Installing MailDock on DigitalOcean

DigitalOcean is a good host with a hard line on SMTP. That is worth knowing before rather than after.

The port 25 conversation

They block it by default and are more selective than most about unblocking it. A brand-new account with no billing history asking for SMTP looks exactly like what they are guarding against. If you have been a customer for a while, ask and explain; if you have not, expect it to be harder.

Do not build the migration plan before you have the answer. This is the one provider on this list where “they’ll probably say yes” is not a safe assumption.

Reverse DNS is the droplet name

There is no reverse-DNS field in the control panel, and people spend a while looking for one. The PTR is derived from the droplet’s name. So name the droplet mail.example.com — the actual hostname you will use for mail — and the PTR follows.

Rename an existing droplet and the PTR follows too, which is the fix if you named it mail-01.

IPv6

Droplets get IPv6 on request, and it is off by default in most regions.

From 0.8.0 MailDock can serve IPv6, and it is off until you switch it on. Until you do, publish no AAAA record for any name this server answers — not the mail hostname, and not webmail., postmaster. or any domain you point here later: with IPv6 off nothing answers there, so mail servers and certificate challenges that prefer IPv6 fail. Keeping inbound IPv6 closed in the provider’s firewall stays sensible while it is off.

To serve IPv6, install with mailctl install --ipv6, or set IPV6_ENABLED=true in /opt/mailserver/.env and run npm i -g @maildock/mailctl@latest && mailctl upgrade — the CLI first, because an older one has no IPv6 override to apply. It needs Docker 27 or later, which forwards IPv6 so that each client keeps its own address — on an older Docker an IPv6 client would look like the server itself and could relay mail without signing in, which is why the installer refuses it. Then:

• run mailctl doctor and wait for its ipv6 row to read ✔;
• open the mail and web ports to IPv6 in the provider’s firewall;
• publish an AAAA record for the mail hostname, and set the reverse DNS (PTR) for the server’s IPv6 address in the provider’s console;
• outbound mail stays on IPv4 unless you turn outbound IPv6 on, which MailDock refuses until that PTR is in place.

The details are in the IPv6 page of the docs.

Sizing

The $12 basic droplet (2 GB / 1 vCPU / 50 GB) is the sensible floor. The $6 one has 1 GB and is under the 2 GiB the preflight asks for; it will refuse rather than let you find out later.

Floating IPs

If you use a floating IP, mail leaves from the droplet’s own address unless you have configured otherwise. The PTR that matters is the one on whichever address actually sends. Check with dig +short -x on the address in your own outbound headers, not the one you expected.

Then the standard install.