Zimbra Collaboration is a complete mail and groupware server: SMTP, mailbox storage, IMAP/POP, a full web client with calendar, contacts, tasks and file sharing, plus a web admin console. Everything ships as one installer.

That convenience is also the main thing to understand about it. Zimbra bundles and manages its own copies of Postfix, OpenLDAP, nginx, Jetty, MariaDB and more under /opt/zimbra. It expects to own the machine. If you configure the bundled components by hand the usual way, Zimbra's config daemon overwrites your changes.

Editions and licensing (as of 2026)¶

• Zimbra is owned by Synacor. Current releases are in the 10.1.x series.
• There are two editions: the commercial Network Edition (backup/restore, mobile sync/ActiveSync, HSM, support) and the Open Source Edition (OSE).
• From the 10.x series, Zimbra stopped publishing free official binaries of the Open Source Edition. The source code remains public, so community groups build and publish OSE packages (for example the maldua/zimbra-foss project on GitHub). Those builds are unofficial, so evaluate them as you would any third-party package.
• Carbonio (by Zextras) is a separately maintained fork of Zimbra with its own open-source edition, and is the other common choice for the same use case.

Architecture¶

                Internet
                   │
     ┌─────────────┴──────────────────────────────────────────┐
     │ zimbra-proxy (nginx)  :80 :443  :143 :993  :110 :995    │  TLS termination, routing to the right mailbox server
     └─────────────┬──────────────────────────────────────────┘
                   │
 :25 :465 :587     │
 ┌────────────────▼─────┐   LMTP :7025   ┌─────────────────────────────────────┐
 │ zimbra-mta           │───────────────►│ zimbra-store (mailboxd / Jetty)     │
 │ Postfix + amavisd    │                │  - message blobs  /opt/zimbra/store │
 │ + SpamAssassin       │                │  - metadata DB    (MariaDB)         │
 │ + ClamAV + OpenDKIM  │                │  - search index   (Lucene)          │
 └──────────┬───────────┘                │  - web client, admin console :7071  │
            │                            └───────────────┬─────────────────────┘
            └──────────────┬─────────────────────────────┘
                           ▼
                 zimbra-ldap (OpenLDAP) :389
         accounts, domains, COS, server and global config

A single server runs all of these. Larger deployments split LDAP, MTA, proxy and multiple mailbox servers onto separate hosts.

How configuration works¶

1. Settings are attributes in LDAP (zimbraMtaRelayHost, zimbraMailQuota, …). You change them with zmprov or the admin console.
2. They live at different levels: global config (gacf/mcf), server (gs/ms), domain (gd/md), class of service (gc/mc) and account (ga/ma). Lower levels override higher ones.
3. zmconfigd watches LDAP and regenerates the real config files (Postfix's main.cf, nginx config, amavis config) from templates, then reloads the service.

So postconf -e or editing /opt/zimbra/conf/nginx/*.conf directly works only until the next regeneration. Always change the LDAP attribute. Local, non-LDAP settings live in localconfig.xml and are managed with zmlocalconfig.

Installing: prerequisites that cause most failures¶

Zimbra's installer is reliable if the host is prepared. It's painful if not.

1. A dedicated host or VM with a supported OS (Ubuntu LTS or RHEL/Rocky/Alma; check the release notes for your version) and at least 8 GB RAM for a small install.
2. A real FQDN as the hostname, and an /etc/hosts line mapping the server's IP (not 127.0.0.1) to it:

bash hostnamectl set-hostname mail.domain.tld echo "192.0.2.10 mail.domain.tld mail" | sudo tee -a /etc/hosts

3. DNS: an A record for mail.domain.tld, an MX for domain.tld pointing at it, a PTR for the IP, plus SPF, DKIM and DMARC (see Email Authentication and Anti-Spam). The installer checks the MX and complains loudly if it's missing.
4. Nothing else listening on Zimbra's ports. Stop and disable any distribution MTA before installing:

bash sudo systemctl disable --now postfix sendmail exim4 2>/dev/null sudo ss -tlnp | grep -E ':(25|80|110|143|389|443|465|587|993|995|7071)\b'

Also stop any web server, LDAP server or IMAP server on those ports. 5. Firewall: open 25, 80, 443, 465, 587, 993 (and 143/110/995 if you offer them) publicly. Keep 7071 (admin console) restricted to admin networks or a VPN. Keep internal ports (389, 7025, 10024–10026, 3310, 11211) closed to the outside.

Then extract the installer tarball and run it as root:

tar -xzf zcs-*.tgz && cd zcs-*/
sudo ./install.sh

Accept the package selection (all components for a single server). The menu-driven configuration that follows needs at minimum an admin password. Watch for its warnings about DNS and the hostname.

Uninstalling cleanly¶

A half-removed Zimbra is a classic cause of mysterious port conflicts later, for example a stand-alone Postfix that can't bind port 25 or loses STARTTLS. If you're removing it, do it properly:

cd zcs-*/ && sudo ./install.sh -u        # uninstall
systemctl list-unit-files | grep -i zimbra
sudo systemctl disable --now zimbra.service 2>/dev/null
sudo crontab -u zimbra -l                # remove leftovers, then delete the user
# finally remove /opt/zimbra if the uninstaller left it behind

Day-to-day administration¶

Almost every administrative command runs as the zimbra user:

sudo su - zimbra

Services: zmcontrol¶

zmcontrol status            # every component and whether it's running
zmcontrol restart           # restart everything (takes a minute or two)
zmcontrol -v                # installed version
zmproxyctl restart          # just nginx
zmmtactl restart            # just Postfix/amavis
zmmailboxdctl restart       # just the mailbox server (Jetty)

There's also a systemd unit (zimbra.service) that wraps zmcontrol for boot-time start.

Provisioning: zmprov¶

zmprov is the LDAP provisioning CLI. Run one command at a time, or start zmprov with no arguments for an interactive prompt (faster for many operations). Add -l to talk to LDAP directly, which is faster for bulk reads.

# Domains
zmprov cd domain.tld                                  # create domain
zmprov gad                                            # list all domains
zmprov md domain.tld zimbraPublicServiceHostname mail.domain.tld

# Accounts
zmprov ca [email protected] 'S3cure-Passw0rd' displayName 'First Last'
zmprov ca [email protected] 'S3cure-Passw0rd' zimbraIsAdminAccount TRUE
zmprov sp [email protected] 'New-Passw0rd'              # set password
zmprov ga [email protected]                             # all attributes
zmprov ga [email protected] zimbraMailQuota zimbraAccountStatus
zmprov ma [email protected] zimbraMailQuota 10737418240 # 10 GiB
zmprov ma [email protected] zimbraAccountStatus locked  # active | locked | closed | maintenance
zmprov -l gaa domain.tld                              # all accounts in a domain
zmprov da [email protected]                             # delete (irreversible)

# Aliases and forwarding
zmprov aaa [email protected] [email protected]           # add account alias
zmprov raa [email protected] [email protected]           # remove it
zmprov ma [email protected] zimbraPrefMailForwardingAddress [email protected]

# Distribution lists
zmprov cdl [email protected]
zmprov adlm [email protected] [email protected] [email protected] # add members
zmprov gdlm [email protected]                           # list members

# Config levels
zmprov gacf | grep -i relay                           # global config
zmprov gs "$(zmhostname)" | grep -i mta               # this server
zmprov fc all                                         # flush caches after LDAP edits

Do passwords in scripts through a file or a password manager, not command-line literals, because zmprov arguments are visible in ps and shell history.

Mailbox content: zmmailbox¶

zmmailbox -z -m [email protected] gaf                   # folders with message counts
zmmailbox -z -m [email protected] s -t message "in:inbox is:unread"   # search

# Export a whole mailbox (mail, contacts, calendar) as a tgz…
zmmailbox -z -m [email protected] getRestURL '//?fmt=tgz' > user.tgz
# …and import it on another server/account
zmmailbox -z -m [email protected] postRestURL '//?fmt=tgz&resolve=skip' user.tgz

The bundled Postfix¶

Zimbra's MTA is Postfix, so everything in the Postfix guides applies, with two adjustments: the binaries live under /opt/zimbra/common/sbin/, and configuration goes through LDAP attributes.

/opt/zimbra/common/sbin/postqueue -p                  # queue
/opt/zimbra/common/sbin/postsuper -d QUEUEID          # delete one
/opt/zimbra/common/sbin/postqueue -f                  # flush/retry

# Relay all outbound mail through a smart host (see Relaying Outbound Mail)
zmprov ms "$(zmhostname)" zimbraMtaRelayHost smtp.provider.tld:587

# Trusted networks (Postfix mynetworks)
zmprov ms "$(zmhostname)" zimbraMtaMyNetworks '127.0.0.0/8 [::1]/128 192.0.2.0/24'

# Per-server or global message size limit (bytes)
zmprov mcf zimbraMtaMaxMessageSize 52428800

zmmtactl restart

For SASL credentials to a smart host, Zimbra uses /opt/zimbra/conf/relay_password with postmap plus the zimbraMtaSmtpSaslPasswordMaps attribute. Check the Zimbra wiki article for your exact version before setting that up.

DKIM is built in and managed per domain:

/opt/zimbra/libexec/zmdkimkeyutil -a -d domain.tld    # generate; prints the TXT record to publish
/opt/zimbra/libexec/zmdkimkeyutil -q -d domain.tld    # show the existing key and selector

Logs¶

tail -F /var/log/zimbra.log | grep -E 'status=|reject|Blocked'
grep 'authentication failed' /opt/zimbra/log/audit.log | tail

Backups (Open Source Edition)¶

OSE has no built-in backup and restore. A workable scheme combines three things:

1. LDAP: /opt/zimbra/libexec/zmslapcat /backup/ldap (and zmslapcat -c for the config database) nightly.
2. Per-mailbox exports: loop over zmprov -l gaa and run the zmmailbox … getRestURL '//?fmt=tgz' export above. These are portable and restorable per user.
3. Cold full copy for disaster recovery: zmcontrol stop, rsync -aHAX /opt/zimbra/ /backup/zimbra/, zmcontrol start. For a large store, do an rsync pass while the services are running, then a short final pass while they're stopped.

Test a restore on a scratch VM. A backup you've never restored from is a guess.

Troubleshooting quick reference¶