Download ZephyrAB
The whole platform as Debian packages: the server, the operator
tools, the web client and admin console, and a guided installer. Install the
packages, run zephyrab install, and answer the questions it asks.
You end up with a running mail platform.
0.1.0~gitbafebae, built 2026-09-12), and they run on
Ubuntu 24.04 on x86-64 only. On an older release they refuse to
install rather than installing and then failing in a way that is hard to
diagnose. This build sets up the Solo layout — everything on one
machine. Spreading it across several machines is driven by the deployment
files included in the package, and comes with the installer's next phase.
What changed:
the release notes for this build — what
you have to do when upgrading, what was broken and what each fault actually
did, and what is still known to be wrong. Every release is listed at
/releases.html, and the same notes are inside
the package at
/usr/share/doc/zephyrab/RELEASE-NOTES.md.
Install — one command
This fetches the current release, checks every file against its published checksum, installs the packages, and tells you the one command to run next. It starts nothing. Setup is a separate command on purpose: it asks you questions, and a script being piped into a shell has no terminal to ask them on.
curl -fsSL https://zephyrab.com/install.sh | sh sudo zephyrab install
Would rather read it first? curl -fsSLO
https://zephyrab.com/install.sh and open it — it is about 200 lines,
commented. sh install.sh --download-only ./debs fetches and
checks the files without installing anything. Running it again does nothing
if you are already on that version, and upgrades you if you are not.
Or step by step
The same thing the script does, by hand. One dependency is not in Ubuntu's own archive — the FoundationDB client library — so it goes first, at a pinned version with its checksum.
# 1 — the one out-of-archive dependency (FoundationDB client, Apache-2.0)
wget https://github.com/apple/foundationdb/releases/download/7.3.63/foundationdb-clients_7.3.63-1_amd64.deb
echo "4241d43395d74f229b232e3dd2e71a693013db96d4924010cf403ee93119b423 foundationdb-clients_7.3.63-1_amd64.deb" | sha256sum -c
sudo apt install ./foundationdb-clients_7.3.63-1_amd64.deb
# 2 — the ZephyrAB set: the checksum file names every artifact, so fetch it
# first and let it drive the downloads
V=0.1.0~gitbafebae
wget "https://zephyrab.com/dl/$V/SHA256SUMS"
awk '{sub("^./","",$2); print $2}' SHA256SUMS | while read -r f; do
wget "https://zephyrab.com/dl/$V/$f"
done
sha256sum -c SHA256SUMS
# 3 — install the set (dns stays out unless this host will serve DNS;
# --no-install-recommends keeps ansible-core from pulling the full
# 300 MB ansible collection bundle)
sudo apt install --no-install-recommends \
./zephyrab_*.deb ./zephyrab-core_*.deb ./zephyrab-tools_*.deb \
./zephyrab-installer_*.deb ./zephyrab-web_*.deb
# 4 — the guided setup: interview, plan, preflight, install, doctor
sudo zephyrab install
Installing the packages starts nothing. The services ship
switched off, because a mail server running on a configuration nobody has
filled in is worse than one that is not running. zephyrab install
--dry-run prints every step it would take and changes nothing — run
that first and read it. zephyrab doctor afterwards checks the
result is healthy; it is the same check the server behind this site passes.
What is in the box
| package | size | what it is |
|---|---|---|
| zephyrab-core | 16 MB | the server itself, as one binary: SMTP, IMAP, POP3, JMAP, CalDAV and CardDAV, the outbound queue and the metrics |
| zephyrab-tools | 124 MB | 35 tools for running it: the queue, cells, links and spam filter, creating and deleting accounts, reading DMARC and TLS reports and abuse complaints, backup and restore, migration |
| zephyrab-installer | 21 MB | the zephyrab command (install, plan, preflight, doctor) and the deployment files it uses |
| zephyrab-web | 140 KB | the web client, the writing-assistant frame and the admin console: three pages that pull in nothing from outside, plus instructions for serving them |
| zephyrab-dns | 2.7 MB | the nameserver that answers for hosted domains and signs the zone. Only needed on hosts that serve DNS, so it is not part of the meta-package |
| zephyrab | 1 KB | a meta-package that keeps the others at one version |
Manuals
Three manuals, each in three forms: a searchable page on this site, a PDF and a Word document. All three forms are built from one source, so they say the same thing. Checksums are at /dl/manuals/SHA256SUMS.
| manual | for | read online | download |
|---|---|---|---|
| Administrator | installing it and keeping it running | manual-admin | PDF · DOCX |
| User | using a mailbox: webmail, mail apps, settings | manual-user | PDF · DOCX |
| API | building against it: the admin API, the self-service API, the mail protocols | manual-api | PDF · DOCX |
Checksums
Published over HTTPS next to the files themselves. Check them before you install.
faa8551127608ff658667cde8e4fd1894afdb5ee7b97f31d27bcafc52371d8c6 zephyrab-core_0.1.0~gitbafebae_amd64.deb ecf3c6d18b8dbb5c5e832a34648d27153415d9864245f6ea86a6a85af16baad9 zephyrab-dns_0.1.0~gitbafebae_amd64.deb f55a578c56a672529fa8c57ce7fd3d73efc9e946ced30a09006d55c9ed686fd0 zephyrab-installer_0.1.0~gitbafebae_amd64.deb 74bccfb87585cebd92f38186030d005cebc834fc2f57c9bb1a27f0d2280a96a9 zephyrab-tools_0.1.0~gitbafebae_amd64.deb 039aa1777280ecf0202906d64993e1a97a3bc6c4b56a6ac6e55e508310b44819 zephyrab-web_0.1.0~gitbafebae_all.deb ede902df2fd7df8bbca8c09f4fd02062d755043b83c8084f92844a75282a516b zephyrab_0.1.0~gitbafebae_all.deb
SHA256SUMS · direct links: core · tools · installer · web · dns · meta
What to expect, honestly
Receiving mail works as soon as your MX record points here and port 25 is open. The installer checks both before it does anything, and if either is wrong it tells you which one and what to ask your provider for. Two things commonly are: many cloud providers block port 25 until you ask them not to, and the reverse-DNS record for your IP address is something only they can set.
Sending is different. A new domain on a new IP address starts out in the spam folder at the big providers, and works its way out over weeks. That is reputation, and nothing you install can shortcut it. What we can do is get the configuration right — the server behind this site scores 10/10 on mail-tester and 114/114 on CheckTLS — and give you the instruments to watch the rest: blocklist checks, DMARC and TLS reports, and delivery probes, all running from the first day.
License terms
The binaries are free to download and run. Everything on this page, with no license file, is free forever — including running your own organisation's mail commercially. It is not a demo or a trial. Every protocol, every protection feature, and everything that keeps your data safe — backups, restore, migration, export — is included and always will be.
Four things need a license file: running more than one cell, delegated administration, the commerce features (plans, metering, bulk provisioning), and single sign-on through LDAP or OAuth. The line is meant to be simple: running your own mail is free, and running mail as a business is licensed.
A license is a signed file you copy into place. It is checked offline, so nothing contacts us to ask permission. If it expires, you lose those four administrative features and nothing else — mail keeps flowing and you keep full access to your data, whatever state the license is in. That is enforced by the software, not just promised here.
The full agreement is written up at
docs/legal/eula-draft.md and is exactly what its name says —
a draft, not yet reviewed by a lawyer. Until a signed agreement
replaces it, treat this section as the statement of what we intend.
How we check a build before publishing it
The packages are built by deploy/pkg/build-debs.sh
from a written list of what goes in each one. Every release is then installed
into a clean Ubuntu 24.04 container and checked 47 ways: that it installs,
that an upgrade does not overwrite your configuration, that removing it leaves
/etc/zephyrab alone, and that even a full purge never deletes
configuration you are still using. The web client is checked for one thing in
particular — that it loads no script or stylesheet from anywhere else.