CASE STUDY

KAIROSS MAIL

SELF-HOSTED EMAIL ON OUR OWN DOMAIN

Our own deployment of the mail server we set up for clients: a Docker-based mail stack with SOGo webmail at mail.kaiross.in, on its own server, with the DNS and TLS that make it deliverable.

OPEN THE WEBMAIL All client work

Want one on your domain? Get this as a template

Kaiross Mail cover art: a server tower with a padlock and an envelope flying out of it

Verified on the live host · 10 Sep 2026

5
Protocols open
3
DNS records
1
Domain
TLS
Let's Encrypt

THE BRIEF

Kaiross is the client here. The studio wanted email on its own domain that did not bill per seat and did not sit in somebody else's data centre, and it wanted the mail server to live on its own machine, apart from the server that runs the apps.

The result is mail.kaiross.in, and the same build is what we now offer as the custom mail server template.

What it had to do

  • Email on kaiross.in without paying per mailbox, for every role address the studio wants.
  • Mail that stays on a server Kaiross controls, separate from the server that runs its apps.
  • Webmail with calendar and contacts for the browser, and plain IMAP and SMTP for every other client.
  • DNS that makes the mail deliverable from day one: MX, SPF, DKIM and DMARC.
  • TLS on every connection, renewed without anyone remembering to.

WHAT WAS BUILT

Six parts, each one answering on the live host today

Docker-based mail stack

The mail services run as containers on their own server, separate from the app server.

SOGo webmail

Groupware at /SOGo: mail, calendar and contacts in the browser. /webmail and /login answer too.

Admin panel

A web UI at /admin for mailboxes, aliases and domains.

nginx in front

Terminates HTTPS and serves the webmail, the admin panel and the autoconfig file.

Let's Encrypt TLS

Certificate issued 4 Sep 2026; plain HTTP redirects to HTTPS.

Mail-client autoconfig

Served at /.well-known/autoconfig/mail/config-v1.1.xml so Thunderbird and Outlook set themselves up.

DNS & DELIVERABILITY

Three records published for kaiross.in, plus the DMARC policy that reports on them. This is the part that keeps a self-hosted server out of the spam folder.

A clipboard with five ticked rows: MX, SPF, DKIM, DMARC and TLS, beside an envelope with a shield
MX
kaiross.in → mail.kaiross.in, priority 5Where mail for the domain is delivered.
SPF
v=spf1 mx a:mail.kaiross.in ~allWhich hosts may send as kaiross.in.
DKIM
selector mail · RSA · sha256A signature on every outgoing message, verifiable from DNS.
DMARC
p=noneMonitoring mode: reports first, enforcement later.

THE WEBMAIL

SOGo answers at /SOGo: mail, calendar and contacts in one browser tab, behind the same login. The page title is simply “Kaiross Mail”. Anyone who would rather use a desktop or phone app points it at the host and the autoconfig file fills in the ports.

nginx sits in front of it all with a Let's Encrypt certificate, and plain HTTP is redirected to HTTPS, so there is no unencrypted path to the mailbox.

THE SHAPE OF IT

A mail server is three things: a stack that stores and moves mail, a front door people can log in to, and the DNS that persuades everyone else to accept what it sends. Skip the third and the first two are a very private diary.

SCOPE OF THE BUILD

Mail serverSOGo webmailAdmin panelnginx + TLSAutoconfigMX / SPF / DKIM / DMARCOwn server

THE SAME SERVER, YOUR DOMAIN

Everything on this page is available as a template: we set it up on your domain and your server, publish the DNS, and hand over the admin panel.

GET THIS AS A TEMPLATE START YOUR PROJECT