iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Yes—you can run one Roundcube installation for several domains on a single VPS. The reliable design is a shared Postfix and Dovecot mail stack, with Roundcube acting only as the browser interface. Postfix receives and routes each domain, Dovecot authenticates users and serves mail over IMAP, and Roundcube connects to both services. Host-specific Roundcube configuration lets different webmail hostnames select different login defaults while all domains remain on one installation.
The webmail screen is the easy part. Deliverability, TLS, DNS authentication, mailbox storage, abuse controls and backups determine whether the service is usable in production. Build those foundations before inviting users to log in.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How the multi-domain design works
A single VPS can host addresses such as alice@example.com and bob@example.org without creating a separate Linux account for every mailbox. Postfix uses virtual-domain and virtual-mailbox maps to decide which hosted address receives a message. Dovecot stores and serves those messages for authenticated users. Roundcube provides one web interface that talks to Dovecot over IMAP and submits outgoing mail through Postfix.
| Layer | Responsibility | What is shared | What remains domain-specific |
|---|---|---|---|
| Postfix | SMTP reception, outbound submission and recipient routing | One SMTP service and queue | Hosted domains, mailbox maps, aliases and sender policy |
| Dovecot | IMAP/POP3 access, authentication and mailbox delivery through LMTP | One IMAP service and authentication system | Users, mailbox paths, quotas and credentials |
| Roundcube | Browser interface for reading and sending mail | One codebase, web server and database | Optional hostname-specific IMAP settings and login defaults |
| DNS and TLS | Finding the server, proving sender identity and encrypting connections | Canonical mail hostname and VPS certificate | MX, SPF, DKIM and DMARC records for each domain |
Roundcube does not create or manage mail users. The IMAP server remains the authority for accounts, passwords and mailbox access. If IMAP authentication is broken, changing Roundcube settings alone will not fix it.
#1 Best Overall
- 12th Intel Alder Lake N95 Processor – The GMKtec G3 S Mini PC is powered by the 12th Gen Intel N95 processor with 4 cores, 4 threads, 6MB cache and a burst frequency up to 3.4GHz. Compared with N100/N5105/N5100/N5095, the N95 delivers up to 36% overall performance improvement. Perfect for routine tasks, office work, and home entertainment, this compact mini desktop is more convenient than traditional bulky PCs.
- 8GB RAM & 256GB SSD Storage – Pre-installed with 8GB DDR4 memory and a fast 256GB M.2 2242 SSD, the G3 S mini desktop offers quicker startup, smoother multitasking, and faster file transfers. Enjoy seamless performance whether you’re working on multiple applications, browsing, or streaming content.
- Rich Interfaces & Connectivity – The G3 S mini computer comes equipped with USB 3.2 (up to 10Gbps), dual HDMI 2.0 (4K@60Hz), and a 3.5mm audio jack. With support for WiFi 5, Bluetooth 5.0, and Gigabit Ethernet (RJ45 1000MbE), it connects easily with monitors, projectors, printers, office equipment, and other peripherals, making it versatile for both home and business use.
- Dual 4K Display Support – Featuring upgraded Intel UHD Graphics (up to 1000MHz), the G3 S supports 4K video playback and AV1 decoding for a smooth viewing experience. With dual HDMI outputs, you can connect two 4K@60Hz displays simultaneously, enabling efficient multitasking for work and entertainment.
- GMKTEC WARRANTY - GMKtec offers a 3-year limited warranty (1 year replacement + 2 years parts replacement) for each mini PC, starting from the date of the purchase effective on all sales starting Oct. 2026. All defects due to design and workmanship are covered. With a professional after sales team always ready to attend to your needs, you can simply relax and enjoy your mini PC
Plan names, addresses and network access first
Choose one canonical mail hostname
Pick a stable name such as mail.example.net for SMTP, IMAP and webmail. Create an A record for IPv4 and an AAAA record only when IPv6 is correctly routed and configured. Request a certificate covering every public hostname users will visit, and use the same canonical name in Postfix, Dovecot and Roundcube wherever possible. Consistent names prevent certificate warnings and mismatched client settings.
You may also create branded webmail names, for example webmail.example.com and webmail.example.org. Those names can point to the same VPS and be mapped to different Roundcube configuration files, but they still need certificate coverage.
Confirm the VPS prerequisites
- A supported Linux distribution with a static public IP address.
- Provider-controlled reverse DNS (PTR), normally set to the canonical mail hostname.
- Permission to send server-to-server mail on outbound TCP port 25. Some VPS providers restrict it, so check the policy before installing the stack.
- Firewall access for HTTPS (443), SMTP (25), authenticated submission (587 and optionally 465), and IMAPS (993). Open POP3 ports only if you have a specific need for them.
- A backup destination separate from the VPS, with a documented restore procedure.
- A hostname that resolves correctly from the public internet before requesting certificates.
A guide may use 1 GB of RAM as an example starting point, but that figure is not a universal capacity guarantee. Actual requirements depend on mailbox count, web traffic, filtering, indexing and concurrent connections.
Prepare the operating system and baseline security
- Update the system. Install security updates, set the correct timezone, create an administrative account, and disable direct root SSH login where your distribution supports it.
- Set the system hostname. Use the fully qualified canonical name, such as
mail.example.net, and ensure local name resolution returns the same name. - Configure the firewall. Permit only SSH from administration networks plus ports 25, 443, 587, 465 if used, and 993. Do not expose database or cache services to the internet.
- Set reverse DNS. Ask the VPS provider to point the public IP’s PTR record to the canonical mail hostname. Forward and reverse lookups should agree.
- Install TLS prerequisites. Obtain a certificate whose names match the SMTP, IMAP and webmail names. Configure automatic renewal and verify that renewal reloads the web server and mail daemons.
- Establish backups. Back up Dovecot mailbox data, Postfix and Dovecot configuration, Roundcube configuration, its database, DKIM private keys and the password database. Encrypt backups and test restoration.
Configure Postfix for virtual domains and mailboxes
Postfix separates hosted virtual addresses from local UNIX accounts by using virtual-domain and virtual-mailbox maps. A mailbox address such as alice@example.com is mapped to a mailbox path or to a Dovecot delivery transport; no operating-system login named alice is required.
Declare hosted domains
List every domain that this VPS accepts as a hosted mailbox domain in virtual_mailbox_domains. Keep the VPS hostname and other local system names in the appropriate local-domain settings. Postfix warns that all machine hostnames must be accounted for; an incomplete local-domain list can create routing loops or reject mail intended for the server itself.
A typical arrangement uses a database or text map for both domains and addresses. The exact map type is your choice, but the lookup must return a positive result for each complete recipient address.
virtual_mailbox_domains = proxy:mysql:/etc/postfix/sql/virtual_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/sql/virtual_mailboxes.cf
virtual_alias_maps = proxy:mysql:/etc/postfix/sql/virtual_aliases.cf
virtual_transport = lmtp:unix:private/dovecot-lmtpThe transport shown is an example of handing final delivery to Dovecot’s LMTP socket. If you use a different supported transport, make sure the mailbox ownership and delivery path match Dovecot’s configuration.
Map complete addresses, aliases and forwarding
Map the full address, not merely the local part. For example, alice@example.com and alice@example.org are independent recipients and should resolve to the intended mailbox records. Use virtual_alias_maps for aliases such as sales@example.com forwarding to one or more real mailboxes.
Be cautious with catch-all addresses. A catch-all requires the mailbox store and delivery rules to accept every address at that domain. It also attracts dictionary spam and can hide typographical errors. Create explicit aliases and mailboxes unless you have a documented reason to accept unknown recipients.
Separate inbound delivery from authenticated submission
Use SMTP port 25 for server-to-server traffic and authenticated submission on port 587 (or, if required, 465 with implicit TLS). Require SASL authentication for submission, relay only authenticated users, and do not allow an open relay. The same virtual-user credentials used by Dovecot should authenticate Postfix submission so users have one password and one account lifecycle.
Rank #2
- High-Performance NAS with Powerful Procesor: Intel Core 5 320 is ideal for small offices, & More. You can enjoy smooth performance and seamless collaboration, while making use of advanced features like Docker and virtual machines. It works semalessly across every device inluding Windows, macOS, Linux, iOS, Android or Google services and so on.
- Better Way to Store Than External Drives: NAS offers centralized storage, automatic backups, remote access, and a wide range of RAID options for easy data recovery even if a drive fails. Massive Storage Capacity: Never worry about storage limits again. With up 144TB capacity, you can store 50 million 1MB photos or 98K 1.5GB movies，5 million 30MB songs! *Hard Drives not included.
- Secure Private Cloud: Retain 100% data ownership with advanced encryption to protect your files. Flexible permission management makes it easy to protect your privacy when collaborating with others.
- AI-Powered Photo Album: Automatically organizes your photos by recognizing faces, scenes, objects, and locations. It can also instantly remove duplicates, freeing up storage space and saving you time.
- User-Friendly App: Simple setup and easy file-sharing on Windows, macOS, Android, iOS, web browsers, and smart TVs, giving you secure access from any device.
Configure Dovecot for shared virtual-user storage
Dovecot provides IMAP (and optionally POP3), authenticates virtual users and commonly receives final deliveries from Postfix through LMTP. Choose one virtual-user database—SQL or another supported backend—and use it consistently for passwords, mailbox locations and user identifiers.
Define a mailbox namespace and identity mapping
Use a mailbox path that includes the domain, for example /var/vmail/example.com/alice/. Including the domain prevents collisions when two hosted domains use the same local part. Run the storage under a dedicated virtual-mail user and group rather than ordinary shell accounts.
Configure Dovecot’s mail_location, UID/GID mapping and namespace so the path returned by the user database is the same path used by LMTP delivery. Apply quotas in the same layer that records mailbox usage. Inconsistent paths or ownership commonly produce successful authentication followed by empty folders, permission errors or mail delivered to the wrong account.
Align authentication with SMTP submission
Enable a Dovecot authentication socket that Postfix can access, and configure Postfix SASL to use it. Require TLS before accepting credentials. Disable plaintext authentication on public listeners unless it is protected inside TLS, and use a modern password hash supported by your chosen Dovecot version.
Recommended Free Tools
Provide LMTP delivery
Expose a private LMTP socket for Postfix and ensure the Postfix service account can reach it. Test a message to each domain after configuring the socket. If delivery is deferred, inspect both Postfix’s queue log and Dovecot’s LMTP log; a correct DNS setup cannot compensate for a socket, path or permission mismatch.
Install Roundcube once
Roundcube requires an HTTP server, PHP, a database, a working IMAP server and an SMTP server. Install it under the web server, create its database, point the document root at its public_html directory, and keep its temp and logs directories writable by the web-server account. Restrict those directories from direct public downloads.
Set the default IMAP and SMTP endpoints
Configure the canonical mail hostname as the default IMAP and SMTP endpoint. Use secure connection modes and the appropriate submission port. Roundcube should submit as the authenticated user, not as an arbitrary address supplied by the browser.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match$config['imap_host'] = 'ssl://mail.example.net:993';
$config['smtp_host'] = 'tls://mail.example.net:587';
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';The syntax above illustrates the intent; adapt it to the Roundcube release and TLS settings installed on your server. Verify that the certificate name matches the host used in both settings.
Use host-specific configuration when domains need different login behavior
One Roundcube installation can load a small configuration file based on the hostname in the request. Map each webmail hostname to a file with include_host_config:
$config['include_host_config'] = array(
'webmail.example.com' => 'example_config.inc.php',
'webmail.example.org' => 'org_config.inc.php',
);In each host file, set the IMAP host and, when appropriate, a default domain for logins:
Rank #3
- Built for Local AI Development: AMD Ryzen AI Halo is designed for local AI development and inference, featuring 128GB unified memory and support for up to 200B parameter models to build and run intensive AI workloads locally.
- 128GB Unified Memory: Features 128GB LPDDR5x unified memory at 8000 MT/s with 256 GB/s memory bandwidth, providing a shared memory pool across the CPU, GPU, and NPU to support larger AI models.
- AMD Ryzen AI Max+ 395 Processor: Features 16 cores, 32 threads, and Zen 5 architecture, paired with AMD Radeon 8060S integrated graphics featuring 40 RDNA 3.5 compute units and an AMD XDNA 2 NPU with up to 50 TOPS.
- Linux AI Developer Platform: Purpose-built for Linux-based AI development with full AMD ROCm software support and preloaded tools, models, and workflows optimized for local AI development.
- Compact, Connected Design: Includes a 2TB M.2 SSD, 10GbE LAN, Wi-Fi 7, Bluetooth 5.4, USB-C connectivity, and HDMI 2.1b.
// example_config.inc.php
$config['imap_host'] = 'ssl://mail.example.net:993';
$config['username_domain'] = 'example.com';
// org_config.inc.php
$config['imap_host'] = 'ssl://mail.example.net:993';
$config['username_domain'] = 'example.org';With username_domain, a user entering only alice at the first hostname is treated as alice@example.com. Users who work across domains should enter their complete address, because the local part alone is ambiguous. Host-specific files are optional: if every domain shares one IMAP endpoint and users always enter full addresses, a single default configuration is sufficient.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesKeep the web application isolated
- Serve Roundcube over HTTPS only and redirect HTTP.
- Use a separate database and least-privilege database account.
- Keep PHP, Roundcube plugins and the operating system patched.
- Disable unused plugins and remove installer or upgrade files after setup.
- Protect administrative configuration and logs from browser access.
Publish DNS for every hosted domain
Repeat the mail-related DNS work for each domain. A single missing record can make one domain fail while another appears healthy.
| Record | Where | Purpose | Important detail |
|---|---|---|---|
| MX | Each hosted domain | Directs inbound mail | Point it to the canonical mail hostname, not directly to an IP address. |
| A/AAAA | Canonical mail hostname | Resolves the mail server | Publish AAAA only when IPv6 connectivity and firewall rules work. |
| SPF | Each sending domain | Authorizes sending hosts | Include every legitimate outbound host and avoid multiple SPF records. |
| DKIM | Each signing domain | Publishes the public verification key | The selector and public key must match the signer configured on the VPS. |
| DMARC | _dmarc at each domain |
States alignment and handling policy | Start with a policy appropriate to your rollout and monitor reports before tightening it. |
| PTR | VPS provider’s reverse-DNS control | Names the sending IP | Set it to the canonical hostname and ensure forward DNS agrees. |
SPF, DKIM and DMARC are domain-specific even when all domains share one VPS. DKIM private keys must be backed up securely; losing a key requires publishing a new selector and updating the signing configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Secure the complete mail path
Encrypt every user-facing connection
Use HTTPS for Roundcube, IMAPS on 993 for mailbox access and authenticated SMTP submission on 587 (or 465 where that is your chosen service). Configure certificates for every name presented to clients. Do not treat port 25 as a replacement for authenticated submission; it is primarily for server-to-server delivery and is subject to different trust and abuse controls.
Limit abuse and brute force
- Apply connection and authentication rate limits at the web server and mail services.
- Use fail2ban or an equivalent control for repeated IMAP, SMTP and web-login failures.
- Install spam and malware filtering appropriate to your volume.
- Set per-mailbox quotas and monitor disk usage before the filesystem fills.
- Record authentication, delivery and administrative events, and retain logs according to your operational and legal requirements.
Plan updates, backups and recovery
Updates are part of operating the service, not a one-time installation step. Schedule maintenance for the operating system, Postfix, Dovecot, PHP, the database and Roundcube. Backups should include both message data and the metadata that makes it usable: virtual-user records, aliases, DKIM keys, TLS configuration and Roundcube’s database. Periodically restore a mailbox and a configuration backup to verify that the files are complete and readable.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Test each domain before production use
Run the following checks separately for every hosted domain and for at least one mailbox and alias in each domain:
- DNS resolution: confirm MX, A/AAAA, SPF, DKIM and DMARC records from an external resolver. Verify that the MX target resolves to the intended VPS.
- Certificate names: open every webmail hostname and inspect the certificate chain. Check SMTP and IMAP certificates with a TLS-aware client as well.
- Inbound delivery: send from an unrelated mail system to a real mailbox and confirm that Postfix accepts the recipient and Dovecot delivers it through LMTP.
- IMAP login: sign in to Roundcube with the full address and password. Confirm that the expected folders and messages appear.
- Submission: send an external message through port 587 using the same credentials. Confirm that unauthenticated relay is refused and that the message carries the correct From address.
- Outbound authentication: inspect the receiving system’s results for SPF, DKIM and DMARC alignment. Repeat for every sending domain.
- Alias behavior: test each alias and forwarding rule, including a nonexistent recipient, to ensure unwanted catch-all acceptance is not occurring.
- Failure handling: stop or misconfigure one component in a test window and confirm that logs identify the fault and queued mail is handled safely.
These checks validate configuration; they are not a performance benchmark. Capacity depends on workload, filtering and provider limits, so monitor real queue depth, CPU, memory, storage and connection counts after launch.
Troubleshoot by symptom
Roundcube loads but login fails
- Confirm that Dovecot accepts the same full address and password outside Roundcube.
- Check whether
username_domainis appending the wrong domain for the hostname used. - Verify that the IMAP hostname, port and certificate are correct and reachable from the VPS.
- Inspect Dovecot authentication logs before changing Roundcube database settings.
Mail is accepted but never appears
- Check Postfix’s recipient map for the complete address, including its domain.
- Inspect the LMTP socket path and permissions.
- Compare the mailbox path returned by the user database with Dovecot’s
mail_location. - Check virtual-mail user ownership, UID/GID mapping and quota limits.
Users can receive mail but cannot send
- Ensure Roundcube points to the authenticated submission service, normally port 587.
- Verify that Dovecot’s authentication socket is accessible to Postfix.
- Require TLS before authentication and confirm that the client is using the matching certificate name.
- Check that Postfix permits relay only after successful SASL authentication.
Messages reach spam folders
- Confirm that the sending IP has coherent forward and reverse DNS.
- Check SPF authorization and DKIM signatures for the specific sending domain.
- Confirm DMARC alignment between the visible From domain and the authenticated mechanisms.
- Review sending reputation, complaint rates, queue behavior and abuse controls rather than changing DNS records blindly.
Choose between a self-managed stack and alternatives
One Postfix, Dovecot and Roundcube stack gives direct control and can host many domains, but you also own updates, filtering, backups, abuse response and deliverability troubleshooting. A control panel or managed mail service may reduce operational work at the cost of less granular control or different migration constraints.
| Decision area | Questions to answer |
|---|---|
| Administration | Can you add domains, mailboxes, aliases and quotas without editing inconsistent systems? |
| Identity storage | Where are virtual users stored, how are passwords hashed, and how are changes audited? |
| Security automation | How are TLS certificates renewed, vulnerabilities patched and brute-force attempts blocked? |
| Deliverability | Can you manage SPF, DKIM, DMARC, PTR and provider port-25 restrictions? |
| Filtering | What spam and malware controls are available, and who tunes false positives? |
| Recovery | How are mailboxes, aliases, keys and databases backed up, migrated and restored? |
| Scale and resources | What happens as domains, mailboxes, attachments and concurrent web sessions increase? |
| Accountability | Who monitors queues, responds to abuse complaints and applies emergency blocks? |
Operational checklist after launch
- Review queue size, deferred deliveries, disk space and mailbox quota use on a schedule.
- Monitor certificate expiry and DNS changes for every domain.
- Review authentication failures and web access logs for attack patterns.
- Test backup restoration at intervals rather than assuming backup jobs succeeded.
- Apply security updates and restart or reload services in a controlled maintenance window.
- Document the procedure for adding a domain: DNS, Postfix maps, Dovecot user records, DKIM, Roundcube hostname mapping and test messages.
- Document the procedure for removing a domain so aliases, keys, queued mail and backups are handled deliberately.
With those controls in place, one Roundcube codebase can present a consistent webmail experience for many domains while Postfix and Dovecot keep each domain’s addresses, authentication and storage logically separate.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
