Mailcow Monitoring and Maintenance Checklist

Why Maintenance Matters

An unmonitored Mailcow server degrades silently. Queues back up, blacklist entries go unnoticed, disk fills up, and deliverability drops — all without any alert unless you've set one up.

The good news: Mailcow maintenance is predictable. Follow this schedule and problems get caught early. For broader monitoring practices, see our email infrastructure monitoring guide.

Daily Checks (2 Minutes)

Queue Depth

Check the Postfix queue in Mailcow admin → System → Postfix Queue. A healthy queue is near zero. If emails are accumulating:

• 10-50 queued: Normal during high-volume sends
• 50-200 queued: Check for temporary delivery failures (greylisting, rate limiting)
• 200+ queued: Something is wrong — check logs immediately

Via SSH:

cd /opt/mailcow-dockerized
docker compose exec postfix-mailcow mailq | tail -1

Service Status

Mailcow admin → System → Container Information. All containers should show "running." Key containers:

• postfix-mailcow — SMTP sending/receiving
• dovecot-mailcow — IMAP/mailbox access
• rspamd-mailcow — spam filtering
• nginx-mailcow — web interface and API

If any container is down, restart it:

docker compose restart [container-name]

Weekly Checks (15 Minutes)

Blacklist Scan

Check your IP against major blacklists. Use MXToolbox Blacklist Check or automate with a cron job.

Getting blacklisted is normal — even legitimate senders get listed occasionally. What matters is catching it quickly and requesting delisting before it affects deliverability significantly.

Log Review

Mailcow admin → Logs → Postfix logs. Look for:

• Repeated bounce patterns — same recipient domain bouncing means a configuration issue
• Authentication failures — someone may be brute-forcing your SMTP
• TLS errors — certificate issues or outdated cipher suites
• Rate limiting messages — receiving servers throttling your sends

Bounce Rate

Calculate your bounce rate from logs. Healthy: under 2%. Warning: 2-5%. Critical: over 5%.

High bounce rates damage IP reputation. If bounces spike, check your sending list for invalid addresses.

Practitioner note: I set up a simple script that emails me weekly bounce stats from Mailcow logs. Five lines of bash that saves hours of manual log reading. Automate the boring checks so you only spend time on actual problems.

Monthly Tasks (30-60 Minutes)

Update Docker Containers

cd /opt/mailcow-dockerized
docker compose pull
docker compose up -d

Check the Mailcow releases page before updating. Read the changelog for breaking changes or required migration steps.

Disk Space Audit

df -h
docker system df

Mailcow stores mail, logs, and database data. At high volume, logs grow fast. Clean up:

# Prune old Docker images
docker image prune -a

# Check Mailcow log sizes
du -sh /opt/mailcow-dockerized/data/conf/rspamd/local.d/

If disk is above 80%, either expand the volume or clean old data.

SSL Certificate Check

Mailcow uses Let's Encrypt with auto-renewal. Verify it's working:

docker compose exec acme-mailcow openssl x509 -in /etc/ssl/mail/cert.pem -noout -dates

If the certificate expired, force renewal:

docker compose restart acme-mailcow

Reputation Check

• Google Postmaster Tools: Check domain and IP reputation
• Microsoft SNDS: Check your IP's complaint rate
• MXToolbox: Run a full domain health check

Practitioner note: The monthly update is the most skipped task. People set up Mailcow and forget about updates for six months. Then they hit a bug that was fixed three versions ago, or worse, a security vulnerability. Set a calendar reminder. It takes 5 minutes.

Automated Monitoring Setup

Don't rely on manual checks alone. Set up automated alerts:

Option 1: UptimeRobot (Free)

Monitor your mail server's HTTPS endpoint (port 443) and SMTP endpoint (port 587). UptimeRobot sends alerts when either goes down.

Option 2: Cron-Based Monitoring

Add to your server's crontab:

# Check if Postfix is running (every 5 min)
*/5 * * * * docker inspect --format='{{.State.Running}}' mailcowdockerized-postfix-mailcow-1 | grep -q true || echo "Postfix down" | mail -s "ALERT: Mailcow Postfix Down" [email protected]

# Check queue depth (every 15 min)  
*/15 * * * * QUEUE=$(docker compose -f /opt/mailcow-dockerized/docker-compose.yml exec -T postfix-mailcow mailq 2>/dev/null | grep -c "^[A-F0-9]"); [ "$QUEUE" -gt 100 ] && echo "Queue: $QUEUE" | mail -s "ALERT: Mail Queue High" [email protected]

Option 3: Mailcow API Monitoring

Mailcow exposes a REST API. Poll it for health metrics and integrate with your existing monitoring stack (Grafana, Datadog, etc.).

Quarterly Tasks

DKIM Key Rotation

Rotate DKIM keys every 6-12 months. In Mailcow admin → Configuration → Domains → DKIM → regenerate key. Update DNS with the new key. Keep the old key in DNS for 48 hours to handle in-flight emails.

Backup Verification

If you have backups configured, verify they actually work:

# Test restore of Mailcow backup
# (on a test server, not production)

Backups you don't test aren't backups.

Practitioner note: I maintain a shared Google Sheet with every client's Mailcow server, last update date, last blacklist check date, and current reputation status. Low-tech but effective. When a cell turns red (overdue), I know exactly which server needs attention.

If managing your Mailcow server feels like more work than you signed up for, schedule a consultation — I offer managed Mailcow maintenance for businesses that want self-hosted costs without the operational overhead.

Sources

• Mailcow: Update Documentation
• Google: Postmaster Tools
• Microsoft: SNDS
• MXToolbox: Blacklist Check

---

v1.0 · April 2026