Free up to five users. The whole suite, not a demo of it.
If your organisation runs OxiMail for itself and has five users or fewer, it costs nothing — and you get the same thing our paying customers get: the server, the Workspace web client, the Sync agent. Not a headless server with the good parts removed. Aliases, distribution lists and shared mailboxes without their own login do not count towards the five, and anything outside production — testing, evaluation, teaching, research — is unlimited.
Already self-hosting? OxiMail is built to take your mailboxes.
If you run Stalwart, Zimbra, Dovecot or any generic IMAP server, you are exactly who this is for. The migration tooling pulls your mailboxes, folders and flags across — phased, domain by domain, validated against your real clients before you cut over. You are not rebuilding your mail estate from scratch; you are moving it to a JMAP-native engine that is one binary instead of a stack of six.
From Stalwart
Direct migration path — accounts, mailboxes, folders and message flags carried over.
From Zimbra
Leave the JVM stack behind. Mailbox import with folder and flag mapping.
From Dovecot
IMAP-side migration from the most common self-hosted mail store.
From generic IMAP
Any RFC 3501 source — Courier, Cyrus, a managed host you are leaving.
A real mail and collaboration server. Not a demo, not a teaser.
Everything below is shipped today and runs in the single binary. The web client and the desktop sync agent come with it.
JMAP Mail (RFC 8621) plus IMAP4rev2 over TLS. SMTP inbound and outbound. Server-side Sieve filtering with a from-scratch interpreter, managed over ManageSieve.
Calendar, contacts, tasks
JMAP Calendar, Contacts (RFC 9610) and Tasks, with CalDAV and CardDAV for legacy clients — Thunderbird, Apple Mail, eM Client. ICS import and export.
Files and sharing
A file tree with version history, a trash, and share links your server issues and can revoke. Shared with colleagues by principal or by group, or mounted as a network drive on the office LAN.
Chat and calls
Rooms, polls, read receipts and drafts that follow you between devices. Video calls between up to three participants, with screen sharing — larger meetings wait on the SFU.
Spam filtering, built in
A scored three-stage pipeline: network checks (SPF, DKIM, DMARC, ARC, DNSBL), then content analysis, then per-tenant Bayesian classification and URL inspection. No rspamd, no SpamAssassin, no third-party API keys.
Encryption at rest + passkeys
A per-tenant key hierarchy — keys stay on your infrastructure. Phishing-resistant passkey sign-in over WebAuthn. Post-quantum key exchange on every TLS port.
Legacy protocol support
IMAP, CalDAV and CardDAV translation so existing desktop and mobile clients connect unchanged while you move to JMAP at your own pace.
Fail-loud integrity
No silently dropped mail, no swallowed errors. Any message accepted with a 250 is delivered or quarantined — never to /dev/null.
One binary. SQLite. Up to about 2000 accounts.
OxiMail is SQLite-backed and has been validated to around 2000 accounts per instance — far beyond what a five-user deployment needs, and enough for a cooperative, an association or a small institution when you outgrow the free tier. Put it on a Debian host, point your DNS, and you have a full mail and collaboration server in one process, one config, one login. No JVM, no orchestration, no specialist on call to keep a six-service stack standing.
# Debian 13, 2 GB of RAM, a domain and a public IP
# one binary, one config file, one systemd service
# no Postfix, no Dovecot, no web server alongside itThe operator documentation covers the whole path: requirements, ports, first boot, DNS and DKIM, TLS, migration from your current server. Prebuilt packages arrive with the public source release — until then, tell us and we will get you a build.
Fair source: free below the line, paid above it, and AGPL for everyone after four years.
OxiMail is published under a single licence, not split into a free edition and a secret one. Running it for your own organisation with five users or fewer is free. Above five, or the moment you operate OxiMail for other people — a hosting provider, a managed-services company — it is a paid licence, from the first mailbox. And every release turns into AGPL-3.0-or-later four years after it ships, automatically: call it deferred AGPL. That last clause is a ceiling on our own pricing power, written into the licence, which is a thing no cloud provider can offer you. We check the threshold with a report and an admin banner. The server never blocks, never phones home for permission, and never holds your mail hostage over a licence count.
See what free includes and what is paid →The honest list of what sits above the line.
Above five users you buy a licence, and so does anyone operating OxiMail for third parties, from the first mailbox. Some capabilities are separate paid modules rather than part of the base: the AI assistant, Booking, Notify, Comms and Shield. The scaling layer for very large deployments — PostgreSQL, object storage, clustering — is paid too, and only exists as customers pay for it. None of it is required to run a complete, sovereign mail server: the free tier is the whole suite, not an amputated version of it.
The source is not public yet. The documentation already is.
We publish the server source at the public opening, under the licence described above. It has not happened yet, and we would rather say so than leave a dead link on this page. In the meantime the operator and developer documentation is complete and public — read it and judge for yourself.
Read the documentation See the editions