Back to catalog
Mail-in-a-Box
CC0-1.0Mail-in-a-Box replaces Fastmail with an automated self-hosted email server featuring built-in DNSSEC, Nextcloud DAV sync, and Let's Encrypt TLS.
Open-source alternative to — compare it against:
Overview
Joshua Tauberer built Mail-in-a-Box in 2013 to make deploying a mail server reproducible through automated shell provisioning. Instead of requiring administrators to manually assemble Postfix, Dovecot, and DNS records, the project packages the entire stack into a turnkey appliance on a single machine. That design delivers complete email sovereignty without demanding ongoing manual configuration file edits.
Why Mail-in-a-Box instead of Fastmail
Fastmail delivers managed email hosting where server upkeep, TLS renewal, IP reputation, and spam filtering remain invisible to the customer. Mail-in-a-Box handles that same functional footprint—SMTP transport, IMAP storage, webmail, and CardDAV/CalDAV sync—by moving infrastructure ownership onto your own cloud instance. Rather than entrusting message archives and communications metadata to a commercial vendor, you retain full custody of your mail databases.
The operational divide centers on deliverability and ongoing maintenance. Fastmail employs postmasters who monitor outbound IP pools and resolve delivery blocks with major providers. Mail-in-a-Box automates server configuration through an NSD nameserver that provisions DNSSEC, DANE TLSA, SPF, DKIM, DMARC, and MTA-STS records, but the administrator still owns outbound reputation. When cloud VPS subnets carry historical spam flags, the host operator must review delivery logs and request delisting directly.
What it does well
- Automated authoritative DNS: NSD automatically generates and maintains DNSSEC, DANE TLSA, SPF, DKIM, DMARC, and MTA-STS records without manual zone configuration.
- Management HTTP API: a clean REST API allows developers to script mailbox creation, alias redirection, and custom DNS record updates from automation workflows.
- Integrated DAV synchronization: Nextcloud comes preconfigured to synchronize CardDAV contacts and CalDAV calendars across mobile and desktop applications.
- Built-in host security: Let's Encrypt certificates renew automatically, while ufw firewall rules, postgrey greylisting, and fail2ban rate limiting run out of the box.
- Encrypted remote backups: duplicity schedules nightly incremental backups with GPG encryption to Amazon S3, Backblaze B2, or custom rsync servers.
- Multi-domain hosting: a single instance supports multiple domains, distinct mail users, and forwarders without per-seat licensing tiers.