mailcow

mailcow.email
Awesome Privacy➔ Networking➔ Mail Servers➔ mailcow
mailcow

A mail server with everything you need (SMTP, IMAP, webmail, NextCloud support..) using Docker.

Also Consider

Open Source

mailcow Source Code

Author

mailcow

Description

mailcow: dockerized - 🐮 + 🐋 = 💕

#acme#clamav#docker#docker-compose#dovecot#groupware#hacktoberfest#imap#mail#mailcow#mailserver#olefy#postfix#rspamd#servercow#smtp#sogo

Homepage

https://mailcow.email

Repository

  • LicenseGPL-3.0
  • Created09 Dec 16
  • Primary languageJavaScript
  • Size47,917 KB
  • Stars13,631
  • Forks1,834
  • Watchers13,631

Language Usage

Language Usage

Project Health

  • Last commit2 days ago
  • Open issues535
  • Latest release2026-09

Top Contributors

Recent Commits

  • FreddleSpl0it(06 Oct 26)

    Merge pull request #7506 from mailcow/staging Update 2026-09a

  • FreddleSpl0it(06 Oct 26)

    Merge pull request #7505 from mailcow/feat/rspamd-4.2.1 [Rspamd] Update to 4.2.1

  • FreddleSpl0it(06 Oct 26)

    [Rspamd] update to 4.2.1

  • FreddleSpl0it(06 Oct 26)

    [Rspamd] Fix CTE and boundary prefix in domain wide footer

  • FreddleSpl0it(06 Oct 26)

    Merge pull request #7504 from ralfbergs/fix/typo-resovler Fixed typo (changing RESOVLER to RESOLVER).

  • FreddleSpl0it(06 Oct 26)

    Merge pull request #7484 from oidipos/feat/tlspol [postfix-tlspol] bump to v1.14.0

  • Ralf Bergs(03 Oct 26)

    Fixed typo (changing RESOVLER to RESOLVER).

  • milkmaker(01 Oct 26)

    update postscreen_access.cidr (#7494)

  • oidipos(25 Sept 26)

    bump postfix-tlspol to v1.14.0

  • FreddleSpl0it(21 Sept 26)

    Merge pull request #7477 from mailcow/staging Update 2026-09

  • FreddleSpl0it(21 Sept 26)

    Merge pull request #7432 from mailcow/renovate/redis-7.x Update redis Docker tag to v7.4.11

  • FreddleSpl0it(21 Sept 26)

    Merge pull request #7475 from mailcow/feat/sogo-5.12.11 [SOGo] Update to 5.12.11

  • FreddleSpl0it(21 Sept 26)

    [SOGo] Update to 5.12.11

  • FreddleSpl0it(21 Sept 26)

    Merge pull request #7473 from mailcow/feat/unbound-1.26.1 [Unbound] Update to 1.26.1

  • FreddleSpl0it(21 Sept 26)

    [Unbound] Update to 1.26.1

  • renovate[bot](15 Sept 26)

    Update redis Docker tag to v7.4.11 Signed-off-by: milkmaker <[email protected]>

  • milkmaker(09 Sept 26)

    [Web] Updated lang.it-it.json (#7460) Co-authored-by: Stefano <[email protected]>

  • milkmaker(07 Sept 26)

    Translations update from Weblate (#7457) * [Web] Updated lang.si-si.json Co-authored-by: Matjaž Tekavec <[email protected]> Co-authored-by: milkmaker <[email protected]> * [Web] Updated lang.zh-cn.json Co-authored-by: 雨 <[email protected]> --------- Co-authored-by: Matjaž Tekavec <[email protected]> Co-authored-by: 雨 <[email protected]>

  • milkmaker(01 Sept 26)

    update postscreen_access.cidr (#7450)

  • milkmaker(19 Aug 26)

    Translations update from Weblate (#7431) * [Web] Updated lang.it-it.json Co-authored-by: Claudio <[email protected]> * [Web] Updated lang.si-si.json Co-authored-by: Matjaž Tekavec <[email protected]> --------- Co-authored-by: Claudio <[email protected]> Co-authored-by: Matjaž Tekavec <[email protected]>

  • FreddleSpl0it(18 Aug 26)

    Merge pull request #7376 from smpaz7467/fix/extended-sender-acl-authsource [Web] show external sender addresses regardless of authsource

  • FreddleSpl0it(18 Aug 26)

    Merge pull request #7349 from smpaz7467/fix/login-redirect-deeplink [Web] redirect deep links to the matching login page

  • FreddleSpl0it(18 Aug 26)

    Merge pull request #7347 from smpaz7467/fix/dns-zonefile-absolute-rhs [Web] use absolute RHS names in generated DNS zonefile

  • FreddleSpl0it(18 Aug 26)

    Merge pull request #7342 from FrauJulian/feat/show-password [Web] Add show/hide password toggle on login pages

  • FreddleSpl0it(18 Aug 26)

    Merge pull request #7428 from mailcow/feat/forbid-external-alias [Web] Add ACL + global switch to disable external alias goto

  • FreddleSpl0it(18 Aug 26)

    [Web] Add ACL + global switch to disable external alias goto

  • FreddleSpl0it(18 Aug 26)

    Merge pull request #7344 from smpaz7467/fix/forced-pw-change-raw-lang-key [Web] translate password errors in the forced password change modal

  • FreddleSpl0it(18 Aug 26)

    Merge pull request #7290 from wryfi/7150-fix-passwd-verify Fix #7150: passwd-verify.lua wipes auth cache during any nginx outage

  • FreddleSpl0it(18 Aug 26)

    Merge pull request #7334 from DerLinkman/feat/postfix-tlspol-update postfix-tlspol: upgrade to trixie + 1.11.0 update

  • FreddleSpl0it(18 Aug 26)

    Merge pull request #7427 from mailcow/staging Update 2026-07b

mailcow Security

5.7/10

Repo Security Summary

Updated 24 Aug 26

  • Dangerous-Workflow10/10
  • Code-Review3/10
  • Security-Policy10/10
  • Maintained10/10
  • CII-Best-Practices0/10
  • Token-Permissions0/10
  • License10/10
  • Binary-Artifacts10/10
  • Signed-ReleasesN/A
  • Branch-ProtectionN/A
  • Fuzzing0/10
  • Packaging10/10
  • SAST0/10
  • Pinned-Dependencies0/10

Security Advisories (22)

  • lowPatched

    CVE-2026-40878Reflected Parameter Injection / Wrong-Context XSS Escaping in mailcow-dockerized Login Page

  • highPatchedCVSS 7.2

    CVE-2026-40871Second Order SQL Injection in quarantine category via API

  • criticalPatched

    CVE-2026-40872Stored XSS in autodiscover logs email address field

  • highPatched

    CVE-2026-40873Stored XSS in Quarantine attachment filenames

  • mediumPatched

    CVE-2026-40874Missing authorization on Forwarding Hosts delete action

  • highPatched

    CVE-2026-40875Stored XSS in user login history real_rip

  • criticalPatchedCVSS 9.1

    CVE-2025-53909SSTI in Quota and Quarantine Notification Template

  • highPatchedCVSS 7.1

    CVE-2025-25198Password reset poisoning

  • highPatchedCVSS 7

    CVE-2024-56529Session Fixation on mailcow web panel

  • lowPatchedCVSS 3.8

    CVE-2024-41960XSS Vulnerability via Relay Hosts Configuration

  • highPatchedCVSS 7.6

    CVE-2024-41959XSS Vulnerability via API Logs

  • mediumPatchedCVSS 6.6

    CVE-2024-41958Two-Factor Authentication (2FA) Bypass Vulnerability

  • mediumPatchedCVSS 6.8

    CVE-2024-31204XSS Vulnerability via Exception Handler

  • mediumPatchedCVSS 6.7

    CVE-2024-30270Path Traversal and Arbitrary Code Execution Vulnerability

  • highPatchedCVSS 8.8

    CVE-2024-24760Docker Container Exposure to Local Network

  • mediumPatchedCVSS 4.7

    CVE-2024-23824Pixel flood attack leads to Denial of Service in admin page

  • highPatchedCVSS 8.3

    CVE-2023-49077XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation

  • highPatchedCVSS 8.8

    CVE-2023-34108Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords

  • highPatched

    CVE-2023-26490Shell command injection via xoauth2 authentication in imapsync​

  • mediumPatched

    CVE-2022-39258Possible Phishing attacks through Swagger UI

  • criticalPatched

    CVE-2022-31138CVE-2022-31138: IMAPSYNC (Syncjobs) Debug Extended Rights (hidden options)

  • criticalPatched

    CVE-2022-31245CVE-2022-31245: IMAPSYNC (Syncjobs) Debug Extended Rights (pipemess)

mailcow Website

Website

mailcow: dockerized - Blog

The mailserver suite with the 'moo' – 🐮 + 🐋 = 💕 | Official Blog Page

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address185.199.111.153
  • Hostnamecdn-185-199-111-153.github.com
  • LocationFrancisco,Indiana,United States of America,NA
  • ISPGitHub Inc.
  • ASNAS54113

Associated Countries

  • DEDE
  • USUS

Safety Score

Website marked as safe

100%

Trackers

No known trackers found

Blacklist Check

mailcow.email was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview
View full report atweb-check.xyz

mailcow Reviews

More Mail Servers

View More...

About the Data: mailcow

Change History

Edit mailcow Data

You can edit mailcow's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

Delete mailcow Submit Edit to mailcow Add alternative

API

You can access mailcow's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/mailcow

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share mailcow

Help your friends compare Mail Servers, and pick privacy-respecting software and services.
Share mailcow and Awesome Privacy with your network!

← Previous

Docker Mailserver

View Mail Servers (3)