How to Install iRedMail on Debian 12

Introduction

iRedMail is an open-source email server solution that enables the deployment of a fully functional email system. It integrates multiple components for mail transfer, retrieval, storage, virus scanning, spam detection, and secure communication. iRedMail uses the Postfix mail transfer agent and includes a web administration interface for managing email accounts, domains, and other server settings.

This article explains how to install iRedMail on a Debian 12 server.

Prerequisites

Before you begin:

• Deploy a Debian 12 server instance on Vultr with at least 4 GB RAM.
• Create 2 domain name DNS A records pointing to the instance's IP address. For example, mail.example.com and example.com.
• Access the server using SSH as a non-root user with sudo privileges.
• Update the server.
• Open a new Vultr support ticket and request the SMTP port 25 to be unblocked on your instance.

Install iRedMail

iRedMail is not available in the default package repositories on Debian 12. Follow the steps below to set up the server and install iRedMail using the latest installation script.

1. Change the server hostname to your mail domain.

   console Copy

   $ sudo hostnamectl set-hostname mail.example.com
   

2. Open the /etc/hosts file.

   console Copy

   $ sudo nano /etc/hosts
   

3. Add your mail domain mail.example.com as a value of 127.0.1.1.

   127.0.1.1 mail.example.com mail

   Save and close the file.

   The above host configuration enables the server to resolve your mail domain to the system address.

4. Download the latest iRedMail installation archive using wget. 1.7.1 in the URL with the latest version number.

   console Copy

   $ wget https://github.com/iredmail/iRedMail/archive/refs/tags/1.7.1.tar.gz
   

   The above command downloads the archive version 1.7.1. Visit the official iRedMail download page to verify the latest version to download on your server.

5. Extract files from the archive.

   console Copy

   $ tar xvf 1.7.1.tar.gz
   

6. Switch to the extracted files directory.

   console Copy

   $ cd iRedMail-1.7.1
   

7. Enable execute permissions to the iRedMail installation script.

   console Copy

   $ chmod +x iRedMail.sh
   

8. Run the automatic installation script to install iRedMail on your server.

   console Copy

   $ sudo bash iRedMail.sh
   

   Reply to the following prompts to install iRedMail on your server.

   • Press Enter to start the installation process.

   • Default mail storage path: Press Enter to use the default /var/vmail directory.

   • Preferred web server: Keep Nginx selected and press Enter to enable the web server.

   • Choose Preferred backend uses to store mail accounts: Press the Down arrow key and press Space to select MariaDB as the database backend.

   • LDAP suffix: Press Enter to use the default domain format to create a directory tree.

   • Password for MySQL administrator: Enter a new strong password to assign the root database user account on your server.

   • Your first domain name: Enter your domain to use when sending and receiving emails on the server. For example, example.com

   • Password for the mail domain administrator: Enter a new strong password to assign the postmaster mail administrator account.

   • Optional components: Select optional components to install on your server and press Enter to apply changes.

   • Enter Y when prompted to continue and save your iRedMail installation options.

     < Question > Continue? [y|N]

   • Enter Y to allow SSH connections on the default port 22 through the firewall.

     < Question > Restart firewall now (with ssh ports: 22)? [y|N]

9. Reboot the server to apply the iRedMail installation changes.

   console Copy

   $ sudo systemctl reboot
   

10. Open the HTTP port.

    console Copy

    $ sudo ufw allow 80
    

11. Open the HTTPS port.

    console Copy

    $ sudo ufw allow 443
    

12. Open the mail port 25.

    console Copy

    $ sudo ufw allow 25
    

Configure the DNS records

Follow the steps below to configure DNS records such as SPF, DMARC, and DKIM to enable the delivery of emails from your mail server.

1. Log in to your domain registrar such as Vultr DNS and create the following DNS records.

2. Create a new MX (Mail Exchange) record with the following details.

   • Type: MX
   • Name: @
   • Priority: 10
   • Value: mail.example.com

3. Create a new SPF (Sender Policy Framework) record with the following details. Replace 192.0.2.1 with your actual server IP address.

   • Type: TXT
   • Name: @
   • Value: "v=spf1 a mx ip4:192.0.2.1 -all"

4. Create a new TXT record to set up SPF. Set the record name to @. If you're using a subdomain for the email address domain, set the record name to the subdomain. Set the data to the text below. Replace 192.0.2.1 with your server's IP address.

   v=spf1 a mx ip4:192.0.2.1 -all

   The SPF record instructs the recipient server to only allow mail from your server's IP address.

5. Create a new DMARC (Domain-based Message Authentication, Reporting, and Conformance) record with the following details. Replace dmarc-reports@example.com with your domain administrator's email.

   • Type: TXT
   • Name: _dmarc
   • Value: "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; pct=100"

6. Create a new DKIM (DomainKeys Identified Mail) record:

   • Run the following command in your server's terminal to view your domain's DKIM records generated by the amavisd iRedmail utility.

     console Copy

     $ amavisd showkeys
     

     Your output should similar to the one below.

     ; key#1 2048 bits, s=dkim, d=example.com, /var/lib/dkim/example.com.pem
     dkim._domainkey.example.com. 3600 TXT (
     "v=DKIM1; p="
     "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1zj9jaznT73JQMGCB5ag"
     "iSjOEEYqMQqSHRAXMHUm05ZDzy5ypzLdLYech8R+T+5S7+We0tQ0tWMAj07rB4/U"
     "N6BX+J8ycp5Tcsg34lxEuYh34DENoQ8n0x4YLldrO/4+L5xk5pjJpsjiG6JigLPv"
     "VDDzQSB+PA8Sn8NNczxRVhTFZ4AQgma7p9AnraTV+d4zjD24RD2pAvHL45BjH6NS"
     "A4B3V3NfTf+OVbecI5dD29RsK8DIzhGW/XGsoo7G68fGwBpZdYkww3EhjpIojpbn"
     "uM7JeO7rIDbczehroujPCxn52c+AuUC+pnfJuBBMXoeQ0jqabsLfmll0+KPeSuFR"
     "EwIDAQAB")

     Copy all contents in bracelets () to use as your DKIM record's data.

   • Create a new TXT record using the generated DKIM information with the following details.

     • Type: TXT
     • Name: dkim._domainkey
     • Value:"<iredmail-dkim-data>"

   • Test your DKIM keys configuration using amavisd to verify the DNS record.

     console Copy

     $ amavisd testkeys
     

     Output:

     TESTING#1 example.com: dkim._domainkey.example.com => pass

7. Access your instance's management page and navigate to the Settings tab.

8. Click the reverse DNS field in your IPV4 section and replace the existing data with your domain name.

   

Secure iRedMail with Trusted Let's Encrypt SSL Certificates

Follow the steps below to generate Let's Encrypt SSL certificates to replace the default iRedMail self-signed certificates.

1. Install the Snapd package manager.

   console Copy

   $ sudo apt install snapd -y
   

2. Install Certbot using snap.

   console Copy

   $ sudo snap install certbot --classic
   

3. Activate the system-wide Certbot command.

   console Copy

   $ sudo ln -s /snap/bin/certbot /usr/bin/certbot
   

4. Request a new SSL certificate for your active domains. Replace example.com and mail.example.com with the actual domains pointing to your server's IP address, and hello@example.com with your email.

   console Copy

   $ sudo certbot certonly --webroot -w /var/www/html -d example.com -d mail.example.com  -m hello@example.com --agree-tos
   

   Your output should be similar to the one below when successful.

   Successfully received certificate.
   Certificate is saved at: /etc/letsencrypt/live/example.com/fullchain.pem
   Key is saved at:         /etc/letsencrypt/live/example.com/privkey.pem
   This certificate expires on 2024-10-30.

5. Change the Let's Encrypt SSL directory permissions to enable read privileges for other applications such as Postfix and Dovecot on the server.

   console Copy

   $ sudo chmod 0755 /etc/letsencrypt/{live,archive}
   

6. Back up the default iRedMail SSL certificate file.

   console Copy

   $ sudo mv /etc/ssl/certs/iRedMail.crt{,.bak}
   

7. Back up the default iRedMail private key file.

   console Copy

   $ sudo mv /etc/ssl/private/iRedMail.key{,.bak}
   

8. Link your domain's Let's Encrypt certificate file to the iRedMail.crt file.

   console Copy

   $ sudo ln -s /etc/letsencrypt/live/example.com/fullchain.pem /etc/ssl/certs/iRedMail.crt
   

9. Link the Let's Encrypt private key to iRedMail.key.

   console Copy

   $ sudo ln -s /etc/letsencrypt/live/example.com/privkey.pem /etc/ssl/private/iRedMail.key
   

10. Restart the Postfix, Dovecot, and Nginx system services.

    console Copy

    $ sudo systemctl restart postfix dovecot nginx
    

Access the iRedMail Interface

Follow the steps below to access the iRedMail web administration interface to manage user accounts, email domains and view mail logs on the server.

1. Access the iRedMail web administration interface using your management domain.

   https://mail.example.com/iredadmin

   Log in to the iRedMail interface using your first email domain's administrator email and password your set during the installation process:

   • USERNAME: postmaster@example.com
   • PASSWORD: <Administrator-Password>

   

2. Click the Add drop-down and select User from the list to set up a new email account.

   

3. Enter your desired email information and click Add to create the new user.

   

4. Add the /mail path to your domain in new web browser window to access the Roundcube Webmail interface and manage your email.

   

   Enter your Postmaster user and password to log in to its webmail interface.

5. Click Compose to create a new test email to your new user email. For example, user1@example.com.

   

6. Click Send to send the test email and verify that it's successful.

   

7. Click Logout in the bottom left to exit the Roundcube interface.

   

8. Log in to Roundcube using the new email user you created earlier to access the email sent from the postmaster account.

   

9. Click the header link within Headers.

   

10. Verify your domain's DKIM values sent to all mail domains.

    

Conclusion

You have installed iRedMail on a Debian 12 server and configured DNS records to enable the secure delivery of emails. iRedMail enables the hosting and delivery to emails by integrating webmail solutions such as Roundcube to enable access to active email accounts. For more information, visit the iRedmail documentation.