How to Install Mail-in-a-Box on Ubuntu 22.04 VPS — Turnkey Self-Hosted Email

Running your own mail server used to mean wrestling with Postfix, Dovecot, SpamAssassin, OpenDKIM, Let's Encrypt, fail2ban, and a half-dozen DNS records before you could send a single message. Mail-in-a-Box collapses all of that into a single install command. One bash line, a few interactive prompts, and thirty minutes later you have a fully functional mail server with SMTP, IMAP, webmail, contacts, calendar, and even a lightweight file sync — all backed by auto-generated SPF, DKIM, DMARC, and TLS.

Important: Mail-in-a-Box (v71, current stable) requires Ubuntu 22.04 LTS. It does not support Ubuntu 24.04 yet — the project maintainer has not released a 24.04-compatible build at the time of writing. If you provisioned a 24.04 VPS, re-image it to 22.04 before proceeding. Do not attempt to force-install on 24.04; the script will refuse and you can leave the server in a partially configured state.

Want a pre-hardened VPS for your mail server? Our CloudCore Professional plans come with a clean Ubuntu 22.04 image, unthrottled port 25, reverse DNS on request, and IPv4 addresses never previously used for spam. Launch a mail-ready VPS now and start your install in under two minutes.

Table of Contents

What is Mail-in-a-Box?

Mail-in-a-Box (MIAB) is an opinionated, turnkey mail server distribution created by Joshua Tauberer. It bundles, configures, and wires together every component needed to run a production mail server on a single Ubuntu 22.04 VPS, exposing a web admin panel that hides virtually all of the underlying complexity.

Under the hood, MIAB orchestrates a tightly integrated stack. Postfix handles SMTP for both incoming and outgoing mail. Dovecot serves IMAP and manages Maildir storage. Roundcube provides webmail. Nextcloud (a trimmed-down build) powers contacts and calendar via CardDAV and CalDAV. nsd4 acts as an authoritative DNS server so MIAB can publish SPF, DKIM, DMARC, MTA-STS, DANE TLSA, and autoconfig records for you. OpenDKIM signs outbound mail. SpamAssassin and greylisting filter inbound junk. Let's Encrypt / Certbot auto-provisions and renews TLS certificates for every configured domain. fail2ban watches for brute-force attempts and bans offending IPs. Z-Push offers ActiveSync for mobile clients, and Munin produces system graphs.

The opinionated part matters: MIAB makes these choices for you and does not expose most knobs. You get a curated configuration that works correctly by default, not a build-your-own kit. If you want to swap Postfix for Haraka or add Rspamd instead of SpamAssassin, MIAB is the wrong tool — pick Mailcow or Mailu instead. If you want to stop thinking about mail plumbing and just send email, MIAB is one of the best choices in the open-source ecosystem.

It is particularly well-suited for families hosting mail for a handful of users, freelancers who want [email protected] without Google Workspace fees, small nonprofits, hobbyist homelab operators, and developers who need a personal mailbox that won't be mined for ad targeting. MIAB deliberately scales down — it targets single-server deployments serving dozens to low-hundreds of mailboxes, not enterprise fleets.

Why Self-Host Email with Mail-in-a-Box?

Email hosted on your own VPS delivers benefits that rented mail services cannot match:

• Zero-config deliverability setup — MIAB generates SPF, DKIM, DMARC, MTA-STS, and DNSSEC records automatically. You get the same deliverability hygiene that Gmail and Microsoft demand from senders, without editing a single zone file by hand.
• Total privacy — Your messages, contacts, and calendar entries live on hardware you control. No algorithmic scanning, no training data harvesting, no ads injected into your inbox.
• Flat monthly cost — A single VPS hosts unlimited mailboxes on unlimited domains. Hosting a family of five on Google Workspace costs USD 36/month; the same on MIAB is EUR 19.99/month total, regardless of user count.
• One admin panel for everything — DNS, TLS, aliases, mailboxes, backups, custom records, and spam controls are all managed from a single web UI at https://box.example.com/admin.
• Bundled webmail, contacts, and calendar — No need to stand up Nextcloud separately. CalDAV and CardDAV work from day one, so iOS, Android, Thunderbird, and Apple Mail sync seamlessly.
• Escape vendor lock-in — Mail lives in standard Maildir folders. Contacts and calendars are standard vCard and iCalendar. Moving off MIAB (or off a VPS entirely) is a simple rsync away.
• Operational transparency — MIAB is open source. You can read every config it generates, understand every decision, and audit the attack surface. No black boxes.

Cost Comparison: Mail-in-a-Box vs. Hosted Mail

Prerequisites

Before starting the install, confirm every item on this list. Mail-in-a-Box is picky about its environment, and skipping a prerequisite usually means re-imaging the server.

• Ubuntu 22.04 LTS (fresh install, not upgraded from 20.04 or downgraded from 24.04). Do not use 24.04 — MIAB refuses to install on it.
• Root SSH access (not a sudo user). MIAB needs to be run as root with no other users logged in.
• At least 1 GB of RAM (2 GB strongly recommended). SpamAssassin is memory-hungry and a 512 MB server will swap constantly.
• At least 10 GB of free disk space (20+ GB recommended so mailboxes have room to grow).
• A dedicated public IPv4 address. Shared IPs, NAT, or dynamic IPs will not work — outbound port 25 and reverse DNS both require a static IPv4.
• Outbound TCP port 25 not blocked by your provider. Many budget hosts silently block port 25 on new accounts. vps-server.host opens port 25 by default.
• A registered domain name with access to its DNS (either at the registrar or a DNS provider like Cloudflare).
• A fully qualified hostname for the box itself — conventionally box.yourdomain.com. This is the MIAB machine's identity and appears in SMTP HELO and certificates.
• Reverse DNS (PTR) on your VPS IPv4 pointing to box.yourdomain.com. Without rDNS, Gmail and Outlook will reject your outbound mail.
• IPv6 (optional but recommended) with matching AAAA and PTR records if enabled — mismatched IPv6 rDNS is a common deliverability killer.

Recommended Plan: CloudCore Professional

MIAB runs comfortably on modest hardware, but SpamAssassin, Nextcloud, and Dovecot each want a little headroom. We recommend CloudCore Professional:

- 6 vCPU cores

- 12 GB RAM

- 100 GB NVMe SSD

- Dedicated IPv4 + IPv6

- Port 25 unblocked by default, reverse DNS editable via control panel

- EUR 19.99/month

This easily hosts 50+ active mailboxes, a few years of retained mail, and the full Nextcloud contacts/calendar stack with plenty of room for spam filtering.

Connect to the fresh server as root:

ssh root@your-server-ip

Step 1: Prepare the VPS and Set the Hostname

MIAB refuses to install until the system hostname resolves cleanly to the public IP and matches the mail domain you intend to use. Choose your hostname now and use it consistently — changing it later is painful.

Convention: if your email address will be [email protected], name the box box.example.com.

Update the system first so the installer pulls recent package metadata:

apt update && apt upgrade -y

If a kernel upgrade landed, reboot:

reboot

Reconnect after a minute. Now set the hostname:

hostnamectl set-hostname box.example.com

Verify:

hostname -f

Expected output:

box.example.com

Add the hostname to /etc/hosts so local resolution works even before DNS propagates:

echo "$(curl -4 -s ifconfig.me) box.example.com box" | tee -a /etc/hosts

Confirm the server knows its own public IPv4:

curl -4 ifconfig.me

Write this IP down. You will need it for the DNS step next.

Step 2: Configure DNS and Reverse DNS

Mail-in-a-Box needs three things from DNS before it can finish installing: an A record for the box hostname, matching reverse DNS, and (eventually) NS or MX records for the mail domain. Set the first two now.

A Record for the Box

At your DNS provider (registrar, Cloudflare, Route53, etc.), create:

dig +short box.example.com

The returned IP must match curl -4 ifconfig.me. If it does not, wait for propagation (usually 1-5 minutes) before continuing.

Reverse DNS (PTR)

Reverse DNS is set by your VPS provider, not at your domain registrar. On vps-server.host, open your VPS in the control panel, find the "Reverse DNS" or "PTR" field, and set it to box.example.com.

Verify:

dig -x $(curl -4 -s ifconfig.me) +short

Expected output:

box.example.com.

If this step is skipped, MIAB will install fine — but Gmail will reject every message you send until rDNS is correct. Fix it now.

MX and Name Server Records

Do not create MX records yet. You will generate and publish these in Step 6, once MIAB has told you exactly what to publish (the values depend on whether you run MIAB as authoritative DNS or use an external DNS provider).

Step 3: Run the Mail-in-a-Box Installer

With the hostname set and DNS resolving, you can run the installer. MIAB ships as a single bootstrap script that fetches the main repository and runs its setup phases sequentially.

Run the installer as root:

curl -s https://mailinabox.email/setup.sh | sudo -E bash

The -E flag preserves environment variables, and sudo is a no-op when you are already root but required if you are running as a sudo user.

Expected output during the bootstrap phase:

Hello and thanks for deploying a Mail-in-a-Box!
-----------------------------------------------
I'm going to ask you a few questions.
Installing system packages...
Installing nsd (DNS server)...
Installing postfix (SMTP server)...
Installing dovecot (IMAP server)...
Installing nextcloud (contacts and calendar)...
Installing roundcube (webmail)...
Installing spamassassin...
Installing solr (full-text mailbox search)...
Installing fail2ban...
Installing munin (system monitoring)...
Generating DKIM signing key...
Requesting Let's Encrypt TLS certificate...

The full install takes 15-25 minutes on a CloudCore Professional VPS. The installer will pause at several points to ask questions — answer them carefully in the next step.

Step 4: Answer the Interactive Prompts

MIAB asks a handful of questions during setup. Here is exactly what each one means and what to answer.

Prompt 1: Primary Hostname

What email address are you setting this box up to manage?

Answer with the admin email address you want — typically [email protected] or [email protected]. This becomes the first mailbox and the admin panel login.

Prompt 2: Machine Hostname

What is the hostname of this machine?

Enter the FQDN you configured in Step 1: box.example.com. MIAB pre-fills this from hostname -f, so you usually just press Enter.

Prompt 3: Country Code

Enter the two-letter country code where this machine is located:

Enter the ISO 3166-1 country code for your VPS region (e.g., DE for Germany, US for the United States). This populates the country field of your auto-generated TLS certificates.

Prompt 4: Admin Password

Please enter a new password for the user [email protected]:

Choose a strong password (16+ characters, mixed case, digits, symbols). This is the only credential you have for the admin panel — store it in a password manager immediately.

Prompt 5: Public IP Confirmation

This machine's public IP address is 203.0.113.45. Is this correct? [Y/n]

MIAB detects the IP with a lookup. Confirm with Y unless you know it is wrong (e.g., the server is behind NAT, in which case you should not be installing MIAB here).

After the final prompt, MIAB finishes provisioning TLS certificates, publishes DKIM keys, and starts all services. When it completes you will see:

-----------------------------------------------
Your Mail-in-a-Box is running.
Please log in to the control panel for further instructions at:
https://box.example.com/admin
If you have a DNS provider other than Mail-in-a-Box, update your nameservers
as shown on the status page.
You will need to log in with:
  Email:    [email protected]
  Password: (the password you just entered)

Write this URL and credential pair down. You cannot reset the admin password from the command line without a somewhat gnarly workaround.

Step 5: Log In to the Admin Panel

Open https://box.example.com/admin in a browser. Your browser will almost certainly warn about the TLS certificate — this is normal on the first load because Let's Encrypt was issuing the cert at the exact moment you arrived. Either:

• Click through the warning once, or
• Wait 30 seconds and reload — the valid cert should be live.

You land on the System Status Checks page. This is the most important page in MIAB and you will return to it every time something looks off. Each check has a green, yellow, or red indicator:

• Green — working correctly.
• Yellow — warning (non-fatal, but deliverability may suffer).
• Red — broken (fix before sending mail).

• Nameserver glue records are incorrect — only matters if you plan to run MIAB as your authoritative DNS (next step).
• The secondary nameserver is not set — optional but recommended.
• IPv6 address is not set — only matters if your VPS has IPv6.

Step 6: Choose Your DNS Mode

Mail-in-a-Box can run in one of two DNS modes. Pick one now — switching later is possible but annoying.

Mode A: MIAB as Authoritative DNS (Recommended)

MIAB runs its own nsd4 nameserver and auto-publishes every record your mail domain needs: A, AAAA, MX, SPF (TXT), DKIM (TXT), DMARC (TXT), MTA-STS (TXT), DANE TLSA, CAA, autoconfig, and autodiscover. You never touch DNS again for mail.

To enable this mode, delegate your domain's nameservers to MIAB at your registrar (not your current DNS provider). At the registrar control panel:

Glue records are required because, without them, a resolver asking "where is ns1.box.example.com?" would need to query example.com's nameservers — which are ns1.box.example.com. That's a circular reference; glue records break the loop by letting the registry answer directly.

Propagation takes anywhere from 5 minutes (most registrars) to 48 hours (worst case). Check progress:

dig NS example.com

Once the response shows your ns1.box.example.com / ns2.box.example.com, MIAB's System Status Checks page will flip those items green.

Mode B: External DNS (Cloudflare, Route53, etc.)

Keep using your existing DNS provider. MIAB will show you the exact records to publish on the External DNS page of the admin panel (https://box.example.com/admin/external_dns).

Copy each record into your DNS provider. At minimum you need:

Most home and small-business installs are simpler with Mode A. Most deployments at companies that already run Cloudflare benefit from Mode B.

Step 7: Add Custom Domains and Mailboxes

With DNS working, add more mailboxes and domains.

Add a Mailbox

Navigate to Mail › Users in the admin panel. Click Add User, enter the address (e.g., [email protected]), set a password, and choose a privilege level:

• Normal User — standard mailbox, webmail, IMAP, SMTP.
• Admin — same plus access to this admin panel.

Add an Alias

Mail › Aliases lets you forward [email protected] to [email protected] and [email protected], or create a catch-all. Aliases do not count as mailboxes.

Add a Second Domain

You can host unlimited domains on one MIAB instance. To add example.org:

Repeat for as many domains as you want.

Step 8: Validate Deliverability with Mail-Tester

Before handing mailboxes to real users, confirm your deliverability is clean.

Visit mail-tester.com. The page displays a one-time test address like [email protected]. Copy it.

Log in to webmail at https://box.example.com/mail/ as [email protected], compose a message to the test address with a subject line and at least a couple paragraphs of real-looking body text (avoid obvious spam triggers), and send.

Back on mail-tester.com, click Then check your score. You should see 10/10 or 9/10 on a well-configured MIAB install. Common deductions and fixes:

• "Your message has no List-Unsubscribe header" — expected for personal mail, ignore.
• "Your IP address is on a blocklist" — check mxtoolbox.com/blacklists.aspx with your VPS IP. Request delisting from any offending lists (most have a self-service form). If your IP has a long spam history, ask your provider to swap it or redeploy on a clean IP.
• "DKIM signature not found" — DNS for mail._domainkey hasn't propagated or was published incorrectly. Verify with dig TXT mail._domainkey.example.com.
• "No reverse DNS" — revisit Step 2.

Step 9: Configure iOS, Android, and Desktop Clients

MIAB publishes autoconfig and autodiscover records, so most clients set up with just an email and password.

iOS (Mail, Contacts, Calendar)

For CalDAV and CardDAV:

Android (K-9 Mail + DAVx⁵)

Stock Android mail apps vary wildly. The best-supported combination is:

DAVx⁵ then registers the account with Android's native Contacts and Calendar apps.

Desktop (Thunderbird, Apple Mail, Outlook)

• Thunderbird — "Add Account", enter name + email + password, it auto-configures.
• Apple Mail — System Settings › Internet Accounts › Other Mail Account. Same as iOS.
• Outlook — add "Other" account, use IMAP (port 993, SSL), SMTP (port 587, STARTTLS).

Step 10: Set Up Contacts and Calendar (CalDAV / CardDAV)

MIAB ships a trimmed Nextcloud instance specifically for contacts and calendar. Web UI lives at https://box.example.com/cloud/ — log in with your mailbox credentials.

Create calendars, import existing .ics files, create address books, import .vcf, and share with other mailboxes on the box. Changes sync in real time to any client connected via CalDAV/CardDAV.

Client URLs for manual configuration:

• CalDAV: https://box.example.com/cloud/remote.php/dav/calendars/<username>/
• CardDAV: https://box.example.com/cloud/remote.php/dav/addressbooks/users/<username>/contacts/

Step 11: Configure Offsite Backups

MIAB backs itself up daily by default to /home/user-data/backup/ on the same disk. Local-only backup is worthless when the VPS goes down — configure offsite immediately.

Navigate to System › Backup Status. MIAB supports three remote backup targets out of the box:

S3-Compatible Object Storage

Works with AWS S3, Backblaze B2 (via the S3 API), Wasabi, Cloudflare R2, DigitalOcean Spaces, and MinIO.

rsync to Remote Host

Local Only (Not Recommended)

If you truly cannot use offsite, at least verify the local backup is working and periodically download /home/user-data/backup/encrypted/ to your laptop.

Encryption

All MIAB backups are encrypted with a secret key stored at /home/user-data/backup/secret_key.txt. Copy this file somewhere safe immediately — without it, your backups are unrecoverable. A backup without its key is an encrypted brick.

Step 12: Upgrades and Ongoing Maintenance

MIAB releases a new version roughly every 3-6 months. Upgrades are applied by re-running the setup script in place.

cd ~
sudo mailinabox

Or, if that alias is not on your path, the explicit version:

cd ~/mailinabox
sudo setup/start.sh

The script detects the installed version, pulls updates, and applies them idempotently. Expect 5-15 minutes of downtime during the upgrade window.

Check the current version from the admin panel at System › Status Checks (top of page) or via:

cat /home/user-data/mailinabox.version

Subscribe to the MIAB release announcements to be notified when a new version ships.

Routine Checks

• Weekly — skim System Status Checks, confirm no new red items, review Munin graphs.
• Monthly — test a full restore from backup to a staging VPS (or at least verify the backup manifest decrypts with your secret key).
• Per release — read the changelog, run sudo mailinabox during low-traffic hours.

Troubleshooting

Viewing Logs

The most important logs, in order of how often you'll want them:

# MIAB management daemon (admin panel)
sudo journalctl -u mailinabox -f
Postfix (SMTP — outbound send failures show here)
sudo tail -f /var/log/mail.log
Dovecot (IMAP — client login issues)
sudo journalctl -u dovecot -f
Nextcloud (contacts/calendar)
sudo tail -f /var/log/nextcloud.log
fail2ban (shows banned IPs)
sudo fail2ban-client status

FAQ

How many mailboxes and domains can Mail-in-a-Box handle?

A single MIAB instance comfortably handles 50-100 active mailboxes across an unlimited number of domains on modest hardware (4 GB RAM, 2 vCPU). SpamAssassin is the primary bottleneck — on a 12 GB CloudCore Professional VPS, you can scale to several hundred mailboxes before you notice pressure. MIAB is deliberately single-server; if you need clustering, failover across regions, or thousands of accounts, look at Mailcow (Docker, clustering-friendly) or a commercial mail platform. For the vast majority of personal, family, and small-business use cases, one MIAB box serving dozens of users is the right shape.

Can I migrate my existing mail from Gmail, Outlook, or another server into Mail-in-a-Box?

Yes. Create the mailbox in MIAB, then use imapsync to copy every folder from the source IMAP server into MIAB. Install imapsync on any machine with network access to both servers, run one command per mailbox specifying source credentials + MIAB credentials, and imapsync incrementally syncs every message, preserving folders, flags, and timestamps. Run it a second time the night before your DNS cutover to pick up any recent messages, then flip the MX. Nextcloud's contacts and calendar both import standard .vcf and .ics files from the web UI under Contacts › Settings › Import and Calendar › Settings › Import calendar.

Is Mail-in-a-Box secure enough for business use?

Yes, with caveats. Out of the box MIAB gives you TLS everywhere, DKIM signing, DMARC enforcement (set to p=quarantine by default on MIAB-managed DNS), MTA-STS, DANE TLSA, SpamAssassin, ClamAV, fail2ban for brute-force protection, and encrypted backups. That is stronger than many SMB mail setups. What MIAB doesn't give you: formal compliance certifications (SOC2, HIPAA, ISO 27001), enterprise audit logging, or multi-factor authentication on the admin panel. If your business is regulated and needs attestations, stay on Google Workspace or Microsoft 365. For most small businesses, freelancers, and privacy-conscious teams, MIAB's security posture is more than adequate — you simply own the risk yourself.

What happens if my VPS goes down — do I lose email?

Incoming mail is not lost if MIAB is briefly unreachable. SMTP has built-in queueing: sending servers (Gmail, Outlook, etc.) retry delivery for 4-5 days before bouncing. Outages shorter than that are transparent to senders. For longer outages or to add redundancy, you can run a secondary MX server as a backup relay that queues mail and forwards to MIAB when it comes back. Alternatively, keep your backups current (Step 11) and practice a restore drill — MIAB backups restore to a fresh VPS in under an hour. The catastrophic scenario to prevent is losing both the VPS and the backup encryption key, which is why Step 11 emphasizes saving secret_key.txt offline.

Can I use Mail-in-a-Box just for SMTP relay (sending only, no mailboxes)?

Not really. MIAB is designed as a full mail server and expects at least one mailbox to exist for the admin account. If you only need to send transactional mail from your app, use a dedicated relay like Postal, Haraka, or a commercial service (Postmark, SendGrid, Amazon SES). Those are purpose-built for outbound and come with per-message tracking, bounce handling, and analytics that MIAB doesn't expose. Use MIAB when you want mailboxes people read and write from; use a dedicated relay when you want a pipe for app-generated mail.

Next Steps

Now that MIAB is live and delivering clean mail, here are useful follow-ups:

• How to Install Let's Encrypt on Ubuntu — MIAB handles certs internally, but understanding the underlying Certbot workflow helps when you troubleshoot issuance failures or want to run TLS for other services on the same server.

• How to Configure DNS Records for a New Domain — deeper reference on A, AAAA, MX, SPF, DKIM, DMARC, CAA, and MTA-STS records, including what each one does and how to verify it.

• Set up a backup MX server — deploy a second cheap VPS running just Postfix configured as a backup MX. If your main box goes down, the backup queues mail and forwards on recovery. Increases resilience dramatically for a few euros a month.

• Add a second domain — MIAB supports unlimited domains. Move every alias, old project domain, and side hustle onto the same box instead of paying per-domain at Google Workspace.

• Enable two-factor authentication on the admin panel — under System › TOTP Authentication, attach an authenticator app (Aegis, 1Password, Authy). Protects against a stolen admin password.

• Forward root@ mail to yourself — by default, root@ on the server goes nowhere. Add an alias in Mail › Aliases forwarding [email protected] → your real mailbox so cron failures, unattended-upgrade errors, and fail2ban notices reach you.

• Monitor with Uptime Kuma — deploy Uptime Kuma on a separate VPS and monitor SMTP (port 25), IMAP (993), HTTPS (443), and the admin panel URL. Get alerts the moment anything breaks.

Skip the Manual Install — Deploy a Mail-Ready VPS

Our CloudCore Professional plans are pre-configured for mail server deployments: Ubuntu 22.04 image, outbound port 25 unblocked, editable reverse DNS, dedicated IPv4 never previously used for spam, and IPv6 available on request.

- 6 vCPU, 12 GB RAM, 100 GB NVMe SSD

- Clean IPv4 + IPv6 dedicated to you

- Port 25 open out-of-the-box

- Reverse DNS editable from the control panel

- 30-day backup retention on separate storage

- EUR 19.99/month

Launch Your Mail Server VPS and have Mail-in-a-Box running in under 45 minutes, including DNS propagation.