Installing MailDock on OVH

OVH is the one host on this list where port 25 is usually just open, which removes the step that blocks everyone else.

That is genuinely an advantage, and it comes with a matching risk.

Open, but watched

OVH’s anti-spam system monitors outbound traffic and will block an IP that trips it — a sudden volume spike, a burst of bounces, a complaint. Because you never had to ask for the port, there is no established conversation when it happens, and getting unblocked afterwards is harder than being approved in the first place somewhere else.

Practically: warm up properly. Low volume to recipients who expect your mail, growing over weeks. MailDock ships an outbound warm-up schedule that grows the cap on a curve for exactly this. It is off by default, so switch it on under Settings → Reputation protection → IP warm-up before you start sending.

Check the IP’s history

OVH’s ranges are large and have been around a long time, which means a fresh IP may not be fresh. It costs a minute to check a new address against the major blocklists before you build anything on it, and it saves an unexplained fortnight.

Reverse DNS

In the control panel against the IP, and the forward record must resolve first — same order as Linode. OVH’s DNS propagation for reverse records is sometimes slower than you expect; give it an hour before concluding it did not work.

IPv6

Every VPS comes with an IPv6 /64 and it is enabled by default.

From 0.8.0 MailDock can serve IPv6, and it is off until you switch it on. Until you do, publish no AAAA record for any name this server answers — not the mail hostname, and not webmail., postmaster. or any domain you point here later: with IPv6 off nothing answers there, so mail servers and certificate challenges that prefer IPv6 fail. Keeping inbound IPv6 closed in the provider’s firewall stays sensible while it is off.

To serve IPv6, install with mailctl install --ipv6, or set IPV6_ENABLED=true in /opt/mailserver/.env and run npm i -g @maildock/mailctl@latest && mailctl upgrade — the CLI first, because an older one has no IPv6 override to apply. It needs Docker 27 or later, which forwards IPv6 so that each client keeps its own address — on an older Docker an IPv6 client would look like the server itself and could relay mail without signing in, which is why the installer refuses it. Then:

• run mailctl doctor and wait for its ipv6 row to read ✔;
• open the mail and web ports to IPv6 in the provider’s firewall;
• publish an AAAA record for the mail hostname, and set the reverse DNS (PTR) for the server’s IPv6 address in the provider’s console;
• outbound mail stays on IPv4 unless you turn outbound IPv6 on, which MailDock refuses until that PTR is in place.

The details are in the IPv6 page of the docs.

Sizing

The VPS-2 tier and up. Watch the disk on the cheaper tiers — some are generous on RAM and thin on storage, and storage is the one that fills.

Then the standard install.