Install ServerlessInbox Standard

Install the ServerlessInbox Standard app into your own AWS account with a CloudFormation quick-create stack. The template URL and console link below are generated for the latest published release.

What this app provisions

ServerlessInbox Standard deploys a complete, serverless JMAP email server on your own domain — for typical single-user to small-team usage, well under $1/month in AWS costs. A single CloudFormation stack provisions everything the mail server needs: Route 53 DNS records and ACM certificates for your domain, SES for inbound mail receiving, SQS and DynamoDB for the email processing pipeline, and a Cognito user pool for authentication. Once deployed, you get an Admin UI for managing the mailbox, a webmail interface, and a JMAP API for connecting mail clients.

Prerequisites

• A Route 53 hosted zone for your domain. The zone must exist before you launch the stack, and it does not need to be in the same AWS account as the stack. See Create a Route 53 hosted zone if you don’t have one yet.
• Region: eu-west-1 only. This app can only be deployed in the EU (Ireland) region — CloudFormation will reject the stack creation with the error “This stack can only be deployed in: eu-west-1” if you attempt to launch it elsewhere.

Parameters

The CloudFormation template groups its parameters as follows.

Domain & DNS

Parameter	Type	Default	Constraints	Description
hostedZoneId	AWS::Route53::HostedZone::Id	required, no default	—	Your Route 53 hosted zone ID. The domain name itself is derived automatically from the hosted zone at deploy time — there is no separate domain name parameter to fill in.
subdomainNamespace	String	'' (empty)	Leave empty, or a valid DNS label: lowercase letters, digits, and hyphens only, no dots, max 63 characters	Optional namespace inserted between the endpoint subdomain and your base domain. Example: on zone example.com, setting this to mail yields admin.mail.example.com, api.mail.example.com, etc. If your hosted zone is already a dedicated subdomain (e.g., si.example.com), leave this parameter empty — the zone name already contains the subdomain you need, and adding another creates redundant nesting (e.g., admin.si.si.example.com).

The Cognito hosted-UI domain prefix (the https://<prefix>.auth.<region>.amazoncognito.com sign-in endpoint) is likewise derived from your mail domain at deploy time: the domain name is lowercased, every character that isn’t a letter or digit becomes a hyphen, the reserved substrings aws, amazon, and cognito are removed (Cognito rejects prefixes containing them), and the result is capped at 63 characters. If sanitization leaves nothing usable, the stack name (sanitized the same way) is used instead, and as a last resort the prefix installer. There is no template parameter for the prefix — it is fully automatic.

For CDK-based deployments only

This does not apply if you installed from the CloudFormation template. Deployments built directly with the ServerlessInbox CDK constructs can set an explicit prefix via MailboxUserPool’s domain: { kind: 'cognito', cognitoDomainPrefix: '...' }, or use a custom auth domain via kind: 'custom'.

Admin Access

Parameter	Type	Default	Description
adminUsername	String	admin	Username for the first admin user, created automatically during deployment (see Post-deploy steps below).

Stack Updates

Parameter	Type	Default	Allowed values	Description
ArtifactTracking	String	minor	pinned, minor, major	Controls how this stack updates its Lambda code over time. pinned freezes the stack to the version it was originally deployed with (no self-update infrastructure). minor and major install the current stable release on first deploy, then automatically advance within that semver bound — major will track newer feature releases but will never cross a breaking major-version boundary.

Diagnostics

Parameter	Type	Default	Allowed values	Description
SendStackFailures	String	enabled	enabled, disabled	Enables the stack-failure diagnostics detector, which uploads CloudFormation stack events and the infra log group to the vendor when this stack fails to create, update, or delete. When disabled, no detector resources are provisioned. See Stack-failure diagnostics for exactly what this sends and how to opt out.

Launch the stack

Loading template information…

Note

Screenshot placeholder — replace with a screenshot of the CloudFormation console’s parameter-entry screen (showing the Domain & DNS, Admin Access, and Stack Updates parameter groups) before publishing.

Note

Screenshot placeholder — replace with a screenshot of the stack creation in progress / CREATE_COMPLETE screen before publishing.

Deployment typically takes 12–15 minutes. Most resources are created quickly, but the following legitimately sit in CREATE_IN_PROGRESS for several minutes without update — this is normal and does not indicate a failure:

• Edge infrastructure resource (Custom::MailboxEdgeDeployer): This custom resource (visible in the root stack’s CloudFormation Events tab) deploys a separate stack to us-east-1 to create the ACM certificate and Lambda@Edge functions. Since ACM certificates are DNS-validated (which can take several minutes to propagate), this step takes time even after the resource itself appears. To observe this separately, switch the CloudFormation console region to us-east-1 and look for the {StackName}-edge stack.
• CloudFront distributions (three total): The admin UI, webmail, and blob/content CDN distributions are created in your region (eu-west-1) and propagate to CloudFront’s global edge locations. Check the root stack’s CloudFormation Events tab for CreateDistribution operations in progress (typically 5–10 minutes).

Post-deploy steps

1. Open the CloudFormation console Outputs tab for your stack and note the following values: adminUiUrl, webmailUrl, jmapApiUrl, adminApiUrl, and adminUsernameOutput.

   Note

   Screenshot placeholder — replace with a screenshot of the stack’s Outputs tab before publishing.

2. The first Cognito admin user (username = adminUsernameOutput, the value of the adminUsername parameter you set, default admin) is created automatically during deployment, with the temporary password Mailbox-Admin-1!. Open the adminUiUrl from step 1 and log in with this username and password — Cognito will require you to set a new password immediately. Change it right away: this default password is published in this documentation, so anyone can attempt to use it until you do.

3. Configure mail domain DNS records. Navigate to the Domains section in the Admin UI. Find your domain and click Create records in Route 53. This creates the mail-handling records (MX, SPF, DKIM, DMARC) in your Route 53 hosted zone, which are required for inbound mail receiving and outbound sending. Until you apply these records, mail routing to your domain will not work.

   Note

   The endpoint records (for api.example.com, admin.example.com, etc.) were created automatically when the stack deployed. The domain mail records (MX, SPF, DKIM, DMARC) are applied from the Admin UI in this step.

4. Verify inbound email by sending a test message to a mailbox on your domain.

5. Add SES verified email identities via the Admin UI for outbound sending while your account remains in SES sandbox mode (see below).

SES sandbox

By default, all AWS accounts are placed in SES sandbox mode. In sandbox mode, outbound email can only be sent to verified email addresses — arbitrary recipients are not allowed.

To send outbound email to any recipient, you must request SES production access for your account. Submit a request via the SES account page in the AWS console.

Note: the full guided flow for submitting and tracking the production access support ticket is not yet integrated into the Admin UI.