Modoboa

Last reviewed Sep 13, 2026 · 894 words

Modoboa is the friendliest way to end up running Postfix and Dovecot, and the friendliness stops at the panel. What it adds is a Django web application with a genuinely good admin interface, a webmail client, calendar and contacts, Rspamd or Amavis for spam, automatic DKIM signing, and a DNS check page that tells you which of SPF, DKIM, DMARC and reverse DNS you got wrong. What it does not change is that you are still operating a mail server in 2026, with everything that implies about IP reputation, port 25 being blocked on residential connections, and Gmail's willingness to bin your messages for reasons it will not explain. Read the honest case on self-hosted email first; if you are still here, Modoboa is a good way to do it.

The installer is the product, and it is opinionated

Unlike the container-first mail stacks, Modoboa's recommended path is modoboa-installer, a Python script you run as root on a fresh Debian or Ubuntu server. It installs and configures PostgreSQL or MariaDB, Postfix, Dovecot, Rspamd, nginx, uwsgi, Let's Encrypt through certbot, and the Modoboa application, wiring them together with its own templates. On a clean VPS with correct DNS already in place it takes about 15 minutes and works. The listed "installer can be finicky" is earned in the other cases: a server that already has a web server on port 80, a distribution version it has not caught up to, or DNS that is not ready when certbot runs, and you get a half-configured box. The rule is fresh OS, DNS records created and propagated before you start, and the installer.cfg file read from top to bottom before you run anything. A Docker route exists and has improved, but the installer is where the maintainers' attention goes.

Two gigabytes is honest, and here is where it goes

Rspamd wants 300 to 500 MB once its Bayes and fuzzy data warm up. Dovecot and Postfix are light, under 100 MB together at homelab scale. The Django application under uwsgi, plus the database, is another 300 to 400 MB. ClamAV, if you enable the antivirus option, adds about 1 GB for its signature database in memory, which is the single biggest reason the minimum is 2 GB rather than 1. Skip ClamAV on a small box; the attachments it would catch are ones your phone and laptop already scan, and the memory buys you a comfortable margin instead. On a 2 GB VPS with ClamAV off, Modoboa runs a family's worth of mailboxes without swapping.

The panel earns its keep on the boring days

Day-to-day operation is where Modoboa beats hand-built Postfix. Domains, aliases, catch-alls, quotas and per-user settings are forms rather than map files. Domain administrators can be delegated a single domain, which is what makes it usable for hosting a few friends or a small business. The statistics page graphs sent, received, bounced and rejected mail per domain, and the DNS check runs on a schedule and shows a red mark the day your DKIM key stops matching or a DNSBL lists your IP, which is exactly the thing that otherwise goes unnoticed until someone asks why their mail vanished. Autoreplies, sieve filters through the webmail, and LDAP or SMTP authentication against an external directory round it out. The webmail itself is plain; most users will connect Thunderbird or a phone client over IMAP and never see it.

Where the container-first stacks are the safer pick

If you want everything in one docker compose up, Mailu and docker-mailserver are built that way from the start, and mailcow is the most polished of the group with the largest community. They are easier to move between hosts, easier to back up as a set of volumes, and easier to roll back. Modoboa's answer is a better admin UI and a system that looks like a conventional Debian mail server underneath, which matters if you already know Postfix and want to keep editing main.cf when the panel does not expose something. Stalwart is the newer single-binary alternative that replaces Postfix and Dovecot entirely rather than wrapping them; lighter and simpler, but a different bet.

Backups are three things, not one

The database holds domains, users and settings; the mail store under /srv/vmail by default holds the messages; and the Modoboa instance directory plus the DKIM private keys it generated hold the configuration that makes your DNS records valid. Back up all three. Restoring the mailboxes without the DKIM keys means new DNS records and a reputation reset, which is a bad week.

What I'd do

If you have decided to run your own mail and you are on a clean VPS with a clean IP (check it against the major blocklists before you pay for a month), run the Modoboa installer with Rspamd, without ClamAV, on Debian stable, and use the DNS check page as your weekly health ritual. If you would rather have the whole stack as containers, pick mailcow or Mailu instead and accept a plainer admin panel. If you have not decided, read the email piece linked above and then use a hosted provider; Modoboa cannot fix port 25.