I run and manage a MailCow mail server carrying 3,000+ mailboxes, backed by a custom Laravel application with an Angular UI that manages users and configuration through the MailCow API. This post covers the platform and the mail knowledge behind it.
The mail platform
MailCow is the engine — a Docker-based mail suite (Postfix, Dovecot, rspamd) with a clean API. On top of it sits my own management platform: a Laravel backend that talks to the MailCow API, and an Angular front-end that gives administrators a tailored interface for the whole mail operation — mailboxes, domains, aliases and quotas at scale, without touching the admin UI manually.
Custom control plane — Laravel + Angular + MailCow API
The Laravel layer owns the business logic: provisioning users and domains, applying configuration, enforcing naming and quota policies, and auditing every change. The Angular UI sits on top as a clean, fast management surface. Because everything flows through the MailCow API, the platform can automate what would otherwise be thousands of manual clicks — and it keeps full control over who is allowed to change what.
Postfix configuration & management
Under the hood I configure and manage Postfix directly: delivery and transport rules, relaying, and how mail flows between internal and external destinations. Knowing the MTA layer matters — the management platform is only as reliable as the routing, queues and bounce behaviour beneath it.
Spam — defence in depth
Spam handling is a layered problem, not a single filter. rspamd does content scoring and policy checks; SPF, DKIM and DMARC alignment stop forged senders; greylisting and RBL checks keep the obvious noise out before it reaches scoring. I tune those policies per domain and keep an eye on false positives — for 3,000+ mailboxes, the difference between aggressive and accurate filtering is real mail landing in inboxes.
Outcome
3,000+ mailboxes running on a platform where provisioning, configuration and policy are API-driven and automated, with Postfix tuned for reliable delivery and a spam defence that keeps inboxes clean without burning trust on false positives.