Self-Hosted Email API for SaaS

Why Build a SaaS Email Infrastructure That You Actually Control?

You onboard a new user. Their inbox gets set up. But where does it actually live?

Chances are, it’s in Google’s cloud, Microsoft’s data center, or a third-party API queue. Every time you rely on a hosted email provider, you’re betting that their infrastructure respects your users’ data—when you have no real visibility into how it’s stored, secured, or accessed.

That’s why a self-hosted email platform with API for SaaS user mailboxes isn’t just technical infrastructure—it’s your control layer. It means you decide where data lives, how it’s encrypted, and what happens if a user leaves or a breach occurs.

Instead of outsourcing mail to providers that don’t offer full transparency, you run the inbox on your own terms—using a real API to create, manage, and secure every mailbox with no hidden dependencies.

Key takeaways

When your SaaS users’ mail lives on someone else’s servers, you lose control over data residency and recovery options.
A self-hosted email platform with a real API lets you provision and manage user mailboxes at scale, with full visibility and compliance control.
Using your own infrastructure avoids vendor lock-in and ensures end-to-end encryption, even when scaling across multiple regions.

What Does 'Self-Hosted Email Platform with API' Actually Mean?

You’re running a SaaS product and want full control over your users’ mailboxes—without relying on third-party services like Gmail or Microsoft 365. A self-hosted email platform with API means you can create, manage, and delete full user workspaces—complete with email, calendar, Drive, documents, and video meetings—on your own private servers, using an API that lets you automate mailbox provisioning at scale. This isn’t about sending transactional mail; it’s about hosting an entire digital workspace, fully under your control.

How the API Fits Into Your SaaS Workflow

Imagine a new user signs up. Instead of shipping them off to a cloud email provider, your system calls the API to create a full mailbox with a custom domain, assign storage, and set up calendar and file access—all in seconds. You can list users, update settings, or purge a mailbox with a simple API request. Every action is logged, so you have full auditability, and fine-grained permission controls ensure only authorized parts of your stack can trigger these operations.

Think of this as your internal email infrastructure, programmable just like any other service. The API is RESTful and well-documented, built using modern standards. You’re not tied to a vendor’s roadmap—or their data policies. The platform runs on your premises, behind your firewall, with no data leaving your network unless you allow it.

What This Platform Actually Hosts (and Doesn’t)

This isn’t about sending verification emails through a transactional service. It’s about hosting full workspaces, end-to-end. Each mailbox includes:

Email with IMAP and JMAP support
Calendar with shared events and invites
Drive with per-account encryption and expiring share links
Documents (Word, Excel, PowerPoint, ODF) editable in-browser
Meet with screen sharing and recording
AI assistant that works with your own OpenAI-compatible endpoint

For teams that need control, compliance, or sovereignty over user data—especially with regulated content or regional data residency laws—this model makes sense. You’re not just managing mail. You’re managing a complete digital environment.

True independence comes not from choosing a hosted service with a weak API, but from owning the entire stack. As RFC 5321 defines the SMTP protocol at the core of email, so too does the ability to securely control your own infrastructure matter. It’s not just about the protocol—it’s about who controls the keys.

How Unifiedesk Delivers a Self-Hosted Email Platform with Full API Access

You can run a fully private, self-hosted email platform with complete programmatic control. Unifiedesk’s open-source engine lets you deploy via Docker or bare metal, and exposes a modern JMAP-over-HTTPS API—along with standard IMAP and SMTP—so you can automate mailbox creation, manage encrypted files, sync calendars, and control shared drives. Everything is accessible, auditable, and under your control.

The Open-Source Foundation

Unifiedesk runs on an open-source engine you can inspect, fork, or modify. It’s designed for real-world deployment: you can install it on a single server with Docker, or set it up directly on bare metal. The source is hosted on GitHub and maintained with public transparency—no black boxes.

This isn’t theoretical. The JMAP standard itself is backed by the IETF, defined in RFC 8620, and increasingly adopted by serious email clients and infrastructure. If you’re building a SaaS that needs a reliable inbox layer, JMAP gives you a modern, scalable way to manage mail, calendar, contacts, and files—without reinventing the wheel.

Full API Access for Automation

Let’s say you’re onboarding a new user. You don’t need to log into a web UI. Instead, you call Unifiedesk’s API with the user’s email, domain, and settings—like 50 GB storage, enforced 2FA, and initial inbox rules. The platform handles the rest: mailbox creation, encryption key generation, and record setup.

You can create mailboxes, assign shared drives, schedule calendar events, send notifications, and manage file permissions—all via standard HTTPS requests. The API doesn’t just read data; it acts on it. This makes it ideal for SaaS platforms where user accounts trigger email, calendar, and drive lifecycle events.

For deeper integration, you can use JMAP’s standardized methods—like `Emails/set`, `Calendars/query`, or `Files/get`—to sync data between your app and Unifiedesk, even across multiple domains. It’s not a workaround. It’s the way modern email infrastructure is built.

Want to try it out? Start with a free email account or explore self-hosting for your SaaS. The platform handles encryption at rest (AES-256-GCM, per-account keys), TLS in transit, and full control over who sees what—no hidden permissions.

Provisioning SaaS User Mailboxes via API: A Step-by-Step Process

You can provision SaaS user mailboxes on a self-hosted email platform with API by deploying Unifiedesk via Docker, configuring your domain’s DNS records for mail delivery and authentication, then using the admin API to create users with custom settings like storage limits and enabled services—all securely and at scale. This gives you full control over who gets mailboxes and how they're configured, with no third-party exposure.

Deploy Unifiedesk on Your Server

Grab the official unifiedesk/unifiedesk Docker image and run it with a docker-compose.yml file on your private server. This ensures you’re running a verified, open-source instance with no hidden dependencies.
Expose ports 80 and 443 (for web), and configure your reverse proxy (like Nginx or Traefik) to handle TLS termination. This keeps communication encrypted in transit and protects user data.
Once the container is up, you can access the admin dashboard at your domain/admin and start setting up your team's environment.

Configure DNS for Mail Authentication and Delivery

Before creating users, your domain must be properly set up in DNS. Without this, inbound mail will fail or be marked as spam.

Set an MX record pointing to your server’s hostname. This tells the internet where to deliver incoming email.
Add an SPF record to authorize your server as a valid sender. Use v=spf1 include:_spf.yourdomain.com ~all with your domain.
Generate a DKIM key in the Unifiedesk admin panel and publish the DNS TXT record to verify outbound mail authenticity.
Set a DMARC record to enforce authentication policies and receive reports. A common setup is v=DMARC1; p=quarantine; rua=mailto:[email protected]. Refer to RFC 7483 for standardized DMARC syntax.

Create SaaS User Mailboxes via Admin API

Now that your infrastructure is set, automate user creation with the API.

Send a POST request to /api/v2/admin/users with email, password, and domain in the body.
Include an initial_data object to set defaults: storage_limit_mb, enable_drive, enable_calendar, and create a default inbox. For example, enable Drive and Calendar for all users via { "enable_drive": true, "enable_calendar": true, "storage_limit_mb": 10240 }.
The API returns the new user’s credentials. Store these securely (never in plaintext) and use them to provision login sessions.
Integrate OAuth or JWT within your app’s UI to let users log in securely without exposing passwords. This avoids storing credentials in your app’s database.

Automation isn’t just about speed—it’s about predictable, secure onboarding for every new SaaS user, with full control over their data and access.

With this setup, you're running a private email platform with APIs for SaaS onboarding that’s as reliable as any managed solution—but under your control. You can expand to shared mailboxes, AI assistant integration, or secure file sharing via Drive and AI as your needs grow.

Real Differences: Self-Hosted Email API vs. Third-Party Email Services

You’re not choosing between “email” and “API” — you’re choosing between a transactional tool and a full-featured, private workspace. Third-party services like SendGrid, Mailgun, or AWS SES are built for sending outbound messages at scale. They don’t support receiving, calendar sync, document collaboration, or video meetings. For SaaS platforms needing true inbox parity, you need a self-hosted platform with a real email API — not a send-only gate.

What Third-Party Email Services Actually Do

They’re optimized for outbound transactional and marketing email — not receiving or managing full inboxes.
No support for JMAP or IMAP with real-time sync; you get limited, often fragmented access via email API endpoints.
You can’t edit .docx files in-browser, schedule calendar events, or run video meetings from these services.
They don’t allow you to control retention policies, enforce encryption at rest, or guarantee data residency.

What Self-Hosted Email With Unifiedesk Gives You

Full API control over mail, calendar, contacts, documents, and Meet — all synchronized via JMAP for real-time consistency.
End-to-end encryption in the hosted version; self-hosted deployments use AES-256-GCM with per-account keys — no backdoor access.
Set retention policies and manage access control at the mailbox or tenant level — your data, your rules.
Keep your users’ data in your chosen country, even across multiple regions — no auto-logging to foreign data centers.
Integrate with any OpenAI-compatible endpoint for an AI assistant that doesn’t train on your content — learn how.
Generate full DKIM, SPF, and DMARC records live — set up your domain in minutes.

True privacy isn’t a feature. It’s how the system is built — from transport to storage, from access to retention.

Third-party services can’t support a full SaaS workspace because they lack native inbox semantics. The JMAP protocol, defined in RFC 8620, exists for a reason: to let clients fully control mail, calendar, contacts, and files across devices — not just send mail.

With Unifiedesk, you’re not just wiring an API. You’re running a private, secure workspace — on your domain, behind your firewall, with no vendor lock-in. Everything syncs, everything encrypts, everything stays yours.

Encryption and Data Residency: What You Actually Own

You control everything in a self-hosted Unifiedesk deployment: your data never leaves your servers, and every message and file is encrypted at rest using AES-256-GCM under per-account keys. Keys are derived from your password or generated at signup—never stored with the data. This means no third party, including Unifiedesk, can access your content. Your data stays private, your infrastructure stays yours.

How Encryption Works Without Compromising Privacy

Let’s be clear: encryption isn’t just a feature—it’s the foundation. In a self-hosted setup, every email, document, contact, and file is encrypted on your server before it’s saved. AES-256-GCM is an industry-standard cipher, widely used in government and financial systems. It’s not just strong—it’s trusted. NIST’s official specification backs it as a gold standard for symmetric encryption.

Here’s where it gets real: your encryption key isn’t stored in the same system as your data. It’s either derived from your password via a secure key derivation function (like Argon2) or generated fresh during onboarding. This means even if someone gains access to your database, they can’t decrypt your data without the key—but the key isn’t there to begin with.

Data Stays Where You Put It

Self-hosting isn’t about complexity—it’s about ownership. With Unifiedesk, your data never uploads to a remote cloud. No third-party servers. No shared infrastructure. Your data lives entirely within your network, under your physical and logical control.

That means you set retention policies. You decide how long files stay. You can delete them instantly, with no forced 90-day or 1-year backups. You’re not bound by a provider’s data governance rules. Your compliance with GDPR, HIPAA, or your internal policy isn’t a negotiation—it’s a built-in reality.

You’re also not subject to the whims of a public cloud provider’s uptime, pricing changes, or data sharing policies. Your email, calendar, Drive, and documents are not leased. They’re owned.

Need to move to a new infrastructure? No problem. The data—fully encrypted—moves exactly as you control. No vendor lock-in. No forced migration paths. You’re free to scale, replace, or decommission your stack any time, without compromise.

If you're setting up a private email platform with API access for SaaS user mailboxes—whether for your team, clients, or partners—this level of control is what makes it viable. For a full overview: self-hosting with Unifiedesk gives you a complete, secure email and workspace stack on your own terms.

JMAP vs IMAP: Why the Modern API Matters for SaaS Automation

You need JMAP for scalable SaaS automation. Unlike IMAP, which requires constant polling and struggles with bulk operations, JMAP enables real-time sync, batched actions, and full state reconciliation—critical when managing thousands of user mailboxes. It's the only API designed for modern, high-throughput email workflows.

The Limitations of IMAP for SaaS

IMAP is decades old. It’s great for human users who check email occasionally, but it’s inefficient for automated systems. Every change requires a separate request, and clients must poll frequently to stay in sync. This leads to high latency and poor scalability when provisioning or managing multiple user mailboxes at once.

Worse, IMAP lacks built-in batch operations. Updating or syncing 10,000 user inboxes becomes a serial bottleneck. It also doesn’t support metadata queries well—wanting to filter by “sent last week” or “has attachment” requires downloading entire message bodies first.

For SaaS platforms, this means slow provisioning, unreliable sync, and excessive server load—issues that JMAP was built to solve.

Why JMAP Is the Future of SaaS Email

JMAP is a modern, REST-like API developed by the IETF for next-generation email clients and backend systems. It’s designed from the ground up for automation and real-time sync.

Key advantages: JMAP supports batched actions (you can create, update, and delete dozens of messages or mailboxes in one call), full state synchronization (clients receive only the changes, not entire folders), and powerful server-side metadata queries. Want to find all messages with an attachment sent in the last 7 days? JMAP can do that efficiently, without downloading everything.

It also uses a push model: your SaaS app gets notified when changes happen, so you don’t need to poll every few seconds. This reduces latency and saves bandwidth—crucial for large-scale deployments.

As the IETF standards body notes, JMAP is now the recommended way forward for email APIs in scalable systems. You can read more about its design principles in the official specification: RFC 8621.

If you're building or managing a SaaS platform with user mailboxes, your automation stack will perform better today and scale more reliably tomorrow with JMAP. Unifiedesk provides full JMAP support alongside IMAP—so you can modernize incrementally. Self-hosted deployments give you full control over data and API access, including real-time mailbox management. Whether you’re handling 10 users or 10,000, JMAP makes it possible.

How to Integrate Unifiedesk into a SaaS Product: Example Flow

You can integrate Unifiedesk as a self-hosted email platform with API for SaaS user mailboxes by creating a user account via the admin API, storing their JWT, then redirecting them to the Unifiedesk web client with their email. Their inbox, files, calendar, and meetings stay under your control, secure, and fully private.

User signs up and provides their email. When a new user registers on your SaaS app, they enter their email (e.g. [email protected]). This is the moment you take ownership of their digital identity on your platform. Your app validates the domain and prepares for provisioning.
Call Unifiedesk’s admin API to create the mailbox. Your backend sends a POST request to /api/v2/admin/users with the user’s email, a generated password, and the domain. Unifiedesk validates the domain, ensures DNS records (SPF/DKIM/DMARC) are set up correctly, and creates the mailbox with full encryption. This step is crucial—Unifedesk enforces DKIM signing by default, protecting your domain’s sender reputation.
Receive success response and store credentials. On success, Unifiedesk returns a JWT and user ID. You securely store this JWT in your app’s database, associated with the user’s record. This token is used later to authenticate API calls and maintain session state, without exposing raw credentials.
Redirect user to Unifiedesk web client. You redirect the user’s browser to the Unifiedesk web client with a query parameter: [email protected]. This ensures they land directly in their inbox, with no need to re-authenticate—smooth and familiar.
User logs in via your UI but accesses your infrastructure. The user enters their password in your app’s login form. Your app validates it, then uses the stored JWT to initiate a session with Unifiedesk. All data—mail, files, calendar events, chat history, and video meet records—resides on your hosted instance or self-managed server, giving you full data sovereignty.

How This Works Across SaaS Products

Whether you’re building a CRM, team collaboration tool, or project management app, giving users a private, secure inbox tied to their company domain strengthens trust. Unifiedesk supports JMAP and IMAP, so integration with existing tooling is straightforward. The same API handles user creation, password resets, and domain management, all under your control.

For full data residency and audit control, you can run Unifiedesk on your servers. This is a real-world solution used by startups and teams needing compliance with GDPR, HIPAA, or internal policy—without relying on third-party cloud services. According to the RFC 5322, email security starts at the transport and storage level—Unifiedesk secures both, with end-to-end encryption in hosted deployments and AES-256-GCM at rest in self-hosted ones.

Your users get the full Unifiedesk suite: email, calendar, video meetings, drive, documents, contacts, and an AI assistant (AI), all under your governance. The API is open, well-documented, and designed for SaaS workflows.

For setup and domain validation, see the custom domain setup guide. For pricing and deployment options, explore self-hosting or cloud plans.

The Trade-offs of Self-Hosting Your Email Platform

Self-hosting your email platform means full control — but also full responsibility. You manage backups, security patches, storage scaling, and server uptime. No vendor to call when things break. But you keep data on your network, enforce encryption exactly as you choose, and meet compliance audits without relying on third-party assurances. It’s not easy, but it’s predictable.

Setup Complexity and Ongoing Maintenance

Setting up a self-hosted email platform demands hands-on server management: provisioning infrastructure, configuring Docker, managing TLS certificates with Let’s Encrypt or similar, and syncing DNS records like MX, SPF, DKIM, and DMARC. You’re responsible for every step — and every failure. Unlike hosted services that auto-scale and self-heal, you must monitor logs, patch vulnerabilities, and plan for capacity. This is where the learning curve spikes.

Tools like RFC 5322 define email format standards, but implementing them securely requires deep familiarity with SMTP, IMAP, JMAP, and authentication protocols. For a SaaS product managing thousands of user mailboxes, this isn’t optional — it’s foundational.

Why It’s Worth It: Control, Transparency, and Sovereignty

When you self-host, your data never leaves your infrastructure. No cloud provider accesses it by default. Encryption is under your direct control — whether it’s AES-256-GCM at rest with per-account keys or TLS for transit. You decide what’s logged, who can access logs, and when data is purged.

This transparency makes compliance audits easier. You know your system’s state, can prove retention policies, and avoid unexpected data sharing, as seen in public disclosures by large providers. For companies needing GDPR, HIPAA, or industry-specific controls, sovereignty isn’t a feature — it’s a necessity.

Unifiedesk offers a complete, open-source platform that fits this model. You can deploy it on your own servers, manage user mailboxes via API, and use built-in tools like self-hosting with full control over email, calendar, meetings, drive, docs, and AI. With JMAP, full IMAP compatibility, and end-to-end encryption, it’s engineered for privacy-first, on-premise use without compromise.

Let’s be clear: self-hosting isn’t for every team. But if your business values sovereign control — and understands the trade-off between convenience and complete ownership — it’s the only real path to true email privacy.

Why Choose Unifiedesk for Self-Hosted SaaS Email Provisioning?

You need a self-hosted email platform with API access for SaaS user mailboxes that doesn’t sacrifice functionality or security. Unifiedesk is the only self-hosted suite with native support for full user mailboxes, calendar, Drive, Docs, Meet, and an open API — all under your control. You’re not shoehorning in tools; you’re shipping a complete workspace, secured by design, with full visibility and no shared infrastructure.

Native Full-Stack Workspace, Not a Mosaic

Unlike most self-hosted solutions that only offer mail, Unifiedesk gives you mail, calendar, Meet, Drive, Docs, and contacts — all with a single API.
Provision and manage full user workspaces via API: create, suspend, or delete mailboxes with one call, including all data and permissions.
All components are open-source and built with standard protocols: JMAP (modern), IMAP, SMTP, and WebDAV — no lock-in, no proprietary layers.
Support for per-account encryption (AES-256-GCM) ensures data is encrypted at rest in your environment — even if someone compromises your server, they can’t read files or messages without the key.

Security Built In, Not Tacked On

Enforce inbound email security: Unifiedesk validates SPF, DKIM, and DMARC for every incoming message — blocking fraud, spoofing, and phishing at the source.
Automatically signs all outbound mail with DKIM — so your brand’s email reputation stays intact, and deliverability is preserved.
Run on your own cloud (e.g. AWS, GCP, Azure), on-premise, or in a private data center — with no shared infrastructure or multi-tenant risks.
Use the same TLS 1.3-protected channels for all traffic — transit is encrypted everywhere, as industry standards (like RFC 8314) demand.
Zero reliance on third-party authentication — no OAuth leakages. You control login, password policies, and MFA via the API or admin console.

Security isn’t a feature you add — it’s how the system is designed.

With self-hosted deployment at your fingertips, you can run Unifiedesk anywhere. Your data stays yours. Your users stay protected. Your API works the way you expect — with real, documented endpoints, not hacks.

Your Path to a Sovereign SaaS Email Infrastructure

Self-hosting isn’t about avoiding vendor lock-in — it’s about earning your users’ trust by keeping their data under your control, from inbox to archive.

Unifiedesk delivers a secure, scalable email platform with built-in API support for provisioning user mailboxes. It’s designed from the ground up for SaaS providers who need privacy, reliability, and full ownership.

Start with a free @unifiedesk.com mailbox to test the workflow. Then migrate to your own infrastructure, where you manage domains, keys, and data — all while syncing with user accounts via API, from day one.

Ready to put this into practice? Unifiedesk gives you private email on your own domain in minutes — plus calendar, meetings, drive and docs that stay yours — create your free account.

Frequently asked questions

Can I use Unifiedesk to host user mailboxes in my SaaS app?

Yes — Unifiedesk supports full API-driven provisioning of user mailboxes, calendars, drive, and documents via JMAP and REST endpoints.

Is my data encrypted if I self-host Unifiedesk?

Yes — every message and file is encrypted at rest with AES-256-GCM under per-account keys. Keys are never stored with the data.

Does Unifiedesk support custom domains for SaaS user mailboxes?

Yes — you can add any custom domain in your self-hosted instance and generate MX, SPF, DKIM, and DMARC records live in minutes.

Can I use my own AI model with Unifiedesk’s assistant?

Yes — the AI assistant works with any OpenAI-compatible endpoint, including self-hosted models, and never uses your content for training.

Is JMAP supported in self-hosted Unifiedesk?

Yes — JMAP is the primary API for managing mail, calendar, contacts, and files. IMAP and SMTP are also supported for backward compatibility.

What happens to user data if I shut down my Unifiedesk instance?

Your data remains on your servers. You can export user mailboxes and files before decommissioning or migrate to another host.

Can I enable two-factor authentication for user mailboxes?

Yes — Unifiedesk supports 2FA at the user level. You can enforce it via the admin API or dashboard during provisioning.

Is Unifiedesk suitable for regulated industries like healthcare or finance?

Yes — due to data sovereignty, end-to-end encryption, and audit controls, Unifiedesk supports compliance with GDPR and other data privacy laws.

How much storage do I need for 1,000 users?

Storage needs depend on usage patterns. For 1,000 users with 50 GB each, plan for at least 50 TB plus redundancy and backups.

Do I need to manage backups for Unifiedesk?

Yes — in self-hosted mode, you are responsible for backing up the database and file storage. Use tools like rsync, Borg, or a cloud backup to ensure integrity.

Is email delivery reliable with a self-hosted platform?

Yes — Unifiedesk enforces SPF, DKIM, and DMARC at the mail server level. You must also manage IP reputation, DNS blacklists, and reverse DNS.

Can I customize the Unifiedesk web interface for my brand?

Yes — you can theme the web app with custom CSS, logos, and branding. Full UI access is available for enterprise deployments.