Prerequisites
What you need before you start the mail server.
A mail server is judged by other mail servers from the first message. Get these four things right before you install anything.
Checklist
- A registered domain name.
- A server with a static public IP address.
- An SSL/TLS certificate for the server's hostname. Do not use a self-signed certificate.
- Reverse DNS (a PTR record) for the server's IP address that matches the server's hostname.
Reverse DNS is the most important step
Many providers reject mail from an IP address that has no PTR record, or whose PTR record does not match the name the server announces. Ask your hosting provider to set it up.
Ports
| Port | Used for |
|---|---|
| 25 | Receiving mail from other servers. Also used when your server delivers mail directly to another server. |
| 587 | Mail clients and apps submit mail to your server (SMTP with authentication). |
| 465 | Allow it in the firewall if you plan to use implicit-TLS submission. |
These ports are used inside your network and normally stay closed to the internet. See Security.
| Port | Used for |
|---|---|
| 2525 | The bounce SMTP server. Only needed behind a forwarder, because bounces for your bounce domain already arrive on port 25. |
| 8025 | The bounce HTTP server. KumoMTA posts delivery events here. |
| 8080 | The JSON send API. Your own apps call it. |
Allow ports 25 and 587 in your firewall. Some cloud providers block outbound port 25 by default, so ask them to lift the block if direct delivery fails.
Hostnames
The server uses two hostnames, set in server/.env:
| Variable | Example | Purpose |
|---|---|---|
INCOMING_MAIL_HOST | mx.example.com | The name in your domain's MX record. Receives mail on port 25. |
OUTGOING_MAIL_HOST | mail.example.com | The name clients connect to for sending, on port 587. |
Incoming and outgoing are separate servers in separate files, so you can run several of each (for example mx.example.com and mx2.example.com for receiving, and smtp.example.com or mail.example.com for sending). Keeping them apart avoids one large file that handles both.
Create an A record for each hostname that points to your server's IP address, and make sure the hostname matches your TLS certificate.