iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To run webmail on Ubuntu, combine Apache and PHP with Roundcube, Postfix, Dovecot, and MariaDB. Postfix accepts and sends SMTP mail, Dovecot delivers and serves IMAP mail, Roundcube provides the browser interface, and MariaDB stores Roundcube settings and session data. The sequence below covers a single-domain installation using Maildir, encrypted IMAP, authenticated SMTP submission, and HTTPS.
What the finished system does
A browser connects to Apache over HTTPS and loads Roundcube. Roundcube authenticates the user against Dovecot over IMAP and submits outgoing messages to Postfix over authenticated SMTP. Postfix delivers mail locally into each user’s mailbox or transfers it to another mail server. Dovecot reads that mailbox and presents it through IMAP. MariaDB stores Roundcube preferences, address-book data, and session information.
Ubuntu describes the normal flow as a user agent handing mail to a mail-transfer agent (MTA), the MTA handing it to a delivery service, and the user agent retrieving it through IMAP or POP3. In this design, Roundcube is the user agent, Postfix is the MTA, and Dovecot provides mailbox delivery and access.
Decisions to make before installing
Local Unix users or virtual-mailbox identities
| Choice | Best fit | Advantages | Trade-offs |
|---|---|---|---|
| Local Unix users | One domain or a small server where each mailbox maps to an Ubuntu account | Simple authentication, straightforward permissions, and an uncomplicated Dovecot configuration | Mailbox administration is tied to operating-system accounts; multiple domains and large user populations become awkward |
| Virtual mailboxes | Multiple domains, hosted mail, or mailboxes that should not have shell accounts | Mail identities, domains, quotas, and passwords can be managed independently of Unix users | Requires a separate virtual-alias and virtual-mailbox design, database lookups, and more extensive testing |
The basic Ubuntu Postfix walkthrough is aimed at local delivery and does not cover virtual domains. If you need several domains, aliases, catch-all rules, quotas, or a hosted-mail architecture, design those components before installing Roundcube rather than trying to extend a single-domain configuration piecemeal.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Maildir or mbox
| Format | How it stores mail | Operational implications |
|---|---|---|
| Maildir | Each message is a separate file in folders such as cur, new, and tmp |
Concurrent IMAP access is convenient, individual-message backup and recovery are simple, and it is easy to inspect a mailbox |
| mbox | Messages are kept in a shared file for each mailbox or folder | It is traditional and supported, but locking, corruption recovery, and large-file handling require more care |
This guide uses Maildir because Ubuntu’s Postfix example demonstrates home_mailbox = Maildir/. Postfix and Dovecot must use the same format and path; a mismatch makes delivery appear successful while the mailbox shown in webmail remains empty.
IMAP-only or IMAP plus POP3
IMAP keeps the authoritative mailbox on the server and synchronizes folders across devices, which is normally the right choice for webmail. POP3 downloads messages to a client and is useful only when a deployment deliberately needs that behavior. Install and expose Dovecot’s POP3 service only when a client requirement justifies it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Encrypted ports
| Service | Port | Encryption mode | Typical use |
|---|---|---|---|
| IMAP | 143 | Plain connection that can be upgraded with STARTTLS | Compatibility or controlled networks |
| IMAPS | 993 | TLS from the first byte | Preferred direct IMAP endpoint |
| POP3 | 110 | Plain connection that can be upgraded with STARTTLS | Only when POP3 is required |
| POP3S | 995 | TLS from the first byte | Encrypted POP3 |
| SMTP submission | 587 | STARTTLS followed by authentication | Mail clients and Roundcube sending mail |
| SMTP over implicit TLS | 465 | TLS from the first byte | Alternative submission service when supported by the client |
| SMTP server-to-server | 25 | Usually opportunistic STARTTLS | Receiving and relaying mail between servers |
Use 993 and 587 for the normal webmail path. Keep 143, 110, and 995 closed unless they are needed. Port 25 is normally required for receiving mail from other servers, but it should not be treated as an authenticated end-user submission port.
Prepare the Ubuntu LAMP host
Set the hostname and DNS first
Choose a fully qualified name such as mail.example.com. Create an A or AAAA record that points to the server, and ensure the server’s hostname resolves consistently from the machine itself and from clients. For Internet mail, arrange reverse DNS for the public address and publish the DNS records required by your sending policy. DNS, hostname, reverse-DNS, and reputation are deliverability prerequisites even though they are separate from the Roundcube installation.
Set the hostname and patch the operating system before opening services:
sudo hostnamectl set-hostname mail.example.com
sudo apt update
sudo apt full-upgradePlan backups before exposing mail. Keep independent copies of the mailboxes, the Roundcube database, and configuration files; a database backup alone cannot restore message files, and a mailbox backup alone cannot restore preferences or connection settings.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Install and verify Apache and PHP
Install Apache, PHP 8.1 or newer, the PHP database driver for your chosen database, and the extensions required by the Roundcube release. Common installations also need the internationalization, multibyte-string, XML, cURL, ZIP, and image extensions. Confirm the actual requirements in the release’s installation document rather than assuming that every Ubuntu PHP package is sufficient.
sudo apt install apache2 mariadb-server php php-cli php-mysql php-intl php-mbstring php-xml php-curl php-zip php-gd
php -v
php -mCreate a temporary PHP test page under Apache’s document root, request it in a browser, and remove it immediately after confirming that PHP executes. Do not leave a page that discloses module lists or server variables on a public host.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Install and configure Postfix
Choose the mail domain during package setup
Install the supported Ubuntu package:
sudo apt install postfixWhen the package asks for a configuration type, choose the option appropriate for a server that sends and receives Internet mail, then enter the server’s mail domain. Set the system’s mail name and local networks carefully; an overly broad mynetworks value can create an open relay.
For a local-user Maildir design, review /etc/postfix/main.cf and confirm values equivalent to these, adapting the domain and network to your environment:
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mynetworks = 127.0.0.0/8 [::1]/128
home_mailbox = Maildir/
mailbox_command =Do not copy these values unchanged onto a virtual-mailbox server. The mydestination, transport maps, aliases, and mailbox lookups differ materially in that architecture.
Enable authenticated SMTP through Dovecot
Roundcube must submit mail with credentials. Configure Postfix to use Dovecot SASL, disable anonymous authentication, and advertise only mechanisms your clients require. A typical arrangement in /etc/postfix/main.cf includes:
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_tls_auth_only = yesApply submission-specific restrictions in /etc/postfix/master.cf or a dedicated submission service so that port 587 requires TLS and authentication. Do not permit unauthenticated users to relay arbitrary external mail.
Configure the Postfix certificate
Use a certificate whose name matches the hostname clients connect to. In main.cf, set the certificate, private-key, and chain paths supplied by your certificate authority. Protect the private key so only the service account or root can read it. A self-signed certificate is appropriate only when every client is deliberately configured to trust that certificate.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Reload after each validated change:
sudo postfix check
sudo systemctl reload postfix
sudo systemctl status postfix --no-pagerInstall and configure Dovecot
Install IMAP, and add POP3 only if needed
sudo apt install dovecot-imapdAdd dovecot-pop3d only when a client or migration plan requires POP3. Ubuntu documents IMAP on 143, IMAPS on 993, POP3 on 110, and POP3S on 995. Encrypted variants are preferable for remote access.
Match Dovecot to Postfix’s mailbox format
For local Unix users and Maildir, set Dovecot’s mail location to the same path Postfix uses. In the Dovecot mail configuration, use an equivalent of:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
mail_location = maildir:~/Maildir
protocols = imapIf POP3 is enabled, list it in protocols and configure its TLS policy separately. Ensure each user’s home directory and Maildir have ownership and permissions that let Dovecot read and update messages without making mail readable by unrelated users.
Set authentication and TLS policy
Configure Dovecot to authenticate against the same identity that users enter in Roundcube. For a local-user installation, that is commonly the Unix account name or a full address mapped to that account. Enable the authentication mechanisms required by your clients, disable cleartext authentication unless the connection is protected, and specify the certificate and key used for IMAPS.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsauth_mechanisms = plain login
disable_plaintext_auth = yes
ssl = required
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pemThe exact Dovecot configuration-file layout varies by Ubuntu release. Keep the certificate path and hostname consistent with Postfix and Apache, and verify that Dovecot can read the key.
Expose the SASL socket to Postfix
Postfix needs a Unix socket through which it can ask Dovecot to authenticate a submission client. In Dovecot’s service-auth section, create a listener at the Postfix private directory, with a group and mode that allow Postfix to connect but do not make the socket world-writable. The socket path must match smtpd_sasl_path = private/auth.
service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
}Reload both services after checking the configuration:
sudo doveconf -n
sudo systemctl reload dovecot
sudo systemctl reload postfixCreate the Roundcube database
Install MariaDB and create a dedicated account
sudo apt install mariadb-server
sudo mariadb-secure-installation
sudo mariadbInside MariaDB, create a UTF-8 database and a user used only by Roundcube. Replace the example secret with a long, unique password and grant only the privileges needed on that database:
CREATE DATABASE roundcube CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'roundcube_user'@'localhost' IDENTIFIED BY 'replace-with-a-unique-secret';
GRANT ALL PRIVILEGES ON roundcube.* TO 'roundcube_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;Do not reuse the database password for an Ubuntu account, mailbox, or TLS key. Store it in a root-readable configuration file and include that file in your protected configuration backup.
Import the schema
The official Roundcube release includes a database schema for supported engines. Import the MariaDB/MySQL schema supplied with the exact release you installed; the path differs between a distribution package and a manually unpacked release. For example, after locating the supplied MySQL schema file:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
mysql -u roundcube_user -p roundcube < /path/to/roundcube/SQL/mysql.initial.sqlUse the schema shipped with your release rather than an older copy found elsewhere. Schema changes are part of Roundcube upgrades.
Install Roundcube and connect it to mail services
Choose a package or a manual release
| Method | Advantages | Risks and checks |
|---|---|---|
| Ubuntu distribution package | Integrates with system paths, service management, and security updates | The packaged Roundcube version may lag behind the project release; verify that its PHP requirements match the installed PHP |
| Official Roundcube release | Direct control over the application version and release schedule | You must manage ownership, upgrades, configuration protection, and web-server integration yourself |
Whichever method you choose, install a release that supports PHP 8.1 or newer and keep the application outside user-writable directories. Preserve config, the database, and a tested rollback copy before upgrades.
Set filesystem ownership and permissions
Roundcube’s web server account must be able to write its temp and logs directories. Make only those runtime directories writable; the rest of the application should be read-only to the web process whenever possible.
sudo chown -R www-data:www-data /var/www/roundcube/temp /var/www/roundcube/logs
sudo chmod 750 /var/www/roundcube/temp /var/www/roundcube/logsAdjust the path and group to match your Apache configuration. Never solve a write error by making the entire Roundcube tree writable by everyone.
Configure config/config.inc.php
Set the database DSN, IMAP endpoint, SMTP endpoint, and authentication identity. A TLS-based single-domain example is:
$config['db_dsnw'] = 'mysql://roundcube_user:replace-with-a-unique-secret@localhost/roundcube';
$config['default_host'] = 'ssl://mail.example.com';
$config['default_port'] = 993;
$config['smtp_host'] = 'tls://mail.example.com';
$config['smtp_port'] = 587;
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';%u and %p tell Roundcube to reuse the login identity and password for SMTP authentication. If your Dovecot naming scheme expects only a local part, or expects a full address, configure the login form and mappings consistently. A successful IMAP login followed by an SMTP authentication failure usually indicates that those identities do not match.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Protect the configuration file from other local users and never expose it through Apache. Disable Roundcube’s installer after setup, remove any installer directory that the release instructs you to remove, and keep diagnostic pages off the public site.
Configure Apache and HTTPS
Point an Apache virtual host for webmail.example.com at Roundcube’s public directory. The exact directory is package-dependent; newer releases commonly have a web-accessible public_html or public directory. Enable the modules needed by the release, redirect HTTP to HTTPS, and set the certificate and private-key paths in the TLS virtual host.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
sudo a2enmod ssl rewrite headers
sudo a2ensite webmail-ssl.conf
sudo systemctl reload apache2Use a trusted certificate matching the webmail hostname. HTTPS protects the browser session and the credentials exchanged between the browser and Apache; it does not replace TLS on the IMAP and SMTP connections from Roundcube to Dovecot and Postfix.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Firewall and exposure plan
Allow only the services the deployment actually uses. A common webmail server needs HTTPS, SMTP server-to-server delivery, authenticated submission, and IMAPS:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo ufw allow 443/tcp
sudo ufw allow 25/tcp
sudo ufw allow 587/tcp
sudo ufw allow 993/tcp
sudo ufw enable
sudo ufw status verboseAllow port 80 only if you need HTTP-to-HTTPS redirection or certificate issuance. Add 143, 110, or 995 only when those protocols are intentionally supported. Restrict administrative services such as SSH by source address or VPN where practical.
Test each layer before relying on webmail
Test Dovecot authentication locally
Use Dovecot’s authentication test with a real mailbox identity:
sudo doveadm auth test user@example.comA successful result confirms that the password backend recognizes the identity. It does not prove that the mailbox path is writable or that TLS is correctly presented.
Test IMAPS and SMTP TLS
From a trusted administration machine, inspect the certificate and protocol negotiation:
Recommended Free Tools
openssl s_client -connect mail.example.com:993 -crlf
openssl s_client -starttls smtp -connect mail.example.com:587 -crlfFor SMTP, type EHLO test.example after the connection is established. The server should advertise STARTTLS before encryption and AUTH after the encrypted session is negotiated, according to the service policy. Do not submit real passwords over an unencrypted test connection.
Ubuntu’s introductory mail-service checks also use telnet for basic protocol validation. Use that only from a controlled network and only to inspect banners or STARTTLS availability; telnet itself does not encrypt credentials.
Test delivery and the Roundcube path
- Open the HTTPS webmail hostname and confirm the certificate warning is absent.
- Log in with the exact identity accepted by Dovecot.
- Send a message to a mailbox you control on another provider or server.
- Reply to that message and verify that the reply appears in the Roundcube Inbox.
- Check Sent, Drafts, and Trash to confirm that IMAP folder mapping works.
- Watch the logs while repeating a failed operation:
sudo journalctl -u postfix -u dovecot -u apache2 -f.
Inspect the message headers during testing. They reveal whether the message was submitted through the intended host, whether TLS was used, and whether the receiving server accepted or deferred it.
Troubleshooting by symptom
Roundcube loads, but login fails
- Run
doveadm auth testwith the same username format entered in the browser. - Check Dovecot authentication logs for a rejected password, unknown user, or disabled mechanism.
- Confirm that the mailbox exists and that its home directory is accessible to Dovecot.
- Verify that Roundcube’s
default_hostpoints to the correct hostname and port.
Login works, but the Inbox is empty
- Compare Postfix’s
home_mailboxsetting with Dovecot’smail_location. - Check whether new messages are in
~/Maildir/newand whether ownership permits Dovecot to read them. - Confirm that Postfix is delivering locally rather than routing the domain elsewhere.
- Review the Dovecot namespace and folder configuration if Sent or Drafts are missing.
Sending fails with an SMTP authentication error
- Confirm that port 587 is enabled and requires STARTTLS before AUTH.
- Check the Dovecot SASL socket path, mode, user, and group.
- Ensure Postfix’s
smtpd_sasl_pathmatches the socket actually created by Dovecot. - Verify that
%uand%presolve to credentials accepted by Dovecot.
Browsers show certificate warnings
- Check that the certificate name matches the exact hostname in the browser, Roundcube, Postfix, and Dovecot settings.
- Serve the complete certificate chain, not only the leaf certificate.
- Confirm that Apache, Postfix, and Dovecot point to readable copies of the current certificate and key.
- Reload services after renewal and test from a device that does not have an old certificate cached.
Apache reports a permissions or blank-page error
- Inspect Apache’s error log and PHP’s version and extension list.
- Make only Roundcube’s
tempandlogsdirectories writable by the web server. - Check that the configured document root exposes the release’s intended public directory, not its private configuration tree.
- Confirm that the PHP database driver and required Roundcube extensions are installed.
Security and ongoing operations
Protect credentials and privileges
- Use a unique database password, mailbox passwords that are not reused elsewhere, and a private TLS key.
- Keep anonymous SMTP mechanisms disabled and require authentication for submission.
- Use least-privilege database grants and avoid running Roundcube or database services as root.
- Keep the operating system, PHP, Apache, Postfix, Dovecot, and Roundcube patched.
- Limit firewall exposure to the protocols you operate.
Back up what can actually be restored
Back up the Maildir trees, the Roundcube database, Apache/Postfix/Dovecot/Roundcube configuration, TLS deployment metadata, and DNS settings. Store at least one copy separately from the server. Test restoring a mailbox, the database, and a complete webmail configuration; an untested backup is not a recovery plan.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsPlan for deliverability
Successful local tests do not guarantee Internet delivery. Maintain correct forward and reverse DNS, a stable hostname, appropriate SPF, DKIM, and DMARC policy, sensible rate limits, monitoring for rejected or deferred mail, and a process for responding to reputation problems. These controls belong alongside the server build, not after the first delivery failure.
When to choose a different design
A single Ubuntu host with local users, Maildir, Dovecot IMAP, Postfix submission, Apache, PHP, and Roundcube is a practical design for a small organization or personal domain. Reconsider it when you need many domains, large-scale provisioning, high availability, central spam filtering, delegated administration, or strict separation between webmail and mail storage. Those requirements call for virtual-mailbox schemas, alias management, quota policy, monitoring, and often separate hosts or managed services. Roundcube remains the browser client, but the identity and delivery architecture must be designed first.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
