Email Settings GuideQuick answer: for mailcow the mail server is your own host, usually mail.yourdomain.com. IMAP is port 993 with SSL/TLS. SMTP is port 465 (SSL) or 587 (STARTTLS). POP3 is port 995 with SSL. Sign in with your full email address and your mailbox password. If you turned on two factor in the mailcow UI, create an app password and use that in the app instead.
What Changed Recently#
mailcow is stable, but a few of its built in features shape how you connect a client. Here is the current status.
Latest update
Turn on two factor and your mailbox password stops working in apps. Once you enable 2FA in the mailcow UI, mail clients need an app password instead. Create one in the UI and paste it into the app.
Earlier change
SSL is automatic. mailcow issues and renews Let's Encrypt certificates itself, so 993, 995, 465 and 587 are ready out of the box when port 80 is reachable.
Earlier change
Webmail, calendar and contacts are built in. SOGo ships inside mailcow, so one account syncs mail, calendar and contacts over IMAP, CalDAV, CardDAV and ActiveSync.
Before You Begin#
Two things to sort out first. If you skip them, your email app is refused even when every server value is right.
1. Know your mail host
mailcow runs on your own server, so the mail host is the name you set at install, usually mail.yourdomain.com. The username is your full email address.
Where: the same host you open the mailcow UI on
2. Check your two factor setting
If you turned on 2FA in the mailcow UI, your mailbox password will not work in a mail app. You need an app password. With 2FA off, the mailbox password works directly.
Where: App password steps below →
About mailcow#
mailcow, full name mailcow: dockerized, is a free, open-source mail server suite that runs as a set of Docker containers, maintained by mailcow GmbH and a large community.
mailcow bundles Postfix, Dovecot, SOGo and Rspamd behind one web UI, so a lot works on its own. It provisions Let's Encrypt certificates for you, which is why the secure ports connect without any manual certificate step. SOGo adds webmail, calendar and contacts. The one thing that changes client setup is two factor: turn it on and your mailbox password stops working in apps, so you create an app password instead.
| Service Name | mailcow: dockerized |
| Made By | mailcow GmbH, open source (GPLv3) |
| Type | Free self-hosted Docker mail suite |
| Server Host | Your own domain, like mail.yourdomain.com |
| Webmail | SOGo, built in at /SOGo |
| Protocols | IMAP, POP3, SMTP, ActiveSync, CalDAV, CardDAV |
| App Password | Required once 2FA is on |
| Mailbox Quota | Set by admin |
993, 995, 465 and 587. Your host is the name the server runs on.
mailcow Access Login#
mailcow gives you a browser login for both mail and admin. Here is where each one lives:
Webmail
https://mail.yourdomain.com/SOGo
mailcow UI
https://mail.yourdomain.com
Password and 2FA
Set in the mailcow UI, per mailbox
Allow IMAP and App Passwords#
New mailboxes already allow IMAP, POP and SMTP, so most people can skip straight to a client. Do this only if a mailbox was locked down or you turned on two factor and now need an app password.
- Open the mailcow UI at your host and sign in as the mailbox user or an admin.
- Check protocol access on the mailbox. IMAP, POP3 and SMTP each have a toggle, so make sure the ones you need are on.
- Make an app password if 2FA is on. In App passwords, create one and give it IMAP and SMTP access, plus DAV if you want calendar and contacts.
- Use that password in the mail app. With 2FA off, your normal mailbox password works on its own.
mailcow IMAP Settings#
IMAP is the incoming protocol most people should use. It keeps your mail on the server so every device shows the same inbox.
| IMAP Server | Your mailcow host, like mail.yourdomain.com | |
| Port | 993 (SSL) or 143 (STARTTLS) | |
| Encryption | SSL/TLS or STARTTLS | |
| Username | Your full email address on your domain | |
| Password | Your mailbox password or an app password if 2FA is on | |
| Authentication | Required |
mailcow POP3 Settings#
POP3 downloads mail to 1 device. Pick it only if you want a local copy on a single computer. Not sure? See the comparison below.
| POP3 Server | Your mailcow host, like mail.yourdomain.com | |
| Port | 995 | |
| Encryption | SSL/TLS (required) | |
| Username | Your full email address | |
| Password | Your mailbox or app password |
mailcow SMTP Settings#
587 with STARTTLS or 465 with SSL. Both need authentication with your mailbox or app password. Port 25 carries mail between servers, so a mail app should not send on it. Turn on authentication for outgoing mail.
SMTP handles outgoing mail. If you can read mail but not send it, the problem is here.
| SMTP Server | Your mailcow host, like mail.yourdomain.com | |
| Port (SSL) | 465 | |
| Port (STARTTLS) | 587 | |
| Encryption | SSL or STARTTLS (required) | |
| Username | Your full email address | |
| Password | Same mailbox or app password as incoming | |
| Authentication | Required. Check "My outgoing server requires authentication" in Outlook. |
Check mailcow IMAP Settings Online#
You don't need to download anything to check mailcow IMAP settings. Every port here is checked and copies straight from your browser. Since mailcow runs on your own domain, the host belongs to you, so the checker below points known consumer domains to their own guides. For your mailcow domain, use the host from the tables with the ports above.
Does my email address use these settings?
Runs in your browser only. Your address is never sent anywhere or stored.
Want to check the account before you add it to an app? Sign in at your SOGo webmail to confirm the address and password work. If 2FA is on, make an app password first. Once both pass, any email app connects with the tables above.
Look Up IMAP Settings for Any Email Domain#
This page covers mailcow. For every other address, work email on a company domain included, we run a free online lookup database: imapsettings.com.
imapsettings.com
Complete email settings database, by Univik
Enter any email address and get the incoming and outgoing server settings for that domain in 1 step:
Your address is used only to find the settings for that domain. Nothing is stored or shared.
mailcow App Password Setup#
On mailcow the password you use depends on one setting: two factor. With 2FA off, your mailbox password works everywhere. With it on, mail apps need an app password made in the UI.
| Where you sign in | 2FA off | 2FA on |
|---|---|---|
| SOGo webmail and the mailcow UI | ✓ Mailbox password | ✓ Password plus 2FA |
| Outlook, Apple Mail, Thunderbird | ✓ Mailbox password | ✗ App password needed |
| Phone mail apps (IMAP or ActiveSync) | ✓ Mailbox password | ✗ App password needed |
| Calendar and contacts (CalDAV, CardDAV) | ✓ Mailbox password | ✗ App password with DAV |
How to Generate an App Password
- Sign in to the mailcow UI at your host as the mailbox user.
- Open App passwords from your user menu and choose Add.
- Name it after the app, for example "iPhone Mail", and pick the access it needs: IMAP, SMTP and DAV for calendar and contacts.
- Save and copy the password shown on screen. You see it once.
- Paste it into the app as both the incoming and outgoing password.
Set Up mailcow in Email Clients#
Point your client at your mailcow host with IMAP 993 and SMTP 465 or 587. mailcow also serves autoconfig and autodiscover, so many clients fill these in from your email address once the DNS records exist.
Jump to your app:
Outlook (Windows and Mac)
- Open Outlook → File → Add Account (in new Outlook, Settings → Accounts → Add account).
- Enter your mailcow address. Autodiscover often fills the rest, so try that before going manual.
- For manual setup, choose IMAP and set your host to
993with SSL incoming and the same host to465with SSL outgoing. - Enter your mailbox password, or an app password if 2FA is on. Switch on "outgoing server requires authentication".
- Send a test message to yourself to confirm both directions work.
Apple Mail (macOS)
- Open Mail → Settings → Accounts → Add Account → Other Mail Account.
- Enter your name, mailcow address and password, an app password if 2FA is on, then continue.
- When detection fails, set your mailcow host as both incoming and outgoing.
- Set IMAP to 993 SSL and SMTP to 465 SSL, with your full address as the username.
- Finish. To add calendar and contacts too, set up the account as Exchange instead.
iPhone and iPad
- Open Settings → Apps → Mail → Mail Accounts → Add Account → Other, then Add Mail Account.
- Enter your name, mailcow address and password, an app password if 2FA is on, then tap Next.
- Keep IMAP selected and set your host for incoming and outgoing,
993and465with SSL. - Want calendar and contacts? Add the account as Exchange, which uses mailcow ActiveSync.
- Tap Save and wait for iOS to verify the account.
Android
- Open your mail app (Gmail app, Samsung Email or another) → Add account.
- Choose Other or IMAP, or Exchange if you want calendar and contacts through ActiveSync.
- Enter your address and password, an app password if 2FA is on, then pick Manual setup if needed.
- Enter the servers: your mailcow host 993 SSL incoming, the same host 465 SSL outgoing.
- Finish setup and pull down to sync your inbox.
Thunderbird
- Open Thunderbird → Account Settings → Account Actions → Add Mail Account.
- Enter your name, mailcow address and password, an app password if 2FA is on, then select Continue.
- Let it probe autoconfig. mailcow answers, so the servers often fill in on their own.
- If detection misses, choose Configure manually and point both servers at your host, 993 SSL and 465 SSL.
- Select Done. Add the CalDAV and CardDAV URLs in Calendar and Address Book for groupware.
SOGo Webmail and Server Features#
The ports connect your apps. These features control how mail behaves. Most live in SOGo webmail under Preferences, with spam handled in the mailcow UI.
Signature
SOGo, Preferences, Mail. A signature set here shows on webmail. Outlook and other clients keep their own, so set it in both if you use both.
Vacation Auto Reply
SOGo, Preferences, Vacation. Set start and end dates so it stops on its own. The reply goes out from the server, so your computer need not be on.
Filters and Rules
SOGo, Preferences, Mail, Filters. These are Sieve rules that run on the server, so they sort mail before any client sees it. App only rules wait for that app to open.
Spam Filter
mailcow UI, Spam filter. Rspamd scores every message. You set your own allow and deny lists there per mailbox.
POP3 vs IMAP#
| Feature | IMAP | POP3 |
|---|---|---|
| Where mail lives | On the mailcow server | Downloaded to 1 device |
| Multiple devices | ✅ Everything stays in sync | ❌ Each device sees different mail |
| Sent and deleted mail | ✅ Synced everywhere | ⚠️ Stays only on that device |
| Offline reading | ⚠️ Cached mail only | ✅ Full local copy |
| Server storage used | Yes, counts against your quota | Can be freed after download |
| Best for | Phone + computer, everyday use | Single PC, local archives |
mailcow Sending and Storage Limits#
On mailcow the limits belong to your admin, not a fixed policy. These are the settings that decide what goes through, each set in the mailcow UI:
| Mailbox quota | Set per mailbox |
| Max message size | Set server wide or per domain |
| Rate limits | Set per mailbox or domain |
| Attachments | Counted inside the message size limit |
| Secure ports | Work out of the box with auto Let's Encrypt |
| What happens at the limit | Oversized mail is refused, a full mailbox bounces new mail |
Troubleshooting mailcow Connections#
Find the exact error your email app shows, then apply the fix:
| Error you see | What it means | Fix |
|---|---|---|
| Authentication failed | 2FA is on, but the app has your mailbox password | Create an app password in the mailcow UI and paste that into the app instead. |
| The certificate is not trusted | Let's Encrypt has not issued yet, so a self-signed cert is in use | Open port 80 and point the DNS at the server. mailcow then swaps its snake-oil certificate for a real one. |
| Connection timed out | A firewall, a host block or a mailcow IP ban | Confirm 993 and 465 or 587 are open on the server and router. Some hosts block 25 and 465 by default. If it began after several wrong passwords, mailcow banned your IP, so clear it in the UI. |
| 550 relaying denied | Outgoing mail is not authenticating | Send on 587 or 465 with "outgoing server requires authentication" on. Port 25 is for server to server mail. |
| Messages stuck in Outbox | SMTP authentication is off | Enable "outgoing server requires authentication" with the same login as incoming mail. |
Reader Reported Fixes
Three fixes that come up over and over in mailcow setups, beyond the error table above.
Works in SOGo but not in the app? Two factor is on. When webmail signs in fine but a mail client is refused, the mailbox has 2FA. Mail apps cannot answer a 2FA prompt, so make an app password and use that.
Certificate warning on a new server? Let's Encrypt has not run. Until port 80 is reachable and the DNS points at the server, mailcow serves a self-signed cert that clients distrust. Fix those two things and it issues a real certificate on its own.
Timeouts right after a few wrong passwords? mailcow banned your IP. mailcow watches for failed logins. After a handful, its netfilter blocks your address for a while. Every port then times out, which looks like a firewall fault but is not. Wait for the ban to lift or remove your IP in the UI under Configuration, then Fail2ban.
Moving Mail to or from mailcow?#
Pulling mail into mailcow? mailcow has a built in Sync jobs feature under Configuration. It runs imapsync on the server to copy an old mailbox into a mailcow one over IMAP, no desktop tool needed.
Prefer a desktop tool or moving off mailcow? The Univik Email Migration Tool moves every folder across over IMAP. Put your mailcow host and password on one side and the other account on the other.
Leaving for Microsoft 365 or Google? The same tool reads your mailcow mailbox folder by folder with the settings on this page and writes it into the new account.
Back up before any big change. Save the mailbox first so you keep a copy no matter what the move does.
Rather not do it yourself? Our Email Migration Services team plans and runs the whole transfer for you and verifies every folder arrived.
Use These Settings in Univik Email Backup#
The same IMAP settings above let you download your complete mailcow mailbox to your computer. Univik Email Backup saves everything as PST, MBOX, EML or PDF files you keep forever, a useful second copy next to your server snapshots.
- Download Univik Email Backup and install it on Windows.
- Select IMAP from the source list. mailcow is not named, so IMAP is the option to pick.
- Sign in with your full email address and your mailbox password. Use an app password if 2FA is on.
- If the tool asks for server details, use your mailcow host with port
993and SSL from the IMAP table above. Use an app password if 2FA is on. - Pick a saving format and folder, then start the backup. Large mailboxes download in the background.
Univik Tools That Use These Settings#
Many people arrive here mid migration or while archiving a mailbox. All 3 tools use the same IMAP settings from this page:
Email Backup
Download your complete mailcow mailbox to PST, MBOX, EML or PDF before moving servers or rebuilding a host.
Email Backup Tool →
Email Migration Tool
Copy every folder from mailcow straight into Gmail, Microsoft 365 or another server. No manual export needed.
Email Migration Tool →
Email Converter Tool
Already sitting on MBOX, EML or OST files from an old export? Convert them to PST, PDF or any format your new app opens.
Email Converter Tool →Would rather hand the whole migration to experts?
If server settings and app passwords feel like too much, you don't have to learn them. Univik's migration team handles the complete project: planning, transfer, verification and a report showing every folder made it. Since 2013, for single mailboxes up to full company moves.
Email Settings Glossary#
IMAP
Internet Message Access Protocol. Keeps mail on the server, so every device shows the same inbox, folders and read state.
POP3
Post Office Protocol version 3. Downloads mail to 1 device and can remove it from the server. An older approach that still suits local archives.
SMTP
Simple Mail Transfer Protocol. Sends your outgoing mail. Every account needs it next to IMAP or POP3, which only receive.
SSL / TLS / STARTTLS
Encryption for the connection. SSL/TLS encrypts from the start (ports 993, 995, 465). STARTTLS upgrades a plain connection (port 587).
App Password
A 16 character code that replaces your real password inside email apps. Safer because you can revoke 1 app without changing your main password.
OAuth
Sign in through the provider's own window instead of typing a password into the app. The modern method most providers are moving to.
How We Verify These Settings#
Univik builds email backup, migration and converter software since 2013. Our tools sign in to self-hosted servers like mailcow over IMAP and SMTP every day for thousands of users, so a port, certificate or login quirk shows in our connection logs before most guides catch it.
Every value here is confirmed with 3 checks: live IMAP and SMTP connections from Univik Email Backup, a comparison against the mailcow documentation, then a test sign in with an app password made in the UI. We re verify after any mailcow release and at least once a quarter.
Found something that no longer matches your mailcow setup? Tell us and we will retest and update the page, with the change logged in what changed recently.
Help & Support
Frequently Asked Questions
The mail server is your own mailcow host, like mail.yourdomain.com. IMAP uses port 993 with SSL, SMTP uses 465 with SSL or 587 with STARTTLS. Sign in with your full email address and your mailbox password. Use an app password instead if 2FA is on. The secure ports work out of the box.
The usual cause is two factor. If you turned on 2FA, a mail app cannot answer the second step, so it is refused even with the right password. Make an app password in the mailcow UI and use that. If that is not it, check the mailbox still allows IMAP or SMTP access. Several wrong tries can also make mailcow ban your IP, which then times out every port until the ban lifts.
IMAP for almost everyone, since it keeps your phone, computer and SOGo webmail in step. For calendar and contacts too, add the account over ActiveSync. POP3 fits only a single computer with a local download. Full comparison here.
It is the host you set when you installed mailcow, usually mail.yourdomain.com. Use that host for incoming and outgoing. It is also the address of your SOGo webmail and the mailcow UI.
Only if you turned on two factor. With 2FA off, your mailbox password works directly in every client. With it on, mail apps need an app password made in the mailcow UI, one per device is tidy.
Yes. mailcow ships SOGo, a full webmail with calendar and contacts, at https://mail.yourdomain.com/SOGo. You can also open it from the mailcow UI under Apps, Webmail. Sign in with your email address and password.
Because Let's Encrypt has not issued a certificate yet. mailcow serves a temporary self-signed one until port 80 is reachable and your DNS points at the server. Fix those and mailcow swaps in a trusted certificate on its own, then the warning clears. For a lasting local archive, see how to back up your mailcow mailbox.
Yes. SOGo inside mailcow serves calendar and contacts over CalDAV and CardDAV. It also offers full device sync over ActiveSync. Add the account as Exchange for one step setup. To connect a single app, point a CalDAV and CardDAV client at the SOGo URLs under /SOGo/dav/.
An email migration tool copies mail directly between the 2 accounts over IMAP. You need your mailcow host and password, an app password if 2FA is on, plus the destination account details. mailcow also has built in Sync jobs for pulling mail the other way.
If setting this up feels risky or you have many accounts to move, our managed email migration service does the entire job for you.
Other Email Provider Settings
Summary: mailcow Settings at a Glance
- Host: your mailcow server, like mail.yourdomain.com
- IMAP port 993, POP3 995, both SSL/TLS
- SMTP port 465 (SSL) or 587 (STARTTLS)
- Username is your full email address
- App password needed only when 2FA is on
- SSL works out of the box via auto Let's Encrypt
- SOGo webmail built in, with calendar and contacts
- Full sync over ActiveSync, CalDAV and CardDAV