Install poste.io on a VPS

poste.io packs Postfix, Dovecot, Rspamd, ClamAV, and Roundcube webmail into one container with a web admin interface. It is the fastest route to a working mail server. This guide adds the network and memory details you need on a VPS.

1. Before you start

Port 25 must be open on your server, reverse DNS must point at your mail hostname, and your DNS records must be ready. All of that is in our guide on what running your own mail server actually takes. None of what follows works without it.

You also need Docker installed.

2. Understand the network conflict first

poste.io recommends --net=host, which means the container binds directly to the host's ports: 25, 80, 110, 143, 443, 465, 587, 993, 995, and 4190.

If your server already runs Nginx or anything else on 80 and 443, they will collide. Decide now:

• Mail server alone on this VPS: use --net=host as below. Simplest, and it keeps the real client IP visible to the spam filter.
• Existing web server on the same VPS: run poste.io on custom HTTP ports behind your proxy, covered in step 6.

3. Run it

$ docker run \
    --net=host \
    -e TZ=Europe/Prague \
    -v /opt/poste/data:/data \
    --name "mailserver" \
    -h "mail.example.com" \
    --restart=always \
    -d -t analogic/poste.io
$ docker logs -f mailserver

Replace the timezone and the hostname. The -h value is what your server calls itself in SMTP conversations, and it must match your reverse DNS exactly.

Everything persistent lives in /opt/poste/data: accounts, mail, logs. That single directory is your backup.

4. Cut the memory use

The default stack is heavy because of ClamAV. Three environment variables control it:

$ docker run ... \
    -e "DISABLE_CLAMAV=TRUE" \
    -e "DISABLE_ROUNDCUBE=TRUE" \
    ... -t analogic/poste.io

DISABLE_CLAMAV=TRUE saves the most, roughly a gigabyte. DISABLE_ROUNDCUBE=TRUE drops the webmail if your users only use phone and desktop clients. There is also DISABLE_RSPAMD=TRUE, but leave the spam filter on: it does the work that matters.

With ClamAV off, poste.io is comfortable on a 2 GB plan.

5. Finish setup in the browser

Open https://mail.example.com and complete the setup form. You create the first administrator, add your domain, and poste.io generates the DKIM key for it.

Then open the domain settings and copy the DNS records it shows you. Publish them at your DNS provider before you send anything.

6. Running alongside an existing web server

If ports 80 and 443 are taken, start poste.io with custom HTTP ports and put your proxy in front:

$ docker run ... \
    -e "HTTPS=OFF" \
    -e "HTTP_PORT=8080" \
    ... -t analogic/poste.io

Then proxy mail.example.com to http://127.0.0.1:8080 following our Nginx and Let's Encrypt guide. Note the mail ports themselves (25, 587, 993 and the rest) still need to reach the container, so drop --net=host and publish them individually with -p.

This path is more work. If mail is the only job this server does, step 2's simple option is better.

7. Spam filtering

poste.io uses Rspamd for spam scoring and ClamAV for virus scanning, both on by default. Settings live under the admin interface's system settings.

What you get out of the box:

• Score-based filtering, with thresholds that decide whether a message is tagged, quarantined, or rejected.
• Greylisting, which temporarily refuses mail from unknown senders. Legitimate servers retry, most spam software does not.
• DNS blocklist checks against the sending IP.
• Blacklists and whitelists, per domain and per mailbox.
• A regex filter for blocking messages by pattern, documented on their site under the regex spam filter page.

If you have a Spamhaus DQS subscription, poste.io supports plugging it in, which gives you commercial-grade blocklist data instead of the free public lists.

Outbound protection

The PRO version adds relay limits that cap how much a single account can send, with optional automatic blocking. The most common way a self-hosted mail server ends up on a blocklist is one compromised account sending a burst of spam before anyone notices, and a send limit stops that early. The free version does not have this.

If you disabled ClamAV

Turning off ClamAV to save memory removes virus scanning but leaves spam filtering fully intact. Rspamd does the spam work; ClamAV only scans attachments for malware. On a personal or small team server, most people accept that trade.

8. Test both directions

Send a message to an outside address, and send one from an outside address to your new server. Then check what the internet sees:

$ dig mail.example.com A +short
$ dig -x 203.0.113.10 +short
$ dig example.com MX +short
$ dig example.com TXT +short

poste.io also hosts free public checkers for DNSBL, SPF, DKIM, and DMARC on their site, which are worth running once before you trust the setup.

Quick reference

Where to go next

Publish the DNS records from the admin panel, then send a test message in each direction. If mail sends but lands in spam, check your DNS records and your IP reputation first.