Minimal Postfix and Dovecot for One Domain

A personal or project domain can host one inbox without a full mail suite. Postfix receives SMTP. Dovecot stores Maildir and serves IMAP. You get a mailbox you control on a Lucknow VPS. You do not get a spam appliance, a webmail UI, calendar, or any promise that Gmail will accept what you send. This is not Mailcow. If you want the suite, that is a different install and a different operations load.

What this box will and will not do

Will:

• Receive mail for user@example.com when MX points here.
• Let you read it over IMAPS with a mail client.
• Submit outbound through a smarthost so cron and replies can leave the building.

Will not:

• Catch spam or phishing at suite quality. Without a filter, junk lands in INBOX.
• Survive a disk loss without backups you set up.
• Warm a new IP for outbound. Direct send from this VPS still hits every problem in the rest of this series.
• Host dozens of virtual domains, aliases, and per-user quotas without extra maps.

If those limits are unacceptable, do not start here.

DNS and TLS first

MX, A, PTR, SPF, DKIM, and DMARC still apply. For inbound-only reputation they matter less than for sending, but receivers of your replies will check them. Issue a Let's Encrypt certificate for mail.example.com. Open 25 (inbound SMTP), 587 (submission), and 993 (IMAPS) on the host firewall. Do not open 143 or 110. L3/L4 DDoS filtering on the VPS will not stop SMTP dictionary attacks; fail2ban or dovecot's own auth-fail limits belong in the first hour, not later.

Postfix: one domain, local users, LMTP to Dovecot

Use system users or a tiny virtual mailbox map. System users are enough for one or two people.

# /etc/postfix/main.cf excerpts
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
inet_interfaces = all
mydestination = $mydomain, $myhostname, localhost.$mydomain, localhost
virtual_transport = lmtp:unix:private/dovecot-lmtp
mailbox_transport = lmtp:unix:private/dovecot-lmtp
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
relayhost = [smtp.postmarkapp.com]:587

relayhost is the outbound honesty. Submission on 587 should require SASL and TLS. Port 25 accepts from the world only for mydestination recipients (reject_unauth_destination). An open relay on a Lucknow IP will be blocklisted within hours.

Dovecot: Maildir and IMAPS

# /etc/dovecot/conf.d/10-mail.conf
mail_location = maildir:~/Maildir
# /etc/dovecot/conf.d/10-ssl.conf
ssl = required
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pem
# protocols
protocols = imap lmtp

Enable the LMTP unix listener and the Postfix sasl auth socket under /var/spool/postfix/private so the two daemons can talk without exposing extra TCP. Create the user, log in once from the client, and send a test from an outside account. If it never arrives, check MX, then mail.log, then whether the sender's side bounced on your greylist or TLS policy.

Limitations you should budget for

No Rspamd means phishing mail looks like a colleague. You can add rspamd later; you cannot skip backups of ~/Maildir. High-Speed SSD on Intel Xeon Platinum is plenty for a personal mailbox; it does not replace snapshots you copy off-box. Calendar, contacts, and ActiveSync are out of scope. Multiple domains want virtual mailboxes, not extra Linux accounts.

Inbound 25 will be probed continuously. Disable unused SASL mechanisms, require TLS for auth, and watch logs. Netbay does not run this stack for you. You own updates, certificate renewal, and the day the disk fills with junk.

Outbound replies go through the smarthost in main.cf. Do not congratulate yourself on a working IMAP login and then send direct from the same IP to a thousand users. Receiving mail and being trusted to send mail are different reputations.

Back up ~/Maildir (or /var/vmail) the same way you back up a database: encrypted, off-box, with a restore drill. A High-Speed SSD in Lucknow DC01 is fast; it is still one disk. Certificate renewal must be unattended (certbot with a postfix + dovecot reload hook) or IMAPS dies at 90 days and clients refuse to connect. Budget an hour a month for logs, queue size, and disk. That hour is the real cost of a "simple" inbox.

Takeaway

Postfix plus Dovecot is a small, understandable inbox for one domain, with sharp limits on spam, scale, and outbound trust. You can spin up an Ubuntu 24.04 instance on Netbay in under 60 seconds, point MX at the static Lucknow IP, and keep outbound on an ESP — netbayhosts.in.