Monitoring Mailcow with Vigilmon

Mailcow is the de facto Docker-based email suite for self-hosters who want a full Google Workspace replacement with complete data ownership. It bundles Postfix, Dovecot, Rspamd, ClamAV, SOGo, nginx, MySQL, and Redis into a single Docker Compose stack with a polished web admin UI. Running your own mail server is powerful — but a silent Mailcow failure means lost email, bounced messages, and frustrated users. Vigilmon gives you real-time alerts when any Mailcow component goes down, before your inbox does.

What You'll Set Up

HTTP uptime monitor for the Mailcow web admin UI
Mailcow REST API health check confirming all containers are running
TCP port monitors for SMTP (25) and submission (587)
SSL certificate expiry alerts for the web admin HTTPS and SMTP STARTTLS
Heartbeat monitors for Rspamd spam filter and Postfix mail queue health

Prerequisites

Mailcow installed and running via Docker Compose
Mailcow admin UI accessible over HTTPS
A Mailcow API key (generate in Configuration → Access → API in the admin UI)
A free Vigilmon account

Step 1: Monitor the Mailcow Web Admin UI

The Mailcow web admin UI is the control plane for your entire email server. If it goes down, you lose the ability to manage domains, mailboxes, and aliases.

Log in to vigilmon.online and click Add Monitor.
Set Type to HTTP / HTTPS.
Enter your Mailcow admin URL: https://mail.yourdomain.com/admin.
Set Check interval to 1 minute.
Set Expected HTTP status to 200.
Click Save.

Mailcow's login page loads independently of most backend services, so a 200 response here confirms nginx is up and the Mailcow frontend container is healthy. For a deeper check, use the /health endpoint if your Mailcow version exposes one.

Step 2: Monitor the Mailcow Container Status API

Mailcow exposes a REST API that reports the running state of every container in the stack. This is the most accurate way to confirm that Postfix, Dovecot, Rspamd, ClamAV, and SOGo are all up — not just nginx.

Click Add Monitor in Vigilmon.
Set Type to HTTP / HTTPS.
Enter: https://mail.yourdomain.com/api/v1/get/status/containers
Under Request headers, add:
```
X-API-Key: YOUR_MAILCOW_API_KEY
```
Set Expected HTTP status to 200.
Under Response body, set Contains to "postfix" to verify the JSON payload includes container data.
Set Check interval to 3 minutes.
Click Save.

The API returns a JSON object where each key is a container name (e.g. postfix-mailcow, dovecot-mailcow, rspamd-mailcow) and the value includes its running state. A 200 response with a postfix entry confirms the Mailcow API and database are responding correctly.

Step 3: TCP Port Monitors for SMTP and Submission

Even when the web UI is up, the actual mail delivery ports may be blocked, misconfigured, or crashed. Monitor them independently.

SMTP Port 25 (Inbound Mail Delivery)

Click Add Monitor → set Type to TCP Port.
Enter your mail server hostname: mail.yourdomain.com
Set Port to 25.
Set Check interval to 1 minute.
Click Save.

Submission Port 587 (Client Mail Sending)

Click Add Monitor → set Type to TCP Port.
Enter mail.yourdomain.com.
Set Port to 587.
Set Check interval to 1 minute.
Click Save.

Port 25 going down means inbound mail from other servers stops. Port 587 going down means your users cannot send email through mail clients. These are separate failure modes that require separate monitors.

Step 4: SSL Certificate Alerts

Mailcow auto-manages Let's Encrypt certificates via its built-in acme-mailcow container. Auto-renewal can silently fail if port 80 is blocked or DNS propagation lags. A certificate expiry on a mail server causes immediate SMTP rejection by other mail servers.

Web Admin SSL Certificate

Open the HTTP monitor you created in Step 1 (the /admin URL).
Enable Monitor SSL certificate.
Set Alert when certificate expires in less than 21 days.
Click Save.

SMTP STARTTLS Certificate

The SMTP STARTTLS certificate is served by Postfix and may differ from the web UI certificate:

Click Add Monitor → set Type to TCP Port.
Enter mail.yourdomain.com, Port 25.
Enable Monitor SSL certificate (Vigilmon probes STARTTLS on SMTP ports).
Set Alert when certificate expires in less than 21 days.
Click Save.

Repeat for port 587 (submission) and port 993 (IMAP SSL) if you want complete mail stack certificate coverage.

Step 5: Heartbeat Monitoring for Rspamd

Rspamd provides spam filtering for every inbound and outbound email. Mailcow exposes Rspamd's web UI on port 11334. If Rspamd goes silent, mail can pile up or pass through unfiltered.

Use Vigilmon's heartbeat monitor via a cron job on your Mailcow host that calls the Rspamd actions API:

In Vigilmon, click Add Monitor → Cron Heartbeat.
Set Expected ping interval to 5 minutes.
Copy the heartbeat ping URL (e.g. https://vigilmon.online/heartbeat/abc123).
On your Mailcow server, add a cron job that checks the Rspamd API and pings Vigilmon on success:

# /etc/cron.d/mailcow-rspamd-heartbeat
*/5 * * * * root curl -sf http://localhost:11334/api/actions > /dev/null && curl -s https://vigilmon.online/heartbeat/abc123

The /api/actions endpoint returns Rspamd's current action thresholds as JSON. If Rspamd is healthy, the first curl returns 0 and the heartbeat ping fires. If Rspamd is down, the ping is skipped and Vigilmon alerts after the 5-minute window passes.

Step 6: Heartbeat Monitoring for the Postfix Mail Queue

A stuck Postfix queue means email piles up silently. Mailcow provides queue visibility through its API. Monitor queue depth with a heartbeat that only pings when the queue is draining normally:

# /etc/cron.d/mailcow-queue-heartbeat
*/10 * * * * root \
  QUEUE_COUNT=$(docker exec mailcowdockerized-postfix-mailcow-1 postqueue -p 2>/dev/null | tail -1 | grep -oP '^\d+' || echo 0) && \
  [ "$QUEUE_COUNT" -lt 50 ] && curl -s https://vigilmon.online/heartbeat/YOUR_QUEUE_HEARTBEAT_URL

Create a second heartbeat monitor in Vigilmon with a 15-minute interval for this check. The heartbeat only fires when queue depth is under 50 messages. If your queue gets stuck and grows beyond that threshold, the heartbeat stops and Vigilmon alerts you.

Adjust the threshold (50) to match your normal mail volume — a busy server might have 200 queued messages at peak; a personal server should rarely exceed 5.

Step 7: Configure Alert Channels

Go to Alert Channels in Vigilmon and add your preferred notification method (email, Slack, webhook, PagerDuty).
For SMTP port monitors, set Consecutive failures before alert to 2 — brief TCP timeouts can be transient. Two consecutive failures confirm a real outage.
For the API health check monitor, set Consecutive failures before alert to 1 — the API is internal and should always respond.
Use Maintenance windows in Vigilmon during Mailcow updates. Mailcow container restarts during docker compose pull && docker compose up -d can cause brief port downtime:

# Before updating Mailcow
curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_VIGILMON_API_KEY" \
  -d '{"monitor_id": "YOUR_SMTP_MONITOR_ID", "duration_minutes": 10}'

Summary

| Monitor | Type | Target | What It Catches | |---|---|---|---| | Web admin UI | HTTP | https://mail.yourdomain.com/admin | nginx/frontend crash | | Container status API | HTTP | /api/v1/get/status/containers | Any container down | | SMTP | TCP Port | Port 25 | Inbound mail delivery failure | | Submission | TCP Port | Port 587 | Client send failure | | Web admin SSL | SSL Certificate | mail.yourdomain.com | Let's Encrypt renewal failure | | SMTP STARTTLS SSL | SSL Certificate | Port 25 STARTTLS | Mail TLS certificate expiry | | Rspamd heartbeat | Cron Heartbeat | /api/actions check | Spam filter crash | | Queue heartbeat | Cron Heartbeat | Postfix queue depth | Stuck mail queue |

Mailcow gives you a complete self-hosted email stack with the power of Google Workspace and none of the lock-in. With Vigilmon watching every layer — the web UI, the container health API, the SMTP ports, SSL certificates, and spam filter heartbeats — you'll know about failures before they become lost email.