How to Run a Mail Server on Raspberry Pi with an OpenClaw Agent

Only 33.4% of the top one million websites maintain a valid DMARC record, and 85.7% of all domains have no DMARC enforcement at all (Landbase, 2026 Email Deliverability Report). That gap matters because Gmail, Yahoo, and Microsoft now require SPF, DKIM, and DMARC from bulk senders. Even low-volume senders without proper authentication see their messages filtered or rejected entirely. Running your own mail server does not fix the internet's email authentication problem, but it does put you in complete control of the DNS records and TLS configuration that determine whether your messages land in inboxes or spam folders.

A Raspberry Pi makes this practical for small teams and homelabs. The hardware costs $60 to $80, draws under 5W at idle, and runs Postfix and Dovecot comfortably within 500 MB of RAM. A Pi 5 can handle email for 10 to 50 users without performance issues, which covers most small organizations and personal domains. Compared to renting a VPS for the same purpose, the Pi pays for itself within a few months and keeps your data physically in your hands.

Every Pi mail server guide covers Postfix installation and basic DNS setup. None of them cover what happens after: monitoring the mail queue for stuck messages, triaging incoming mail by content, or routing attachments somewhere useful. That is where an AI agent changes the equation. By running an OpenClaw agent alongside your mail server on the same Pi, you get a system that watches the queue around the clock, responds to routine inquiries, and pushes attachments to persistent cloud storage where they are searchable and shareable.

This guide walks through the full stack: Postfix and Dovecot for sending and receiving, DNS authentication for deliverability, TLS encryption with Let's Encrypt, and an OpenClaw agent for ongoing mail management.

Before installing packages, make sure you have the right hardware, software, and network access. The ISP check at the bottom is the most common showstopper, so verify it first.

Hardware:

• Raspberry Pi 5 with 4 GB or 8 GB RAM (the Pi 4 with 4 GB also works well)
• USB SSD or high-endurance microSD card. SSD is strongly recommended for a service that writes to disk constantly. SD cards degrade faster under write-heavy workloads and can fail without warning
• USB-C power supply: the official 27W supply for Pi 5, or a quality 15W supply for Pi 4
• Ethernet connection. Wi-Fi works but Ethernet provides the stable, low-latency link a mail server needs

Software:

• Raspberry Pi OS Lite, 64-bit. The 32-bit version is not supported by OpenClaw
• Node.js 24, which OpenClaw requires as its runtime
• A domain name you control, with full access to DNS record management
• An API key from an LLM provider (Anthropic, OpenAI, or Google) for the OpenClaw agent

Network requirements:

• A static public IP address, or a dynamic DNS service that keeps your domain pointed at your home connection
• Ports forwarded through your router to the Pi: 25 (SMTP for server-to-server delivery), 587 (submission for email clients), 993 (IMAPS for secure mailbox access), and 443 (HTTPS if you run webmail)
• Your ISP must not block port 25. Many residential ISPs block outbound SMTP to prevent spam. Call your provider or test with telnet smtp.gmail.com 25 from the Pi before buying anything

DNS records you will create later:

• An MX record pointing your domain to the Pi's public IP
• An A record for mail.yourdomain.com
• TXT records for SPF, DKIM, and DMARC (covered in detail in the DNS section)

If your ISP blocks port 25, you have two options: use an outbound relay service like SendGrid or Mailgun to handle delivery, or switch to a business internet plan that allows port 25 traffic. Everything else in this guide assumes port 25 is open.

Start with a fresh Raspberry Pi OS Lite installation. Flash the image using Raspberry Pi Imager, enable SSH during the imaging step, and boot the Pi. If you are setting up headless (no monitor), configure your Wi-Fi credentials and SSH key in the Imager's advanced settings before flashing.

SSH into the Pi and update the system:

sudo apt update && sudo apt upgrade -y

Install the core mail server packages:

sudo apt install -y postfix dovecot-core dovecot-imapd

During Postfix installation, the configuration wizard asks you to choose a server type. Select Internet Site and enter your domain name (for example, yourdomain.com) as the system mail name. This tells Postfix which domain it handles mail for.

Postfix main configuration

Edit /etc/postfix/main.cf to set the essential parameters:

myhostname = mail.yourdomain.com
mydomain = yourdomain.com
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, $mydomain
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.yourdomain.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.yourdomain.com/privkey.pem
smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtp_tls_security_level = may

The smtpd_tls_auth_only = yes line ensures that clients must use TLS before authenticating. Without this, passwords could travel over the network in plaintext.

Dovecot IMAP configuration

Dovecot handles mailbox storage and lets email clients retrieve messages over IMAP. Edit /etc/dovecot/conf.d/10-mail.conf to set the storage format:

mail_location = maildir:~/Maildir

Maildir stores each message as a separate file, which is more reliable on flash storage than mbox (a single large file that grows over time). Enable TLS in /etc/dovecot/conf.d/10-ssl.conf:

ssl = required
ssl_cert = </etc/letsencrypt/live/mail.yourdomain.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.yourdomain.com/privkey.pem

TLS certificates with Let's Encrypt

Install Certbot and request a certificate for your mail subdomain:

sudo apt install -y certbot
sudo certbot certonly --standalone -d mail.yourdomain.com

Certbot needs port 80 open temporarily during the challenge. If you are already running a web server on port 80, use the --webroot method instead. Set up automatic renewal with a cron job that restarts the mail services after renewing:

echo "0 3 * * * certbot renew --quiet --deploy-hook 'systemctl restart postfix dovecot'" | sudo tee /etc/cron.d/certbot-mail

Optional: Roundcube webmail

If you want browser-based access to your mailbox, install Roundcube:

sudo apt install -y roundcube roundcube-plugins

Roundcube pulls in Apache and MariaDB as dependencies. The full stack (Postfix, Dovecot, Roundcube, Apache, MariaDB) uses under 500 MB of RAM at idle on a Pi 5, which leaves plenty of headroom for the OpenClaw agent you will add later.

Restart both core services and verify they are running:

sudo systemctl restart postfix dovecot
sudo systemctl status postfix dovecot

At this point you have a working mail server. It can send and receive email for your domain over encrypted connections. The next step is configuring the DNS records that convince other mail servers to trust your messages.

DNS authentication is not optional in 2026. Gmail, Yahoo, and Microsoft require SPF, DKIM, and DMARC from anyone sending more than 5,000 messages per day to their users. Even for low-volume senders, missing authentication records increase the chance of landing in spam. Misconfigured DNS alone can cause up to a 70% drop in email delivery rates, turning a perfectly functional mail server into one that nobody receives mail from.

SPF (Sender Policy Framework)

SPF tells receiving servers which IP addresses are authorized to send email for your domain. Add a TXT record at the root of your domain's DNS zone:

v=spf1 a mx ip4:YOUR.PUBLIC.IP -all

Replace YOUR.PUBLIC.IP with your Pi's static public IP. The -all flag tells receivers to reject email from any unauthorized source. Use ~all (soft fail) during testing so you can monitor failures without losing mail, then switch to -all once deliverability is confirmed.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every outgoing message, proving it was not tampered with in transit. Install OpenDKIM:

sudo apt install -y opendkim opendkim-tools

Generate a 2048-bit signing key:

sudo mkdir -p /etc/opendkim/keys/yourdomain.com
sudo opendkim-genkey -b 2048 -d yourdomain.com -D /etc/opendkim/keys/yourdomain.com -s mail -v

This creates mail.private (the signing key that stays on your server) and mail.txt (the public key for DNS). Add the contents of mail.txt as a TXT record at mail._domainkey.yourdomain.com in your DNS provider's dashboard.

Configure OpenDKIM to work with Postfix by adding the milter connection to /etc/postfix/main.cf:

milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

Restart OpenDKIM and Postfix for the changes to take effect:

sudo systemctl restart opendkim postfix

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. Add a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100

Start with p=quarantine rather than p=reject so you receive aggregate reports and can review them before enforcing strict rejection. The rua tag sends daily XML reports to the specified address, showing which messages passed or failed. Organizations that eventually move to p=reject alongside BIMI see up to a 42% reduction in spam complaints, but get the basics working first.

Testing your configuration

Send a test email to a Gmail account and open the message in Gmail. Click the three-dot menu, select "Show original," and look for the Authentication-Results header. You want to see spf=pass, dkim=pass, and dmarc=pass. Online tools like MXToolbox and Mail-tester.com can also verify your full DNS and mail server configuration from the outside.

Store and search every email attachment your agent extracts

Free 50 GB workspace with automatic file indexing, no credit card required. Upload attachments from your Pi mail server, search them by content, and share with your team through a single link.

Start 14-Day Trial

With Postfix and Dovecot running, your Pi is a functional mail server. The next step is adding an OpenClaw agent that monitors the server and handles routine management tasks. This is the part existing Raspberry Pi mail server guides skip entirely.

OpenClaw is an open-source agent framework that turns your Pi into a persistent AI gateway. The Pi handles orchestration while language models run in the cloud via API, so you do not need local GPU power. The official documentation is clear on this point: do not run local LLMs on a Pi, even small ones are too slow. Cloud inference via Anthropic, OpenAI, or Google is the recommended path.

Installing OpenClaw alongside the mail server

Install Node.js 24 from the NodeSource repository (OpenClaw's required runtime):

curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
sudo apt install -y nodejs

Run the OpenClaw installer:

curl -fsSL https://openclaw.ai/install.sh | bash

The installer launches an onboarding wizard that configures your LLM provider credentials and enables daemon mode. The daemon runs as a systemd service, starting automatically on boot and restarting on crashes. A Pi 5 with 4 GB RAM comfortably runs both the mail stack and OpenClaw simultaneously since the mail server uses under 500 MB and OpenClaw's gateway process is lightweight.

What the agent can do with your mail server

OpenClaw agents have direct access to shell commands and file I/O on the host system. That gives the agent a natural interface to every part of the mail stack:

• Monitor the Postfix mail queue by running mailq and checking /var/spool/postfix/ for stuck or deferred messages
• Parse delivery logs in /var/log/mail.log to detect authentication failures, connection timeouts, or unusual sending patterns
• Read incoming messages from Maildir directories and categorize them by sender, subject line, or content
• Compose and send automated replies to routine inquiries using the sendmail command
• Extract attachments from incoming mail and upload them to external storage

The architectural point worth emphasizing: the agent does not replace Postfix or Dovecot. It sits alongside them, reading logs and mailbox contents, taking action through standard command-line tools. If the agent process goes down, your mail server keeps running exactly as before. This separation means you can experiment with agent capabilities without risking your mail delivery.

Persistent state across reboots

OpenClaw stores its configuration and memory in ~/.openclaw/ and ~/.openclaw/workspace/. This state survives reboots, so the agent remembers previous interactions, triage rules you have set up, and any patterns it has learned from your mail flow. Before upgrading the Pi's operating system or migrating to new hardware, create a portable backup with openclaw backup create.

Routing attachments to cloud storage

Email attachments accumulate fast, and an SD card or small SSD on a Pi is not the right place to archive them long-term. The agent can extract attachments from incoming mail and push them somewhere more durable.

For basic needs, an external USB drive or a NAS on your local network handles moderate volumes. Amazon S3 via the AWS CLI works for cheap cold storage without search. Google Drive via rclone gives you a familiar interface but limited programmatic access.

For teams that want their attachments searchable by content and shareable through a single link, a cloud workspace designed for agent workflows fits better. Fastio provides free workspaces for agents with built-in file indexing. The agent can upload extracted attachments through the Fastio MCP server, and once Intelligence is enabled on the workspace, every uploaded file is automatically indexed for semantic search. That means you can later ask "find the contract PDF from November" and get results with citations pointing to the specific attachment.

The Business Trial includes 50 GB of storage, included credits, and 5 workspaces with no credit card required. For a Pi mail server handling a small team's email, that covers years of attachment storage. If you eventually want to hand the workspace to a colleague or client, Fastio's ownership transfer lets the agent build and organize the workspace, then transfer it to a human account while retaining admin access.

OpenClaw's skill ecosystem on ClawHub can extend this further. Community-built skills handle specific automation patterns, and you can write custom skills in TypeScript to match your exact mail triage workflow. The combination of a reliable Postfix mail server, an OpenClaw agent for automation, and a persistent cloud workspace for storage gives you a self-hosted email system that is more capable than what most guides achieve, running on hardware that costs less than two months of a hosted email service.