Recommended Free Tools
To run webmail on an Ubuntu LAMP server, connect five pieces: Apache and PHP serve Roundcube, Postfix sends and accepts SMTP mail, Dovecot provides IMAP (and optionally POP3), and MariaDB or MySQL stores Roundcube data. Configure them to use the same mailbox format, require TLS for remote access, and expose only the ports your deployment needs.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The sequence below uses local Unix mail users and Maildir because that is the smallest maintainable single-domain design. A multi-domain provider should use a virtual-mailbox design instead; Ubuntu’s basic Postfix guide does not cover virtual domains.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
How the mail stack fits together
Roundcube is a browser-based user agent, not a mail server. When a user clicks Send, Roundcube authenticates to Postfix over SMTP. Postfix transfers the message locally or to another mail server. Dovecot delivers local mail into each user’s mailbox and lets Roundcube read it over IMAP. Apache provides the HTTPS page, PHP runs Roundcube, and MariaDB or MySQL holds preferences, contacts, cache and session data.
| Component | Job | Typical connection | Data to protect |
|---|---|---|---|
| Apache | HTTPS web server and PHP front end | TCP 443 from browsers | Roundcube configuration and TLS private key |
| PHP | Runs Roundcube | Apache module or PHP-FPM | Runtime secrets and temporary files |
| Roundcube | Webmail user interface | IMAP, SMTP and database | config/config.inc.php, logs and temp files |
| Postfix | SMTP transfer and local delivery | Port 25 for server traffic; authenticated submission on the port you enable | Queue, certificates and authentication settings |
| Dovecot | IMAP/POP3 access and mailbox delivery | IMAP 143 with STARTTLS or 993 with implicit TLS; POP3 110 or 995 when enabled | Mailboxes, passwords and TLS keys |
| MariaDB/MySQL | Roundcube preferences and session storage | Local database socket or TCP | Database and its credentials |
Ubuntu describes the flow as user agent to mail transfer agent, mail transfer agent to delivery service, then retrieval through IMAP or POP3. Roundcube’s installation requirements specify PHP 8.1 or newer, an HTTP server, an IMAP server, an SMTP server and a supported database.
Decide the mailbox design before installing
Local Unix users or virtual-mailbox identities
| Choice | Best for | Advantages | Costs and limits |
|---|---|---|---|
| Local Unix users | One server, one domain, a small team | Simple account creation with adduser; Dovecot can authenticate against the system; Postfix’s basic Ubuntu configuration is designed around this model. |
Each mailbox is tied to an operating-system account. It becomes awkward to host many domains or delegate administration. |
| Virtual mailboxes | Multiple domains, hosted mail or many accounts | Mail identities are independent of login accounts; domains and quotas can be managed centrally. | Requires a separate identity and delivery design, database lookups and additional testing. Ubuntu’s basic Postfix guide explicitly does not cover virtual domains. |
If your requirement is “mail.example.com for a few Linux users,” start with local users. If customers, aliases, multiple domains or per-domain administration are requirements, design virtual mailboxes first rather than converting a live local-user installation later.
Maildir or mbox
Maildir stores each message as a separate file in a user’s directory. It works well with concurrent IMAP access and file-level backups. mbox stores many messages in one file and can be simpler in legacy installations, but large files are more vulnerable to locking and corruption problems. The procedure here uses Maildir by setting Postfix’s home_mailbox and Dovecot’s mail_location to the same path. Do not mix formats: a successful SMTP delivery with a mismatched Dovecot path appears to the user as an empty inbox.
IMAP only or IMAP plus POP3
Use IMAP for normal webmail and multi-device access. It leaves messages on the server and synchronizes folders and read state. Enable POP3 only for a client that genuinely needs download-and-remove behavior. Dovecot documents IMAP on 143, IMAPS on 993, POP3 on 110 and POP3S on 995; encrypted variants are preferable for remote clients.
Implicit TLS or STARTTLS
Implicit TLS starts encryption as soon as the connection opens (993 for IMAPS and 995 for POP3S). STARTTLS begins on a plaintext protocol port and upgrades the same connection (143 for IMAP and 110 for POP3). Both can be secure when the client verifies a trusted certificate and the server requires encryption before authentication. For SMTP submission, choose one authenticated port, configure it consistently in Postfix and Roundcube, and do not permit password authentication before TLS.
Prerequisites and preparation
- An Ubuntu server with a fixed public address, a fully qualified hostname such as
mail.example.com, and DNS that resolves that name to the server. - Administrative access through SSH or a console. Keep a second session open while changing firewall or SSH-related settings.
- A patched operating system and a backup plan for the database, mailboxes and configuration before exposing services.
- A domain whose DNS, reverse DNS and mail reputation can be configured. Webmail can work without perfect deliverability, but other providers may reject mail when the hostname, reverse-DNS record or sender authentication is inconsistent.
- A trusted certificate covering the web and mail hostnames. A self-signed certificate is appropriate only when every client is deliberately configured to trust it.
Replace example.com, mail.example.com and account names below with your values. Commands assume a root shell or a user permitted to run sudo.
sudo apt update
sudo apt full-upgrade
sudo hostnamectl set-hostname mail.example.com
sudo apt install apache2 mariadb-server php libapache2-mod-php php-mysql php-intl php-mbstring php-xml php-zip php-curl php-gdCheck the PHP version and loaded extensions before installing Roundcube:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
php -v
php -mRoundcube requires PHP 8.1 or newer. The exact extension list can vary by Roundcube release and database driver, so compare the release’s installation requirements with php -m and install any missing package before opening the installer.
Verify Apache is executing PHP rather than downloading PHP files. Create a temporary file, request it locally, then remove it:
echo '<?php echo PHP_VERSION; ?>' | sudo tee /var/www/html/version.php
curl http://127.0.0.1/version.php
sudo rm /var/www/html/version.phpThe response should contain the PHP version. Do not leave a diagnostic file in the web root.
Install and configure Postfix
Install the MTA and choose the local delivery model
sudo apt install postfixDuring the package dialog, select the server type that matches your DNS and intended role, then enter the server’s mail domain when prompted. For a simple single-domain server, set Maildir delivery explicitly:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo postconf -e 'home_mailbox = Maildir/'
sudo postconf -e 'myhostname = mail.example.com'
sudo postconf -e 'mydomain = example.com'
sudo postconf -e 'myorigin = $mydomain'
sudo postconf -e 'mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain'Keep mydestination limited to domains this host is meant to receive locally. A broad value can turn the server into an accidental destination for mail that belongs elsewhere.
Enable authenticated submission through Dovecot SASL
Postfix should not accept authenticated passwords on an unencrypted connection. Add the Dovecot authentication socket and disable anonymous mechanisms:
sudo postconf -e 'smtpd_sasl_type = dovecot'
sudo postconf -e 'smtpd_sasl_path = private/auth'
sudo postconf -e 'smtpd_sasl_auth_enable = yes'
sudo postconf -e 'smtpd_sasl_security_options = noanonymous'
sudo postconf -e 'smtpd_tls_auth_only = yes'Enable a submission service in /etc/postfix/master.cf. Remove the leading comment characters from the existing submission stanza, or add an equivalent service:
submission inet n - y - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_recipient_restrictions=permit_sasl_authenticated,rejectUse a separate submission service instead of allowing every internet host to relay through port 25. Permit relay only for authenticated users and trusted local policy.
Install Dovecot and make its mailbox path match Postfix
Install IMAP (and optional POP3)
sudo apt install dovecot-imapd
# Only if POP3 is required:
sudo apt install dovecot-pop3dSet Maildir storage in Dovecot’s mail configuration (the exact include file differs slightly by Ubuntu release):
mail_location = maildir:~/MaildirFor an IMAP-only deployment, keep the enabled protocols to IMAP. If POP3 is installed, enable it only when a documented client requirement exists. Confirm that Postfix’s home_mailbox = Maildir/ and Dovecot’s maildir:~/Maildir point to the same directory under each user’s home.
Provide the SASL socket to Postfix
In Dovecot’s authentication service configuration, create the socket Postfix expects:
service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
}Ensure the authentication mechanisms required by your clients are enabled, but never rely on plaintext authentication without TLS. A common arrangement is plain and login over an encrypted connection.
Configure Dovecot TLS
Set the certificate and private-key paths in Dovecot’s SSL configuration. Use the same certificate identity that clients use for the IMAP hostname:
ssl = required
ssl_cert = </etc/ssl/mail/fullchain.pem
ssl_key = </etc/ssl/mail/privkey.pem>Use the real paths supplied by your certificate authority or automation. Restrict the key so only root and the service account that must read it can access it. Reload Dovecot after every certificate or protocol change.
Create a dedicated Roundcube database
Do not let Roundcube connect as the MariaDB root user. Create a database with UTF-8 support and a user limited to that database:
sudo mariadbCREATE DATABASE roundcube CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'roundcube'@'localhost' IDENTIFIED BY 'REPLACE_WITH_A_LONG_RANDOM_SECRET';
GRANT ALL PRIVILEGES ON roundcube.* TO 'roundcube'@'localhost';
FLUSH PRIVILEGES;
EXIT;The grant is database-scoped, not a server-wide grant. Store the password in a root-readable configuration file or a secret-management system; do not put it in shell history, a ticket or a publicly readable web file.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Install Roundcube and initialize its schema
Choose package or official release
A distribution package is convenient to update with Ubuntu, but its Roundcube version may lag behind the project release. The official release archive gives you the version named in its installation document and makes the upgrade procedure your responsibility. Whichever route you choose, verify that the release supports PHP 8.1 or newer and that its database schema matches the files you install.
Extract the chosen release outside the public directory, for example under /var/www/roundcube. The archive contains an SQL schema and a web directory; releases commonly call that directory public_html or public. Use the directory named by the release rather than exposing the entire application tree.
sudo mkdir -p /var/www/roundcube
# Extract the official archive into /var/www/roundcube, then inspect it:
sudo find /var/www/roundcube -maxdepth 2 -type f -name 'mysql.initial.sql' -o -name 'index.php'Import the database schema
For a release containing the standard MySQL schema, import it before opening the web interface:
sudo mariadb roundcube < /var/www/roundcube/SQL/mysql.initial.sqlIf the release uses a different schema filename or database engine, follow that release’s installation document and then set the matching DSN.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSet the Roundcube connection values
Create or edit /var/www/roundcube/config/config.inc.php. The following is a starting point; use your real hostnames, port choices and secret:
<?php
$config['db_dsnw'] = 'mysql://roundcube:REPLACE_WITH_A_LONG_RANDOM_SECRET@localhost/roundcube';
$config['imap_host'] = 'ssl://mail.example.com:993';
$config['smtp_host'] = 'tls://mail.example.com:587';
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';
$config['product_name'] = 'Example Webmail';%u and %p tell Roundcube to reuse the logged-in identity and password for SMTP authentication. If your Dovecot users log in as full addresses but local Unix accounts use short names, make the naming scheme consistent or configure the appropriate login transformation. A successful IMAP login followed by an SMTP authentication failure is usually an identity or submission-policy mismatch.
Apply least-privilege filesystem permissions
Apache must write Roundcube’s temp and logs directories, but the whole application should not be writable by the web server:
sudo chown -R root:www-data /var/www/roundcube
sudo find /var/www/roundcube -type d -exec chmod 755 {} ;
sudo find /var/www/roundcube -type f -exec chmod 644 {} ;
sudo chown -R www-data:www-data /var/www/roundcube/temp /var/www/roundcube/logs
sudo chmod 750 /var/www/roundcube/temp /var/www/roundcube/logsIf the release uses different writable directories, apply the same principle only to those directories. Keep config.inc.php readable by Apache but not writable by it, and remove any installer directory or disable the installer after setup.
Publish Roundcube through Apache over HTTPS
Create a dedicated virtual host
Point Apache’s DocumentRoot at Roundcube’s public web directory, not its parent directory. For an archive with public_html, create /etc/apache2/sites-available/webmail.conf:
<VirtualHost *:80>
ServerName mail.example.com
DocumentRoot /var/www/roundcube/public_html
<Directory /var/www/roundcube/public_html>
AllowOverride All
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/webmail-error.log
CustomLog ${APACHE_LOG_DIR}/webmail-access.log combined
</VirtualHost>Change public_html to the release’s actual public directory. Enable the site and required modules:
sudo a2enmod rewrite ssl headers
sudo a2ensite webmail.conf
sudo apache2ctl configtest
sudo systemctl reload apache2Before adding TLS, confirm that the hostname reaches this virtual host rather than a default Apache page.
Install a trusted certificate and redirect HTTP
Obtain a certificate from a trusted certificate authority for the exact webmail hostname. Configure the Apache port-443 virtual host with that certificate and key, then redirect port 80 to HTTPS. Certificate automation is preferable because expired certificates stop both browser access and, if the same identity is used, mail-client access.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUse matching certificate and key paths in Postfix and Dovecot. A certificate for www.example.com does not satisfy a client connecting to mail.example.com unless the latter name is included in the certificate. Test renewal before relying on it in production.
Firewall and service order
Open only the services this design needs. A typical single-domain deployment uses HTTPS, SMTP server-to-server traffic, and one authenticated submission port, plus IMAPS; add POP3S only when required. Do not expose MariaDB to the internet.
sudo ufw allow 443/tcp
sudo ufw allow 25/tcp
sudo ufw allow 587/tcp
sudo ufw allow 993/tcp
# If POP3S is deliberately enabled:
sudo ufw allow 995/tcp
sudo ufw enable
sudo ufw status verboseKeep SSH access allowed from your administration network before enabling UFW. If you use a different submission port or STARTTLS-only IMAP, open that exact port and close unused alternatives.
Reload services after configuration changes:
sudo systemctl restart dovecot
sudo systemctl restart postfix
sudo systemctl reload apache2
sudo systemctl enable apache2 postfix dovecot mariadbCreate a mailbox and run an end-to-end test
Create a local Unix mailbox
sudo adduser alice
sudo passwd aliceThe account name and the Roundcube login must follow the same convention you selected. Send a test message to the new address from an external account, then log in through the HTTPS webmail URL. Postfix should create or deliver to /home/alice/Maildir; Dovecot should display that Maildir through IMAP.
Check protocol encryption and authentication
Inspect the IMAPS certificate and handshake:
openssl s_client -connect mail.example.com:993 -servername mail.example.com -crlfFor SMTP submission, connect with a TLS-capable client or OpenSSL and issue EHLO. The server should advertise STARTTLS before authentication and AUTH only after TLS is active. Ubuntu’s mail-service documentation also describes telnet-based checks for initial protocol validation; use those only to inspect banners and STARTTLS capability, never to send a real password over an unencrypted session.
Read logs while testing
sudo journalctl -u postfix -u dovecot -f
sudo tail -f /var/log/mail.log
sudo tail -f /var/log/apache2/webmail-error.logPerform the complete path: log in, send a message to an external address, reply to it, receive the reply in Roundcube, open it on a second IMAP session, and verify that the sent copy appears in the Sent folder. This distinguishes web, SMTP, delivery and IMAP failures instead of treating every problem as “Roundcube is broken.”
Troubleshooting by symptom
| Symptom | Likely cause | What to check |
|---|---|---|
| Apache shows a blank page or downloads PHP | PHP module/FPM is missing, disabled or incompatible | Run php -v, inspect Apache’s error log, confirm the required PHP extensions and reload Apache. |
| Roundcube reports a database connection error | Wrong DSN, password, database host or schema | Log in with the dedicated MariaDB account, verify the database name and import the release’s schema. Keep the DSN password synchronized with the SQL user. |
| Roundcube opens but the inbox is empty | Dovecot’s mailbox path does not match Postfix delivery, or the login identity maps to another account | Check home_mailbox, mail_location, the user’s home directory and Dovecot logs. Inspect whether new mail is arriving in Maildir/new. |
| IMAP login fails | Wrong username format, disabled mechanism, certificate mismatch or blocked port | Test 993 (or 143 with STARTTLS), verify the certificate hostname, confirm the account password and compare Dovecot’s auth log with the identity Roundcube sends. |
| Sending fails but receiving works | SMTP submission is not enabled, SASL socket permissions are wrong, or Roundcube is using the wrong port/identity | Check the submission stanza, Dovecot’s private/auth socket ownership, Postfix SASL settings and Roundcube’s smtp_host. |
| External servers reject outgoing mail | DNS, reverse DNS, sender reputation or policy alignment problem | Verify the sending hostname, reverse-DNS record and domain authentication policies. Successful local SMTP authentication does not guarantee internet deliverability. |
| Browsers warn about TLS | Expired, self-signed or hostname-mismatched certificate | Renew the certificate, include every hostname clients use, and configure the same valid chain in Apache, Postfix and Dovecot. |
| Roundcube logs or temp files are unwritable | Incorrect ownership or overly restrictive mode | Grant the web-server account write access only to the release’s required writable directories; do not make the application tree globally writable. |
Security and ongoing operations
Protect credentials and services
- Use a unique, randomly generated database password and separate Unix, mail and administrative credentials.
- Require TLS before SMTP authentication and use encrypted IMAP or POP3. Disable anonymous SASL mechanisms.
- Keep MariaDB bound to localhost unless a separate, justified database architecture requires remote access.
- Limit UFW rules to HTTPS and the mail protocols you actually operate. Close POP3, alternate submission ports and test services when unused.
- Keep Apache, PHP, Postfix, Dovecot, Roundcube and Ubuntu security updates current. Read release notes before upgrading Roundcube because database migrations and PHP requirements can change.
Back up what makes the service recoverable
Back up three categories separately: the Dovecot/Postfix mailboxes, the Roundcube database, and configuration plus TLS material. A database-only backup does not restore mail, and a mailbox-only backup loses user preferences and identities. Protect backups with encryption and access controls, and perform a test restore on an isolated host. Record the package versions, enabled protocols, virtual-host paths and secret locations so a restore is repeatable.
Keep deliverability in scope
Webmail’s login page can be healthy while outbound mail is rejected elsewhere. Maintain a stable fully qualified hostname, correct forward and reverse DNS, coherent envelope and header domains, and the sender-authentication records required by the recipients you target. Monitor mail queues and logs for deferred or bounced messages rather than judging delivery by the Roundcube Sent folder alone.
When to change this design
The local-user/Maildir pattern is a sound starting point for one Ubuntu host and a modest number of accounts. Move to virtual mailboxes when you need multiple domains, centralized mailbox administration, aliases independent of Linux accounts, quotas or a larger hosted-mail operation. Consider IMAP-only when every client is webmail or modern mobile mail; add POP3 only for a known legacy workflow. Keep the protocol, certificate, firewall and backup decisions documented so a future migration does not silently expose plaintext authentication or deliver mail into an unread mailbox.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
