1 · Before you start
Pre-setup checklist
Gather these before running the installer. Each one removes a wait later.
| Item | Why it matters | Needed |
|---|---|---|
| Activation key | Issued by Dual Path for your organization (starts with DPX1.). The server cannot be used without it. | Required |
| A fresh Debian 12 server | 64-bit (amd64), 4 GB of memory recommended (2 GB minimum), 40 GB disk or more, with a public IPv4 address. | Required |
| Server name | The name mail apps will use, such as mail.contoso.com, in a domain you control. | Required |
| Access to your domain's DNS | About six records are published per mail domain. With Cloudflare the wizard publishes them for you. | Required |
| Cloudflare API token | Lets the wizard publish DNS itself. See section 4. | Recommended |
| Outgoing mail route | Either a provider that allows outgoing port 25, or a relay (smart host) login. See section 5. | Required |
| Reverse DNS for the server's IP | Set with your hosting provider to the server name. Improves delivery to Gmail, Outlook.com and others. | Recommended |
| An administrator email address | For certificate and security notices. | Required |
| Microsoft Entra app registration | For Microsoft 365 sign-in and directory import. See section 6. | Optional |
| Claude Code, Claude Desktop or ChatGPT | To let an AI assistant check and do the setup steps with you. | Optional |
2 · The server
Choose the server and provider
Size
- 2 vCPUs and 4 GB of memory comfortably serve a small or medium organization.
- Disk: allow about 2 to 5 GB per mailbox plus 20 GB for the system. Mail grows; choose a plan you can resize.
- Turn on the provider's snapshots or backups.
Operating system
- Debian 12 (bookworm), 64-bit, freshly installed. The installer refuses other systems.
- Do not install other web or mail software first. The installer sets up nginx, Postfix, MariaDB and the mail platform itself.
- Set the server's time zone and keep its clock synchronized (the default is fine).
Network ports
- Inbound: 25 (mail from other servers), 80 and 443 (web, Autodiscover, certificates), 465 and 587 (sending from mail apps), 993 and 143 (IMAP), 995 and 110 (POP).
- The installer opens these in
ufwif it is on. A provider firewall or security group must be opened in the provider's own console. - Keep SSH (22) limited to your own addresses where the provider allows it.
Provider tips
- Vultr, Hetzner, OVH and Linode host mail servers, but often block outgoing port 25 on new accounts until you ask them to open it.
- Azure, AWS, Google Cloud and DigitalOcean block outgoing port 25 by default. Plan on a relay (section 5).
- Prefer a static IP address that has not been used for spam. Check it on a blocklist lookup before you start.
3 · The server name
Pick the server name
The server name is the address mail apps, phones and other mail servers use. It is set at install time.
Good choices
mail.contoso.comfor a single company.- A name under a domain you control and can publish DNS for.
- One server can host several mail domains; the server name only needs to be in one of them.
Avoid
- Names behind a proxy or CDN (an orange cloud in Cloudflare). Mail and Autodiscover need a direct, DNS-only record.
- Provider-supplied names such as
*.cloudapp.azure.com, which cannot carry SPF or DKIM records. - Changing the name after installing: choose it first.
Tip: set the server's reverse DNS (PTR) to the server name in your hosting provider's control panel before you install. It takes effect quickly and saves a delivery problem later.
4 · DNS
Prepare DNS
For each mail domain the wizard shows the exact records to publish and checks them against public DNS. If your DNS is at Cloudflare, it can publish them for you.
| Record | Example | Purpose |
|---|---|---|
| A | mail.contoso.com → server IP | The server itself |
| MX | contoso.com → 10 mail.contoso.com | Where mail for the domain is delivered |
| CNAME | autodiscover.contoso.com → mail.contoso.com | Automatic setup in Outlook and DPKooltuo |
| TXT (SPF) | v=spf1 mx -all | Which servers may send as the domain |
| TXT (DKIM) | dkim._domainkey.contoso.com | Signing key, generated by the server |
| TXT (DMARC) | _dmarc.contoso.com | Policy for mail that fails SPF and DKIM |
Cloudflare token
- Open the token page. The wizard links to Cloudflare's API token page with the right permissions filled in. You can also create one by hand: My Profile ▸ API Tokens ▸ Create Token.
- Permissions: Zone ▸ Zone ▸ Read and Zone ▸ DNS ▸ Edit. Limit it to the zones you will use for mail.
- Create and copy the token, then paste it into the wizard's DNS step. Personal and account-owned tokens both work.
Moving mail from another service? The wizard previews every change and never replaces existing MX records unless you tick the box. Publish everything else first, set up and test mailboxes, then switch the MX records when you are ready to move mail. Lower the MX record's TTL to five minutes a day in advance so the switch takes effect quickly.
5 · Outgoing mail
Plan how mail leaves the server
Other mail servers are reached on port 25. The wizard tests it; if it is blocked, send through a relay.
Direct delivery
- Needs outgoing port 25 open at the provider.
- Set reverse DNS to the server name.
- Nothing else to configure: SPF
v=spf1 mx -allcovers it.
Through a relay
- Any SMTP relay with a login works: your own relay, or a sending service such as Amazon SES, SendGrid, Mailgun or Postmark.
- Have ready: relay host, port (usually 587), user name and password.
- Add the relay's SPF requirement (for example
include:sendgrid.net); the wizard asks for the full SPF value. - Verify your domain with the sending service first; many hold new accounts in a sandbox until you ask for production access.
6 · Microsoft 365 (optional)
Prepare the Microsoft Entra app registration
Needed for administrators to sign in with Microsoft, for people to sign in to DPXchange Mail with Microsoft 365, and to import your directory. You can add it later.
- App registrations ▸ New registration in the Microsoft Entra admin center. Single tenant.
- Redirect addresses (Web):
https://mail.contoso.com/admin/auth/callbackandhttps://mail.contoso.com/mail/api/sso/callback, using your server name. - API permissions: Microsoft Graph application permissions
User.Read.AllandGroup.Read.All, then Grant admin consent. - Certificates & secrets: create a client secret and copy its value. Note the tenant ID and application (client) ID.
7 · Install
Run the installer
Sign in to the server over SSH as root, or as a user with sudo, and run:
curl -fsSL https://dpxchange-licensing.dp.dpai.sh/install | sudo bash -s -- --host mail.contoso.com
Add --key DPX1... to activate straight away. The installer checks that the release is signed by Dual Path, installs the mail platform and DPXchange, opens the firewall ports, and prints:
Setup wizard: https://203.0.113.10/setup/ Setup code: ABCD-EFGH-JKLM
Expect a certificate warning when you first open the wizard: the server uses a temporary certificate until the wizard's certificate step is done. Lost the code? Run
sudo dpx-setup code on the server.8 · The setup wizard
Work through the steps
| Step | What you do | Tip |
|---|---|---|
| 1. Activate | Paste the activation key. | The server needs internet access to reach the licence service. |
| 2. Server administrator | Set the server admin password and your email address. | Store the password in your password manager; it signs in to the admin console. |
| 3. Mail domain | Add your first domain. | Add more domains later in the admin console. |
| 4. DNS records | Connect Cloudflare and publish, or copy the records to your DNS provider. | Public DNS usually updates within minutes; use Check again. |
| 5. Certificate | Get the certificate. | Works once the server name resolves to the server. |
| 6. Outgoing mail | Test port 25, or enter a relay. | See section 5. |
| 7. First mailboxes | Create a mailbox for yourself and a test user. | Passwords are shown once. |
| 8. Protection baseline | Apply the recommended mail flow rules. | Each rule can be changed later. |
| 9. Microsoft 365 | Optional: enter the app registration details. | See section 6. |
When every required step is done, choose Finish setup. The setup service turns itself off; sudo dpx-setup enable brings it back with a new code.
9 · AI assistant
Let Claude or ChatGPT help
The wizard's steps are also available as an MCP server. An assistant can check every step, explain what is wrong, publish DNS through Cloudflare, get the certificate and create mailboxes. It cannot set the server admin password, and everything it changes appears in the wizard's activity list.
Over SSH (works immediately)
- For Claude Code:
claude mcp add dpxchange-setup -- ssh you@server sudo dpx-setup mcp - Prepare: an SSH key for the server, and passwordless sudo for that account (or connect as root).
- Works before DNS or the certificate exist.
Over HTTPS (after the certificate)
- For claude.ai, Claude Desktop connectors or ChatGPT developer mode.
- The wizard makes a private address, valid for a day, and lists it until it expires or you disconnect it.
A good first prompt: “Check the DPXchange setup status and walk me through the remaining steps. Show me any DNS changes before you make them.”
10 · After setup
First checks
- Send a message to and from an outside address (Gmail or Outlook.com) and check it arrives in the inbox, not spam.
- Add the account in DPKooltuo or Outlook with just the email address and password, to confirm Autodiscover.
- Set up a phone with Exchange (ActiveSync).
- Review the admin console's Accepted domains page: every check should be green.
- Note the installation ID on the Licence page; Dual Path support may ask for it.
11 · Troubleshooting
Common problems
| Symptom | Likely cause | Fix |
|---|---|---|
| The wizard address does not load | A provider firewall or security group blocks 443. | Open 80 and 443 (and the mail ports) in the provider's console. |
| Installer says Debian 12 is needed | Another system or version. | Reinstall the server with Debian 12, 64-bit. |
| Activation fails: key in use on another server | Each key covers one server unless agreed otherwise. | Ask Dual Path to move the key to the new server. |
| Cloudflare: cannot see any zones | Token lacks Zone Read, or is limited to other zones. | Edit the token's permissions and zone list. |
| Certificate: name does not point at this server | DNS not published or not yet visible, or the record is proxied. | Publish the A record as DNS-only, wait a few minutes, try again. |
| Outgoing port 25 blocked | The provider blocks direct delivery. | Ask the provider to unblock it, or configure a relay. |
| Mail goes to spam | Missing reverse DNS, SPF or DKIM, or a new IP with no reputation. | Make every DNS check green, set reverse DNS, and send low volumes at first. |
| Console shows only the Licence page | The licence is not active (not activated, expired, revoked, or offline over 14 days). | Check the message on the Licence page; choose Check now, or contact Dual Path. |
Ready to deploy
Need an activation key or help planning a migration? Dual Path can help.