The reliable way to add browser-based mail to an Ubuntu LAMP server is to combine Apache and PHP for the web tier, Roundcube for the browser client, Postfix for SMTP transport, Dovecot for mailbox access and delivery, and MariaDB or MySQL for Roundcube’s settings and session data. Configure the same mailbox format in Postfix and Dovecot, authenticate SMTP through Dovecot, protect Apache and mail protocols with trusted TLS certificates, then test sending and receiving before opening the services to the internet.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you are building
A webmail page does not deliver or store mail by itself. It is a user agent that talks to the mail services already running on the server. A typical message path is:
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Component | Role | Connection to the next component |
|---|---|---|
| Apache and PHP | Serves the HTTPS application | Runs Roundcube |
| Roundcube | Browser-based mail client | Reads mail over IMAP and submits outgoing mail over SMTP |
| Postfix | Mail transfer agent (MTA) | Accepts authenticated submissions and transfers or delivers messages |
| Dovecot | IMAP/POP3 access and local delivery service | Exposes mailboxes and provides SMTP authentication through SASL |
| MariaDB or MySQL | Roundcube preference and session database | Used by the Roundcube PHP application |
Ubuntu identifies Postfix as its default supported MTA. The design below is aimed at one Ubuntu server using local Unix users and a single primary mail domain. A multi-domain or high-volume hosting service needs a virtual-mailbox design rather than simply repeating these steps for more domains.
Decide the mail layout before installing anything
Several choices affect every later configuration file. Make them first and document them for whoever will maintain the server.
Local Unix users or virtual mailboxes
Local delivery maps each mailbox to a Unix account on the server. It is the simplest arrangement for a small installation: Dovecot authenticates the operating-system user, Postfix delivers to that user’s home directory, and the same username can log in to Roundcube. It also means mailbox administration is tied to operating-system accounts.
Virtual mailboxes keep mail identities in a separate directory and often a database. They are preferable for multiple domains, aliases and large user populations, but require a broader Postfix and Dovecot design, separate provisioning, quota handling and a different backup plan. Ubuntu’s basic Postfix guide does not cover virtual domains, so do not treat the local-user recipe as a multi-domain solution.
Maildir or mbox
Postfix can deliver to either traditional mbox files or Maildir directories. This guide uses Maildir because each message is a separate file, which makes concurrent IMAP access and incremental backups easier to reason about. The setting must match in both services:
home_mailbox = Maildir/With that Postfix setting, Dovecot normally uses:
mail_location = maildir:~/MaildirIf you choose mbox instead, select the corresponding Dovecot location and keep the choice consistent. Switching formats after users have mail requires a migration; changing one service alone will make existing messages appear to disappear.
IMAP only or IMAP plus POP3
Roundcube needs IMAP. POP3 is optional and is useful only for clients that intentionally download messages rather than synchronizing folders. Installing POP3 increases the exposed surface and creates another protocol to monitor. Enable dovecot-pop3d only when a real client requirement justifies it.
Implicit TLS or STARTTLS
| Service | Common port | TLS mode | When to use it |
|---|---|---|---|
| IMAP | 143 | Plain connection upgraded with STARTTLS | Compatibility or controlled internal networks; require encryption before authentication |
| IMAPS | 993 | TLS starts immediately | Preferred for Roundcube and modern mail clients |
| POP3 | 110 | Plain connection upgraded with STARTTLS | Only when POP3 is required |
| POP3S | 995 | TLS starts immediately | Encrypted POP3 access |
| SMTP submission | 587 | STARTTLS | Authenticated client submission |
| SMTPS | 465 | TLS starts immediately | Use when your client policy calls for implicit-TLS submission |
Do not allow users to authenticate over an unencrypted connection. A certificate that clients cannot validate is not a secure deployment; self-signed certificates are suitable only when every client is deliberately configured to trust that certificate.
Prepare the Ubuntu LAMP host
Set the hostname and DNS first
Choose the public mail name, such as mail.example.net, and make sure its forward DNS record resolves to the server’s public address. Set the Ubuntu hostname to the same fully qualified name and arrange reverse DNS with the hosting or network provider. Correct forward and reverse DNS will not guarantee delivery, but inconsistent names commonly trigger connection and reputation problems.
Patch the operating system and plan recovery
Update Ubuntu before exposing any service and schedule regular security updates. Take a backup before installing mail software. You need restorable copies of three separate things:
- Mailboxes, including each user’s Maildir.
- The Roundcube database.
- Postfix, Dovecot, Apache and Roundcube configuration, certificates and keys.
Test a restoration on another host or an isolated directory. A backup that has never been restored is only an assumption.
Install the web and database packages
Install Apache, PHP, the PHP database driver and the extensions required by the Roundcube release you selected. Roundcube’s installation document requires PHP 8.1 or newer, an HTTP server, an IMAP server, an SMTP server and a supported database. A common MariaDB-backed Ubuntu baseline is:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo apt update
sudo apt full-upgrade -y
sudo apt install apache2 mariadb-server php php-mysql php-intl php-mbstring php-xml php-curl php-zipVerify the PHP version with php -v. Treat the extension list above as a starting point, not a substitute for checking the exact requirements shipped with your Roundcube release. Remove extensions you do not need and install any additional ones that the release’s installation document marks as required.
Confirm Apache executes PHP before continuing. A temporary file containing <?php phpinfo(); ?> should render as a PHP information page when requested locally; delete that file immediately because it discloses sensitive configuration.
Install and configure Postfix
Install the MTA
sudo apt install postfixDuring the package dialog, choose the server type that matches your deployment, enter the server’s mail name and specify the local networks that are allowed to use the host. Do not list broad private or public networks unless you intentionally operate a relay for them. An incorrectly broad mynetworks setting can turn the server into an open relay.
Select Maildir delivery
Set the mailbox format in Postfix’s main configuration:
home_mailbox = Maildir/Create a test Unix account only after you have chosen your account policy. For an existing user, create the Maildir directories with the account’s ownership, or allow Dovecot’s mail-delivery service to create them on first use. Check that the resulting path is /home/username/Maildir when the Unix account’s home directory is /home/username.
Enable authenticated SMTP through Dovecot
Roundcube should submit mail through an authenticated submission service, not by pretending to be a trusted local process. Add the Dovecot SASL settings to Postfix’s configuration:
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_tls_auth_only = yesThe exact submission-service stanza varies with the Ubuntu release and whether you use a dedicated master.cf service on port 587. Keep anonymous mechanisms disabled, require TLS before authentication and reload Postfix after every configuration change:
sudo postfix check
sudo systemctl reload postfixIf postfix check reports a syntax or permission problem, fix that before proceeding. A successful reload does not prove that SMTP authentication works; test the advertised capabilities later.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsInstall and configure Dovecot
Install IMAP, and POP3 only if needed
sudo apt install dovecot-imapdAdd POP3 support only when required:
sudo apt install dovecot-pop3dUbuntu documents IMAP on port 143, IMAPS on 993, POP3 on 110 and POP3S on 995. Use the encrypted variants for internet clients.
Match Postfix’s mailbox location
Configure Dovecot to read the same Maildir that Postfix writes. A local-user setup commonly contains:
mail_location = maildir:~/MaildirCheck the effective configuration rather than relying on a remembered file path:
sudo doveconf -nLook for the effective mail_location, enabled protocols and listener settings. A mismatch here is the most common reason a successful delivery appears as an empty inbox.
Recommended Free Tools
Configure encrypted listeners and certificates
Point Dovecot’s SSL certificate and private-key settings to the trusted certificate for the mail hostname. Keep the private key readable only by the service account and root. Enable the encrypted listener on 993 and, if POP3 is enabled, on 995. You can leave 143 or 110 available for STARTTLS only if your policy requires them; otherwise disable unused listeners.
Use the same certificate name that users enter in Roundcube and their other mail clients. A certificate for the web hostname will not validate a different IMAP hostname unless that name is included in the certificate’s identities.
Expose Dovecot’s authentication socket to Postfix
Postfix needs a Unix socket through which it can ask Dovecot to authenticate a submitting user. In Dovecot’s authentication service, create a listener at the path Postfix expects:
service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
}The surrounding syntax differs slightly between Dovecot releases, so preserve the existing structure in the packaged configuration. Restart or reload Dovecot after editing and verify that the socket exists with the expected owner and group:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo systemctl reload dovecot
sudo ls -l /var/spool/postfix/private/authAuthentication identity must match mailbox naming. If Dovecot expects a full address such as [email protected] but local delivery uses only user, choose and configure a consistent login transformation rather than hoping Roundcube will infer it.
Create the Roundcube database
Use a dedicated database and database account. Do not give the web application administrative access to MariaDB. Generate a long random password and keep it in a password manager or another protected secret store.
The following shell pattern generates a password, creates the database with UTF-8 support and grants only the privileges Roundcube needs:
export ROUNDCUBE_DB_PASSWORD=$(openssl rand -base64 32)
sudo mariadb <Import the schema supplied with the Roundcube release. The filename can differ between releases; use the MySQL schema file shipped in its SQL directory:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11sudo mariadb roundcubemail < /var/www/roundcube/SQL/mysql.initial.sqlDo not paste the generated password into shell history or a public repository. In config/config.inc.php, set the database DSN for the roundcubemail database and the dedicated account. Keep the secret outside source control; one practical pattern is to provide the complete DSN through a protected Apache/PHP environment variable and read it with getenv().
Install Roundcube and set safe permissions
Place the application
Use the official Roundcube release package or source archive, unpack it outside a temporary download directory and place it at a path such as /var/www/roundcube. Keep the application code owned by root or another deployment account so a web-process compromise cannot rewrite the whole tree.
Roundcube requires PHP 8.1 or newer and the required PHP extensions, plus the IMAP and SMTP services you configured above. Run the release’s installer or complete its configuration file manually, then remove any installer directory that the release tells you to remove.
Make only runtime directories writable
The web server must write Roundcube’s temp and logs directories. Grant ownership or group write access only to those directories:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo chown -R www-data:www-data /var/www/roundcube/temp /var/www/roundcube/logs
sudo chmod 750 /var/www/roundcube/temp /var/www/roundcube/logsDo not use a recursive writable permission such as chmod -R 777, and do not make the configuration or PHP source tree writable by Apache.
Configure IMAP, SMTP and the encryption key
In config/config.inc.php, set these values for your hostnames and policy:
- The IMAP endpoint, preferably the TLS endpoint on port 993.
- The SMTP submission endpoint on port 587 with STARTTLS, or port 465 when your policy uses implicit TLS.
- The SMTP authentication identity and password mapping. Using the logged-in username and password avoids storing a shared account in Roundcube.
- A randomly generated Roundcube encryption key of the length required by your release.
- The database DSN for the dedicated MariaDB account.
Roundcube’s IMAP login must be accepted by Dovecot exactly as entered. If your users log in with full addresses, configure Dovecot and Postfix for full-address identities; if they log in with short Unix usernames, keep that convention everywhere.
Publish Roundcube through Apache HTTPS
Create a dedicated Apache virtual host for the webmail name. Point its document root at the Roundcube public directory or application directory required by the release, disable directory listing and redirect HTTP to HTTPS. Keep the Roundcube host separate from unrelated websites so access logs, PHP settings and certificates are easier to manage.
Install a certificate issued by a trusted authority for the exact webmail hostname. Configure Apache to use the certificate and private key, allow only modern TLS settings supported by your Ubuntu release and enable the required PHP module. After enabling the site, validate Apache’s configuration and reload it:
sudo apachectl configtest
sudo systemctl reload apache2Roundcube also needs a correct application URL and, where applicable, a trusted proxy configuration. If it is behind a reverse proxy, ensure the proxy passes the original HTTPS scheme and does not expose the PHP application directly on an untrusted interface.
Use the same trusted TLS identity for mail services
Postfix and Dovecot need certificate and key paths that point to the certificate for the mail hostname. The web certificate and mail certificate can be the same certificate only when both hostnames are included in its identities. Restrict the key file’s permissions, reload both services and verify that they present the expected chain.
Do not treat a self-signed certificate as a shortcut for public deployment. It is acceptable only when every intended client has been explicitly configured to trust it; otherwise users will either receive warnings or be tempted to bypass certificate validation.
Restrict the firewall
Open only the ports your design actually uses. A common encrypted setup needs:
- 443 for Roundcube HTTPS.
- 25 for server-to-server SMTP, if this host receives mail directly.
- 587 for authenticated SMTP submission.
- 993 for IMAPS.
- 995 only if encrypted POP3 is enabled.
Port 80 may be needed for an HTTP-to-HTTPS redirect or certificate issuance, but it should not serve an authenticated mail session. Do not expose 110 or 143 for clear-text authentication. If the server sends mail through an upstream relay, port 25 may not need to be reachable from the internet.
Test each layer before declaring success
Check the services locally
sudo systemctl status apache2 postfix dovecot mariadb
sudo postfix check
sudo doveconf -nResolve the configured hostnames from a client network and check that the certificate names match what the client uses. Confirm that the Maildir exists for a test account and that its owner can read it.
Check IMAP and IMAPS
An unencrypted local protocol check can confirm that the service answers, but never use it to send credentials. For encrypted IMAP, inspect the handshake with:
Free tools Windows power users keep installed
One-click scans. No signup required.
openssl s_client -connect mail.example.net:993 -crlfThe certificate chain and hostname should validate, and Dovecot should return an IMAP greeting. For port 143, confirm that the server advertises STARTTLS and refuse authentication until TLS is active.
Check SMTP submission and SASL
Use an SMTP TLS probe:
openssl s_client -starttls smtp -connect mail.example.net:587 -crlfAfter the handshake, issue EHLO client.example.net. The response should advertise STARTTLS before encryption and AUTH after the encrypted session is established. Do not test with a real password in a transcript that will be retained in logs or shared with others.
Perform an end-to-end message test
- Log in to Roundcube over HTTPS with the test mailbox.
- Send a message to a separate account that you control.
- Reply from that account and confirm that the reply arrives in the Roundcube inbox.
- Open the message source and check that it was submitted through the intended hostname.
- Review Apache, Postfix and Dovecot logs for authentication failures, TLS errors, queue delays or mailbox-path errors.
Ubuntu’s mail-service documentation describes telnet-based protocol checks for initial validation. Use those checks only for banners and capability negotiation; use encrypted probes for any authentication test.
Common failures and their fixes
Roundcube loads, but the inbox is empty
Compare Postfix’s home_mailbox value with Dovecot’s effective mail_location. Check the test user’s home directory, Maildir ownership and the Dovecot log. If Postfix delivers to mbox while Dovecot reads Maildir, the services are looking at different storage.
SMTP authentication fails while IMAP login works
Check that the Dovecot authentication socket exists at Postfix’s configured smtpd_sasl_path, that its owner and group allow Postfix to open it and that Dovecot’s authentication service is listening. Then run postfix check, reload both services and repeat the encrypted EHLO test.
Roundcube reports a database connection error
Confirm the database name, account, host and generated password in the DSN. Test the account directly against MariaDB from the server, verify that the schema import completed and inspect PHP and Roundcube logs. A database account restricted to localhost should not be changed to a wildcard host merely to hide a configuration mistake.
Browsers warn about the certificate
Make sure the certificate includes the exact webmail hostname, the server sends the intermediate chain and Apache is serving the intended virtual host. For mail clients, separately verify the IMAP and SMTP hostnames; a valid HTTPS certificate does not automatically validate a different mail name.
Messages queue instead of leaving the server
Inspect the Postfix queue and logs. Typical causes include missing or incorrect DNS, a blocked outbound port 25, a failed TLS handshake, a remote server rejecting the name or a reverse-DNS mismatch. A successful Roundcube submission proves only that the local SMTP service accepted the message, not that the recipient accepted it.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Operational security and maintenance
- Use unique, high-entropy secrets for the Roundcube database account, service accounts and Unix users.
- Require encrypted IMAP and SMTP authentication, and keep anonymous SASL mechanisms disabled.
- Keep Apache, PHP, Postfix, Dovecot, MariaDB and Ubuntu patched.
- Monitor authentication failures, queue growth, disk usage, certificate expiry and repeated delivery errors.
- Back up mailboxes, the Roundcube database and configuration separately, then test restoration on a clean host.
- Limit the firewall to the protocols and source networks you actually need.
- Publish accurate DNS, maintain reverse DNS and configure the sender-domain controls required by your delivery policy. The basic installation steps do not constitute a complete deliverability configuration.
Roundcube stores preferences and session data in its database, but the messages themselves remain in the mailbox store managed by Dovecot. Losing the database therefore removes user settings and sessions, while losing the Maildir removes the mail. Back up both.
When to choose a different installation method
| Method | Advantages | Risks and trade-offs |
|---|---|---|
| Ubuntu distribution packages | Integrated service users, paths, upgrades and security updates | Versions may lag behind the newest Roundcube release; package configuration follows distribution conventions |
| Official Roundcube release package or source | Access to the release you require and its supplied schema | You must track upgrades, PHP compatibility, file ownership and security notices yourself |
| Local Unix mailboxes | Simple authentication and delivery for one domain or a small team | Mailbox administration is coupled to operating-system accounts and is not a full virtual-domain platform |
| Virtual mailboxes | Better separation for many domains, aliases and centralized provisioning | More moving parts, more database design and a larger migration and backup scope |
For a small Ubuntu server, the local-user, Maildir, IMAP-only and encrypted-submission combination is the shortest path to a maintainable installation. Move to virtual mailboxes only when the operational requirements justify designing that system rather than stretching the local-user recipe beyond its limits.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
