Skip to content
A canvas tent half pitched on a grassy ridge at sunset, with a backpack, rope, lantern and stacked firewood beside a cold fire ring

Install guide

Install UNA in an evening

Six steps from an empty server to your first message. The installer does the heavy lifting, and your server hands you every DNS record ready to copy.

What you need

Before you start

A VPS

With its own public IPv4 address, on Ubuntu, Debian, CentOS or AlmaLinux, and 1 GB of memory or more.

A domain

And access to its DNS at your registrar, or someone who can add records for you.

Port 25

A provider that opens port 25 for incoming mail and lets you set reverse DNS (PTR) for the server’s IP.

I run UNA on Vultr, and its 1 GB server is enough. Inbound port 25 must be open. If your provider blocks outbound 25, UNA sends through Amazon SES or any SMTP relay instead. It needs to be a server on the internet rather than a computer at home, because other mail servers have to be able to reach it.

Stuck on the server side? I’ll install it for you for €149, first year included.

  1. At your VPS provider

    Step 1: Get port 25 opened

    Port 25 is how other mail servers deliver to yours, and most providers keep it closed on a new server until you ask. Open a support ticket asking them to “remove the SMTP block on port 25”. Once they approve it, stop and start the server from their control panel; a reboot from inside the server is not enough.

    Incoming is all you need. UNA can send through Amazon SES or any SMTP relay instead, switched on from Settings, Sending whenever you like.

  2. On the server

    Step 2: Install Docker

    The installer needs Docker and Docker Compose, and stops if either is missing. On Ubuntu and Debian, Docker’s own script installs both:

    curl -fsSL https://get.docker.com | sudo sh

    On CentOS or AlmaLinux, or if you would rather not pipe a script into a shell, follow Docker’s instructions for your system.

  3. On the server

    Step 3: Run the installer

    git clone https://github.com/roncanfil/una.email-install.git
    cd una.email-install && ./install.sh

    It asks you to accept the license agreement, then for your domain, two hostnames and a database password. Press Enter to keep the defaults: mail for the mail server, webmail for where you sign in, and a generated password.

    Then it opens the firewall if ufw or firewalld is running, pulls the images, starts everything, runs the migrations and writes out your DNS records.

  4. At your registrar

    Step 4: Publish your DNS

    Open http://your-server-ip/dns-setup in a browser. It lists every record for the names you chose, each with a copy button, and remembers which ones you have done. The same list is on the server as YOUR_SETUP.md. With the default hostnames it looks like this:

    TypeHostValue
    AmailYour server’s IP
    AwebmailYour server’s IP
    MX@mail.yourdomain.com
    TXT@SPF
    TXTuna._domainkeyDKIM
    TXTuna._domainkey.mailThe same DKIM, for bounces
    TXT_dmarcDMARC
    PTR(at your VPS provider)mail.yourdomain.com

    The PTR record is set at your VPS provider, not your registrar, and it must return mail.yourdomain.com. A PTR that does not match is the most common reason a new mail server lands in spam.

  5. On the server

    Step 5: Get the certificate

    Once both A records resolve, usually after 5 to 10 minutes:

    ./renew-ssl.sh

    One free certificate covers both hostnames, and the script also prints an optional DANE (TLSA) record for extra protection. Your setup page shows how to keep the certificate renewing on its own.

  6. In the browser

    Step 6: Sign in and send a test

    Open https://webmail.yourdomain.com. The first screen creates the admin sign-in for this install. It is not a mailbox, so create your first one under Settings, Accounts. Mail to an address with no mailbox is refused.

    Then send a few sentences of ordinary text to mail-tester.com and check the score. SPF, DKIM, DMARC, PTR and blacklists should all pass, and the report names any record that is wrong.

    If your provider keeps outbound port 25 closed, switch sending to a relay under Settings, Sending. It takes effect straight away.

Afterwards

Once it is running

Your 90 days

They start when the install first checks in. Buy a license from Settings, License whenever you are ready: €49 a year per install.

Backups

./backup.sh writes one archive with the database, attachments, settings and DKIM keys. Copy it off the server and keep it like a password.

The finished campsite at night, a fire burning in its stone ring beside a steaming mug, and a lantern lit inside the open tent

Clone it, run it, sign in

Open the install repository

Stuck on the server side? I’ll install it for you for €149, first year included.

Built by Ron Canfield