How to Install and Secure Zimbra on Ubuntu

To install Zimbra on Ubuntu, give the server a fully qualified hostname, create the DNS records mail needs, run Zimbra’s install.sh, and then lock it down: a real TLS certificate, SPF, DKIM and DMARC, the admin console kept off the public internet, and a tested backup. Zimbra is a full mail and collaboration suite, with webmail, calendars, shared folders and spam and virus filtering built in. It is also demanding: plan on at least 8 GB of RAM for a small office, and expect the installer to take 20 to 40 minutes.

This guide is for Zimbra Collaboration Suite (open source edition) on Ubuntu 22.04 or 24.04, on a server you control. Check the Zimbra release notes for the exact version your Ubuntu release supports before downloading, and check the system requirements for your user count. The steps below were written from Zimbra’s documented install flow; confirm each prompt against the version you install, because the wording changes between releases.

Before you start: the server and the DNS#

Mail is unforgiving about names. Zimbra needs a fully qualified hostname that resolves both ways, and the internet needs records that point at it. Use a name under your own domain, such as mail.example.com.

Check the names from another machine:

dig +short A mail.example.com
dig +short MX example.com
dig +short -x YOUR.SERVER.IP

The three answers must agree: the A record gives your IP, the MX points at the same name, and the reverse lookup returns the same name. Also check that outgoing port 25 is open. Many cloud providers block it by default and ask you to request it; without it, Zimbra can receive mail but cannot deliver any.

Step 1: Prepare Ubuntu#

sudo hostnamectl set-hostname mail.example.com
echo "YOUR.SERVER.IP mail.example.com mail" | sudo tee -a /etc/hosts
sudo timedatectl set-timezone Asia/Kolkata
sudo apt update && sudo apt -y upgrade
sudo reboot

After the reboot, confirm the name and the time:

hostname -f
timedatectl | grep -E "Time zone|synchronized"

hostname -f must print mail.example.com. Change the timezone to yours. Remove any other service that uses ports 25, 80 or 443 before going further: sudo ss -tlnp | grep -E ":(25|80|443) " should print nothing.

Step 2: Download and unpack Zimbra#

Download the Ubuntu package for your release from Zimbra’s download page, then unpack it:

cd /tmp
tar xzf zcs-*_UBUNTU24_64.*.tgz    # use the UBUNTU22 file on 22.04
cd zcs-*/

Check the download’s checksum against the value published next to it on the download page before you install anything from it.

Step 3: Run the installer#

sudo ./install.sh

The installer asks you to accept the licence, then lists the packages it will install. Keep the defaults for a single-server setup: LDAP, mail store, MTA, proxy, Apache, memcached and the web client. Keep ClamAV (virus scanning) and SpamAssassin (spam filtering) selected. Then the configuration menu appears. The items that matter:

• Hostname: mail.example.com.
• Domain name: example.com, the domain users will receive mail on.
• Admin password: a long random password, saved in your password manager. It is the super-admin account, so do not reuse anything.
• Accept the default for the admin and webmail ports unless you have a clear reason to change them.

Press a to apply the configuration, and answer yes when asked whether to continue. This takes a while. The installer ends by printing the admin console address, which uses port 7071.

Step 4: Check that every service is running#

sudo su - zimbra -c "zmcontrol status"

Every line should say Running. If one says Stopped, read its log before restarting anything: /opt/zimbra/log/ holds one per service, and /var/log/zimbra.log records mail activity.

Then open the admin console at https://mail.example.com:7071, log in as admin with the password from step 3, and accept the certificate warning. You are now on a self-signed certificate, which Step 5 replaces.

Step 5: Install a real TLS certificate#

Browsers and other mail servers check certificates, and a self-signed one causes warnings and failed deliveries. Get a free Let’s Encrypt certificate for mail.example.com. Standalone mode needs port 80 for the check, so it runs as root and is simplest on a server where you can briefly stop the web service:

sudo apt -y install certbot
sudo certbot certonly --standalone -d mail.example.com

Deploy the certificate and its chain into Zimbra, using the paths certbot printed:

sudo su - zimbra -c "/opt/zimbra/bin/zmcertmgr deploycrt comm /etc/letsencrypt/live/mail.example.com/cert.pem /etc/letsencrypt/live/mail.example.com/chain.pem"
sudo su - zimbra -c "zmcontrol restart"

Renewal is the part people forget. Certbot renews on a timer, but Zimbra must be given the new files each time. Add a deploy hook so it happens automatically:

sudo tee /etc/letsencrypt/renewal-hooks/deploy/zimbra.sh >/dev/null <<'EOF'
#!/bin/sh
su - zimbra -c "/opt/zimbra/bin/zmcertmgr deploycrt comm /etc/letsencrypt/live/mail.example.com/cert.pem /etc/letsencrypt/live/mail.example.com/chain.pem" && su - zimbra -c "zmcontrol restart"
EOF
sudo chmod 755 /etc/letsencrypt/renewal-hooks/deploy/zimbra.sh
sudo certbot renew --dry-run

The dry run must finish with its success message. A renewal problem found now is an annoyance; the same problem found on day 90 means mail stops.

Step 6: Publish SPF, DKIM and DMARC#

Without these records, Gmail and Outlook treat your mail as suspicious. They are also the work the rest of this guide depends on.

SPF says which servers may send for your domain. Add one TXT record to example.com:

v=spf1 mx -all

Use mx only if the mail server is the sender. If you also send through another service, list that service as well, and keep to one SPF record per domain.

DKIM signs outgoing mail. Ask Zimbra for the public key:

sudo su - zimbra -c "/opt/zimbra/libexec/zmdkimkeyutil -q -d example.com"

Publish the value it prints as a TXT record named default._domainkey.example.com. Check it resolves before moving on:

dig +short TXT default._domainkey.example.com

DMARC tells receivers what to do with mail that fails. Start by only monitoring. Publish a TXT record on _dmarc.example.com:

v=DMARC1; p=none; rua=mailto:[email protected]

Create the dmarc@ mailbox first, or point rua at an address you read. Move to p=quarantine and then p=reject only after the reports show all your real mail passing. The full sequence is in our guide to setting up DMARC without losing email.

Step 7: Create users and test mail end to end#

sudo su - zimbra -c "zmprov ca [email protected] 'a-long-password'"
sudo su - zimbra -c "zmprov sp [email protected] 'a-long-password'"

Create one user, then send mail in both directions: from that account to a Gmail address, and from Gmail back to it. In Gmail, open the received message, choose Show original, and check three lines: SPF: PASS, DKIM: PASS and DMARC: PASS. If any fails, fix that record before creating more users.

For a mail-delivery problem, the log shows the exact answer each receiver gave:

sudo tail -n 50 /var/log/zimbra.log | grep -iE "reject|defer|bounce|status="

Step 8: Lock it down#

Zimbra is a full mail server exposed to the internet, so harden it in this order.

1. Keep the admin console off the public internet. Port 7071 should accept connections only from your office or VPN address. Allow the rule before enabling the firewall:

   sudo ufw allow OpenSSH
   sudo ufw allow 25,465,587,143,993,80,443/tcp
   sudo ufw allow from 203.0.113.45 to any port 7071 proto tcp
   sudo ufw default deny incoming
   sudo ufw enable

   Replace 203.0.113.45 with your own address. Users reach webmail on 443; only you need 7071.

2. Turn off weak TLS. Check the SSL protocol settings in the admin console under the server’s configuration, and disable TLS 1.0 and 1.1 so only TLS 1.2 and 1.3 are offered. Then test from outside, for example with testssl.sh mail.example.com:443, and fix anything it reports as weak.
3. Require strong passwords and enable two-factor login for administrators. Zimbra supports two-factor authentication for accounts, so enable it for the admin account first.
4. Stop open relay. A mail server that forwards mail for anyone is used for spam within hours. Zimbra does not relay mail for outside senders by default. Confirm it after setup by sending a test message to an outside address from a sender you do not own, and check the result in the log.
5. Let Fail2ban watch the logins. Install it, then add a jail that reads Zimbra’s authentication failures from /var/log/zimbra.log. Repeated failed logins from one address then get that address blocked at the firewall.
6. Keep ClamAV and SpamAssassin running. Both are installed by default. Check with zmcontrol status after every update.

Step 9: Back up, and test the restore#

A mail server with no tested backup is one bad upgrade away from losing years of mail. Zimbra’s own data is in two places: the LDAP directory (accounts and settings) and the mail store (the messages). Zimbra ships a backup utility, and its documentation describes a full backup and a restore, so use the procedure for your version.

Store the backup off the server, and check that it restores into a test host at least once. A backup that has never been restored is a hope, not a backup. The general principles, retention and off-server copies are the same as for databases, in how to back up MariaDB and PostgreSQL on a VPS.

Keep it updated#

Zimbra and Ubuntu both publish security fixes. Set a monthly routine: sudo apt update && sudo apt -y upgrade, read Zimbra’s release notes before any Zimbra upgrade, and take a backup before each one. Test the upgrade on a copy first if the server carries real mail.

Common mistakes to avoid#

• Skipping reverse DNS. Receivers reject or spam-file mail from an IP that does not resolve back to the name in your HELO.
• Leaving the self-signed certificate. Mail clients then warn users, and some refuse to connect.
• Forgetting the renewal hook. The certificate renews on disk and Zimbra keeps serving the old one until it expires.
• Exposing port 7071 to everyone. The admin console is then one stolen password away from your whole mail system.
• Publishing DMARC at reject on day one. Find every real sender in the reports first.
• Running it on a small plan. Under-sized RAM makes the store and the spam filter slow, and users notice first.

Running Zimbra on a SiteHarbour VPS#

Zimbra needs reserved memory and a clean operating system, which is what a SiteHarbour VPS provides. VPS-2 gives 8 GB of RAM and 4 vCores, which is the starting point for a small Zimbra server. Every plan is handed over with the firewall, SSH key login and automatic security updates already in place, and you can move to a larger plan later without migrating. Check outgoing port 25 with us before you order, because it is the one setting that decides whether Zimbra can deliver mail at all.

Frequently asked questions#

How many users can one Zimbra server handle?#

It depends on RAM, disk and how much mail each person sends. A small office of 10 to 30 people runs comfortably on 8 GB. Measure memory and disk for a week before you grow it.

Can Zimbra run on the same server as my website?#

Technically yes, but it is not recommended: both want ports 80 and 443, and both compete for memory. Use a separate server, or a separate VPS, for mail.

Is Zimbra free?#

The open source edition is free to download and use. Some features, such as certain administration and backup tools, belong to the paid editions. Read the edition comparison before you plan around a feature.

Why do my messages go to spam?#

Almost always SPF, DKIM, DMARC or reverse DNS is missing or wrong. Check with the Show original test in step 7 before anything else.

Can I import mail from another provider?#

Yes. Zimbra can migrate mailboxes from other IMAP servers. For a one-time copy from a hosted provider, the same logic as moving mailboxes with imapsync applies: copy first, switch the MX record second, and sync again afterwards.

The short version: a correct name and DNS, a real certificate with automatic renewal, SPF, DKIM and DMARC, an admin console that only you can reach, and a backup you have restored at least once. Get those five right and Zimbra is a reliable mail server. Get any one wrong and your mail goes to spam or stops.