# Priority Listing: Self-Hosted Email Service on AWS EC2

This document outlines the step-by-step priority list to deploy and verify a self-hosted, Docker-based email server on AWS EC2.

---

## Phase 1: AWS Configuration & Requests (Immediate Priority)

Before writing any configuration files or launching servers, you must set up the AWS infrastructure and submit request forms to AWS Support. **AWS manually reviews these requests, which can take 24–48 hours.**

### 1. Provision AWS Resources
- **EC2 Instance**: Launch a `t3.medium` (or larger) instance running Ubuntu 24.04 LTS.
- **Elastic IP**: Allocate a static Elastic IP and associate it with the EC2 instance. (Note the IP address).
- **Security Group**: Configure the security group to allow inbound traffic on:
  * Port `25` (SMTP)
  * Port `143` / `993` (IMAP / IMAPS)
  * Port `587` / `465` (Submission / SMTPS)
  * Port `80` / `443` (HTTP / HTTPS for Webmail & SSL certificates)

### 2. Request Port 25 Unblocking & Reverse DNS (PTR)
You cannot send emails from EC2 without removing the default Port 25 limit.
- **Action**: Submit the [Request to Remove Sending Limitations](https://aws.amazon.com/premiumsupport/knowledge-center/ec2-port-25-throttle/) form in the AWS Support Center.
- **Provide the following details**:
  * Your Elastic IP address.
  * Your email domain (e.g., `yourdomain.com`).
  * The Reverse DNS (PTR) record you want associated with the IP (e.g., `mail.yourdomain.com`).
  * A clear explanation of your use case (e.g., "Hosting our company email service for internal staff communications").

---

## Phase 2: Development & Infrastructure Setup

Once AWS approves your request, proceed with the software installation.

### 1. Host Setup
- Install Docker and Docker Compose on the EC2 instance.
- Set up a swap file if memory usage is tight (especially if using Mailcow).

### 2. Mail Server Installation (Example: Mailcow)
- Clone the repository: `git clone https://github.com/mailcow/mailcow-dockerized`
- Generate configuration: `./generate_config.sh`
  * Enter your mail subdomain (e.g., `mail.yourdomain.com`).
- Adjust configurations in `mailcow.conf` (e.g., timezone, HTTP/S ports).
- Spin up the containers: `docker compose up -d`

### 3. DNS Configuration
Add the following records at your Domain Registrar or DNS manager (Route 53, Cloudflare, etc.):

| Record Type | Host / Name | Value | Purpose |
| :--- | :--- | :--- | :--- |
| **A** | `mail` | `<Your EC2 Elastic IP>` | Points to your mail server |
| **MX** | `@` (Root) | `10 mail.yourdomain.com.` | Directs incoming mail to the mail server |
| **TXT** | `@` | `v=spf1 ip4:<Your Elastic IP> -all` | SPF: Authorizes EC2 to send mail |
| **TXT** | `dkim._domainkey` | *Generated by Mailcow UI* | DKIM: Cryptographic mail signing |
| **TXT** | `_dmarc` | `v=DMARC1; p=quarantine; pct=100;` | DMARC: Action policy for failures |

---

## Phase 3: Testing & Verification Plan

Run these verification checks before onboarding your organization.

### 1. Inbound Connection Port Check
Verify that the firewall/security groups are open to the public internet:
```bash
# From a remote machine, test SMTP
nc -zv <Your Elastic IP> 25

# Test IMAPS
nc -zv <Your Elastic IP> 993
```

### 2. Inbound & Outbound Email Delivery
* **Outbound Test**: Create an inbox in your new mail server and send an email to an external address (e.g., a personal Gmail or Outlook account). Verify it arrives and does not go to spam.
* **Inbound Test**: Reply to that email from Gmail/Outlook and verify it is received on your self-hosted server.

### 3. Comprehensive Deliverability & Trust Test
* Use a service like [Mail-Tester](https://www.mail-tester.com/) or [MxToolbox](https://mxtoolbox.com/).
* Send a test email from your mail server to the address provided by Mail-Tester.
* **Target Score**: 10/10. Ensure SPF, DKIM, DMARC, and Reverse DNS (PTR) alignment are all marked green.