· 6 min read
Mail-in-a-Box Review (2026): A Mail Server Appliance for Ubuntu
Mail-in-a-Box turns a fresh Ubuntu server into a finished mail server with one script, DNS and backups included. Here is what it does, where it falls short and who it suits.
Jump to section
Mail-in-a-Box takes a fresh Ubuntu server and turns it into a finished mail server with one script. It sets up the mail software, webmail, contacts and calendars, DNS, certificates, backups and a control panel, and then checks every day that it all still works. There are almost no choices to make, and that is the point.
This review covers what it does, what I found in the installer and control panel code, where it falls short and how it compares with Stalwart, Mailu and mailcow. Features were checked against version 78, released on 22 October 2026, on 31 October 2026.
Short answer: Mail-in-a-Box is the closest thing to a mail server appliance. If you have a spare domain and a fresh Ubuntu server, it does almost everything for you, including the DNS records. The catch is that it only installs on Ubuntu 22.04, it wants the whole server to itself and it is deliberately hard to customise.
How I tested: I ran the version 78 installer on a test Ubuntu 22.04 machine on 31 October 2026. It checked the system, set up its package sources and installed the system packages, but it expects a real server with a public address and its own DNS, and my locked-down test network stopped it before the mail software was in place. Everything after that point comes from the project’s setup guide, security guide, changelog and the installer and control panel source code, not from a working box.
At a Glance: Who Mail-in-a-Box Is (and Isn’t) For
| Who it suits | How well | Why |
|---|---|---|
| Individual or family wanting their own email with little effort | Ideal | One script, sensible defaults and daily checks that tell you what to fix. |
| Small team that needs mail, contacts and calendars | Strong fit | Webmail, contacts and calendars included, plus Exchange ActiveSync for phones. |
| Anyone who already runs other things on their server | Alternative needed | It needs a fresh machine and takes it over. Mailu or docker-mailserver run alongside other apps. |
| Sysadmin who wants to tweak everything | Partial fit | The project says plainly that it isn’t built for power users to customise. |
| Business needing many domains and per-domain admins | Partial fit | Several domains work, but there is one admin level and no per-domain delegation. |
| Non-technical user who just wants email that works | Alternative needed | A managed provider such as Fastmail or mailbox.org is far less work. |
What Mail-in-a-Box Is
Mail-in-a-Box was started by Joshua Tauberer, with its first release in August 2014, and is now run by him and volunteer contributors. Its stated goals are to make a good mail server easy to deploy and to promote decentralisation and privacy. It also says what it won’t do: it isn’t trying to be unhackable, and it isn’t built for power users to customise.
| Job | What it uses |
|---|---|
| Sending and receiving | Postfix |
| Mailboxes | Dovecot for IMAP and POP3, with Sieve filters and auto-replies |
| Webmail | Roundcube |
| Contacts and calendars | A built-in copy of Nextcloud (CardDAV and CalDAV) |
| Phones | Exchange ActiveSync through Z-Push |
| Spam | SpamAssassin, which learns from what you mark as spam, plus greylisting |
| DNS | Its own DNS server, with SPF, DKIM, DMARC, DNSSEC, DANE and MTA-STS records set for you |
| Certificates | Let’s Encrypt, renewed automatically |
| Backups | Encrypted backups to the server itself, rsync, Amazon S3 or compatible storage, or Backblaze B2 |
| Protection and monitoring | Firewall, Fail2ban, Munin graphs and daily status checks |
Setting It Up: What I Found
The setup guide asks you to rent a server, point your domain’s nameservers at the box (or copy its records to your own DNS host), and run one command. The installer asks for your server name and first email address, then installs everything. Afterwards, the control panel tells you which DNS records are missing and whether anything is broken.
| What I checked | What I found |
|---|---|
| System check | The installer stops on anything other than Ubuntu 22.04, and stops below 512 MB of memory, warning below 768 MB. 1 GB is recommended |
| Questions asked | Just your server name, public address and first email address. Everything else is decided for you |
| Package sources | It adds two extra Ubuntu package sources (PPAs) for PHP and the backup tool, so it really does take over the machine |
| DNS | The box runs its own DNS server and writes every record, including DKIM, DMARC and DNSSEC. You can use your own DNS host instead and copy the records across |
| Status checks | The control panel checks services, open ports, certificates, DNS, disk space, memory, backups and whether a new version is out, and emails you each day |
| Two-step sign-in | The control panel supports a code from an authenticator app. It covers the control panel, not mail apps |
| Backups | Encrypted with Duplicity, with backup status included in the daily checks |
Ubuntu 22.04 only: version 78 still installs only on Ubuntu 22.04, whose standard support from Canonical ends in 2027. The changelog doesn’t yet mention support for a newer Ubuntu. Expect to move to a new server when that changes.
Know the limits: it needs a fresh server that it controls, there is no per-domain admin role, no app passwords for mail apps and no antivirus scanner. It is designed to be left alone, so if you want to change how it works you are working against it.
What It Takes to Run
| Requirement | Details |
|---|---|
| Server | A fresh Ubuntu 22.04 64-bit machine with nothing else on it |
| Memory | 512 MB minimum, 1 GB recommended |
| Network | A static IP address with matching reverse DNS, and port 25 open in both directions |
| Domain | Ideally a domain whose nameservers you can point at the box. Your own DNS host works too |
| Updates | Run the setup script again for each new version. Version 78 was a security update for Roundcube and PHP |
Backups are built in, which is rare. Even so, the box is a single server, so check the backups actually work and keep a copy somewhere else. And as with any self-hosted server, your mail can still end up in spam if the IP address has a poor reputation. The project says so itself.
Security
| Feature | Details |
|---|---|
| Sender checks | SPF, DKIM and DMARC, with records published for you |
| Connections | Modern TLS throughout, with DANE, MTA-STS and DNSSEC |
| Sign-in | Passwords for mail. Authenticator-app codes for the control panel. Fail2ban blocks repeated guessing |
| Backups | Encrypted before they leave the box |
| Stored mail | Not encrypted on disk |
| Licence | CC0 (public domain) |
The project publishes a plain-English security guide explaining what it protects against and what it doesn’t, which I wish more projects did.
Who Is Behind It
Mail-in-a-Box is led by Joshua Tauberer in the United States, with volunteer contributors on GitHub. There is no company and no paid support: the README asks people not to contact him directly and to use the discussion forum instead. Releases are steady, with version 77 in September 2026 and version 78 in October 2026, both fixing security issues in bundled software.
Mail-in-a-Box Pricing in 2026
It is free and released into the public domain under CC0, with no paid edition and no limit on mailboxes or domains. The only cost is your server: a VPS with 1 to 2 GB of memory from a provider that allows mail servers typically costs £5 to £10 a month.
Comparative Matrix: Mail-in-a-Box vs. the Alternatives
| Feature | Mail-in-a-Box | Mailu | mailcow | Stalwart |
|---|---|---|---|---|
| How it’s installed | One script on a fresh Ubuntu server | Docker containers | Docker containers | One program or Docker |
| Recommended memory | 1 GB | 1 GB (3 GB with ClamAV) | 6 GB minimum | About 2 GB |
| Runs DNS for you | Yes | No (shows the records) | No (shows the records) | No (shows the records) |
| Calendars and contacts | Yes (Nextcloud) | Optional | Yes | Yes |
| Built-in backups | Yes | Manual | Yes (script) | Manual |
| Full Review | You are here | Coming soon | Read the review | Read the review |
Pros and Cons
| Strengths | Weaknesses |
|---|---|
| Closest thing to a mail server appliance | Only installs on Ubuntu 22.04 |
| Writes every DNS record, including DNSSEC | Needs a fresh server all to itself |
| Daily status checks tell you what to fix | Deliberately hard to customise |
| Encrypted backups built in | No antivirus scanner |
| Webmail, contacts, calendars and ActiveSync included | Two-step sign-in covers the control panel only |
| Runs on 1 GB of memory | Volunteer-run, with no paid support |
Frequently Asked Questions
Is Mail-in-a-Box free?
Yes. It is released into the public domain under CC0, with no paid edition. You pay only for your server.
Can I install Mail-in-a-Box on Ubuntu 24.04?
Not with version 78. The installer stops on anything other than Ubuntu 22.04.
Does Mail-in-a-Box include webmail?
Yes. Roundcube is included, along with contacts and calendars through a built-in copy of Nextcloud.
Do I have to use Mail-in-a-Box for my DNS?
No, but it is easiest. If you keep your DNS elsewhere, the control panel lists every record to copy across.
Can I run other websites or apps on the same server?
Not really. It expects a fresh server and takes it over. It can host simple static websites for your domains, but anything else belongs on another server.
Final Verdict
Mail-in-a-Box does more of the work for you than any other self-hosted mail server here. It writes your DNS, gets your certificates, backs itself up and checks every day that nothing has broken. For a family or small team with a spare server, that is a lot of peace of mind for nothing.
The price of that simplicity is control. It runs on one version of Ubuntu, wants the whole server and doesn’t like being changed. If that suits you, it is an easy recommendation. If you want email you never have to think about at all, your email is too important to run on goodwill, and a managed provider will serve you better.
Sources: Mail-in-a-Box website and setup guide, Mail-in-a-Box on GitHub, changelog, security guide.
Note: This article contains no affiliate links. I have no connection with the Mail-in-a-Box project. Checked on 31 October 2026. Features may change.
Paul O'Brien
I've spent over 25 years working hands-on with email, DNS and cloud infrastructure. I test email providers and privacy tools for real, then tell you what they're good at and where they fall short.
More about meMore like this
You're subscribed. New articles come by email, as I publish or every Thursday. Change how often
Comments