Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk11 min

How to Run Your Own Mail Server with Mail-in-a-Box on a VPS

A practical guide to running Mail-in-a-Box on a dedicated Ubuntu 22.04 VPS, from port 25 and DNS preparation to installation, deliverability, TLS, backups, and migration.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Mail-in-a-Box can turn a fresh Ubuntu 22.04 LTS 64-bit VPS into a complete personal mail system, but it is not an application you safely add to an existing server. It expects a dedicated machine, a domain with correctly aligned DNS, an IP address that can send on SMTP port 25, and an operator prepared to manage reputation, updates, backups, and recovery.

This guide explains the deployment from VPS selection through DNS, installation, encrypted client access, deliverability checks, backup, migration, and troubleshooting. The project homepage lists release v76, dated May 24, 2026; confirm the current release and requirements immediately before a production install.

As an Amazon Associate I earn from qualifying purchases.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What Mail-in-a-Box does

Mail-in-a-Box is an appliance-style distribution for self-hosted email. Its goal is a prescriptive, automated setup rather than a collection of independent packages that you tune indefinitely. The project describes it as a one-click, easy-to-deploy SMTP-and-everything-else server.

On a supported machine, the installer configures the mail transport, mailbox access, webmail, contacts and calendars, spam controls, DNS integration, certificates, firewall rules, intrusion protection, monitoring, and administrative controls. You manage the resulting system through its HTTPS control panel instead of hand-editing every service configuration.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

That convenience has a corresponding constraint: the box owns much of its configuration. Manual edits and unrelated packages can conflict with its self-management or be overwritten during maintenance. Think of it as an appliance with a documented operating procedure, not as a general-purpose Linux server.

What is included

  • Postfix for SMTP mail transport.
  • Dovecot for IMAP and POP mailbox access.
  • Roundcube webmail.
  • Nextcloud contacts and calendar integration.
  • Spam filtering and greylisting.
  • Firewalling, fail2ban, monitoring, and DNS tooling.
  • Automatic DNS records when the box is authoritative for your domain.
  • Free Let’s Encrypt certificates for HTTPS and mail services, with an option to import another certificate.
  • Encrypted backup jobs that can remain local or be copied elsewhere.

Decide whether this deployment fits

Mail-in-a-Box is a good fit when you want control over addresses and data and are willing to operate one deliberately configured server. It is less suitable when you need a heavily customized mail stack, multiple unrelated applications on the same host, or a provider that will not permit SMTP traffic.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The central design decision is whether you accept the appliance’s limited configuration surface. If you need to replace individual components, maintain custom service files, or share the host with a web application, choose a different architecture. If predictable automation is more valuable than low-level control, the dedicated-appliance model is an advantage.

Choose the VPS before installing anything

Start with a completely fresh cloud machine. The supported image documented by the project is Ubuntu 22.04 x64. Do not select a preconfigured mail or web image and do not reuse a server that already has production services.

Requirement Why it matters What to verify with the provider
Ubuntu 22.04 LTS, 64-bit This is the currently documented supported base image. The image is a clean installation, not a customized template.
Dedicated VPS The appliance manages system packages, services, firewall rules, and generated configuration. No other customer workload shares the operating system, and you can rebuild the instance if needed.
Public, stable IPv4 address Remote mail servers need to connect to your SMTP endpoint and evaluate its reputation. The address is not on a known blocklist and can be replaced if its prior reputation is poor.
Inbound and outbound SMTP access Port 25 is used for server-to-server delivery. Some networks block it by default. Port 25 is permitted in both directions, and the provider has a clear abuse policy.
Reverse-DNS control Receiving systems commonly compare the connecting IP’s PTR name with your mail hostname. You can set a PTR record and change it if the first address is unsuitable.
Administrative SSH access Installation, emergency recovery, and migration require a reliable out-of-band path. You receive root or sudo access and can use key-based SSH.
Backup destination A local-only backup disappears with the server or its disk. You can copy encrypted backups to another server or an S3-compatible service.

Ask the provider specifically about SMTP restrictions, abuse handling, reverse DNS, and IP replacement before paying for a long commitment. A technically perfect installation can still fail if the address has a bad history or the provider blocks outbound port 25.

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

Prepare the domain and DNS

Register a domain you control and choose who will be authoritative for its DNS. There are two workable arrangements.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Let Mail-in-a-Box manage DNS

Delegating the domain’s nameservers to the box allows the control panel to publish the records it needs. This is the most automated path. You must set the nameserver and glue records at the registrar correctly, then wait for delegation and DNS propagation.

Keep DNS at your registrar or another provider

You can leave nameservers where they are and copy the records shown in the Mail-in-a-Box control panel into that DNS service. This gives you continuity with an existing DNS platform, but every record change must be copied accurately and propagation must be allowed before status checks can pass.

Records to plan

At minimum, plan for the mail hostname, MX, SPF, DKIM, DMARC, MTA-STS, and the forward and reverse names associated with the server. The exact values are generated for your installation and displayed by the control panel; do not substitute examples from another domain.

  • MX: directs incoming mail to the box’s mail hostname.
  • SPF: identifies which hosts may send for the domain.
  • DKIM: publishes the public key that receiving systems use to verify signed messages.
  • DMARC: tells receivers how to evaluate messages that fail SPF or DKIM alignment and where to send reports.
  • MTA-STS: advertises a policy for requiring authenticated TLS when supported by both domains.
  • A and AAAA records: map the mail hostname to the server address when applicable.
  • PTR (reverse DNS): is set at the VPS provider, not usually in your normal DNS zone.

Keep the hostname, forward DNS, reverse DNS, MX target, and certificate names consistent. Inconsistency is a common cause of failed checks and distrust from receiving providers.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

Install Mail-in-a-Box step by step

  1. Provision the machine. Create a new Ubuntu 22.04 LTS 64-bit VPS with its own public IP. Do not install a web server, control panel, database, firewall suite, or mail package first.
  2. Set the hostname. Choose the fully qualified mail hostname you intend to publish and configure it before the installer begins. Confirm that forward DNS and the provider’s reverse-DNS setting will agree.
  3. Prepare delegation or external DNS. Either point the domain’s nameservers at the box or be ready to enter the records shown by the control panel in your existing DNS service.
  4. Obtain the project code. Clone the official Mail-in-a-Box repository on the fresh server and check out the release tag you intend to run. Use a tagged release rather than an unreviewed development state for production.
  5. Run the installer. From the checked-out project directory, execute sudo setup/start.sh. The script asks for the administrative account, domain details, hostname, and other deployment values.
  6. Complete every prompt carefully. Record the administrator credentials and the backup encryption password in a password manager or another secure location outside the VPS.
  7. Open the control panel over HTTPS. After installation, use the administrative panel to review users, aliases, DNS values, certificates, and service status.
  8. Resolve status checks. Work through warnings for DNS, open ports, certificates, hostname alignment, and running services before inviting users to send mail.
  9. Create mail identities. Add user mailboxes and aliases in the panel. An alias can forward or deliver mail without requiring a separate login, while a user mailbox provides authenticated access.
  10. Test real clients. Verify webmail, then configure an encrypted desktop or mobile client and send test messages to more than one external provider.

The installer is intentionally opinionated. If a prompt or status check conflicts with an existing service, stop and correct the underlying host or DNS problem instead of forcing a partial installation.

Ports, encryption, and client settings

Mail-in-a-Box’s documented protected services use TLS 1.2 or newer. Configure clients for authenticated, encrypted submission rather than unauthenticated SMTP.

Function Port Client or server use
SMTP submission over TLS 465 Encrypted message submission from a mail client.
SMTP submission with negotiated TLS 587 Authenticated submission, commonly selected by desktop and mobile clients.
IMAP over TLS 993 Encrypted mailbox access while retaining messages on the server.
POP over TLS 995 Encrypted download access for clients that use POP.
HTTPS 443 Administrative control panel and webmail.

The box blocks unauthenticated submission. Use the mailbox username and password with the encrypted submission port selected by your client, and verify that the certificate hostname matches the server name.

Opportunistic outbound TLS

Server-to-server delivery uses opportunistic encryption: when the receiving server supports a negotiated TLS connection, the message is encrypted in transit. Ordinary opportunistic TLS does not protect against an active man-in-the-middle attack. DNSSEC and DANE TLSA can provide stronger authenticated transport when both domains publish and validate the required records, but they are not automatically a guarantee for every destination.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Certificates and HTTPS

The control panel can request and renew a free Let’s Encrypt certificate for the web interface and mail services. A paid certificate is not required for the standard deployment. The setup guide also supports importing another certificate when your organization has a separate certificate policy.

Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.

Certificate issuance and renewal depend on correct DNS and hostname records. Verify the first certificate in a browser and in a mail client, then keep the hostname and DNS records unchanged unless you understand the renewal and service consequences.

Deliverability: the part the software cannot control

Running the software does not guarantee inbox placement. Gmail, Microsoft, Yahoo, and other receiving systems make independent decisions based on authentication, content, traffic patterns, complaints, blocklists, and the reputation of the sending IP and domain. The project explicitly warns that other mail services may block or spam-filter messages sent from a self-hosted box.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Give the box the best possible signals:

  • Publish valid SPF and DKIM records for the sending domain.
  • Publish a DMARC policy with aligned domains and monitor its reports before tightening enforcement.
  • Keep forward DNS, reverse DNS, the SMTP hostname, and certificate names aligned.
  • Use a provider that permits port 25 and can replace an address with poor reputation.
  • Monitor bounces, deferrals, complaint notices, and blocklist alerts.
  • Send only wanted mail and remove invalid recipients promptly.

If messages fail immediately, inspect the SMTP response and the receiving provider’s explanation. A clean status panel proves that your local services are running; it does not override a recipient’s policy or repair a previously abused IP address.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Operate it as an appliance

Do not install unrelated packages simply because the VPS has spare capacity. Avoid hand-editing generated Postfix, Dovecot, DNS, firewall, or web-server files. The next maintenance action may regenerate them, leaving you with a change that appears to vanish or a conflict that is difficult to diagnose.

Use the project’s maintenance guide and release notes for upgrades, package changes, restores, and version-specific requirements. Before upgrading, confirm that your backup completed successfully and that the encryption key is available off the box. Keep a written record of the domain delegation, provider account, reverse-DNS setting, administrator account, and recovery contacts.

Back up and restore safely

The backup system encrypts the data it stores. That protects a copied backup if the destination is exposed, but it creates a non-negotiable recovery requirement: the encryption password or key must be preserved separately. A backup without its decryption secret cannot be restored.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Choose a backup layout

  • Local retention: convenient for quick recovery from an accidental deletion, but lost with the VPS or its disk.
  • Rsync to another server: keeps encrypted backup files under your control on a second machine.
  • S3-compatible storage: sends encrypted backups to Amazon S3 or a compatible service such as DigitalOcean Spaces.

Store the encryption password in a password manager, offline record, or secure escrow that is independent of the mail server. Test that you can retrieve both a backup file and the key before you rely on the arrangement.

Migration procedure

  1. Provision a fresh supported Ubuntu 22.04 x64 VPS and set its hostname.
  2. Use the maintenance procedure to block non-SSH services on the old box while preserving administrative access.
  3. Take a final encrypted backup and verify that it reached the off-box destination.
  4. Install Mail-in-a-Box on the new machine and restore the backup using the preserved encryption key.
  5. Update DNS and glue records, including MX, nameserver delegation, and any provider-side reverse-DNS setting.
  6. Wait for DNS propagation and run the control panel’s status checks.
  7. Re-enable normal services only after the new box is receiving and sending test mail.

Propagation means some senders may continue using the old address temporarily. Keep the old machine available for the period required by your DNS TTL and operational plan, but do not leave unauthenticated services exposed during the transition.

Troubleshooting by symptom

Symptom Likely cause Action
Installer reports a non-fresh system or conflicting service Packages, configuration, or another control panel already exist. Rebuild a clean Ubuntu 22.04 x64 VPS and install only Mail-in-a-Box.
Port 25 tests fail The provider or upstream network blocks SMTP. Ask the provider to remove the restriction or move to a mail-capable address; do not keep debugging DNS until transport is available.
Reverse-DNS or hostname warning PTR, forward DNS, and the configured hostname disagree. Set the provider-side PTR to the same fully qualified hostname published in DNS and in Mail-in-a-Box.
Certificate issuance fails DNS has not propagated, the hostname is wrong, or HTTPS is unreachable. Correct DNS and port 443 access, wait for propagation, then retry through the control panel.
Mail reaches spam or is rejected Recipient policy, IP reputation, or missing authentication. Check SPF, DKIM, DMARC, forward and reverse DNS, SMTP responses, and the provider’s reputation or replacement-IP process.
Backup cannot be restored The encrypted backup key or password is missing. Locate the separately preserved key; there is no substitute decryption path documented for the encrypted backup.
Manual configuration disappears after maintenance The appliance regenerated its managed files. Undo the unsupported edit and use the documented control-panel or maintenance procedure.

How to judge alternatives

If Mail-in-a-Box is not the right fit, compare another mail stack using the same practical criteria rather than package counts:

  • Does it require a fresh machine, or can it share an existing host?
  • How much control does it expose over SMTP, IMAP, filtering, DNS, and authentication?
  • Are webmail, calendars, spam filtering, certificates, and monitoring bundled?
  • How are encrypted backups, off-site copies, migrations, and restores performed?
  • Can the hosting provider support port 25, reverse DNS, abuse handling, and IP replacement?
  • Who owns routine updates and how much manual maintenance is expected?

Mail-in-a-Box favors a narrow, automated workflow. Its trade-off is less freedom to customize individual components or co-locate unrelated software.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Launch checklist

  • Fresh dedicated Ubuntu 22.04 LTS 64-bit VPS.
  • Public IP with SMTP port 25 access and a reverse-DNS option.
  • Domain registered and nameserver strategy selected.
  • MX, SPF, DKIM, DMARC, MTA-STS, forward DNS, and PTR planned.
  • Tagged Mail-in-a-Box release selected; the homepage lists v76 dated May 24, 2026.
  • sudo setup/start.sh completed without unresolved errors.
  • HTTPS certificate issued and verified.
  • Users, aliases, webmail, and encrypted client access tested.
  • Outbound tests checked at multiple recipient providers.
  • Encrypted backups copied off the VPS.
  • Backup encryption key stored separately and a restore test completed.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.