Mailcow security: what is built in and what the operator must still do

November 2026 • Security

Mailcow security is a shared job. The software bundles the components that protect a mail server, such as Postfix, Dovecot, Rspamd, ClamAV and automatic banning of repeated failed logins. It cannot decide who may reach your server, whether you keep it updated, or whether you can restore it after a failure. Those tasks belong to the person who operates the server.

This page lists what Mailcow does by itself, the vulnerabilities that were published for it, and a checklist in seven parts: network exposure, authentication, spam and virus filtering, transport security, updates, backup and monitoring. It is useful for anyone who runs a self hosted mail server, and for anyone who wants to know what a hosted Mailcow service has to do for them.

What Mailcow includes

The Mailcow documentation describes a suite where each service runs in its own container on a bridged network. Postfix handles mail transfer. Dovecot serves IMAP and POP3. SOGo provides webmail with CalDAV and CardDAV. Rspamd filters spam. ClamAV is an optional antivirus. Olefy analyses Office documents. A Postfix helper called TLS-Pol resolves MTA-STS and DANE policies, and Unbound does DNS lookups with DNSSEC checks. An ACME client obtains Let's Encrypt certificates. Netfilter, which works like Fail2ban, bans abusive addresses, and a Watchdog service checks the other containers.

Sources: Mailcow documentation pages listed at the end, read November 2026.

Published Mailcow advisories and CVEs

The Mailcow repository publishes security advisories on GitHub. Its security policy asks reporters to send vulnerabilities by email to the maintainers. After a report, the team confirms the problem, identifies the affected versions, looks for similar issues and prepares fixes for the releases that are still maintained. The table lists advisories that we opened and read. It is a selection, not a full list.

Sources: GitHub security advisories for CVE-2024-56529, CVE-2025-25198, CVE-2025-53909, CVE-2026-40871 and CVE-2026-40872; CIRCL CVE records for CVE-2022-31138; GCVE mirror of the NVD record for CVE-2024-24760. Severity scores are those of the publisher, not our rating.

The GitHub list also shows other advisories published on 16 April 2026, including a low-severity cross-site scripting issue on the login page, a high-severity stored script issue in quarantine attachment names, and a missing authorisation check on deleting forwarding hosts. The list page showed no CVE number for them. For the whole set, check the Mailcow security page directly.

Two points follow from this list. First, several issues were reachable only with an account, for example an administrator or an API key, so access control and API restrictions matter. Second, every fix was shipped as a Mailcow release. A server that is not updated keeps the weakness.

Mailcow security checklist for the operator

1. Network exposure

• Know the ports. Mailcow lists incoming TCP ports 25, 465, 587, 143, 993, 110, 995, 4190, 80 and 443. If you do not offer POP3, you can restrict it at the firewall.
• Operator: if you use ufw or firewalld, add rules to the DOCKER-USER chain. The documentation states that INPUT rules do not restrict Mailcow, because Docker publishes the ports.
• Operator: do not publish database or internal service ports. CVE-2024-24760 showed that same-subnet hosts could reach container ports, so keep the server on a network you trust and keep it updated.
• Operator: if a reverse proxy sits in front of Mailcow, add its address to TRUSTED_PROXIES. Otherwise failed ActiveSync and CalDAV logins are attributed to the proxy, which can be banned.
• Operator: limit API access. Each API key has an allow list of addresses in CIDR form. The option to skip the address check is meant for APIs that are not reachable from the internet.

2. Authentication

• Mailcow supports TOTP, WebAuthn (FIDO security keys) and Yubico OTP. WebAuthn needs HTTPS. Forced enrolment and forced password changes can be enabled for administrators, domain administrators and mailbox users.
• After 10 wrong second-factor codes the second factor locks for 15 minutes. Each wrong code also counts as a failed login for Netfilter.
• Mailbox users with two-factor login must create app passwords for external mail clients, because the normal password is refused there.
• Operator: turn on forced two-factor enrolment for administrators first. Use one API key per application so that each can be disabled alone, and prefer read-only keys where writing is not needed.
• Operator: review administrators and domain administrators regularly.

3. Spam and virus filtering

Mailcow Rspamd is the spam filter. The web interface offers spam score management, per-domain and per-user allow and block lists, and a quarantine. Check the Mailcow and Rspamd documentation for the outgoing connections your server needs. Community advice in the Mailcow forum is to tune scores gradually and to train the Bayes filter by moving missed spam into the junk folder. This is community advice, not an official default.

• ClamAV is optional. The documentation says its default signature databases have limited detection and describes extra databases. With additional databases ClamAV uses about 1.3 GB of RAM. A low-memory setting turns it off, which also turns off antivirus scanning.
• Operator: decide whether to run ClamAV, size the server for it, and watch for false positives after adding databases.
• Operator: review the quarantine and the Rspamd settings after each major update, because updates can replace some changed files.

4. Transport security and DNS

• Certificates come from the ACME client (Let's Encrypt). The DNS name of the server and a valid certificate are needed before MTA-STS.
• MTA-STS in the web interface needs release 2025-09 or newer. It has three modes: none, testing and enforce. The id in the DNS record must change whenever the policy changes. Mailcow generates a new id when you save changes. The documentation advises monitoring the mail logs after you enable it, and switching back to testing if legitimate mail is blocked.
• The documentation says MTA-STS is most useful for domains that cannot use DANE.
• DKIM keys are generated in the interface. The documentation does not list the key sizes on the pages we read. RFC 6376 requires at least 1024-bit RSA keys, and Google recommends 2048 bits where the provider supports it. A Mailcow forum thread warns that deleting a key before the new one is in use leaves outgoing mail unsigned for a while.
• Operator: publish SPF, DKIM, DMARC and a matching PTR record for the server's address. See our guide to SPF, DKIM and DMARC.

5. Updates

• The stable branch is the default and is released at least once a month. Releases are numbered by year and month, for example 2026-03b. The nightly branch is for testing only. The legacy branch, based on 2025-02, stopped receiving security updates in February 2026.
• update.sh checks for changes and asks before a major update, with a link to release notes that list breaking changes.
• Operator: back up first, read the release notes, run update.sh, then check the mail flow. Rolling back works only together with a database backup.
• Operator: do not use the unattended force option on a production server. The documentation calls it unsupported.

6. Backup

• The helper script backs up the components vmail, crypt, redis, rspamd, postfix and mysql, or all of them. It can run from cron and delete old backups after a number of days.
• The crypt component is part of the backup, so restore tests should include it.
• Operator: keep copies off the server, and restore into a test system from time to time. The documentation suggests snapshots on the backup target for consistency, and warns against copying to a Samba share because file permissions break.
• A Mailcow partner also lists regular restore tests and snapshots before updates as part of the maintenance work.

7. Monitoring

• Netfilter bans networks after repeated failed logins to the web interface, ActiveSync, CalDAV and CardDAV, IMAP, POP3, SMTP authentication, Sieve and SOGo. Defaults use single addresses (/32 and /128). Bans of repeat offenders can grow in length. Private addresses and loopback are never banned.
• API requests are logged in the interface under System, Information, Logs, API.
• The DNS check button in the interface shows record problems, including the MTA-STS id.
• Operator: read the logs, watch disk space and mail queues, and use an external monitor for the web interface and the mail ports. Subscribe to the GitHub advisories of the repository.

How this applies to our email add-on

Our Managed Web Server does not include email. Email is a separate add-on that runs on a separate Mailcow server in Vilnius, Lithuania. Mail is separate from the web server, so web traffic and code errors on a site do not interrupt mail. Outbound mail is rate-limited and sent through relays. Mail domains are managed from the panel. Webmail comes from the Mailcow server, not from the PFHW panel.

Where PFHW fits, and where it does not

The add-on suits customers who want mail on infrastructure that is separate from their websites. In the checklist above, the operator is whoever runs the Mailcow server: for a server you install yourself, that is you. If you use any hosted Mailcow service, ask the provider which of the seven parts it covers.

• Gap: webmail is the Mailcow server's, not part of the PFHW panel.
• Gap: there are no mailing lists. The importer reports cPanel mailing lists as not imported.
• Gap: autoresponders, email filters and spam-filter settings are not in the PFHW portal and are not imported. Whatever Mailcow offers is on the mail server's own pages.

Frequently asked questions

Is Mailcow secure by default?

Mailcow ships with spam and virus filtering, automatic banning and two-factor login support. Several settings still depend on you, such as firewall rules, forced two-factor enrolment, API key restrictions, updates and backups. A server that is not updated keeps known weaknesses.

How do I update Mailcow?

Run the update.sh script in the installation directory. It checks for changes and asks before a major update. Back up first, because rolling back works only together with a database backup. The stable branch is the one for production.

Does Mailcow have two-factor authentication?

Yes. The web interface supports TOTP, WebAuthn and Yubico OTP. Mail clients cannot use a second factor, so users with two-factor login create app passwords for them.

What does Mailcow Rspamd do?

Rspamd is the spam filter. It scores incoming mail and works with allow and block lists, a quarantine and a spam score setting.

Should I run a self hosted mail server?

Only if you can keep it updated, monitor it and restore it from a backup. Without that, a hosted mailbox or a hosted Mailcow service may be a better fit. Mail also needs correct DNS records and a good sending address.

Where do I report a Mailcow vulnerability?

The repository's security policy asks reporters to email the maintainers at the address shown in the policy. Vulnerabilities in third-party components go to those projects.

Related resources

• Exchange alternative: Mailcow vs Exchange vs SmarterMail
• Business email: SPF, DKIM and DMARC explained
• Why web and mail servers should be separate
• Control panel hardening checklist

Sources

• mailcow documentation, overview and components
• mailcow documentation, system requirements, ports and firewall notes
• mailcow documentation, DNS records
• mailcow documentation, updates
• mailcow documentation, two-factor authentication
• mailcow documentation, Netfilter
• mailcow documentation, API access
• mailcow documentation, backup
• mailcow documentation, MTA-STS
• mailcow documentation, ClamAV databases
• mailcow community forum, spam settings
• mailcow community forum, changing a DKIM key pair
• mailcow-dockerized security policy and advisories, GitHub
• GitHub advisory GHSA-f9xf-vc72-rcgm (CVE-2026-40872)
• GitHub advisory GHSA-r8fq-wrfm-cj2q (CVE-2026-40871)
• GitHub advisory GHSA-8p7g-6cjj-wr9m (CVE-2025-53909)
• GitHub advisory GHSA-3mvx-qw4r-fcqf (CVE-2025-25198)
• GitHub advisory GHSA-23c8-4wwr-g3c6 (CVE-2024-56529)
• GCVE database, NVD record for CVE-2024-24760
• CIRCL CVE database, CVE-2022-31138
• Datazone, Mailcow for small and mid-size businesses
• RFC 6376, DKIM signatures, IETF
• Google, Email sender guidelines

Request a demo