Set up Synology MailPlus Server for business email

Who benefits from MailPlus Server?

Synology MailPlus Server suits small businesses that already operate a compatible Synology NAS and want more control over their email.

It is particularly interesting if you manage several domains, want to store mail locally, already manage users through DSM, want greater independence from Microsoft 365 or Google Workspace, can organise backups and maintenance, and can obtain a static public IP with reverse DNS.

Synology separates two packages: MailPlus Server runs the server, while MailPlus provides the users’ web interface. Five MailPlus licences are currently included; further users require additional licence packs. Not every NAS model supports MailPlus Server. Check compatibility and recommended user numbers before planning.

MailPlus is not a free version of Microsoft 365. You exchange recurring cloud subscriptions for operational responsibility. That can be worthwhile, but the responsibility remains.

My recommendation for small businesses

Use MailPlus Server for mailbox storage, mail processing and webmail on your Synology.

Send directly only when you have a static public IPv4 address, a matching PTR record, inbound and outbound port 25, a suitable IP reputation, reliable Internet access, working monitoring and a separate backup.

If only outbound port 25 is blocked or your IP reputation is problematic, an SMTP relay can handle outgoing delivery. MailPlus continues to manage users, mailboxes and incoming messages.

If inbound port 25 is also unavailable or your public IP changes regularly, I would not run a complete office mail server. Hosted email or an upstream mail server on a VPS is usually a better fit.

I operate barista.de and wir.rocken.digital through Synology MailPlus. The main work is not clicking through installation: it is DNS, delivery, security and ongoing checks.

Check the prerequisites first

Before installing anything, draw your planned mail route. Email needs an unambiguous route to your server. Think of the MX record as the sign pointing to a building, the A record as its address and PTR as the reverse confirmation. Missing or inconsistent information can cause delivery problems.

You need your own domain

For example, choose a domain and a mail hostname:

Domain: business.example
Hostname: mail.business.example

Use your real domain in production. The hostname should match in the A, MX and PTR records, MailPlus configuration, TLS certificate and SMTP greeting. Small inconsistencies can make a mail server look suspicious.

You need a reachable IP address

For direct reception, the server must be reachable from the Internet on TCP port 25. A static public IP is the most dependable business option. A changing address requires DNS updates, and dynamic address ranges often receive stricter treatment from other mail servers.

Check for CGNAT, where several customers share one public IP. Incoming connections usually do not work as required in that situation.

The PTR record must match the hostname

Reverse DNS maps an IP address back to a hostname through PTR. Receiving servers can check whether the public IP corresponds to mail.business.example. Your domain registrar normally cannot set this record: it is managed by the provider responsible for the public address, usually your Internet or hosting provider.

If you cannot obtain a suitable PTR, use an SMTP relay instead of sending directly from that IP.

Plan a separate backup

Storing email on Synology does not make the NAS its own backup. A backup on the same device may fail at the same time as the original.

Synology supports backing up and restoring MailPlus to another Synology NAS. For business email, use a physically or at least technically separate destination.

The recommended MailPlus architecture

Component	Role
Domain DNS provider	Manages A, MX, SPF, DKIM and DMARC records
Internet provider	Provides a static IP and PTR record
Router and firewall	Forward only required ports to Synology
MailPlus Server	Receives, checks, stores and sends email
MailPlus	Provides webmail
SMTP relay	Optional delivery route if your own IP is unsuitable
Separate backup destination	Protects mailboxes and configuration
Monitoring	Reports outages, queues and delivery issues

This involves more than an inbox and a Send button. That is true of a self-managed mail server generally, not just Synology.

Install MailPlus Server

Open DSM’s Package Center and install Synology MailPlus Server followed by Synology MailPlus. The first manages the server; the second serves users.

Start MailPlus Server and choose a new mail system in the setup wizard. Depending on your DSM and MailPlus versions, the wizard asks for account type, domain, hostname, network interface and storage location. Synology documents this new-system setup workflow.

Choose the account type

Small installations normally use local DSM users. LDAP or domain users make sense when central identity management already exists. Avoid introducing a new directory infrastructure solely for the mail server.

Enter the domain and hostname carefully

Domain: business.example
Hostname: mail.business.example

The hostname must be a fully qualified domain name, or FQDN. It should resolve to your public IP and match your certificate. Synology explicitly highlights this relationship in its MailPlus settings.

Choose the right volume

Store mail on a volume intended for business data. Allow space for attachments, sent messages, trash and automated reports accumulating over years.

Set user or group mailbox quotas. A quota limits mailbox storage. MailPlus supports both levels, with the user setting taking precedence.

Activate users and mailboxes

A DSM account does not automatically receive an active MailPlus mailbox. Enable only users who need email in the users and groups area.

Configure mailbox quota, maximum message size, permitted senders, aliases, group addresses, forwarding and automatic replies.

For functional addresses such as info@, billing@ and support@, use aliases or shared mailboxes where appropriate instead of creating a personal DSM account for every address.

Configure SMTP, IMAP and webmail

Enable only the protocols you actually need.

SMTP for mail transport

SMTP transfers email between servers, normally using TCP port 25. MailPlus uses this port by default.

Authenticated users and mail clients should use encrypted SMTP submission, for example port 587 with TLS as documented by Synology. Enable SMTP authentication. An open relay allows unauthorised strangers to send through your server and must be avoided.

IMAP for email clients

IMAP synchronises mailboxes across the server, phones and computers. Use port 993 for encrypted IMAP; Synology also documents it for external clients.

POP3 traditionally downloads messages. IMAP generally suits multiple devices better. Disable POP3 unless you specifically need it.

Webmail over HTTPS

Publish MailPlus webmail through HTTPS using a clear hostname such as:

webmail.business.example

Do not expose the DSM login as the general employee entry point. A reverse proxy can publish webmail on port 443 without exposing unnecessary administration interfaces.

Assign a certificate

Obtain a valid TLS certificate for mail.business.example. It supports an encrypted client/server connection and must cover the hostname users enter in Outlook, Apple Mail or their phones.

DSM can obtain a certificate from Let’s Encrypt or import an existing one. Assign it to the relevant MailPlus, SMTP, IMAP, webmail and, where applicable, reverse-proxy services.

A certificate protects the connection; it does not solve delivery issues. SPF, DKIM, DMARC and PTR cover other parts of the mail route.

Publish DNS records for MailPlus

You need at least an A record and an MX record, plus properly configured SPF, DKIM and DMARC. Synology recommends these for reliable mail operation and protection against impersonation.

A record

Map the mail hostname to its public IPv4 address:

mail.business.example → 203.0.113.10

This is a reserved example. Use your real public IP. Add an AAAA record only when the entire IPv6 mail route works correctly; partial IPv6 configuration causes difficult intermittent failures.

MX record

MX tells other servers where to deliver your domain’s incoming mail:

business.example → mail.business.example

MX points to a hostname, not directly to an IP address.

SPF record

SPF defines authorised sending systems. For direct sending, the policy may authorise your public IP. With a relay, include the relay provider’s requirements. Publish only one SPF policy at a given DNS name; multiple policies cause errors.

Enable DKIM

DKIM signs outgoing messages. MailPlus creates a public/private key pair, keeps the private key and publishes the public part through DNS. Receivers verify the signing domain and the integrity of the signed message parts.

Start DMARC carefully

DMARC checks whether at least one passing SPF or DKIM result aligns with the visible sender domain and publishes a policy for failures. Start an existing domain with monitoring:

p=none

Review reports and every legitimate source: MailPlus, newsletters, website forms, accounting software, ticket systems and external invoicing services. Only then move towards quarantine or reject. Configure SPF and DKIM first, as Synology recommends.

Configure the router and firewall

Do not open every port merely because it appears in a table. Depending on access needs, a typical installation uses:

Port	Purpose	Public access needed?
TCP 25	Server-to-server email	Yes for direct reception
TCP 587	Authenticated SMTP submission	For external mail clients
TCP 993	Encrypted IMAP	For external mail clients
TCP 443	HTTPS webmail	When webmail is used externally
TCP 465	Optional SMTP over TLS	Only if intentionally used

Forward required ports to the NAS’s fixed internal IP. Add corresponding Synology firewall rules; router forwarding and the NAS firewall are separate controls.

Do not expose DSM administration ports generally. Prefer VPN, protected access or tightly restricted firewall rules.

Protect MailPlus against abuse

Enable suitable spam and antivirus filtering, SPF/DKIM/DMARC checks, DNS blocklists, failed-login limits, sending and size limits, logging and notifications. MailPlus provides settings for these functions and for blocklists and allowlists.

Use allowlists sparingly. Broad exceptions for entire domains or IP ranges can bypass useful checks.

Also protect DSM: plan security updates, separate administrator and everyday accounts, enable administrator two-factor authentication, disable the default admin account, limit login attempts, configure critical-event alerts and document configuration changes.

These steps reduce risk and improve your response; they do not make the system invulnerable.

Test every mail route before switching

Do not change MX first. Complete setup, then test:

1. External sender to MailPlus
2. MailPlus to an external recipient
3. The recipient’s reply
4. Sending through webmail
5. Sending through an external client
6. Receiving through IMAP
7. Attachments
8. Delivery to several major providers
9. SPF, DKIM and DMARC results in message headers
10. Messages to nonexistent recipients

Inspect the MailPlus queue and logs. Sent-folder presence proves only that your client handed over the message, not that the recipient accepted it. Synology also identifies missing or incorrect authentication records as potential delivery problems.

Migrate existing email

MailPlus Server can migrate messages from external sources, including your previous provider. Plan the transition in stages:

1. Create users and aliases
2. Prepare DNS
3. Test MailPlus
4. Migrate existing mailboxes
5. Change MX
6. Keep the old provider temporarily active
7. Check late arrivals
8. Cancel the previous service only after verification

Lower the old MX record’s TTL sufficiently in advance so caches refresh more quickly when the change happens.

Test backup and restoration

A backup becomes useful when you know how to restore it. Document its destination, schedule, retention, incident owner, user/configuration recovery and required emergency credentials.

Test restoration with a test mailbox or separate environment. Consider Internet outages too: your office server cannot receive directly while its connection is down. Other servers usually retry later, but business-critical communication should not rely on retries alone.

Higher availability may need a second server, upstream gateway or MailPlus High Availability. These increase cost and maintenance considerably.

When an SMTP relay is a better fit

A relay handles outbound delivery when port 25 is blocked, PTR is unavailable, IP reputation is poor, the public IP is not static or you do not want full responsibility for delivery.

The relay processes outgoing messages in transit and takes over part of the delivery and IP-reputation work. Review contractual terms, privacy, limits, logs and support for your domain rather than choosing solely by a free allowance.

When hosted email is better

MailPlus is not a good default if nobody owns the service long term. Prefer a specialist provider if you cannot regularly check updates, run separate backups, obtain reliable connectivity and a suitable IP/PTR, or monitor queues and logs. This also matters with round-the-clock critical email, many mobile users without IT support or unresolved retention requirements.

A properly managed external service is better than an abandoned self-hosted server. Self-hosting should reduce dependencies sensibly, not hide new risks under a desk.

Common MailPlus mistakes

MX points to an IP address

Point MX to a hostname, then create the hostname’s A record.

PTR is missing

Other servers may reject or downgrade messages without suitable reverse DNS.

SPF authorises the wrong route

If you send through a relay but authorise only your own IP, SPF may fail.

DKIM is enabled but not published

The public key must be accessible through DNS; a key stored in MailPlus alone is insufficient.

DMARC starts immediately with reject

You may block legitimate newsletters, forms and invoicing. Analyse first and tighten later.

The backup is on the same NAS

Hardware failure, ransomware, mistakes or theft can affect the server and backup together.

Nobody checks the queue

Delivery problems do not disappear when nobody looks at them.

Conclusion: more than a package installation

MailPlus can provide local mailboxes, user administration, webmail, security features and controllable storage costs for small businesses.

It requires a compatible NAS, reliable public reachability, correct DNS, a suitable certificate, separate backups and ongoing ownership.

• MailPlus stores and manages mailboxes.
• A static IP and PTR enable direct mail operation.
• SPF, DKIM and DMARC protect domain authentication.
• A relay handles sending when your own IP is unsuitable.
• Backups remain separate.
• Monitoring reports issues before customers do.

Check the static IP, PTR and port 25 before installation. If these requirements fail, choose a relay, gateway or hosted workflow.

Frequently asked questions

Is Synology MailPlus free?

Five email licences are currently included. Additional active users need licence packs; supported user numbers also depend on the NAS model.

Does it work without a static IP?

Dynamic DNS can update a hostname, but changing addresses, missing reverse DNS and blocklists make this an unreliable business default. Consider a relay, gateway or hosted provider.

Which ports are needed?

TCP 25 for direct reception, typically 587 for authenticated submission, 993 for encrypted IMAP and 443 for HTTPS webmail. Expose only the services you need.

Can I use an ordinary Internet connection?

Only if it provides public reachability, appropriate reverse DNS and permitted mail traffic. Residential connections often do not meet all requirements.

Is using a relay still self-hosting?

Yes. Users, mailboxes, rules and incoming messages can stay on Synology while an external server handles outgoing delivery.

Is RAID enough for backup?

No. RAID can maintain availability after a drive failure; it does not reliably protect against deletion, malware, configuration errors, theft or failure of the whole NAS. Use a separate backup and test restoration.

Sources and further documentation

• Synology: MailPlus licences and supported accounts
• Synology: configure MailPlus DNS
• Synology: backup and restoration

Your next step: check your static IP, PTR and port 25 with your provider, then choose the appropriate mail route.

Look up terms in the searchable glossary.