Free tools Windows power users keep installed
One-click scans. No signup required.
You can run a complete iRedMail mail server on a VPS by starting with a clean supported Debian or Ubuntu installation, assigning it a stable mail hostname, confirming that your provider allows SMTP on port 25, and then completing the downloadable installer. Reliable delivery also depends on matching DNS records (A, MX, PTR, SPF, DKIM and DMARC), a narrow firewall policy and a trusted TLS certificate. This guide walks through the documented classic installer for iRedMail 1.8.8, released on 8 September 2026.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Use the procedure for a low-traffic production server with at least 4 GB of RAM. The iRedMail team recommends its Enterprise Edition for new deployments, but the downloadable installer remains the directly documented VPS path described here.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesChoose a supported VPS before installing
Use a current supported release
The 1.8.8 download matrix lists Debian 12 and 13 and Ubuntu 22.04, 24.04 and 26.04, with Ubuntu 24.04 identified as the recommended Ubuntu choice. Select a 64-bit image offered by your VPS provider and apply its normal security updates before beginning. Do not install iRedMail on a server that already runs the mail stack it is about to configure.
| Operating system | Status in the 1.8.8 installer matrix |
|---|---|
| Debian 12 | Supported |
| Debian 13 | Supported |
| Ubuntu 22.04 | Supported |
| Ubuntu 24.04 | Supported and recommended Ubuntu release |
| Ubuntu 26.04 | Supported |
Meet the resource and account prerequisites
- Plan for at least 4 GB of RAM for a low-traffic production server with spam and virus scanning enabled.
- Use a fresh system. Existing Postfix, Dovecot, database, LDAP or Amavisd installations may be overwritten or leave the host in an unsupported state.
- Confirm that UID and GID values 2000, 2001 and 2002 are unused. The installer needs these values for its service accounts.
- Confirm that TCP port 25 is reachable from the public internet. Some VPS companies block or throttle it; ask the provider before purchasing or committing to the server.
A larger mailbox population, heavy filtering or many mobile synchronization clients can require more memory than the minimum. Treat 4 GB as the documented starting point, not a capacity guarantee.
#1 Best Overall
Pick the permanent mail hostname
Choose an FQDN such as mail.example.com or mx.example.com. The same name should be used consistently in DNS, the TLS certificate and mail-client settings. You need control of the domain’s DNS zone and the VPS public IP.
Prepare the VPS and set its hostname
Start from a clean host
Log in as root or use an account with unrestricted sudo. Before running the installer, remove accidental mail-stack packages from a reused image or redeploy the VPS with a clean operating-system image. Do not preconfigure Postfix, Dovecot, a database, LDAP or Amavisd; iRedMail installs and wires these components itself.
Check the required numeric identities. Each command should produce no existing account or group before installation:
getent passwd 2000
getent passwd 2001
getent passwd 2002
getent group 2000
getent group 2001
getent group 2002If any value is already assigned, stop and resolve the conflict on a newly provisioned host rather than changing an unrelated system account.
Configure the FQDN on Debian or Ubuntu
iRedMail’s documented layout uses a short name in /etc/hostname and places the FQDN first in /etc/hosts. For a server called mx.example.com, use:
printf '%sn' mx | sudo tee /etc/hostname
sudo editor /etc/hostsEnsure the hosts file contains a line like this, with your own hostname and domain:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →127.0.0.1 mx.example.com mx localhost localhost.localdomainVerify the result:
hostname -fThe command should return mx.example.com. If it still returns the old name, reboot the VPS and run the check again before starting the installer. Also create the public A record described below; local hostname configuration and public DNS must agree.
Install the downloadable iRedMail package
Install the small set of prerequisites
Enable the official Debian or Ubuntu repositories supplied by your operating system and install the packages required to run the wizard:
sudo apt-get update
sudo apt-get install -y gzip dialogDownload the iRedMail 1.8.8 archive from the official release page on a workstation, upload it to the VPS (for example, into /root), and substitute the exact archive filename in the extraction command.
Rank #2
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
cd /root
tar zxf iRedMail-x.y.z.tar.gz
cd /root/iRedMail-x.y.z/
bash iRedMail.shThe directory name and archive version in the commands are placeholders for the filename you actually downloaded; do not leave x.y.z in a production command.
Recommended Free Tools
Answer the installer wizard deliberately
The interactive wizard asks for the location of mailboxes, the account-storage backend, the first mail domain and the administrator password. The default mailbox location shown by the wizard is /var/vmail/. Keep it unless your storage plan requires another mounted path and you have verified that the path is persistent and writable.
For the backend, choose the technology your team already knows. The guide’s reason is operational: the maintenance advantage of familiarity generally outweighs small differences between supported backends. Record the choice because it determines which administration tools and configuration files you will use later.
Choose one primary webmail interface
| Option | What it provides | Resource and management consideration |
|---|---|---|
| Roundcube | Lightweight webmail | Lower resource demand than SOGo in the documented comparison |
| SOGo | Webmail, calendar, contacts and ActiveSync | Needs substantially more memory when many ActiveSync clients are used |
| Both | Both interfaces installed | Possible, but their mail-filter rule formats are incompatible; standardize users on one filter-management interface |
Installing both does not make their filter rules interchangeable. If users create rules in both interfaces, explain which interface is authoritative before handing out accounts.
Review and launch the installation
The final wizard screen displays a summary of the selected paths, backend, domain and components. Read it carefully, then type y when prompted to begin. The installer configures the selected services automatically. Keep the terminal session available until it finishes and save the generated administrator details.
Publish DNS records that let mail flow
DNS is not a cosmetic step. Receiving systems use it to find your server, evaluate its identity and decide whether messages look legitimate. iRedMail’s DNS guidance treats A and MX as required and recommends reverse PTR, SPF, DKIM and DMARC for a deliverable setup.
| Record | Example | Purpose and qualification |
|---|---|---|
| A | mail.example.com. A 203.0.113.10 |
Maps the mail hostname to the VPS public IPv4 address. Use your real address. |
| PTR (reverse DNS) | 203.0.113.10 PTR mail.example.com. |
Set by the IP provider. A missing or mismatched reverse name can damage delivery reputation. |
| MX | example.com. 10 mail.example.com. |
Directs inbound mail for the domain to the mail hostname, which must itself have an A record. |
| SPF | example.com. TXT "v=spf1 mx -all" |
Authorizes the servers named by MX when that accurately describes every sender. |
| DKIM | dkim._domainkey.example.com. TXT ... |
Publishes the public key corresponding to the key generated by Amavisd. |
| DMARC | _dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]" |
Reports and applies a policy based on SPF and DKIM alignment. |
Set A, PTR and MX first
- Create an A record for the exact hostname used by the VPS, such as
mail.example.com, pointing to its public IP. - Ask the VPS or IP provider to set reverse DNS (PTR) for that IP to the same mail hostname. You usually cannot create this record in your ordinary domain DNS panel.
- Create the domain MX record pointing to the hostname, including the trailing dot where your DNS provider’s interface expects a fully qualified name.
Check that the forward lookup returns the VPS address and that the reverse lookup returns the same hostname. A hostname that resolves forward to one server but reverses to another is a common deliverability failure.
Publish an SPF policy that matches your senders
Add one SPF TXT record at the domain root. The example v=spf1 mx -all authorizes the servers listed in MX and rejects other senders, but only use it if all legitimate outbound mail comes from those hosts. If another service sends on behalf of the domain, its authorization must be represented in the policy; do not publish an SPF record that contradicts your actual sending path.
Generate and verify DKIM
After installation, display the public key generated for the domain:
amavisd showkeysCopy the returned value into a TXT record at dkim._domainkey.example.com (replace the domain and selector if the command reports different values). Query the published record and then ask Amavisd to test it:
dig -t txt dkim._domainkey.example.com
amavisd testkeysThe DNS query should return the same public key that the server uses. A failed test usually means the record is at the wrong name, contains a copied formatting error or has not propagated to the resolver you queried.
Start DMARC in observation mode
DMARC.org defines DMARC as “a way to make it easier for email senders and receivers to determine whether or not a given message is legitimately from the sender, and what to do if it isn’t.” Begin with a monitoring policy such as:
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"Review the aggregate reports and correct SPF or DKIM alignment problems before moving to an enforcement policy. DMARC depends heavily on correctly configured SPF and DKIM; publishing p=reject before those mechanisms align can reject legitimate mail.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Configure the firewall and provider network
Allow only the services that users and peer mail servers need. The following are the externally relevant TCP ports in the iRedMail port reference.
| Port | Service | Exposure guidance |
|---|---|---|
| 25 | SMTP server-to-server delivery | Required from the public internet for inter-server mail. Confirm that the provider neither blocks nor throttles it. |
| 587 | Authenticated message submission | Open for users and require SMTP authentication. |
| 993 | IMAPS | Open for clients that retrieve mail over encrypted IMAP. |
| 995 | POP3S | Open only if you offer encrypted POP3 retrieval. |
| 80 | HTTP | Used by webmail-related endpoints and the webroot certificate-validation procedure. |
| 443 | HTTPS | Required for secure webmail and administration endpoints. |
| 465 | Legacy SMTPS | The reference describes it as deprecated in favor of 587; do not make it your primary submission port. |
Database ports 3306 and 5432, LDAP ports 389 and 636, Amavisd ports and iRedAPD management ports are localhost-only by default. Keep them private; do not add broad internet firewall exceptions for convenience.
Apply equivalent rules in both the VPS provider’s network firewall and the operating-system firewall if both are enabled. A port shown as open locally can still be unreachable when the provider filters it upstream.
Replace the self-signed certificate with Let’s Encrypt
The installer creates a self-signed certificate, so browsers and mail clients display trust warnings. iRedMail documents Let’s Encrypt as a free replacement. The certificate name must resolve publicly to this VPS before validation can succeed.
Validate the webroot without issuing a certificate
Install Certbot and run a dry run against the mail hostname:
Rank #4
- Standard size: 6 pink server note pads, Each Book Comes with 50 bound order slips - that's 300 ticket sheets total! Check Pads Size 6.75 x 3.5 inch.
- Convenient Work: These guest check books for servers have a tear-free dotted line that is easy to rip off. You can give as a customer copy or keep for record keeping. We've provided extra rows on the back for additional note taking.Perfect For Restaurants, Lounges, Hotels, Cafes, And Waiters To Use.
- Record Important Information: These server note pads can record important information.Each ticket has a unique serial number printed at the top, dates, order details, number of guests, order amount, table numbers etc. They are lightweight, small and can fit most aprons. They can be used on-demand and can help decrease errors in orders, while improving work efficiency.
- High Quality: Sturdy, Not Drop Powder, It's Thick, You Can Write On The Back And Front Easily.Their whole page printing has clear handwriting and a reasonable layout. On the customer retention part of each guest check, "THANK YOU" on the back to make customers feel appreciated.
- Contact Us: We're confident that the quality of the server note pads will go beyond your expectation. If you experience an issue, feel free to contact us, we'll appreciate it to learn from your experience, and we'll make it better
apt install -y certbot
certbot certonly --webroot --dry-run -w /opt/www/well_known -d mail.example.comReplace mail.example.com with the exact FQDN clients will use. The dry run must complete successfully before you request the real certificate. Failure generally indicates that the A record is wrong, port 80 is blocked, or another web server is intercepting the challenge path.
Issue the certificate and link iRedMail to it
Run the same command without --dry-run after validation passes:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
certbot certonly --webroot -w /opt/www/well_known -d mail.example.comCertbot places the live files under /etc/letsencrypt/live/mail.example.com/. Back up the iRedMail-generated certificate and key, then replace their paths with links to the renewed files:
sudo cp -a /etc/ssl/certs/iRedMail.crt /etc/ssl/certs/iRedMail.crt.before-letsencrypt
sudo cp -a /etc/ssl/private/iRedMail.key /etc/ssl/private/iRedMail.key.before-letsencrypt
sudo ln -sfn /etc/letsencrypt/live/mail.example.com/fullchain.pem /etc/ssl/certs/iRedMail.crt
sudo ln -sfn /etc/letsencrypt/live/mail.example.com/privkey.pem /etc/ssl/private/iRedMail.key
sudo systemctl restart postfix dovecot nginxUse the certificate’s full chain for the public certificate path. Restarting all three services makes Postfix, Dovecot and Nginx load the new files.
Automate renewal safely
Let’s Encrypt certificates expire, so run Certbot’s renewal process regularly and refresh the links and services after a successful renewal. A renewal hook can perform the link and restart operations:
#!/bin/sh
ln -sfn /etc/letsencrypt/live/mail.example.com/fullchain.pem /etc/ssl/certs/iRedMail.crt
ln -sfn /etc/letsencrypt/live/mail.example.com/privkey.pem /etc/ssl/private/iRedMail.key
systemctl restart postfix dovecot nginxSave the hook in the Certbot renewal-hook location used by your distribution, make it executable, and test the renewal workflow with Certbot’s dry-run mode. Do not wait for an expiry warning to discover that a hook has the wrong path or permissions.
Log in and harden the new server
Read the generated deployment notes
Immediately open /root/iRedMail-x.y.z/iRedMail.tips. It contains the application URLs, generated credentials and configuration-file locations for the components selected in the wizard. Store those details in a password manager and remove unnecessary copies from shared tickets or shell history.
Use long, unique passwords for every mailbox and administrator account. The iRedMail guide identifies weak passwords as the weakest part of a mail server because attackers target compromised accounts to send spam. Require users to change any temporary password before they begin sending.
Use the correct web endpoints
| Component | Documented URL pattern |
|---|---|
| Roundcube | https://your_server/mail/ |
| SOGo | https://your_server/SOGo |
| iRedAdmin | https://your_server/iredadmin/ |
Replace your_server with the certificate hostname, not a raw IP address, so the browser and mail clients can validate the name.
Best Value
Run acceptance checks before inviting users
Perform these checks against your own deployment after DNS has propagated and the certificate is installed:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Create a test mailbox and sign in through the selected webmail endpoint.
- Configure an email client for authenticated SMTP submission on port 587. Confirm that unauthenticated attempts are not being used for user mail.
- Connect over IMAPS on port 993, or POP3S on port 995 if you intentionally enabled POP3, and verify that the client trusts the certificate hostname.
- Run
amavisd testkeysand inspect a sent message’s headers to confirm that the expected DKIM selector signs it. - Use DNS queries to confirm A, MX, SPF, DKIM and DMARC records, then verify that the public PTR points back to the same mail hostname.
- Send a test message to an external mailbox and reply to it. Check both directions, because inbound MX routing and outbound reputation can fail independently.
These are deployment checks, not guarantees of inbox placement. Recipient systems apply their own reputation, content and rate controls even when your DNS and TLS configuration is correct.
Troubleshoot the failures that stop delivery
Port 25 is unreachable
Test from an external network, not only from the VPS itself. If the service listens locally but outside hosts cannot connect, ask the provider whether outbound or inbound port 25 is blocked or throttled and check its network firewall. Do not try to substitute port 587 for server-to-server delivery; 587 is the authenticated submission port for users.
Clients still warn about the certificate
Confirm that clients connect to the exact name on the certificate, that the A record for that name points to this VPS and that the full-chain and private-key links target the same Let’s Encrypt directory. Restart Postfix, Dovecot and Nginx after replacing the links. An IP address or an alternate hostname will continue to produce a name-mismatch warning.
DKIM or DMARC checks fail
Run dig -t txt dkim._domainkey.example.com and compare the returned key with amavisd showkeys. Check the selector and domain spelling, wait for DNS propagation, and rerun amavisd testkeys. For DMARC, verify that the visible From domain aligns with the domain authenticated by SPF or DKIM before increasing enforcement beyond p=none.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallInbound mail does not arrive
Check that the MX record points to a hostname with an A record, not directly to an IP address, and that port 25 is open in both provider and host firewalls. A stale second MX record can send some messages to an old server; remove records that no longer accept mail.
The installer reports an account or package conflict
Do not force the wizard over an existing mail installation or reuse UID/GID values 2000–2002. Redeploy a clean supported image, confirm the prerequisites again and rerun the installer. This is safer than trying to untangle partially overwritten service configurations.
Decide which deployment path fits your operation
Downloadable installer versus Enterprise Edition
The iRedMail team recommends Enterprise Edition for new deployments. This article uses the classic downloadable installer because its VPS installation procedure, wizard prompts and post-install files are directly documented. If your organization is evaluating Enterprise Edition, verify its current packaging, licensing and migration process separately rather than assuming that every wizard step above is identical.
Roundcube versus SOGo
Roundcube is the lighter choice when users need straightforward webmail. SOGo is the broader collaboration choice when calendar, contacts and ActiveSync matter and the VPS has enough memory for those clients. Installing both is technically possible, but incompatible mail-filter rule formats make a single standard interface the safer operating policy.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Provider selection criteria
For this workload, compare providers on technical policy rather than headline CPU numbers: port-25 availability, reverse-PTR control, a static public IP, full DNS record access and enough RAM for scanning. A provider that refuses PTR changes or blocks SMTP can prevent a properly configured iRedMail host from delivering mail.
Quick Recap
Operational checklist
- Supported, clean Debian or Ubuntu VPS with at least 4 GB RAM for the documented low-traffic baseline.
- Unused UID/GID values 2000, 2001 and 2002.
- FQDN configured locally and published in an A record.
- Provider-confirmed port 25 access and a matching PTR record.
- MX, SPF, DKIM and DMARC records validated with DNS tools.
- Only 25, 587, 993 and/or 995, plus 80 and 443, exposed as required; internal service ports kept private.
- Let’s Encrypt certificate installed, linked to iRedMail paths and covered by a tested renewal hook.
- Strong administrator and mailbox passwords, with credentials from
iRedMail.tipsstored securely. - Test mailbox, authenticated submission, encrypted retrieval and DKIM signing verified before production use.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
