. Mailcow's team tests against it directly. It's stable, has a long support lifecycle, and Docker's official packages work cleanly on it. Ubuntu 24.04 LTS is a solid second option.

Do not use Ubuntu 22.10, 23.04, 23.10, or any non-LTS Ubuntu release. Mailcow specifically warns against these due to nftables and systemd-resolved conflicts that break container networking.

How Do You Prepare the Server Before Installing Mailcow?

How Do You Configure the Server Hostname?

Mailcow needs the server's Fully Qualified Domain Name (FQDN) set correctly before installation. The FQDN must match what you'll use for the A record pointing to this server — conventionally mail.yourdomain.com.

# Set the hostname (run as root)
hostnamectl set-hostname mail.yourdomain.com
 
# Verify
hostname -f
# Should output: mail.yourdomain.com

Which Ports Does Mailcow Require?

Mailcow uses these ports. Verify nothing else is listening on them before installation:

# Check for port conflicts
ss -tulpn | grep -E ':25|:80|:110|:143|:443|:465|:587|:993|:995|:4190'

If anything appears, stop and disable the conflicting service:

# Common conflicts
systemctl stop apache2 nginx postfix exim4 2>/dev/null
systemctl disable apache2 nginx postfix exim4 2>/dev/null

Mailcow's nginx handles ports 80 and 443. Mailcow's Postfix handles port 25. If you have an existing web server or mail server running, it will conflict.

How Do You Harden SSH Before Exposing the Server?

Before this server handles email for real addresses, lock down SSH access. Default password authentication on a public IP gets brute-forced within hours.

# Generate an SSH key on your local machine if you don't have one
ssh-keygen -t ed25519 -C "mailcow-server"
 
# Copy your public key to the server
ssh-copy-id root@your-server-ip
 
# Verify key-based login works, then disable password authentication
nano /etc/ssh/sshd_config

Change these settings in sshd_config:

PasswordAuthentication no
PermitRootLogin prohibit-password
PubkeyAuthentication yes
Port 22  # Consider changing to a non-standard port

systemctl restart sshd

Verify your key-based login works in a second terminal before closing your current session. Locking yourself out of a remote server is not a fun afternoon.

How Do You Configure DNS Records for Mailcow?

DNS is where most Mailcow installations fail. Configure all seven records correctly before installing the software. Email authentication depends on DNS, and DNS propagates slowly — get it right first.

What Is the A Record for a Mail Server?

The A record maps your mail subdomain to your server's IP address. Log into your domain registrar's DNS panel and add:

Type:  A
Name:  mail
Value: YOUR.SERVER.IP.ADDRESS
TTL:   3600

This makes mail.yourdomain.com resolve to your server. Every other record either points to this or depends on it.

What Is an MX Record and Why Does Email Need One?

The MX (Mail Exchanger) record tells other mail servers where to deliver email addressed to your domain. Without it, nobody can send you email from external servers.

Type:     MX
Name:     @ (root domain)
Priority: 10
Value:    mail.yourdomain.com
TTL:      3600

What Is an SPF Record and How Do You Set It Up?

SPF (Sender Policy Framework) is a TXT record that lists which servers are authorized to send email from your domain. Receiving servers check SPF to verify that mail claiming to be from your domain actually came from one of your listed servers.

Type:  TXT
Name:  @ (root domain)
Value: v=spf1 mx ~all
TTL:   3600

v=spf1 declares this as an SPF record. mx authorizes the server in your MX record. ~all is a soft fail — email from unlisted servers gets a warning, not an outright rejection. Use -all (hard fail) once you've verified everything is working correctly.

What Is DKIM and How Does Mailcow Configure It?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The receiving server uses your public key (published in DNS) to verify that the message actually came from your server and wasn't modified in transit.

You cannot set the DKIM TXT record before installing Mailcow, because Mailcow generates the DKIM key pair. Add a placeholder for now and come back after installation:

Type:  TXT
Name:  dkim._domainkey
Value: (add after Mailcow installation)
TTL:   3600

After installation, navigate to Configuration → Mail Setup → Domains → your domain → DKIM Keys in the Mailcow admin panel. Copy the generated value and update this DNS record.

What Is DMARC and How Do You Configure It?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) builds on SPF and DKIM. It tells receiving servers what to do when either check fails: do nothing, quarantine, or reject. It also requests reports on authentication results sent to an email address you specify.

Start with p=none to monitor without affecting delivery:

Type:  TXT
Name:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected]; fo=1
TTL:   3600

p=none means take no action on failures — just report. After 1-2 weeks of monitoring your DMARC reports and confirming SPF and DKIM are passing for all legitimate outbound email, change to p=quarantine then eventually p=reject. Moving too fast to p=reject before verifying your authentication setup breaks mail delivery from legitimate sources.

What Is a PTR Record and Why Is It Critical for Email?

The PTR record (Pointer record, or Reverse DNS) is the reverse of an A record. Where an A record maps a hostname to an IP, a PTR record maps an IP back to a hostname. For email, it maps your server's IP to mail.yourdomain.com.

Many mail servers reject email from IPs without a matching PTR record. It's the single most commonly missed DNS configuration, and missing it causes immediate rejection by ISPs.

Unlike every other DNS record, the PTR record is set at your server provider, not your domain registrar. In NetCup's Customer Control Panel (CCP):

1. Go to Server → your VPS → Network
2. Find your IPv4 address
3. Set Reverse DNS to mail.yourdomain.com
4. Repeat for your IPv6 address if enabled
   Do the same for IPv6. Many modern mail servers check IPv6 PTR records.

# Verify the PTR record after setting it (allow up to 24 hours to propagate)
dig -x YOUR.SERVER.IP.ADDRESS +short
# Should return: mail.yourdomain.com.

What Are Autodiscover and Autoconfig Records?

These CNAME records let email clients (Outlook, Thunderbird, Apple Mail) automatically configure themselves when a user adds your email address:

Type:  CNAME
Name:  autodiscover
Value: mail.yourdomain.com
TTL:   3600
 
Type:  CNAME
Name:  autoconfig
Value: mail.yourdomain.com
TTL:   3600

Not required for mail to work, but prevents users from manually entering IMAP/SMTP settings.

How Do You Install Mailcow on Your Server?

Installing Docker on Debian 12

Mailcow requires Docker Engine 24.0.0+ installed from Docker's official repository, not the version in Debian's default packages:

# Remove any old Docker packages
apt remove docker docker-engine docker.io containerd runc 2>/dev/null
 
# Install dependencies
apt update && apt install -y ca-certificates curl gnupg
 
# Add Docker's GPG key
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/debian/gpg | \
  gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg
 
# Add Docker's repository
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  tee /etc/apt/sources.list.d/docker.list > /dev/null
 
# Install Docker
apt update && apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
 
# Verify
docker --version
# Docker version 26.x.x or newer
 
docker compose version
# Docker Compose version v2.x.x

How Do You Clone and Configure Mailcow?

# Clone Mailcow into /opt/mailcow
cd /opt
git clone https://github.com/mailcow/mailcow-dockerized
cd mailcow-dockerized
 
# Generate the configuration file
./generate_config.sh

The script asks three questions:

1. Mail server hostname (FQDN): Enter mail.yourdomain.com
2. Timezone: Press Enter to use the server default, or enter your timezone (e.g., Europe/Berlin)
3. Branch: Enter 1 for master (stable)
   This generates mailcow.conf. Review it before starting:

cat mailcow.conf

Key settings to verify or adjust:

# mailcow.conf — important settings
 
MAILCOW_HOSTNAME=mail.yourdomain.com  # Should match what you entered
HTTP_PORT=80                           # Keep default unless port conflict
HTTPS_PORT=443                         # Keep default
SMTP_PORT=25                           # Keep default
SMTPS_PORT=465                         # Keep default
SUBMISSION_PORT=587                    # Keep default
 
# If you have another service on port 80/443, change these:
# HTTP_PORT=8080
# HTTPS_PORT=8443
 
# Skip ClamAV if RAM is tight (saves ~1GB RAM)
# Set SKIP_CLAMD=y to disable antivirus
SKIP_CLAMD=n

If your server has only 2GB RAM and ClamAV is pushing it, set SKIP_CLAMD=y. Rspamd will still catch most spam through heuristics and reputation checks. ClamAV specifically targets malicious attachments.

How Do You Start Mailcow for the First Time?

# Pull all Docker images (takes 5-15 minutes on first run)
docker compose pull
 
# Start Mailcow in the background
docker compose up -d
 
# Watch the startup logs — watch for the Let's Encrypt certificate request
docker compose logs -f acme-mailcow

The acme-mailcow container requests a Let's Encrypt TLS certificate for mail.yourdomain.com. This requires:

• Port 80 to be open from the internet (no firewall blocking it)
• The A record for mail.yourdomain.com to already be propagated
  If certificate provisioning fails, check:

# Check ACME logs for the specific error
docker compose logs acme-mailcow | tail -50
 
# Verify DNS is propagated
dig mail.yourdomain.com A +short
# Must return your server's IP

When Mailcow is running, all 15+ containers should show as running:

docker compose ps

Every service should show Up or Up (healthy). If any show Restarting, check their logs:

docker compose logs [service-name] --tail=100

How Do You Configure Mailcow After Installation?

How Do You Log Into the Admin Panel?

Navigate to https://mail.yourdomain.com in your browser. The default admin credentials are:

Username: admin
Password: moohoo

Change this password immediately. Go to Access → Edit administrator details → update the password to something 20+ characters.

How Do You Add Your Domain to Mailcow?

Go to Configuration → Mail Setup → Domains → Add domain.

• Domain: yourdomain.com (without the mail subdomain)
• Description: anything recognizable
• Quota: default is 10GB per domain
• Mailbox quota: default is 3GB per mailbox — adjust to match your disk space
  Click Add. Mailcow generates a DKIM key pair for the domain automatically.

How Do You Get the DKIM Key to Add to DNS?

After adding the domain, click the DNS button next to it. Mailcow shows a complete list of required DNS records with green/red indicators showing which are currently configured correctly.

The DKIM record looks like:

Name:  dkim._domainkey.yourdomain.com
Type:  TXT
Value: v=DKIM1; k=rsa; t=s; s=email; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

Copy the entire p=... value and add it to your DNS. Some DNS providers have a 255-character TXT string limit. DKIM keys exceed this. Most providers handle this automatically by splitting into multiple strings. If yours doesn't, split the p= value yourself into two quoted strings:

"v=DKIM1; k=rsa; t=s; s=email; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ..." "8AMIIBCgKCAQEA..."

After adding the DKIM record, wait for DNS propagation (anywhere from 5 minutes to 24 hours), then verify the green checkmarks in Mailcow's DNS panel.

How Do You Create a Mailbox?

Configuration → Mail Setup → Mailboxes → Add mailbox.

• Username: the part before the @ (e.g., traven for [email protected])
• Domain: select from dropdown
• Full name: display name in email clients
• Password: use a password manager to generate 20+ characters
• Quota: 0 uses the domain default
  Click Add. Your mailbox is ready.

How Do You Test Email Deliverability?

Before using this for real communication, verify your configuration actually reaches inboxes.

How Do You Use mail-tester.com?

Navigate to mail-tester.com. It gives you a unique email address. Send a real email to it from your new mailbox (through SOGo webmail at https://mail.yourdomain.com/SOGo/). Wait 30 seconds, click Check your score.

Target: 9/10 or higher. A perfect 10 means every authentication layer is correct and your IP has no reputation problems.

Common reasons for losing points:

• SPF fails: Check your SPF TXT record is set correctly
• DKIM fails: Verify the DKIM TXT record matches what Mailcow shows exactly
• PTR mismatch: Verify your reverse DNS at NetCup points to mail.yourdomain.com
• Blacklisted IP: New VPS IPs occasionally appear on blocklists from previous tenants

How Do You Check if Your IP Is Blacklisted?

# Check MXToolbox for common blacklists
curl -s "https://mxtoolbox.com/SuperTool.aspx?action=blacklist&run=toolpage&input=YOUR.SERVER.IP"
 
# Or use the command line check
dig +short YOUR.REVERSED.IP.in-addr.arpa.zen.spamhaus.org
# No answer = not blacklisted
# 127.0.0.2 = listed on Spamhaus ZEN

If your IP is blacklisted, check the specific blocklist's removal process. Most accept removal requests with a brief explanation. Spamhaus's removal form at https://www.spamhaus.org/lookup/ is the most common.

How Do You Verify All Authentication Records Are Working?

# Check all DNS records from your server
dig yourdomain.com MX +short
dig yourdomain.com TXT +short | grep spf
dig dkim._domainkey.yourdomain.com TXT +short
dig _dmarc.yourdomain.com TXT +short
dig -x YOUR.SERVER.IP +short  # PTR check
 
# Send an authentication check email (runs SPF, DKIM, DMARC checks and replies with results)
# From your new mailbox, send any email to:
# [email protected]
# You'll receive a full report within minutes

The Port25 verifier reply confirms every authentication layer independently. You want to see SPF check: pass, DKIM check: pass, and SpamAssassin check: ham.

How Do You Connect Email Clients to Your Mailcow Server?

What Are the Connection Settings for Mailcow?

These settings work for any email client — Thunderbird, Apple Mail, Outlook, Spark, Fastmail-compatible clients:

How Do You Set Up Mailcow on iPhone (iOS)?

1. Settings → Mail → Accounts → Add Account → Other → Add Mail Account
2. Enter your name, email address, and password
3. iOS will attempt autodiscover — if you added the autodiscover CNAME record, it auto-fills settings
4. If auto-configure fails: tap IMAP, enter the settings from the table above manually
5. Enable Mail and Contacts, tap Save

How Do You Set Up Mailcow on Android?

1. Open your email app (Gmail app works with IMAP, or use FairEmail for a privacy-respecting option)
2. Add account → Other
3. Enter your email address → Manual setup → IMAP
4. Incoming: mail.yourdomain.com, port 993, SSL/TLS
5. Outgoing: mail.yourdomain.com, port 587, STARTTLS
6. Enter your mailbox password for both
   FairEmail is worth highlighting specifically. It's open source, has no trackers, doesn't sync your contacts to a third-party server, and costs a one-time €1 for the full version. It's the email client that matches the privacy philosophy of running your own server.

How Do You Access Mailcow Webmail?

Navigate to https://mail.yourdomain.com/SOGo/. Log in with your full email address and password. SOGo provides a full web-based email, calendar, and contacts interface — comparable to Gmail's web UI but running on your server.

How Do You Secure and Maintain a Mailcow Server?

How Do You Enable Automatic Updates?

Mailcow provides an update script that handles pulling new Docker images, applying migrations, and restarting services:

cd /opt/mailcow-dockerized
./update.sh

Automate this with a cron job. Run it weekly during off-peak hours:

crontab -e
 
# Add this line — runs every Sunday at 3AM, logs to /var/log/mailcow-update.log
0 3 * * 0 cd /opt/mailcow-dockerized && ./update.sh --force >> /var/log/mailcow-update.log 2>&1

Keep the OS updated separately:

# Automatic unattended security upgrades
dpkg-reconfigure -plow unattended-upgrades

How Do You Back Up Mailcow?

Mailcow's data lives in Docker volumes under /var/lib/docker/volumes/. The email store, configuration, and database are all there.

#!/bin/bash
# /usr/local/bin/mailcow-backup.sh
# Run nightly — backs up all Mailcow volumes to /backups/mailcow
 
DATE=$(date +%Y%m%d_%H%M)
BACKUP_DIR=/backups/mailcow
MAILCOW_DIR=/opt/mailcow-dockerized
 
mkdir -p $BACKUP_DIR
 
# Stop Mailcow for a consistent backup (brief downtime)
cd $MAILCOW_DIR
docker compose down
 
# Backup all named volumes
for volume in $(docker volume ls -q | grep mailcow); do
  docker run --rm \
    -v $volume:/data:ro \
    -v $BACKUP_DIR:/backup \
    alpine tar czf /backup/${volume}_${DATE}.tar.gz /data
done
 
# Backup mailcow.conf
cp $MAILCOW_DIR/mailcow.conf $BACKUP_DIR/mailcow.conf_${DATE}
 
# Restart Mailcow
docker compose up -d
 
# Remove backups older than 14 days
find $BACKUP_DIR -name "*.tar.gz" -mtime +14 -delete
 
echo "Backup complete: $DATE"

chmod +x /usr/local/bin/mailcow-backup.sh
# Run nightly at 2AM
echo "0 2 * * * /usr/local/bin/mailcow-backup.sh >> /var/log/mailcow-backup.log 2>&1" | crontab -

An alternative: Mailcow has a built-in helper at helper-scripts/backup_and_restore.sh that handles backup and restoration of individual components with less downtime.

How Do You Harden Mailcow Against Brute Force Attacks?

Mailcow includes Fail2Ban integration by default. It watches authentication logs and blocks IPs after failed login attempts. Verify it's running:

docker compose ps fail2ban-mailcow
# Should show: Up

Configure the ban duration in data/conf/fail2ban/jail.local:

[DEFAULT]
bantime = 86400   # 24 hours
findtime = 600    # 10 minute window
maxretry = 5      # 5 failures triggers ban

Restart the Fail2Ban container after changes:

docker compose restart fail2ban-mailcow

For SSH brute force (separate from Mailcow), install fail2ban at the OS level:

apt install fail2ban
systemctl enable fail2ban --now

How Do You Monitor Mailcow's Health?

# Check all containers are running
docker compose -f /opt/mailcow-dockerized/docker-compose.yml ps
 
# Check for queued mail (should be empty during normal operation)
docker compose exec postfix-mailcow postqueue -p
 
# Flush stuck queue
docker compose exec postfix-mailcow postqueue -f
 
# Check Rspamd's spam filter statistics
docker compose exec rspamd-mailcow rspamc stat
 
# View live SMTP log
docker compose logs -f postfix-mailcow
 
# Check recent delivery status (sent, deferred, bounced)
docker compose logs postfix-mailcow | grep "status=" | tail -50

A healthy server has an empty or near-empty mail queue. Mail that's been deferred means the receiving server temporarily rejected it — Postfix retries automatically. Bounced mail (permanent failure) means the destination address doesn't exist or their server permanently rejected it.

How Do You Advance Your DMARC Policy to Reject?

After running with p=none for two weeks and reviewing your DMARC reports, advance the policy in stages:

# Week 1-2: p=none (monitoring only)
"v=DMARC1; p=none; rua=mailto:[email protected]; fo=1"
 
# Week 3-4: p=quarantine (failed auth goes to spam)
"v=DMARC1; p=quarantine; rua=mailto:[email protected]; fo=1; pct=25"
# pct=25 applies the policy to only 25% of failing messages initially
 
# Week 5+: p=reject (failed auth is rejected outright)
"v=DMARC1; p=reject; rua=mailto:[email protected]; fo=1"

The pct parameter is a safety valve during the quarantine phase. Setting it to 25 means only a quarter of SPF/DKIM failures get quarantined. If something breaks and you're still sending legitimate mail that fails authentication, only 25% of it gets flagged while you diagnose the problem. Scale it up to 100 over a week once you're confident.

A DMARC policy of p=reject means any email claiming to be from your domain that fails authentication gets rejected at the receiving server. Nobody can spoof your domain and have the email delivered.

What About IP Warmup — Why Does It Matter?

A new server IP address has no email sending reputation. Major providers — Gmail, Outlook, Yahoo — judge incoming mail partly by the IP's history. An IP that suddenly starts sending hundreds of emails a day from a standing start looks like a spam operation.

The warmup process builds reputation gradually:

Week 1: Send 20-50 emails per day. Real conversations with real recipients. Focus on getting replies, because replies are the strongest positive reputation signal.

Week 2: Scale to 100-200 per day.

Week 3-4: 500 per day.

Month 2+: Scale to your actual sending needs.

This matters most if you're using this server for any bulk sending — newsletters, notifications, announcements. For personal email (a few dozen messages a day), you'll naturally stay within safe limits and reputation builds passively.

Frequently Asked Questions About Self-Hosted Email With Mailcow

Is self-hosted email harder to maintain than Gmail?
After initial setup (1-3 hours), monthly maintenance is 30-60 minutes: running ./update.sh weekly, checking that certificates renewed, skimming mail logs for delivery problems. It's more work than zero, but not much more.

Can I migrate my Gmail history to Mailcow?
Yes. imapsync copies all email between IMAP servers. Google Takeout exports your Gmail in Mbox format, which imapsync or Thunderbird's ImportExportTools can import into your IMAP server. The complete migration guide is longer than this article allows, but it's a solved problem.

Will my self-hosted email get blocked by Gmail?
Not if properly configured. The combination of SPF, DKIM, DMARC, and a clean PTR record is what Gmail checks. A mail-tester.com score of 9/10 means you're delivering correctly. If Gmail specifically gives you trouble, their Postmaster Tools at postmaster.google.com show your domain and IP reputation directly.

What happens if my VPS goes down?
Email from external servers gets deferred and retried for 5 days by default. If your server is back up within that window, you receive everything. For high-availability setups, you can configure a backup MX record pointing to a second server. For personal email, the 5-day retry window covers most outages.

Can I add multiple domains to Mailcow?
Yes. Mailcow supports unlimited domains. Each domain gets its own DKIM key, mailboxes, aliases, and spam filtering settings. Add more domains through Configuration → Mail Setup → Domains at any time.

For the full self-hosted stack that this server fits into, the self-hosted productivity guide covers Nextcloud for file sync, Vaultwarden for passwords, Immich for photos, and Jellyfin for media — all running alongside Mailcow on the same or similar infrastructure. The Docker overview covers the container fundamentals Mailcow runs on. The cybersecurity overview covers the threat model you're managing when you expose services to the internet.