Connecting your own mail server: mailcow

With a mailcow installation the mailboxes stay on your own server and Conbool sits in front of it as a gateway. Conbool accepts incoming messages, checks them and delivers to mailcow. Outbound, Conbool accepts the messages from mailcow, applies signature, disclaimer or encryption and delivers on.

In mailcow two settings are essential for this: the domain must not be a relay domain, and the outbound path runs through a sender-dependent transport. The general connection of a self-operated server is described in connecting your own mail server.

DNS

• MX of the domain to mail.conbool.com.
• SPF extended by include:mail.conbool.com. The address of your own server stays in the record.
• DKIM: Conbool provides the selector conbool1, the portal shows the value. Your own mailcow selector can stay, a second signature does no harm.

Partner and on-premises installations deliver from their own instance and show different values in the portal accordingly.

The domain must not be a relay domain

Menu path: Mail, Configuration, Domains, Edit on the domain. Under Relay options, Relay this domain stays switched off, as do the two sub-options Relay all recipients and Relay non-existing mailboxes only.

If the box is ticked, mailcow no longer delivers the domain into the local mailboxes but looks up the MX and sends the message back to the gateway. The gateway delivers it to mailcow again, and the message circles between both sides until one of them breaks off with too many hops. This is by far the most common mistake in this setup.

In addition, every address of the domain has to exist as a real mailbox, found under Mail, Configuration, Mailboxes.

Setting up the outbound path

Two steps, both are needed.

Step 1, create the transport. System, Configuration, Routing, Sender-dependent transport maps, add an entry there.

• Host: [mail.conbool.com]:25
• Username and password stay empty, authorisation runs through the address of your own server
• Switch Active on

Port 25 is correct, the transport requests STARTTLS itself. TLS-wrapped ports such as 465 are not provided for. The square brackets suppress the MX lookup for the target host.

Step 2, assign the transport. Back to Mail, Configuration, Domains, edit the domain, choose the new entry in the Sender-dependent transport maps field and save. Without this step the entry under routing remains a mere definition and does not take effect.

The selection field only appears for accounts with the Set relayhost for a domain permission. If the right is missing, the field stays hidden. Then either add the right or let an account with full administrator rights do the assignment.

Transport maps are the wrong place

The Transport maps section under routing does not fit this connection. It maps by the target of a message, not by the sender. An entry with the target * therefore also routes the mail of all further domains hosted on the same mailcow through the gateway and can additionally undermine local delivery. For connecting a single domain, only the sender-dependent transport is correct.

Relaying hosts

Under System, Configuration, Routing sits the Relaying hosts section. An entry for mail.conbool.com makes sure that mail delivered by the gateway does not additionally run through the local spam filter. Recommended, but not mandatory.

Verify the setup

• A test message from outside to an address of the domain. It arrives in the mailbox and arrives exactly once.
• A test message from the mailbox to the outside. It appears in the portal in message tracing as outbound and carries the Conbool DKIM signature.

What does not run through the gateway

Messages between two mailboxes of the same domain are delivered by mailcow directly. They never reach the gateway and therefore do not appear in message tracing. Anyone who wants to capture this traffic too connects it through journaling into the archive, described in the archive setup.

Continue with inbound protection under MailGuard and with archiving under Archive.