Run DavMail on the VPS as a dedicated, non-root systemd service, connect it to Exchange or Microsoft 365 with the backend that matches your mailbox, and expose only the protocol listeners your clients need. For a headless Microsoft 365 server, use a non-interactive OAuth method such as O365DeviceCode; the interactive and manual OAuth modes require a browser or dialog and are not suitable for an unattended VPS.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The example below uses Microsoft 365 EWS, OpenJDK, IMAP on port 1143, POP on 1110, SMTP on 1025, CalDAV on 1080 and LDAP on 1389. Treat those as configurable sample ports, not universal defaults, and protect the OAuth token and properties files as credentials.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat DavMail does on a VPS
DavMail is a gateway rather than a replacement mail server. It logs in to Microsoft Exchange or Microsoft 365 and translates the mailbox into standard protocols that ordinary applications understand: POP and IMAP for mail retrieval, SMTP for sending, CalDAV for calendars, CardDAV for contacts and LDAP for directory lookups. A mail or calendar client connects to the VPS; DavMail makes the corresponding Exchange request upstream.
This is useful when a client supports standard protocols but does not support the Exchange or Microsoft 365 authentication and APIs used by your organization. The VPS supplies an always-on endpoint, while Exchange remains the system of record for messages, folders, calendars, contacts and directory data.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
There are two separate network paths to plan:
- Outbound from DavMail: the VPS must reach the Exchange or Microsoft 365 endpoint and the authentication services required by your chosen OAuth flow.
- Inbound to DavMail: client devices reach only the listeners you enable, such as IMAP or SMTP. These listeners must be restricted with a host or cloud firewall when they are reachable beyond the VPS itself.
DavMail does not remove the need for a valid Exchange account, tenant policy, consent and any required client registration. It also does not turn an unauthenticated public listener into a secure mail service; authentication, encryption and network restrictions remain your responsibility.
Decide the deployment before installing
Microsoft 365 or on-premises Exchange
Identify the mailbox platform and its supported endpoint first. Microsoft 365 normally uses an Office 365 backend and the tenant’s current Exchange Web Services (EWS) or Graph policy. An on-premises installation needs the OWA or EWS URL appropriate to that Exchange version and deployment. Older Exchange installations may require the WebDAV mode instead of EWS.
| Mailbox environment | Backend choices listed by DavMail | What you must verify |
|---|---|---|
| Microsoft 365 | O365EWS or O365Graph |
Which backend your tenant and DavMail release support, the tenant endpoint, consent policy and OAuth registration. |
| Exchange 2007 or later on-premises | ExchangeEWS |
The reachable EWS/OWA base URL, certificate trust and the authentication policy enabled by the organization. |
| Older Exchange deployment | ExchangeWebDav where supported |
Whether that legacy WebDAV service is enabled and the exact server URL; do not assume an EWS URL will work. |
The example in this guide uses O365EWS. If your tenant has moved to or requires Graph, change the mode and follow the authentication requirements of the DavMail version you install rather than copying the EWS values unchanged.
Headless or interactive authentication
| Authentication mode | VPS suitability | Why |
|---|---|---|
O365DeviceCode |
Suitable for a headless server when supported by your tenant and DavMail release | The service displays a device code and a verification address. You complete authorization on another approved device, then the server stores the resulting token. |
O365Interactive |
Not suitable for a truly headless VPS | Requires an interactive browser window. |
O365Manual |
Not suitable for an unattended first run | Requires a browser or dialog-driven manual flow. |
A first Microsoft 365 authorization can require user consent. Tenant administrators may need to approve the application or configure a custom client ID. The DavMail FAQ also documents tenant IDs and the current native-client redirect URI, https://localhost/common/oauth2/nativeclient, which became relevant with the January 2026 redirect-URI change. Use the redirect value required by the version and registration you are actually running.
Prepare the Linux VPS
Use a supported Linux distribution with current security updates. A DNS name is strongly preferable if clients will connect remotely, because it gives you a stable endpoint and makes certificate and firewall rules easier to manage. Create a dedicated service account; do not run DavMail as root.
Minimum preparation checklist
- A VPS with reliable outbound HTTPS access to the Exchange or Microsoft 365 services.
- A non-root account such as
davmailfor the daemon. - A host firewall and, where applicable, a cloud security-group rule.
- Recent OpenJDK. The DavMail server documentation states that OpenJDK 8 or later is supported; a current supported LTS release is preferable for a new installation.
- Enough storage for configuration, token data and logs. Mail itself remains in Exchange unless a client downloads or caches it.
- A backup or recovery plan for the properties file and OAuth registration information, without copying token files into an insecure location.
Install OpenJDK
Use your distribution’s supported OpenJDK package. Package names differ, so confirm the exact package for your release. Typical Debian-family systems use a package such as openjdk-17-jre-headless; RPM-family systems commonly provide a package such as java-17-openjdk-headless. Verify the result:
java -versionDo not continue if the command is missing or points to an obsolete Java runtime. If your distribution supplies a newer supported LTS release, use that instead of forcing an old version.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Install DavMail
There are two practical installation paths.
Distribution package
Choose the Debian or RPM package when you want distribution integration, upgrades through the package manager and the systemd configuration supplied with the package. The package may create a service account, configuration directory and unit file for you; inspect those paths before replacing them.
- Refresh the package metadata for your distribution.
- Install the DavMail package and OpenJDK runtime using the distribution’s package manager.
- Inspect the installed unit with
systemctl cat davmailor the unit name supplied by the package. - Locate the packaged properties file and confirm which user and configuration directory the unit uses.
Package names and unit names vary by distribution, so do not assume that a unit called exactly davmail.service exists. List matching units with systemctl list-unit-files | grep -i davmail.
Platform-independent archive
Use the platform-independent Linux archive when the distribution does not provide DavMail or provides a release older than the one you require. Unpack it under a root-owned application directory, for example /opt/davmail, and keep writable configuration and OAuth data outside that application tree, under the service account’s home or a separately protected configuration directory.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Create the application directory with root ownership.
- Extract the archive there and make the launcher executable if the archive requires it.
- Create a dedicated service account and a configuration directory that the account can write.
- Record the actual launcher path; it may be a shell script or a Java invocation, depending on the archive.
- Create your own systemd unit using that path, as shown later.
Keeping program files root-owned limits the damage from an accidental overwrite. Keeping token and properties files in a directory writable only by the service account allows DavMail to refresh credentials without granting it write access to the whole operating system.
Create the service account and protected directories
If the package did not create an account, create a system account with no interactive shell and no unnecessary home-directory access. The exact account-management command differs by distribution; the important properties are a stable UID, no root privileges and ownership of only the files DavMail must modify.
A typical layout separates immutable application files from mutable state:
/opt/davmailor the distribution’s application path: root-owned program files./etc/davmail: root-owned properties file, readable by the DavMail account but not by unrelated users./var/lib/davmailor the service account’s home: OAuth tokens and other state that DavMail must update.- Journald: service logs, subject to your distribution’s retention and access policy.
Set restrictive permissions on the properties file and token directory. A token grants access according to the consent and account policy, so treat it like a password: do not place it in a world-readable home directory, a public backup, a ticket or a shell history.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Create the DavMail properties file
Start with a minimal server configuration and add only the protocols you need. This example selects Microsoft 365 EWS and the device-code OAuth flow:
davmail.server=true
davmail.mode=O365EWS
davmail.authentication=O365DeviceCode
davmail.url=https://outlook.office365.com/EWS/Exchange.asmx
davmail.imapPort=1143
davmail.popPort=1110
davmail.smtpPort=1025
davmail.caldavPort=1080
davmail.ldapPort=1389Save the file at the path used by your package or unit. The important settings are:
davmail.server=trueenables server mode rather than a desktop-oriented windowed configuration.davmail.modeselects the Exchange or Microsoft 365 backend.davmail.authenticationselects the OAuth method. Use a headless-capable method for an unattended VPS.davmail.urlidentifies the EWS or other endpoint. Use the endpoint appropriate to your tenant or on-premises deployment; the Microsoft 365 example is not valid for every Exchange server.- The listener-port settings determine where clients connect. Change or disable ports that you do not need.
Do not enable POP merely because it appears in the sample. IMAP is usually the better choice for multi-device folder synchronization, while POP is a download-oriented protocol with different state behavior. If no client needs LDAP, leave that listener disabled according to the configuration options available in your DavMail release.
Complete Microsoft 365 OAuth without a desktop
First authorization with device code
- Start DavMail once in server mode under the service account, either in the foreground for diagnosis or through systemd.
- Watch the service log for the device-code prompt. It should provide a verification address and a one-time code.
- On an approved workstation or phone, open the displayed address, enter the code and authenticate with the Microsoft 365 account.
- Approve the requested permissions if your organization’s policy allows it. If consent is blocked, a tenant administrator must complete the required approval or provide an approved client registration.
- Return to the VPS log and wait for the authorization to complete. DavMail should persist a token for later unattended refreshes.
- Stop the foreground process if you used one and start the systemd service with the same properties and state directory.
The VPS does not need a graphical browser for this flow. It does need outbound connectivity and a tenant that permits the selected OAuth method. If the device-code option is unavailable in your installed release or blocked by tenant policy, use an approved interactive authorization workflow from a controlled machine and then transfer the resulting token state securely; do not copy credentials through email or an unrestricted shared directory.
Redirect and client-registration problems
A redirect error usually means that the registered client, tenant policy and DavMail configuration disagree. Check the tenant ID and client ID, confirm that the application registration allows the native-client redirect required by the current Microsoft identity configuration, and use https://localhost/common/oauth2/nativeclient where the current DavMail FAQ and registration flow specify it. Do not substitute a guessed redirect URL.
Bind listeners and configure the firewall
The sample configuration exposes these local services:
| Protocol | Sample port | Typical client use |
|---|---|---|
| IMAP | 1143 | Mail synchronization and folder access |
| POP | 1110 | Mail download for clients that require POP |
| SMTP | 1025 | Message submission through DavMail |
| CalDAV | 1080 | Calendar access |
| LDAP | 1389 | Directory and contact lookup |
These are nonstandard example ports chosen to avoid collisions with commonly occupied system ports. They are not proof that a listener is enabled or reachable. After starting DavMail, check the actual sockets with:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
ss -ltnp
systemctl status davmail --no-pagerBind listeners to localhost if all clients run on the VPS or connect through a local tunnel. If remote clients must connect directly, restrict each port to known source addresses with the VPS firewall or a private network. Open only the protocols in use. A public listener should use the TLS and authentication capabilities supported by your DavMail version; never expose an unauthenticated plain-text service to the internet.
Also check the cloud provider’s security group. A port can be allowed by the operating-system firewall and still be blocked upstream, or opened in the cloud firewall while blocked locally. Test from an authorized client network rather than from an unrelated public scanner.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Run DavMail with systemd
Debian and RPM packages include systemd configuration according to the DavMail server documentation. Prefer that unit because it already knows the packaged executable and configuration paths. Review it before enabling the service, especially the account, properties-file argument and state directory.
For an archive installation, create an equivalent unit and replace the paths with the ones on your VPS:
Recommended Free Tools
[Unit]
Description=DavMail Exchange gateway
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
User=davmail
Group=davmail
WorkingDirectory=/var/lib/davmail
ExecStart=/opt/davmail/davmail /etc/davmail/davmail.properties
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.targetThe launcher name and command-line syntax can differ between archive releases. Confirm the executable’s help output and the package documentation before enabling this exact command. If the launcher expects only a properties-file path, adjust ExecStart accordingly.
- Save the unit under
/etc/systemd/system/davmail.servicewhen no packaged unit exists. - Run
systemctl daemon-reload. - Start it with
systemctl start davmail. - Inspect startup and OAuth output with
journalctl -u davmail -e. - After a successful test, enable it at boot with
systemctl enable davmail.
Do not use systemctl enable --now until the properties file, account ownership and listener restrictions are correct. Starting first, checking logs and then enabling reduces the chance of booting a misconfigured service repeatedly.
Connect clients and verify each function
Configure clients with the VPS DNS name, the enabled listener port and the authentication details expected by DavMail. Verify one protocol at a time rather than assuming that successful IMAP proves SMTP, calendar or directory access also works.
- IMAP: confirm login, folder listing, message headers, message download and flag changes.
- SMTP: send a message to a test recipient and confirm both client acceptance and Exchange delivery. Check the DavMail log if the client reports only a generic submission error.
- POP: if enabled, verify the expected download and deletion behavior for that client; POP does not provide the same folder synchronization model as IMAP.
- Calendar: connect through the CalDAV endpoint, read an existing event, create a test event and verify that it appears in Exchange.
- Contacts and directory: test the CardDAV or LDAP function used by your client separately from calendar access.
Record the exact hostname, port, encryption setting and username format that worked. This makes later client repairs faster and helps distinguish a client setting from a server-side failure.
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshoot the common failures
No login window appears on the VPS
This is expected when an interactive OAuth mode is selected on a headless server. Change to O365DeviceCode when supported, or authorize through an approved interactive workflow and securely persist the token. Do not wait for a graphical window that cannot exist on the VPS.
Device-code authorization never completes
- Read the service log for an expired code or a tenant-policy rejection.
- Confirm that the VPS can make outbound HTTPS connections and that its clock is accurate.
- Check tenant consent, client registration and the account’s ability to use the selected application.
- Repeat the flow with a newly issued code; device codes are time-limited.
OAuth consent or redirect failure
Review the tenant and client identifiers, application permissions and native-client redirect. The current redirect documented for the relevant flow is https://localhost/common/oauth2/nativeclient; use it only when it matches your DavMail version and registration instructions. A redirect mismatch is not fixed by changing the Exchange EWS URL.
Client reports connection refused
- Confirm that the corresponding protocol is enabled in the properties file.
- Check
ss -ltnpto see whether DavMail is listening on the expected port. - Read
journalctl -u davmailfor a startup or bind error. - Check the VPS firewall and cloud security group for the client’s source address.
- Look for another process already using the port and either stop it or select an unused port.
The client connects but Exchange operations fail
Verify that the mode and URL match the mailbox. Microsoft 365, Exchange 2007 or later and older WebDAV deployments do not share one universal endpoint. An incorrect OWA or EWS base URL can allow the local socket to open while every upstream request fails.
Sent messages appear twice
The DavMail FAQ warns that duplication can occur when an IMAP client saves a copy in its Sent folder while Exchange also saves the submitted message. Configure the client so that only one side performs the Sent-item copy, following the behavior supported by that client and your DavMail version.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe service works manually but not after reboot
- Check that the unit is enabled and that its
User, working directory and properties path still exist. - Ensure the service account can read the properties file and write its token/state directory.
- Use
journalctl -b -u davmailto inspect the current boot rather than an older manual-run log. - Confirm that network-online ordering is sufficient for your VPS image and that no interactive prompt is waiting for input.
Security and maintenance checklist
- Run as a dedicated non-root account.
- Keep the application tree root-owned and limit write access to configuration and token directories.
- Protect OAuth tokens and properties files with restrictive permissions and encrypted, access-controlled backups.
- Expose only required listeners and restrict remote source addresses.
- Use encryption settings supported by the DavMail release and the client; do not assume a nonstandard port is encrypted merely because it is not 143, 110 or 25.
- Keep OpenJDK, DavMail and the operating system patched through a controlled maintenance process.
- Monitor journald for repeated OAuth failures, bind errors and upstream connection failures.
- Review outbound SMTP policy with the VPS provider. Some providers restrict or rate-limit mail submission, independently of DavMail.
- Revoke or replace OAuth credentials when the service account, tenant registration or VPS ownership changes.
Choosing the right exposure model
| Deployment choice | Best fit | Main trade-off |
|---|---|---|
| Localhost-only listeners | Clients on the VPS or users connecting through a private tunnel | Smallest attack surface, but every remote device needs the tunnel or private network. |
| Remotely reachable listeners restricted by firewall | A known group of remote users or managed device addresses | Convenient direct access, but firewall maintenance and transport security become critical. |
| Distribution package | Administrators who value integrated upgrades and a supplied systemd unit | The repository may lag behind the newest DavMail release. |
| Platform-independent archive | Administrators who need a newer release or a distribution-neutral layout | You must maintain the unit, executable path and upgrade process yourself. |
| EWS backend | Deployments whose tenant or Exchange version supports EWS | Requires a correct EWS endpoint and any tenant policy governing EWS access. |
| Graph backend | Microsoft 365 environments that require or prefer Graph | Availability and permissions depend on the DavMail release and tenant configuration. |
For most unattended VPS deployments, the conservative pattern is a package-managed or carefully maintained archive installation, a dedicated service account, device-code OAuth where permitted, only the required listeners, and a firewall that limits every remotely reachable port.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
