Back to tutorials
Tutorial

Webmail Setup Guide Tutorial (2026): Roundcube on a VPS with SSL, IMAP/SMTP, and DNS Records

Webmail setup guide tutorial for 2026: install Roundcube on a VPS, secure with SSL, and configure IMAP/SMTP + DNS records.

By Anurag Singh
Updated on Jul 22, 2026
Category: Tutorial
Share article
Webmail Setup Guide Tutorial (2026): Roundcube on a VPS with SSL, IMAP/SMTP, and DNS Records

A dependable webmail portal prevents a lot of “I can’t add this mailbox to Outlook” tickets. In 2026, Roundcube is still a sensible fit for VPS email. It’s lightweight PHP, the UI is familiar, and it works well with a standard IMAP/SMTP stack (Dovecot + Postfix). This webmail setup guide tutorial walks through a clean Roundcube install on Ubuntu, forced to HTTPS, and connected to your existing mail services.

This walkthrough assumes IMAP and SMTP already work, even if you only have a couple of mailboxes. If delivery is flaky or DNS is half-finished, fix that first. Webmail won’t hide those problems. It will highlight them.

What you’ll build (and what you should already have)

  • URL: https://webmail.example.com
  • Webmail app: Roundcube (PHP) served by Nginx + PHP-FPM
  • Mail services: Dovecot (IMAP) and Postfix (SMTP) on the same VPS (or reachable privately)
  • TLS: Let’s Encrypt certificate for the webmail host
  • DNS: A/AAAA for webmail, plus email authentication alignment checks

If you’re deciding where to run email + webmail, use a VPS where you control DNS, ports, and certificate renewal. A HostMyCode VPS is a solid baseline.

If you’d rather not babysit mail servers, managed VPS hosting is a better production fit.

Prerequisites checklist (don’t skip)

  • Ubuntu 24.04 LTS or 22.04 LTS (commands below assume Ubuntu)
  • A non-root sudo user (or root with care)
  • Open ports: 80, 443, and mail ports you actually use (common: 25, 587, 465, 993)
  • Working IMAP on 993 (Dovecot recommended)
  • Working SMTP submission on 587 (Postfix recommended)
  • DNS control for your domain

Quick diagnostics:

hostname -f
ss -lntp | egrep ':(80|443|25|465|587|993)\b'
openssl s_client -connect 127.0.0.1:993 -servername mail.example.com -brief

If DNS or mail routing is shaky, use these before you continue:

Step 1: Plan your DNS for webmail (and avoid common naming traps)

Create a dedicated hostname for webmail. Avoid reusing mail.example.com unless you’re stuck with an older layout. Separate names make redirects, TLS, and future migrations easier.

  • A record: webmail.example.com → your VPS IPv4
  • AAAA record (optional but recommended): webmail.example.com → your VPS IPv6

Set TTL to 300 seconds while you’re building. Once everything is stable, bump it to 3600+.

Verify DNS from your workstation:

dig +short webmail.example.com A
dig +short webmail.example.com AAAA

Step 2: Install Nginx, PHP-FPM, and required PHP extensions

Roundcube is a PHP application. It needs common extensions for IMAP, XML, and text handling.

On Ubuntu 24.04, PHP 8.3 is available in the standard repos. That keeps the install straightforward.

sudo apt update
sudo apt -y install nginx
sudo apt -y install php8.3-fpm php8.3-cli php8.3-common \
  php8.3-mbstring php8.3-xml php8.3-curl php8.3-zip php8.3-intl \
  php8.3-imap php8.3-gd php8.3-bcmath

Confirm PHP-FPM is running:

systemctl status php8.3-fpm --no-pager

Pitfall: On Ubuntu 22.04, the default PHP version may differ. Check php -v. Then install the matching phpX.Y-* packages as a set.

Step 3: Install Roundcube (package route, then harden)

On a hosting VPS, the Ubuntu package is usually the best tradeoff. Updates come through apt, and you avoid manual upgrade work. You’ll still tighten the web root and configuration.

sudo apt -y install roundcube roundcube-core roundcube-plugins

On Ubuntu, Roundcube typically lands here:

  • /var/lib/roundcube/ (app)
  • /etc/roundcube/ (config)

Confirm:

dpkg -L roundcube | head

Database note: Roundcube can use SQLite or MySQL/MariaDB. For a small-to-medium user base, SQLite is often enough. It also keeps the stack smaller.

If you already run MariaDB for other services, using it for Roundcube is fine. Don’t add a database layer only because you think you “should.”

Step 4: Configure Nginx virtual host for webmail

Create an Nginx server block. On Ubuntu, you’ll usually place it under /etc/nginx/sites-available/.

sudo nano /etc/nginx/sites-available/webmail.example.com

Paste this and adjust server_name and paths if your package layout differs:

server {
  listen 80;
  server_name webmail.example.com;

  root /var/lib/roundcube/public_html;
  index index.php;

  access_log /var/log/nginx/webmail_access.log;
  error_log  /var/log/nginx/webmail_error.log;

  # Block hidden files and config leftovers
  location ~ /\. { deny all; }

  location / {
    try_files $uri $uri/ /index.php?$query_string;
  }

  location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php8.3-fpm.sock;
  }

  # Cache static assets lightly; don’t cache dynamic pages here
  location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff2?)$ {
    expires 7d;
    add_header Cache-Control "public";
    try_files $uri =404;
  }
}

Enable the site and reload:

sudo ln -s /etc/nginx/sites-available/webmail.example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

If you host multiple sites, check for duplicate server_name entries. When names conflict, Nginx may silently pick a “default” server. That makes routing confusing fast.

Step 5: Issue an SSL certificate for webmail.example.com

TLS is mandatory for webmail. Use Let’s Encrypt and let Certbot handle renewal.

If you prefer a troubleshoot-first approach, keep this nearby: TLS certificate deployment tutorial (Let’s Encrypt on a hosting VPS).

sudo apt -y install certbot python3-certbot-nginx
sudo certbot --nginx -d webmail.example.com

Certbot will update your Nginx config with listen 443 ssl. It typically adds an HTTP→HTTPS redirect too.

Verify renewal:

sudo certbot renew --dry-run

Confirm HTTPS and headers:

curl -I https://webmail.example.com

Step 6: Configure Roundcube to use your IMAP/SMTP correctly

On Ubuntu, Roundcube’s main config is commonly /etc/roundcube/config.inc.php. Back it up first. Then edit it.

sudo cp -a /etc/roundcube/config.inc.php /etc/roundcube/config.inc.php.bak.$(date +%F)
sudo nano /etc/roundcube/config.inc.php

Set the IMAP and SMTP endpoints. If mail runs on the same VPS, tls://127.0.0.1 can work.

For long-term maintenance, hostname-based TLS is usually easier to keep correct. If you terminate TLS on Dovecot/Postfix, prefer the hostname.

// IMAP
$config['default_host'] = 'tls://mail.example.com';
$config['default_port'] = 993;

// SMTP (submission)
$config['smtp_host'] = 'tls://mail.example.com';
$config['smtp_port'] = 587;
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';

// Use the user’s full email address as login (common)
$config['username_domain'] = '';

// App identity
$config['product_name'] = 'Example Webmail';

// Security-related
$config['force_https'] = true;
$config['session_lifetime'] = 30;
$config['ip_check'] = true;

Reality check: Many servers accept IMAP login as user or user@example.com. Roundcube can handle either. Your users can’t read your mind, though.

Pick one format, configure to match, and document it.

Test IMAP and SMTP from the VPS if login fails in the browser:

# IMAP capability check
openssl s_client -connect mail.example.com:993 -servername mail.example.com -quiet

# SMTP STARTTLS check
openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com -crlf -quiet

Step 7: Lock down PHP and session behavior for webmail

Webmail is an authentication surface. Don’t run it with overly generous defaults. Aim for predictable behavior and sensible limits, not security theater.

Create an override file for the FPM pool (default pool is www):

sudo nano /etc/php/8.3/fpm/pool.d/webmail-overrides.conf

[www]
php_admin_value[expose_php] = Off
php_admin_value[upload_max_filesize] = 10M
php_admin_value[post_max_size] = 12M
php_admin_value[max_execution_time] = 60
php_admin_value[max_input_time] = 60
php_admin_value[memory_limit] = 256M
php_admin_value[session.cookie_secure] = 1
php_admin_value[session.cookie_httponly] = 1
php_admin_value[session.cookie_samesite] = Lax

Reload PHP-FPM:

sudo php-fpm8.3 -t
sudo systemctl reload php8.3-fpm

Pitfall: If you run multiple PHP apps, avoid global edits in /etc/php/8.3/fpm/php.ini. Pool-level overrides stay scoped. Rollbacks are also painless.

Step 8: Add basic Nginx hardening specific to webmail

Roundcube is dynamic, but you can still tighten a few edges. Add conservative headers. Keep request sizes in check.

Edit your site file (the TLS version if Certbot split it):

sudo nano /etc/nginx/sites-available/webmail.example.com

Inside the server block, add:

client_max_body_size 12m;

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "same-origin" always;

Then validate and reload:

sudo nginx -t
sudo systemctl reload nginx

If you want a broader header set that’s generally safe for hosting workloads, read: Nginx security headers configuration tutorial.

Step 9: Make login safer without annoying users

You’ll get the biggest win from two simple controls:

  • Rate limiting at the web tier (slows credential stuffing)
  • Server-side bans (Fail2Ban) based on Nginx logs

Add a small Nginx rate limit for login POSTs. In /etc/nginx/nginx.conf (inside the http block), define a zone:

sudo nano /etc/nginx/nginx.conf

limit_req_zone $binary_remote_addr zone=webmail_login:10m rate=10r/m;

Then apply it in your webmail server block. Roundcube uses /?_task=login, but matching that cleanly in Nginx is awkward.

A simple, safe approach is to limit all POSTs to index.php:

location = /index.php {
  limit_req zone=webmail_login burst=20 nodelay;
  include snippets/fastcgi-php.conf;
  fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}

Reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

If you also want bans plus better log visibility, plug this into whatever monitoring you already run. This pairs well with: Log monitoring setup guide tutorial (Logwatch + Fail2Ban).

Step 10: Verify mail DNS alignment (so webmail doesn’t create support tickets)

Webmail doesn’t improve deliverability. It does become the place users notice deliverability problems.

Before you call the setup “done,” confirm the basics:

  • MX points to the right host
  • PTR (reverse DNS) matches your sending host (for outbound)
  • SPF/DKIM/DMARC align with your actual sending path

Quick checks:

dig +short MX example.com

# If you send mail directly from this VPS, confirm PTR is set for the VPS IP.
# (Exact check depends on your IP; this example uses IPv4)
dig +short -x 203.0.113.10

If PTR is missing or wrong, fix it before you start warming up outbound reputation. This guide stays focused: Reverse DNS setup tutorial.

Step 11: Create a tiny “known good” test plan

Use two mailboxes (one local, one external). Validate the entire loop:

  1. Log in to Roundcube with user@example.com
  2. Send an email to a Gmail/Microsoft mailbox
  3. Reply back to confirm inbound delivery and threading
  4. Attach a 1–2 MB file to confirm upload limits
  5. Log out, then log in again (session handling)

Useful server-side checks while you test:

# Watch Nginx errors
sudo tail -f /var/log/nginx/webmail_error.log

# Watch mail logs (path may vary by distro)
sudo tail -f /var/log/mail.log

Step 12: Back up Roundcube config (and keep restores boring)

Roundcube is easy to reinstall. The parts you don’t want to rebuild under pressure are your config, any plugins you added, and the Roundcube database (if you use one).

At minimum, back up:

  • /etc/roundcube/
  • /var/lib/roundcube/ (verify what’s custom vs packaged)
  • DB dump or SQLite file (if applicable)
  • Nginx site file: /etc/nginx/sites-available/webmail.example.com

If you already run structured VPS backups, add these paths. Run a restore drill quarterly.

If you haven’t tested a restore, you don’t have a restore plan. You have hope.

Practical troubleshooting: the five failures you’ll actually see

1) Blank page or 502/504 in the browser

  • Check PHP-FPM socket path: /run/php/php8.3-fpm.sock
  • Check Nginx error log: /var/log/nginx/webmail_error.log
  • Confirm PHP-FPM is running: systemctl status php8.3-fpm

2) Login works, but sending fails

  • Confirm submission port: prefer 587 with STARTTLS
  • Verify SMTP TLS: openssl s_client -starttls smtp -connect mail.example.com:587
  • Check Postfix restrictions: look at /var/log/mail.log for auth failures

3) IMAP connection errors

  • Verify Dovecot listens on 993: ss -lntp | grep 993
  • Test TLS and cert name: openssl s_client -connect mail.example.com:993 -servername mail.example.com
  • Confirm the login format (user vs full email address)

4) Let’s Encrypt renewals fail for webmail

5) Users complain about spam folder placement

  • Webmail isn’t the cause; outbound alignment is
  • Confirm SPF/DKIM/DMARC and PTR match your sending path
  • If you need to route mail through a smart host, consider a relay setup (especially for new IPs)

Operational checklist (printable)

  • DNS: webmail.example.com A/AAAA resolves to the VPS
  • HTTPS enforced; certbot renew --dry-run passes
  • Nginx site enabled; nginx -t clean
  • PHP-FPM running; pool overrides applied
  • Roundcube points to IMAP 993 and SMTP submission 587
  • Basic rate limiting enabled for login
  • Mail DNS alignment validated (MX, PTR, SPF/DKIM/DMARC)
  • Backups include Roundcube config + DB; restore steps documented

Summary: a clean webmail portal without extra drama

Roundcube on a VPS stays practical because it’s simple. You get one hostname, one TLS certificate, a small PHP footprint, and a web UI that talks to your IMAP/SMTP services. When a desktop client misbehaves, users still have a browser fallback.

If you want this to stay stable through renewals, security updates, and a growing mailbox count, run it on infrastructure you control. Start with a HostMyCode VPS. Or choose managed VPS hosting if you want routine hardening and upkeep handled for you.

If you’re setting up production email plus webmail, run it on a VPS with predictable networking, clean DNS control, and room to grow. HostMyCode offers HostMyCode VPS plans for hands-on admins and managed VPS hosting for teams that want fewer operational chores.

FAQ

Should webmail run on the same VPS as Postfix/Dovecot?

It can. For small deployments it’s simpler and reduces latency. For larger setups, separating webmail from mail services can help isolate load and security boundaries.

Do I need a separate SSL certificate for webmail?

Yes. Use a certificate that matches webmail.example.com. A wildcard can work too, but a dedicated cert keeps things straightforward.

Why does Roundcube login work but SMTP sending fails?

Most often it’s the submission port or TLS mode. Use port 587 with STARTTLS, confirm credentials, and check Postfix logs for SASL auth failures.

Can I put webmail behind Cloudflare?

You can, but be careful with rate limiting and IP visibility. If you do, configure real client IP handling in Nginx and review Cloudflare’s mail-related limitations (Cloudflare won’t proxy SMTP/IMAP).

What’s the minimum backup for this setup?

Back up /etc/roundcube/, your Nginx site config, and Roundcube’s database (or SQLite file). Also keep a note of installed packages and versions for rebuilds.