Provision docker-mailserver accounts and domain authentication

Use docker-mailserver’s supported setup/provisioning commands rather than editing generated Postfix/Dovecot files inside a running container. Generated files can be replaced at restart and may not represent the authoritative configuration.

Provision one controlled identity

1. Read the account-management and setup.sh sections linked from the official documentation.
2. Create a test mailbox through the tooling for the pinned release, securely entering its password.
3. Add any alias deliberately and confirm its destination; a catch-all changes unknown-recipient behavior for the domain.
4. Generate/configure signing keys through the documented DKIM procedure and publish the exact resulting DNS values.

Keep the key material persistent and restricted. Merge SPF requirements into one coherent record and review DMARC alignment against your actual sender/bounce configuration.

Verify the identity, not just the CLI result

Test mailbox login with the intended username/TLS settings, a controlled incoming message, and approved authenticated submission. Inspect received headers to confirm the actual signing domain/selector rather than assuming a DNS record means signing occurred.

Verify aliases do not leak messages between accounts and unauthorized clients cannot relay externally. Do not use server administration credentials in application SMTP code. For programmatic inbound events, a separate forwarding/parser design is needed; the stack is not automatically a JSON webhook provider.