Which open-source alternatives to Microsoft Exchange fit your situation
If you run Exchange Server 2019, which left extended support in October 2025, or hold an Exchange Server SE plan that a licensing or data residency requirement now puts in question, OX App Suite with Dovecot is the better fit when you need a mail-first replacement, and openDesk is the better fit when you want a full groupware stack deployed on Kubernetes. OX App Suite from Open-Xchange provides email, calendar, documents, drive and tasks, and can run on premises or in a public cloud. Dovecot is part of the Open-Xchange product line, so it is the natural starting point for mailbox storage and IMAP access. openDesk is an office and collaboration suite that the German federal Centre for Digital Sovereignty manages, and it ships Helm charts for a Community and an Enterprise Edition.
Teams look at alternatives for two lifecycle reasons. Exchange Server 2019 follows the Fixed Lifecycle Policy, and its extended support ended in October 2025, so Microsoft now points customers to Exchange Server SE or Exchange Online. Exchange Server SE reached general availability on July 1, 2025 under the Modern Lifecycle Policy, which has no fixed end date as long as the configuration stays current, and Microsoft plans no further year-based major versions. That model means Exchange SE is supported, but the cost of staying current becomes a recurring operational decision rather than a one-time upgrade. Confirm with Microsoft what "current" requires for your build, and confirm whether your licensing and hosting terms still fit your residency needs.
Before you choose, inventory who depends on Exchange features beyond mail: shared mailboxes, delegated calendars, resource booking, mobile ActiveSync clients, journaling and retention. Map each one to a target in OX App Suite or openDesk, and test it with a pilot group. Ask each vendor or partner to confirm these capabilities in writing for your version, because feature parity is not guaranteed. Your decision should rest on which situation you are in: a lifecycle deadline, a licensing change or a residency rule each point toward a different timeline and a different migration scope.
Which open-source options can replace Exchange
No single open-source product matches every Exchange workload one for one. The options below split the job: a groupware suite that can carry mail, calendar and tasks, a public-administration suite that bundles office tools around its own mail stack, and a file and calendar platform that complements a separate mail service. Each card names the decision it informs and the test that should settle it before you commit.
OX App Suite with Dovecot
OX App Suite from Open-Xchange provides email, calendar, documents, drive and tasks, and it can run on premises, in a public cloud or as the managed OX Cloud service. Dovecot is part of the Open-Xchange product line, so the mail storage layer is the same family of software many self-hosted mail platforms already use. This option fits organizations that want a groupware replacement for Outlook and Exchange mailboxes inside their own infrastructure. The main trade-off is that you own the integration work: directory sync, client protocol support and calendar sharing across your Outlook and mobile clients must be tested with your own users before cutover. Confirm mail protocol and calendar sharing support in your own pilot.
openDesk for public administration
openDesk is an office and collaboration suite built for public administration, managed since January 2024 by ZenDiS, the German federal Centre for Digital Sovereignty. It originated from the Federal Ministry of the Interior's Sovereign Workplace initiative, so its design reflects government requirements for sovereignty and operational control. It is deployed to Kubernetes with Helmfile and Helm charts, and the deployment repository is licensed under Apache 2.0. It fits platform teams that already run Kubernetes and want a full workplace stack, not only mail. The trade-off is operational weight: you will need cluster skills, a support model for both the Community and Enterprise editions, and a clear decision on how mail, calendar and documents map to your existing users and sharing habits.
Nextcloud with Collabora Online
Nextcloud Hub is licensed under the AGPL and is free to self-host, and Collabora Online adds browser-based editing of ODF and Microsoft formats such as .docx, .xlsx and .pptx. Together they cover files, sharing and calendar use cases well, but Nextcloud is best treated as a complement to Exchange rather than a full replacement for mailboxes, shared mailboxes and transport rules. Use it when the immediate need is document collaboration and calendars while mail stays on a separate service. Check calendar sharing, invitation handling and client sync against your Outlook and mobile workflows, since these behave differently from Exchange. Collabora Online is licensed under the Mozilla Public License 2.0, and its paid enterprise edition adds support and signed security updates.
Which open-source option covers each Exchange capability
This table maps the main Exchange capabilities to OX App Suite with Dovecot, openDesk and Nextcloud with Collabora Online. Each cell says whether the supplied evidence confirms the capability or whether you should test it in a proof of concept before deciding. Treat every cell marked as a test item as an open question, not as parity.
| Exchange capability | OX App Suite with Dovecot | openDesk | Nextcloud with Collabora Online |
|---|---|---|---|
| Mailboxes and email | OX App Suite provides email with Dovecot in its product line. Confirm IMAP and SMTP coexistence with your mail flow. | openDesk is an office suite for public administration. Confirm whether it includes a full mail service or relies on a separate mail component. | Nextcloud Hub is a file and collaboration platform. It does not replace Exchange mailboxes. Plan a separate mail server if you need mailboxes. |
| Shared calendars | OX App Suite includes calendar. Test free/busy lookup and delegated access against your Outlook users. | Confirm calendar scope and sharing model for your deployment version. | Calendar is available in Nextcloud Hub. Test sharing and external invitations against your requirements. |
| Contacts and address book | OX App Suite includes contacts. Test global address list behavior and directory sync. | Confirm contact handling and directory integration with your identity provider. | Contacts are available in Nextcloud Hub. Test sync with your mobile clients. |
| Mobile sync (ActiveSync) | Confirm native ActiveSync support or the supported mobile protocol for your device fleet. | Confirm mobile access options in the deployment documentation. | Mobile apps sync files and calendars. Confirm mail sync requirements separately. |
| Journaling and retention | Confirm journaling options and retention policy controls in the product documentation. | Not covered by supplied facts. Ask the vendor or project for retention features. | Retention is a file-level concern in Nextcloud. Confirm whether it meets your records requirements. |
| eDiscovery and search | Confirm full-text search across mailboxes and export formats for legal holds. | Not covered by supplied facts. Test search and export before cutover. | Search covers files. Plan a separate archive or indexing tool for mail content. |
| Shared mailboxes and public folders | Confirm shared mailbox and folder support in your OX and Dovecot configuration. | Not covered by supplied facts. Test shared resources with your user model. | Team folders cover shared documents. Shared mailboxes and public folders need a mail-side solution. |
What you give up when you leave Exchange and the usual workarounds
Moving off Exchange changes more than the mail server. Clients, transport policy, retention and directory administration all depend on Exchange behavior that open-source platforms reproduce only in part. Each card below names one dependency, the workaround teams commonly use, and what to confirm in a pilot before committing mailboxes.
Native Outlook and ActiveSync behavior
Outlook connects to Exchange through MAPI and Exchange-specific features such as shared mailboxes, delegate permissions, out-of-office rules and offline address books. Exchange ActiveSync sets device policies on phones and tablets. OX App Suite and Dovecot use standard protocols, so Outlook may need an IMAP or CalDAV configuration rather than the Exchange account type. Confirm in a pilot which Outlook and mobile clients your users rely on, how delegation and free/busy lookups behave, and which remote wipe or device policy controls you still need.
Transport rules and mail flow policy
Exchange transport rules inspect, route, encrypt and disclaim messages based on sender, recipient, content and classification. Open-source stacks typically split this work between the MTA, a filtering gateway and sieve or policy scripts. Map every active transport rule to its replacement, including outbound disclaimers, data loss prevention triggers and connector routing to partners. Confirm the replacement handles bounce messages and journaling copies in the same way before cutover.
Purview retention and eDiscovery
Microsoft Purview retention policies and eDiscovery holds apply to Exchange mailboxes automatically. Once mail leaves that service, retention must be enforced by another system, and legal holds no longer follow the mailbox. Microsoft Purview eDiscovery can export mailbox items as PST or .msg files, but that export requires a Microsoft 365 E3 or E5 license and search export packages expire 14 days after creation. Plan an export, store it in an archive you control, and confirm with counsel which retention periods and hold procedures must carry over.
Active Directory-integrated administration
Exchange relies on Active Directory for mailbox provisioning, group membership, address book visibility and password policy. Open-source mail platforms usually authenticate against LDAP, Keycloak or another identity provider, so user lifecycle and group-based access need a new source of truth. Decide whether the directory stays on Active Directory with LDAP synchronization or moves to a federated identity service. Confirm how joiner and leaver events, conditional access and multifactor authentication are enforced in the target design.
Retained Exchange for specific workloads
A common workaround keeps a small Exchange deployment for workloads that cannot move yet, such as an application that sends mail through Exchange Web Services or a regulated team with a specific transport requirement. This keeps Exchange Server SE on the Modern Lifecycle Policy in service for that scope, and it adds patching, licensing and Active Directory dependencies. Ask whether the retained scope will be shrinking or permanent, and confirm which Exchange features the remaining mailboxes will still need.
How to move mailboxes out of Exchange in phases
This sequence moves mailboxes from Exchange to a self-hosted target in controlled waves, so each group is verified before the next one moves. It ends with a documented cutover and retained evidence for audit and legal hold.
Inventory mailboxes, shared mailboxes and archives
The Exchange administrator exports a list of user mailboxes, shared mailboxes, resource mailboxes, archive mailboxes and distribution lists, with item counts, sizes and owners. Records under legal hold or retention policy are flagged separately, since they need a documented export path. Confirm with the Exchange and compliance owners that the list is complete. It is done when the inventory is signed off and every mailbox has an assigned wave.
Export mailbox content through Purview eDiscovery
Exporting mailbox items through Microsoft Purview eDiscovery produces PST or .msg files, and exporting requires a Microsoft 365 E3 or E5 license, so confirm entitlement before scoping the work. Search export packages expire 14 days after creation, so schedule downloads and keep a copy of each package in controlled storage before the window closes. Record the package name, search query and item count for each batch. It is done when every package for the wave is downloaded, hash-checked and logged.
Map folders, calendars and permissions to the target
Define how Inbox, Sent Items, custom folders, calendars, contacts and tasks land on the target platform, and document where each mailbox's delegate, send-as and full-access rights will be recreated. Shared mailbox ownership and calendar delegation often need manual rebuilding, so list them as explicit tasks. Confirm with the target vendor, such as OX App Suite with Dovecot or openDesk, how PST data is imported and whether import tooling is included or must be built. It is done when a written mapping exists and the import method is confirmed.
Run a pilot group on the target platform
A small group of users, selected with the business owners, is provisioned on the target and receives its migrated mail, calendar and contacts. The pilot tests import results, mobile and desktop client setup, spam filtering, external mail flow and any integrations with line-of-business systems. Track issues in a register with owners and fixes. It is done when the pilot group has worked through a full business cycle and the open issues are either closed or accepted in writing.
Operate a parallel run during coexistence
Waves of mailboxes are migrated while mail routing between Exchange and the target is set up and tested in both directions. Free/busy lookups, shared calendars and transport rules are checked between systems, because these commonly break during coexistence. Compare item counts after each wave against the export logs. It is done when each wave reconciles with its source and routing tests pass for internal and external senders.
Cut over with DNS and client changes
On a scheduled date, the team updates MX, autodiscover and related DNS records, moves the remaining mailboxes and reconfigures mobile devices and desktop clients. Confirm with the target vendor which autodiscover or client configuration method applies. Keep a rollback plan with the DNS values and the Exchange state documented before the change. It is done when mail flows through the target for all users, the old routes are retired and the help desk has a tested runbook.
Decommission Exchange and retain evidence
After a hold period agreed with compliance, Exchange is removed in a documented sequence, and the export packages, logs, reconciliation reports and the cutover record are archived under the retention schedule. Confirm with legal and compliance how long eDiscovery exports and migration logs must be kept, and whether any archived PST files must remain searchable. It is done when a signed decommissioning record exists and the retained evidence is indexed and accessible to auditors.
Which option fits by situation
When mail content, attachments and calendars must stay in a specific country, data center or cloud account, self-hosting is the most direct route. OX App Suite can be deployed on premises or in a public cloud the client controls, and openDesk runs on Kubernetes with Helm charts, so both can sit inside the client's own infrastructure rather than a vendor's multi-tenant service. The cloud account or data center then becomes the place where residency is proven.
- Deployment target: Confirm whether the organization needs an on-premises data center, a sovereign cloud region or an air-gapped network, since each changes the hosting design.
- Backups and replicas: Mailbox copies, search indexes and backups must follow the same residency rules as the primary store.
- Support access: Decide who can reach the systems from outside the region and how that access is logged.
- Identity: Directory, single sign-on and multifactor services often hold personal data too and need the same review.
- Operations: Your own staff or a partner must run patching and monitoring inside the boundary.
Ask your legal and privacy teams to map each data category to a named location before choosing a deployment model.
Open-source mail and collaboration software carries no per-user license fee, so the recurring cost moves to infrastructure, staff time and, optionally, a support subscription. Those are the lines to model. Enterprise support tiers exist for both ecosystems, but they are a choice rather than a requirement, and the size of the recurring bill depends on how much of the operation you take on yourself.
- One-time costs: Migration planning, mailbox moves, integration with the directory and testing are typically paid once.
- Recurring infrastructure: Compute, storage, backup and network charges continue for as long as the platform runs.
- Support subscription: A vendor support contract is optional and priced by the vendor, so request a written quote tied to your scope.
- Staff time: Patching, monitoring and user administration are internal or contracted effort that recurs every month.
- Retainer versus project: Ask whether ongoing upgrades and operations are covered by a retainer or left to your team.
Before comparing with your current bill, ask each vendor and implementation partner for a quote that separates these components.
When mail must connect to line-of-business systems, custom approval flows, archiving rules or bespoke clients, an open stack gives you direct access to configuration and interfaces. Dovecot exposes its behavior through configuration files and is widely used as an IMAP and authentication layer, and OX App Suite is part of the Open-Xchange product line that Dovecot belongs to. This makes the mail core adjustable, but changes must be tested carefully because they are yours to maintain.
- Dovecot configuration: Authentication, mailbox layout and protocol settings live in files such as
dovecot.confand need version control. - Open interfaces: Confirm which APIs OX App Suite exposes for provisioning and integration before designing around them.
- Upgrade impact: Each custom change can complicate future upgrades, so record every deviation from the vendor defaults.
- Client support: Check which mail clients and mobile protocols your users need and test them against the chosen stack.
- Ownership: Name who will maintain each custom component after the project closes.
Ask for a written list of supported integration points and the test plan for each one before development begins.
Regulated organizations need controls, configuration baselines and evidence that can be shown to an examiner. DeployOpen prepares systems, controls and evidence for compliance assessments, including access reviews, logging, backup records and change history. DeployOpen does not issue audit reports, attestations or certifications. Those come from independent auditors and certification bodies, and the scope of their work should be agreed before the platform is built.
- Control mapping: Map each applicable control to a configuration, a procedure or a log source in the new platform.
- Evidence collection: Decide which logs, screenshots and change records will be retained, and for how long.
- Retention and legal hold: Confirm how mail retention, deletion and legal hold will work without a vendor eDiscovery tool.
- Security testing: Plan application and infrastructure testing before go-live and after major changes.
- Auditor engagement: Invite your external auditor early so that the evidence format meets their expectations.
Before committing, ask your auditor which frameworks and evidence formats they will accept for the new platform.
How much effort and time does an Exchange replacement take?
What does it cost to replace Exchange with open-source software?
The cost is the sum of several components, and only some of them are software. Self-hosted OX App Suite with Dovecot, or openDesk, is free to download under its own licensing terms, so the main costs are infrastructure, the people who build and run the platform, and any paid support subscription you choose. Infrastructure recurs every month. Implementation, data migration and client rollout are one-time costs. Costs rise with mailbox count, data volume, the number of high-availability sites, and the number of integrations with directory, archiving, mobile and compliance tools. Ask any provider for a fixed-scope written quote that lists each deliverable, the environment it runs in, who operates it after handover, and which items recur each year. Confirm the licensing terms and any support tiers directly with the vendor before you compare totals.
How long does an Exchange migration to open-source email take?
The timeline depends on how much of the environment you need to move and how much you need to change along the way. No supplied source gives a duration for this kind of project, so treat any number a vendor quotes as a claim to verify. The main drivers are the number of mailboxes and total mailbox size, whether calendars, shared mailboxes, public folders and distribution lists must keep working, how many clients (desktop Outlook, mobile, shared devices) must be reconfigured, and whether directory integration and single sign-on need to be rebuilt. Migration waves, a pilot group and a rollback plan add time but reduce risk. Ask for a timeline by phase in the written scope, with explicit assumptions about data volume and user counts.
What does our internal team need to provide during an Exchange migration?
A migration needs decisions and access from your side as much as technical work. Expect to supply named owners for identity, mail flow, DNS and certificates, security and compliance, and the business owners who approve cutover windows. The team also needs read access to the current Exchange environment, a test tenant or staging environment, and a list of mailboxes, shared resources, retention rules and external integrations such as scanners, line-of-business applications and archiving tools. Users will need communication and some training. Confirm in the written scope who performs each task, because gaps in ownership are a common reason migrations stall.
Can our own IT team replace Exchange without an outside partner?
A capable internal team can do it, provided it has people with hands-on experience in mail routing, directory services, certificates, backup and restore, and the chosen open-source platform. The harder parts are rarely the software installation. They are mail flow testing against external domains, anti-spam and anti-malware configuration, high availability, backup and recovery testing, and the coordinated cutover. Ask yourself whether those skills exist on the team now, whether anyone can take on operations after go-live, and whether the migration competes with existing projects for the same people. If the answer to any of these is no, a fixed-scope engagement covering implementation, hardening, backup and documentation may be a better use of budget than trying to learn under deadline. DeployOpen plans, implements, hardens, backs up and documents self-hosted platforms inside your own infrastructure, and provides ongoing support as a retainer.
How do PST exports and eDiscovery licensing affect an Exchange exit plan?
PST exports are the common way to move mailbox content, but they are a poor format for ongoing use. Microsoft Purview eDiscovery can export Exchange mailbox items as PST or .msg files, and the export package expires 14 days after it is created. Exporting through this route requires a Microsoft 365 E3 or E5 license, so confirm your entitlement before you plan around it. Your plan should decide which content must be preserved, how legal holds and retention labels are handled, how PST files are verified and imported, and where they are stored securely afterward. Ask your legal and records teams to confirm the retention requirements in writing before any export starts, because the exit plan changes depending on whether you must keep an immutable copy of the source data.
What happens to Outlook clients after moving off Exchange?
Outlook can continue to be used with some open-source platforms, but the connection method, supported protocols and feature parity must be confirmed for each product before you commit. Users typically need new account profiles, updated server settings and, in some cases, a different client for calendars or shared folders. Some Outlook features tied to Exchange, such as certain delegate, rules, or add-in behaviors, may not work the same way. Test with a representative user group, including mobile devices and shared mailboxes, and document any changes users must make. Ask the vendor or implementation partner to list supported clients and known gaps in the written scope.
What should a fixed-scope quote for an Exchange replacement include?
A useful quote lists scope, deliverables and timeline in writing before work starts. It should name the target platform and version, the environments covered, the number of mailboxes and data volume assumed, and the migration waves. It should also state what is included in testing, security hardening, backup and restore validation, documentation, user training and cutover support. Ask which items are one-time and which recur, such as support, upgrades and continuous testing, and what triggers a change order. Make sure the quote states who handles PST and eDiscovery exports, how exports are verified, and who is responsible for the final decommissioning of Exchange. DeployOpen does not publish a price list, and a quote follows from the written scope.
What changes for users when mail moves off Exchange
Users will notice the change first in their client. Outlook users on Exchange typically connect through a desktop client, and an OX App Suite or openDesk deployment will bring a web interface, and possibly different mobile and desktop clients depending on what your design allows. Confirm with your vendor or integrator which clients are supported for mail, calendar and contacts, and which Outlook features (such as certain rules, delegate permissions, shared mailbox behavior or add-ins) are available on the target platform. Do not promise users feature parity. Document every Outlook workflow your business relies on and test each one against the target before you set a cutover date.
Calendars and contacts need the most attention because they are the hardest to move cleanly. Meeting invitations sent from the old system may not update automatically, and shared calendars and delegated access will usually need to be granted again by their owners. Plan a re-sharing step for each shared calendar and shared mailbox, and assign a named owner to the list. Mobile users face a separate change: their device profile, account settings and certificates will likely need to be replaced, so decide early whether you will push configuration profiles through your mobile device management tool or ask users to set up accounts manually.
Run a pilot group before the full cutover. Choose a small set of users from several departments, include at least one delegate-heavy team and one mobile-heavy group, and keep the pilot running long enough to catch month-end or quarter-end mail patterns. Publish a clear message that states the date, what will change, what will not, and where to get help, and send reminders close to the switch. Staff a support window around the cutover with a known queue, a runbook for common issues and an escalation path to the platform team. Agree the length of that window in writing with your implementation partner so the cost and staffing are visible before work starts.
How DeployOpen scopes, migrates and supports an Exchange replacement
DeployOpen plans, implements, integrates, hardens, backs up, documents and supports self-hosted open-source mail and collaboration platforms inside your own infrastructure. For an Exchange replacement, we start from written scope covering mailboxes, calendars, shared resources, retention evidence and cutover, so the choice between OX App Suite with Dovecot and openDesk rests on your requirements.
How we scope
- Inventory mailboxes, shared mailboxes, distribution lists, calendars and public folders in your current environment.
- Record which Exchange features your users rely on, such as delegation, rules, mobile sync and journaling, and mark each as in or out of scope.
- Agree in writing the target platform, hosting location, identity integration and deliverables before work starts, as engagements are fixed-scope.
How we build
- Deploy the chosen platform in your cloud account, data center or air-gapped network, with the hosting model you have approved.
- Configure identity, mail routing, client access and migration tooling, and test each against the scoped requirements.
- Run security testing of the deployment and document the controls and evidence needed for your compliance assessments.
How we hand over
- Document the architecture, configuration, runbooks and backup procedures so your own team can operate the platform.
- Support a pilot group and agreed cutover steps, including PST-based archive exports where your retention rules require them.
- Deliver written handover material and confirm with your auditors which evidence they will accept, since DeployOpen does not issue audit reports or certifications.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainers can cover patching, platform upgrades, backup restore testing and periodic security testing against the agreed scope.
- Ask for a quote built from the written scope, covering one-time build work and any recurring support you choose to retain.

