[GH-ISSUE #1110] Proxy mail server #914

Open
opened 2026-02-26 06:34:55 +03:00 by kerem · 21 comments
Owner

Originally created by @kennylajara on GitHub (May 19, 2021).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1110

Is your feature request related to a problem? Please describe.

I am trying to proxy a mailserver but the task seams to be impossible at the moment with NPM whit this is possible to do with Nginx.

Describe the solution you'd like

I'd like the option to stream proxy mail serves as described here: https://docs.nginx.com/nginx/admin-guide/mail-proxy/mail-proxy/
I tried to stream the ports but the protocoles imap, smpt and pop3 are not supported by NPM.

Describe alternatives you've considered

The only alternative that I can think is manually configure the mailserver with the "Custom Nginx configuration" option but the reason why I am using NPM is because I don't know how to deal with Nginx directly.

Originally created by @kennylajara on GitHub (May 19, 2021). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1110 <!-- Are you in the right place? - If you are looking for support on how to get your upstream server forwarding, please consider asking the community on Reddit. - If you are writing code changes to contribute and need to ask about the internals of the software, Gitter is the best place to ask. - If you think you found a bug with NPM (not Nginx, or your upstream server or MySql) then you are in the *right place.* --> **Is your feature request related to a problem? Please describe.** <!-- A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] --> I am trying to proxy a mailserver but the task seams to be impossible at the moment with NPM whit this is possible to do with Nginx. **Describe the solution you'd like** <!-- A clear and concise description of what you want to happen. --> I'd like the option to stream proxy mail serves as described here: https://docs.nginx.com/nginx/admin-guide/mail-proxy/mail-proxy/ I tried to stream the ports but the protocoles `imap`, `smpt` and `pop3` are not supported by NPM. **Describe alternatives you've considered** <!-- A clear and concise description of any alternative solutions or features you've considered. --> The only alternative that I can think is manually configure the mailserver with the "Custom Nginx configuration" option but the reason why I am using NPM is because I don't know how to deal with Nginx directly.
Author
Owner

@jc21 commented on GitHub (May 19, 2021):

While the version of Nginx (OpenResty) is built with mail extensions, this project doesn't really support this type of configuration as the nginx document describes. Certainly something that could be added in future, though I'd like to see more demand for it.

If anyone else is wanting this feature please add a thumbs up to @kennylajara's issue above.

<!-- gh-comment-id:844544985 --> @jc21 commented on GitHub (May 19, 2021): While the version of Nginx (OpenResty) is built with mail extensions, this project doesn't really support this type of configuration as the nginx document describes. Certainly something that could be added in future, though I'd like to see more demand for it. If anyone else is wanting this feature please add a thumbs up to @kennylajara's issue above.
Author
Owner

@kennylajara commented on GitHub (May 20, 2021):

Ok... so, meanwhile I am trying some workaround and need to mound my mailsever's .well-known directory with the proxy's .well-known directory but looks like the npm's .well-known directory is not being used. The .well-know directory that I found with some files is on the docker's overlay2 directory...

So... can you help me on that?

<!-- gh-comment-id:845242100 --> @kennylajara commented on GitHub (May 20, 2021): Ok... so, meanwhile I am trying some workaround and need to mound my mailsever's `.well-known` directory with the proxy's `.well-known` directory but looks like the npm's `.well-known` directory is not being used. The `.well-know` directory that I found with some files is on the docker's `overlay2` directory... So... can you help me on that?
Author
Owner

@dszymczuk commented on GitHub (Dec 26, 2021):

I'm bumping this issue. Is it possible to mount .well-known folder into nginx-proxy-manager?
I would like to use poste.io as my mail server, but to enable TLS certificate with let's encrypt I need to mount .well-known folder from poste.io.
I don't know how to use /data/letsencrypt-acme-challenge folder correctly.

<!-- gh-comment-id:1001211733 --> @dszymczuk commented on GitHub (Dec 26, 2021): I'm bumping this issue. Is it possible to mount `.well-known` folder into nginx-proxy-manager? I would like to use poste.io as my mail server, but to enable TLS certificate with let's encrypt I need to mount `.well-known` folder from poste.io. I don't know how to use `/data/letsencrypt-acme-challenge` folder correctly.
Author
Owner

@chaptergy commented on GitHub (Dec 27, 2021):

As a workaround: you could mount a file with an nginx mail block into /data/nginx/custom/root.conf. (See custom mountpoints)

<!-- gh-comment-id:1001740160 --> @chaptergy commented on GitHub (Dec 27, 2021): As a workaround: you could mount a file with an nginx `mail` block into `/data/nginx/custom/root.conf`. (See [custom mountpoints](https://nginxproxymanager.com/advanced-config/#custom-nginx-configurations))
Author
Owner

@iamk3 commented on GitHub (Dec 27, 2021):

I am interested in this functionality as well!

@chaptergy would you provide an example or link to an example of how to add the mail block? I understand the location based on your previous link. There currently isn't a dir located at /data/nginx/custom/ to contain any conf files.

<!-- gh-comment-id:1001783998 --> @iamk3 commented on GitHub (Dec 27, 2021): I am interested in this functionality as well! @chaptergy would you provide an example or link to an example of how to add the mail block? I understand the location based on your previous link. There currently isn't a dir located at /data/nginx/custom/ to contain any conf files.
Author
Owner

@chaptergy commented on GitHub (Dec 27, 2021):

Well, you'll need to mount it into the docker container. So you would have to create a file on the host where docker is running, e.g. nginx-mail.conf with your desired nginx config. It could look something like this: Example by @aitkar

mail {
    server_name mail.example.com;
    auth_http   localhost:9000/cgi-bin/nginxauth.cgi;

    proxy_pass_error_message on;

    ssl                 on;
    ssl_certificate     /etc/ssl/certs/server.crt;
    ssl_certificate_key /etc/ssl/certs/server.key;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;

    server {
        listen     25;
        protocol   smtp;
        smtp_auth  login plain cram-md5;
    }

    server {
        listen    110;
        protocol  pop3;
        pop3_auth plain apop cram-md5;
}

     server {
        listen   143;
        protocol imap;
    }
}
Click to view note about certificates

Note: Certificate files are usually located at the following locations.

ssl_certificate /etc/letsencrypt/live/npm-<cert-id>/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/npm-<cert-id>/privkey.pem;

The <cert-id> can be found in the list of ssl certficates. In this case the <cert-id> would be 3.
image

Then you have to edit you docker compose file to mount this file into the specific location inside the container and expose your ports:

services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    [...]
    ports:
      # Expose the ports you need for your mail
      - '25:25'
      - '110:110'
      - '143:143'
      - [...]
    volumes:
      - /path/to/nginx-mail.conf:/data/nginx/custom/root.conf  # Add this line
      - [...]
<!-- gh-comment-id:1001788265 --> @chaptergy commented on GitHub (Dec 27, 2021): Well, you'll need to mount it into the docker container. So you would have to create a file on the host where docker is running, e.g. `nginx-mail.conf` with your desired nginx config. It could look something like this: <sup>[Example by @aitkar](https://github.com/jc21/nginx-proxy-manager/issues/450#issue-633678356)</sup> ```nginx mail { server_name mail.example.com; auth_http localhost:9000/cgi-bin/nginxauth.cgi; proxy_pass_error_message on; ssl on; ssl_certificate /etc/ssl/certs/server.crt; ssl_certificate_key /etc/ssl/certs/server.key; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; server { listen 25; protocol smtp; smtp_auth login plain cram-md5; } server { listen 110; protocol pop3; pop3_auth plain apop cram-md5; } server { listen 143; protocol imap; } } ``` <details><summary>Click to view note about certificates</summary> > Note: Certificate files are usually located at the following locations. > ```nginx > ssl_certificate /etc/letsencrypt/live/npm-<cert-id>/fullchain.pem; > ssl_certificate_key /etc/letsencrypt/live/npm-<cert-id>/privkey.pem; > ``` > The `<cert-id>` can be found in the list of ssl certficates. In this case the `<cert-id>` would be `3`. > ![image](https://user-images.githubusercontent.com/26956711/147511616-13652519-78bb-4a40-8d4d-026fe09f62f0.png) </details> Then you have to edit you docker compose file to mount this file into the specific location inside the container and expose your ports: ```yml services: app: image: 'jc21/nginx-proxy-manager:latest' [...] ports: # Expose the ports you need for your mail - '25:25' - '110:110' - '143:143' - [...] volumes: - /path/to/nginx-mail.conf:/data/nginx/custom/root.conf # Add this line - [...] ```
Author
Owner

@sanderlv commented on GitHub (Nov 25, 2022):

Is there and progress on this implementation or fearure request? Would love to see this natively in NPM. Having my mail services beging NPM with an ssl cert. (The described docker tip is too complex for me to understand).

<!-- gh-comment-id:1327811935 --> @sanderlv commented on GitHub (Nov 25, 2022): Is there and progress on this implementation or fearure request? Would love to see this natively in NPM. Having my mail services beging NPM with an ssl cert. (The described docker tip is too complex for me to understand).
Author
Owner

@vadikonline1 commented on GitHub (Dec 15, 2022):

Create with portainer:

Image: docker.io/mailserver/docker-mailserver:edge
Ports: 25:25 143:143 465:465 587:587 993:993
Volume: contrainer: /etc/letsencrypt -> volume: (indicate the volume from npm where the certificates are included)
Network: hostname: mail DomainName: example.vom
Environment variables:
ENABLE_FAIL2BAN=1
SSL_TYPE=manual
PERMIT_DOCKER=network
ONE_DIR=1
ENABLE_POSTGREY=0
ENABLE_CLAMAV=0
ENABLE_SPAMASSASSIN=0
SPOOF_PROTECTION=0
FETCHMAIL_POLL=300
POSTGREY_AUTO_WHITELIST_CLIENTS=5
POSTGREY_DELAY=300
POSTGREY_MAX_AGE=35
POSTGREY_TEXT=Delayed by Postgrey
SASLAUTHD_MECH_OPTIONS=
SSL_CERT_PATH=/etc/letsencrypt/live/npm-X/fullchain.pem
SSL_KEY_PATH=/etc/letsencrypt/live/npm-X/privkey.pem
TLS_LEVEL=modern
Container capabilities: NET_ADMIN SYS_PTRACE

After starting the container, apply the following commands in the console:

  1. setup email add admin@example.com password (from adding accounts)
  2. setup config dkim
<!-- gh-comment-id:1352941503 --> @vadikonline1 commented on GitHub (Dec 15, 2022): Create with portainer: **Image**: docker.io/mailserver/docker-mailserver:edge **Ports**: 25:25 143:143 465:465 587:587 993:993 **Volume**: contrainer: /etc/letsencrypt -> volume: (indicate the volume from npm where the certificates are included) **Network**: hostname: mail DomainName: example.vom **Environment variables:** ENABLE_FAIL2BAN=1 SSL_TYPE=manual PERMIT_DOCKER=network ONE_DIR=1 ENABLE_POSTGREY=0 ENABLE_CLAMAV=0 ENABLE_SPAMASSASSIN=0 SPOOF_PROTECTION=0 FETCHMAIL_POLL=300 POSTGREY_AUTO_WHITELIST_CLIENTS=5 POSTGREY_DELAY=300 POSTGREY_MAX_AGE=35 POSTGREY_TEXT=Delayed by Postgrey SASLAUTHD_MECH_OPTIONS= SSL_CERT_PATH=/etc/letsencrypt/live/npm-X/fullchain.pem SSL_KEY_PATH=/etc/letsencrypt/live/npm-X/privkey.pem TLS_LEVEL=modern **Container capabilities**: NET_ADMIN SYS_PTRACE After starting the container, apply the following commands in the console: 1. setup email add admin@example.com password (from adding accounts) 2. setup config dkim
Author
Owner

@pacomarcilla commented on GitHub (Aug 3, 2023):

I don´t know if I arrive late to the party but here are my 2 cents. I do have NPM working for ports 25, 587 and 993 as streams for my mail server.

All I've done is:

  • Modify the docker-compose file to expose ports 25, 587 and 993.
  • Recreate de container with the new docker-compose file.
  • Redirect traffic from pfsense firewall through the NPM.
  • Create a stream for each port pointing to the backend server.

All seems do work perfectly fine from the outside.

I do have some other streams for other services working but seems like mail ports are more sensible.

Hope it helps!

<!-- gh-comment-id:1663807216 --> @pacomarcilla commented on GitHub (Aug 3, 2023): I don´t know if I arrive late to the party but here are my 2 cents. I do have NPM working for ports 25, 587 and 993 as streams for my mail server. All I've done is: - Modify the docker-compose file to expose ports 25, 587 and 993. - Recreate de container with the new docker-compose file. - Redirect traffic from pfsense firewall through the NPM. - Create a stream for each port pointing to the backend server. All seems do work perfectly fine from the outside. I do have some other streams for other services working but seems like mail ports are more sensible. Hope it helps!
Author
Owner

@quillfires commented on GitHub (Nov 23, 2023):

I don´t know if I arrive late to the party but here are my 2 cents. I do have NPM working for ports 25, 587 and 993 as streams for my mail server.

All I've done is:

  • Modify the docker-compose file to expose ports 25, 587 and 993.
  • Recreate de container with the new docker-compose file.
  • Redirect traffic from pfsense firewall through the NPM.
  • Create a stream for each port pointing to the backend server.

All seems do work perfectly fine from the outside.

I do have some other streams for other services working but seems like mail ports are more sensible.

Hope it helps!

How did you do this?

<!-- gh-comment-id:1824853795 --> @quillfires commented on GitHub (Nov 23, 2023): > I don´t know if I arrive late to the party but here are my 2 cents. I do have NPM working for ports 25, 587 and 993 as streams for my mail server. > > All I've done is: > > * Modify the docker-compose file to expose ports 25, 587 and 993. > * Recreate de container with the new docker-compose file. > * Redirect traffic from pfsense firewall through the NPM. > * Create a stream for each port pointing to the backend server. > > All seems do work perfectly fine from the outside. > > I do have some other streams for other services working but seems like mail ports are more sensible. > > Hope it helps! How did you do this?
Author
Owner

@Smallinger commented on GitHub (Dec 16, 2023):

if there any updates for this ?

<!-- gh-comment-id:1858873575 --> @Smallinger commented on GitHub (Dec 16, 2023): if there any updates for this ?
Author
Owner

@Baltimorepc commented on GitHub (Mar 6, 2024):

i would love to get this working for me as i use my Asustor Nas and it has trouble getting certs. i would love to run my mail server thru my npm but i have not been able to get it to work

<!-- gh-comment-id:1982029862 --> @Baltimorepc commented on GitHub (Mar 6, 2024): i would love to get this working for me as i use my Asustor Nas and it has trouble getting certs. i would love to run my mail server thru my npm but i have not been able to get it to work
Author
Owner

@manalishi70 commented on GitHub (May 24, 2024):

I don´t know if I arrive late to the party but here are my 2 cents. I do have NPM working for ports 25, 587 and 993 as streams for my mail server.

All I've done is:

  • Modify the docker-compose file to expose ports 25, 587 and 993.
  • Recreate de container with the new docker-compose file.
  • Redirect traffic from pfsense firewall through the NPM.
  • Create a stream for each port pointing to the backend server.

All seems do work perfectly fine from the outside.

I do have some other streams for other services working but seems like mail ports are more sensible.

Hope it helps!

I don´t know if I arrive late to the party but here are my 2 cents. I do have NPM working for ports 25, 587 and 993 as streams for my mail server.

All I've done is:

  • Modify the docker-compose file to expose ports 25, 587 and 993.
  • Recreate de container with the new docker-compose file.
  • Redirect traffic from pfsense firewall through the NPM.
  • Create a stream for each port pointing to the backend server.

All seems do work perfectly fine from the outside.

I do have some other streams for other services working but seems like mail ports are more sensible.

Hope it helps!

I try this by creating a proxy host my.domain.com:993 pointing to port 147 on the mailserver. Did you do it this way?
It doesn't work for me

<!-- gh-comment-id:2129242159 --> @manalishi70 commented on GitHub (May 24, 2024): > I don´t know if I arrive late to the party but here are my 2 cents. I do have NPM working for ports 25, 587 and 993 as streams for my mail server. > > All I've done is: > > * Modify the docker-compose file to expose ports 25, 587 and 993. > * Recreate de container with the new docker-compose file. > * Redirect traffic from pfsense firewall through the NPM. > * Create a stream for each port pointing to the backend server. > > All seems do work perfectly fine from the outside. > > I do have some other streams for other services working but seems like mail ports are more sensible. > > Hope it helps! > I don´t know if I arrive late to the party but here are my 2 cents. I do have NPM working for ports 25, 587 and 993 as streams for my mail server. > > All I've done is: > > * Modify the docker-compose file to expose ports 25, 587 and 993. > * Recreate de container with the new docker-compose file. > * Redirect traffic from pfsense firewall through the NPM. > * Create a stream for each port pointing to the backend server. > > All seems do work perfectly fine from the outside. > > I do have some other streams for other services working but seems like mail ports are more sensible. > > Hope it helps! I try this by creating a proxy host my.domain.com:993 pointing to port 147 on the mailserver. Did you do it this way? It doesn't work for me
Author
Owner

@Baltimorepc commented on GitHub (May 28, 2024):

Thank you i will give this a try hopfully it will work as all my mail server is showing not trusted even though it is and my nextcloud or other services wont send emails because of it

<!-- gh-comment-id:2135938657 --> @Baltimorepc commented on GitHub (May 28, 2024): Thank you i will give this a try hopfully it will work as all my mail server is showing not trusted even though it is and my nextcloud or other services wont send emails because of it
Author
Owner

@marshalleq commented on GitHub (Oct 25, 2024):

So this is not currently supported by the looks in Nginx Proxy Manager. I assume it would be easier to get to work in something like https://hub.docker.com/r/linuxserver/swag which I used to use, but came to this for simplicity. Seems like this simplicity has some drawbacks.

<!-- gh-comment-id:2436594120 --> @marshalleq commented on GitHub (Oct 25, 2024): So this is not currently supported by the looks in Nginx Proxy Manager. I assume it would be easier to get to work in something like https://hub.docker.com/r/linuxserver/swag which I used to use, but came to this for simplicity. Seems like this simplicity has some drawbacks.
Author
Owner

@hanisntsolo commented on GitHub (Jan 23, 2025):

is somebody looking at this @jc21 pls help with the mail proxy

<!-- gh-comment-id:2609662735 --> @hanisntsolo commented on GitHub (Jan 23, 2025): is somebody looking at this @jc21 pls help with the mail proxy
Author
Owner

@hanisntsolo commented on GitHub (Jan 23, 2025):

While the version of Nginx (OpenResty) is built with mail extensions, this project doesn't really support this type of configuration as the nginx document describes. Certainly something that could be added in future, though I'd like to see more demand for it.

If anyone else is wanting this feature please add a thumbs up to @kennylajara's issue above.

can you please help here there are enough upvotes to address this issue.

<!-- gh-comment-id:2609803241 --> @hanisntsolo commented on GitHub (Jan 23, 2025): > While the version of Nginx (OpenResty) is built with mail extensions, this project doesn't really support this type of configuration as the nginx document describes. Certainly something that could be added in future, though I'd like to see more demand for it. > > If anyone else is wanting this feature please add a thumbs up to [@kennylajara](https://github.com/kennylajara)'s issue above. can you please help here there are enough upvotes to address this issue.
Author
Owner

@Bigsausage64 commented on GitHub (Feb 26, 2025):

Hi,

I've managed to get my SMTP server behind my NPM with a stream host but as every connection come from a local IP (my NPM's private address) I can't find a way to not be an open relay.

If I trust m'y NPM's private address, I become open relay, if I don't trust it, legit emails are rejected.

When my SMTP server is directly connected to internet (no proxy involved), everything works fine.

Can someone help me understand what I'm doing wrong ? Thanks

<!-- gh-comment-id:2685861163 --> @Bigsausage64 commented on GitHub (Feb 26, 2025): Hi, I've managed to get my SMTP server behind my NPM with a stream host but as every connection come from a local IP (my NPM's private address) I can't find a way to not be an open relay. If I trust m'y NPM's private address, I become open relay, if I don't trust it, legit emails are rejected. When my SMTP server is directly connected to internet (no proxy involved), everything works fine. Can someone help me understand what I'm doing wrong ? Thanks
Author
Owner

@phoniclynx commented on GitHub (Jul 27, 2025):

I've tried to get NPM to work with streams, but every time I try creating the stream in the web interface, it gives the error "Internal Error".
Has anyone got an example of what I could write as a config file in the /data/ngix/stream folder? or if there is something better to get stream working?

<!-- gh-comment-id:3124274456 --> @phoniclynx commented on GitHub (Jul 27, 2025): I've tried to get NPM to work with streams, but every time I try creating the stream in the web interface, it gives the error "Internal Error". Has anyone got an example of what I could write as a config file in the /data/ngix/stream folder? or if there is something better to get stream working?
Author
Owner

@github-actions[bot] commented on GitHub (Jan 29, 2026):

Issue is now considered stale. If you want to keep it open, please comment 👍

<!-- gh-comment-id:3815026321 --> @github-actions[bot] commented on GitHub (Jan 29, 2026): Issue is now considered stale. If you want to keep it open, please comment :+1:
Author
Owner

@JSchlesinger commented on GitHub (Feb 16, 2026):

Yes I would like this feature too please, specifically to expose the proton mail bridge running in docker so I can access my Proton email when I am not on the same network.

<!-- gh-comment-id:3909260857 --> @JSchlesinger commented on GitHub (Feb 16, 2026): Yes I would like this feature too please, specifically to expose the proton mail bridge running in docker so I can access my Proton email when I am not on the same network.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/nginx-proxy-manager-NginxProxyManager#914
No description provided.