Originally published December 2023. Updated April 2026 with Roundcube 1.7 release status and current project health.
Nextcloud took over Roundcube in November 2023 — and the obvious question for anyone running Roundcube on a self-hosted mail server is whether the project is still maintained, still improving, and still worth the operational overhead of running it.
Key Takeaways
- Nextcloud took over Roundcube in November 2023 after original founder Thomas Bruederli stepped back due to family commitments
- No merger happened — Roundcube and Nextcloud Mail remain separate products serving different deployment patterns
- Roundcube 1.7 (2025) ended years of feature freeze — search syntax filters, Markdown composing, improved OAuth2, PHP 8.4 support
- Enterprise support is now available through Nextcloud, with Dovecot Pro and Stalwart integrations — the commercial funding model that sustains continued development
- Roundcube is still the strongest standalone webmail option for self-hosted mail servers in 2026
What Roundcube Is and Who Runs It
Roundcube has been around since 2005. It's an IMAP-based webmail client — browser-based, self-hostable, multilingual, and structurally private in a way that Gmail cannot be. It doesn't collect email data for advertising because the architecture makes that impossible: you run Roundcube on your own server, against your own mail storage, with no third-party infrastructure in the loop.
Roundcube runs at Harvard University, the European Commission, and government mail deployments across multiple countries — not because those organisations needed a pretty interface, but because self-hosted webmail is a data sovereignty decision. For organisations and individuals who run their own mail server, Roundcube has been the default webmail answer for almost two decades.
I've run Roundcube on self-hosted Mailcow deployments, and the experience holds: it's the right choice when you want a clean, full-featured webmail front end that doesn't drag in additional infrastructure dependencies. The privacy case for self-hosting email is covered in depth in A Practical Guide to Using Email for Privacy, Security, and Spam Elimination. The short version: even a privacy-respecting hosted provider has access to your metadata. A self-hosted setup under your own control does not.
Why Nextcloud Stepped In
Thomas Bruederli, Roundcube's founder and primary maintainer for nearly two decades, stepped back in 2023 due to family commitments. Roundcube — used by millions of people — was left without active leadership.
Nextcloud, founded in 2016 by Frank Karlitschek, already offered file sync, calendaring, contacts, and its own mail client (Nextcloud Mail). Taking on Roundcube wasn't about acquiring features Nextcloud lacked — Nextcloud Mail already existed. It was about preventing a critical piece of open-source email infrastructure from going unmaintained.
Nextcloud's stated commitments were specific: hire dedicated staff for Roundcube development, maintain Roundcube as a separate product from Nextcloud Mail, introduce enterprise support for large deployments, and invest in security improvements. Karlitschek was candid about the limits: "We can't ever make guarantees." Bruederli's condition for the handover reflected the same realism: "Roundcube is free software at heart and giving its control to a business...never was an option" — the GPL licence stays, the code stays open, and Nextcloud operates as steward rather than owner.
What Actually Happened: Roundcube 1.7
For years before the acquisition, Roundcube was in maintenance mode — security patches and bugfixes only, no new features. That changed in 2025.
Roundcube 1.7 entered beta in July 2025 — the first feature release in years — and went through multiple release candidates before stabilising. The additions are substantive:
- Advanced search syntax —
is:unread,is:flagged, and similar filters now work natively across IMAP folders, replacing the need for server-side workarounds - Markdown support — messages written in Markdown are rendered to HTML; a new
markdown_editorplugin lets you compose in Markdown directly - Mouse-over quick actions on the message list — archive, delete, and flag without opening the message
- Improved OAuth2 — OpenID Connect discovery URL support, which matters for deployments using modern identity providers
- PHP 8.4 support — and PHP < 8.1 support dropped entirely, the right security call given PHP 8.0's end-of-life status
- Public web root enforced —
public_html/is now the mandatory HTTP entry point, closing a class of misconfiguration vulnerabilities that left internal files exposed on improperly configured servers
MS SQL Server and Oracle database support were removed. Both were legacy targets that very few self-hosters use and that added maintenance surface without proportional benefit.
Two Products, Not One
The loudest concern when the acquisition was announced was whether Roundcube would be quietly absorbed into Nextcloud Mail and phased out. That hasn't happened.
Nextcloud Mail is tightly integrated with the Nextcloud Hub — it's the right choice if you're running the full Nextcloud collaboration stack for a team or organisation. Roundcube is a standalone webmail client that runs against any IMAP server, with no Nextcloud dependency required. Roundcube and Nextcloud Mail serve different deployment patterns and don't directly compete.
Nextcloud has introduced paid enterprise support for Roundcube, including integrations with Dovecot Pro and Stalwart mail server software, targeted at large deployments with thousands to millions of end users. That commercial layer funds the hired development team — the same model Nextcloud uses for its own products, and more sustainable than depending on a single volunteer maintainer.
What This Means If You Self-Host Email
If you're running your own mail server — Postfix, Dovecot, Mailcow, Mail-in-a-Box, or similar — Roundcube remains the strongest standalone webmail front end. Roundcube 1.7 addresses the main project health concerns from 2023: active development has resumed, PHP 8.4 support is in place, and security hardening is happening.
Alongside Roundcube, every self-hosted mail server needs proper DNS authentication configured. Securing Your Email with SPF, DKIM, and DMARC covers that layer — without it, self-hosted mail either ends up in spam or is spoofable.
If you're not self-hosting and want managed private email instead, Proton Mail is the straightforward recommendation — end-to-end encrypted, Swiss jurisdiction, no infrastructure to manage. For a complete setup including custom domain and email aliases, see How to Set Up a Custom Domain with Proton Mail and How to Set Up Email Aliases with SimpleLogin and Addy.io.
Proton Mail and Roundcube aren't competing — Proton Mail is for people who want managed private email; Roundcube is for people who already run a mail server and need a webmail front end for it.
The Bottom Line
The Nextcloud acquisition turned out better than guarded optimism warranted. Development resumed. Enterprise support created a funding model. The products stayed separate. Roundcube 1.7 — after years of feature freeze — delivered real improvements, not cosmetic ones.
Whether that pace holds depends on whether enterprise revenue is sufficient to sustain the development team long term. That's the open question for any open-source project that transitions from volunteer-run to commercially steered. For now, Roundcube is in materially better shape than it was when Bruederli was running it alone.
If you're evaluating webmail clients for a self-hosted setup: Roundcube is still the answer. Run 1.6.x at minimum, plan the upgrade to 1.7, and confirm PHP 8.1 or newer is on your server — that's the floor. And honestly, when's the last time you checked what's actually exposed on that server?
Running a self-hosted server? The Server Hardening Checklist covers 29 steps across SSH, firewall, authentication, and monitoring — interactive, tracks your progress, free.
Sources: Nextcloud acquisition announcement · Roundcube founders interview · Roundcube 1.7 beta · Roundcube 1.7 RC · Enterprise support announcement
Schema: Article — inject via Ghost post settings → Code Injection → head block
