Securely Connecting Mobile Email Apps with DavMail GatewayDavMail Gateway is an open-source proxy that translates Microsoft Exchange server protocols (OWA/EWS/ActiveSync) into standard mail protocols such as IMAP, POP3, SMTP and CalDAV/CardDAV. For organizations or individuals who rely on Exchange but prefer mobile apps that only support standard protocols, DavMail provides a practical bridge. This article explains how DavMail works, why you might use it on mobile devices, and — most importantly — how to set it up and configure it securely for iOS and Android mail apps.
Why use DavMail for mobile email?
- Many mobile email clients (especially lightweight or privacy-focused ones) do not support Exchange ActiveSync or modern Microsoft authentication flows.
- DavMail enables those clients to access Exchange mailboxes through familiar protocols (IMAP/SMTP) while also exposing calendar and contacts over CalDAV/CardDAV.
- It can be deployed locally (on the device or on a trusted server) or centrally (on a gateway server), letting you control security, logging, and authentication flows.
- DavMail supports multiple Exchange hosting scenarios: on-premises Exchange with OWA, Office 365 with OWA/EWS, and other Outlook Web Access interfaces.
How DavMail works (overview)
DavMail acts as a local protocol translator:
- It connects to Exchange via HTTP(S) endpoints such as OWA, EWS, or Exchange Web Services.
- It exposes standard protocol endpoints locally (IMAP, POP3, SMTP for mail; CalDAV for calendar; CardDAV for contacts).
- Mobile apps connect to DavMail using standard protocol settings (IMAP/SMTP servers), which DavMail forwards to Exchange over secure HTTP(S).
The main security consideration is that DavMail becomes an intermediary that must be trusted and configured to minimize exposure.
Deployment options
- Local device (rare): run DavMail on a laptop/phone-like platform and connect mobile apps to it via local network. Not common for mobile devices due to platform restrictions.
- Home/office server (common for power users): run DavMail on a trusted machine within your network; expose its IMAP/SMTP endpoints to mobile devices (VPN or TLS, see security section).
- Cloud or gateway server (organizational): central DavMail instance that all mobile clients use as a controlled gateway to the Exchange backend.
For mobile users, the typical pattern is running DavMail on a server that the mobile device can reach securely (VPN, TLS with public IP, or via SSH tunnel).
Security principles before configuring
- Use TLS everywhere: DavMail must accept only encrypted connections for IMAP/SMTP, and it should connect to Exchange via HTTPS.
- Strong authentication: prefer secure authentication methods and avoid anonymous access.
- Least privilege and network segmentation: limit DavMail’s network access and expose only required ports.
- Keep software updated: DavMail and the OS should be patched regularly.
- Protect credentials: avoid storing plain-text passwords where possible; consider using app-specific passwords or OAuth flows if available.
- Monitor and log: collect connection and authentication logs, and review for anomalies.
Installing DavMail (Linux example)
Below is a concise example for Debian/Ubuntu. Adjust for your distribution.
-
Install Java (DavMail runs on Java):
sudo apt update sudo apt install -y default-jre -
Download DavMail (release .deb or tarball from official project):
# example using .deb package (update URL to latest) wget https://davmail.sourceforge.io/davmail-5.0.0.deb sudo dpkg -i davmail-5.0.0.deb sudo apt -f install -y -
Configure DavMail by editing the davmail.properties file (commonly in /etc/davmail or ~/.davmail):
- Set Exchange OWA/EWS URL
- Configure ports and SSL options
- Enable/disable specific services (IMAP, POP3, SMTP, CalDAV, CardDAV)
Example minimal properties (values illustrative):
davmail.url=https://mail.example.com/owa/ davmail.imapPort=1143 davmail.smtpPort=1025 davmail.enableSsl=true davmail.keystore=/etc/davmail/keystore.jks - Start DavMail as a service:
sudo systemctl enable davmail sudo systemctl start davmail
Secure configuration details
TLS for client connections
- Configure DavMail to present a valid TLS certificate for its IMAP/SMTP endpoints. Use certificates from a trusted CA (Let’s Encrypt is a practical option).
- Never rely on self-signed certs for mobile devices unless you can securely distribute and pin the cert on each device.
Example: use a Let’s Encrypt certificate with DavMail’s Java keystore:
- Obtain cert files via Certbot.
- Convert to a Java keystore: “`bash openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out davmail.p12 -name davmail -password pass:changeit
keytool -importkeystore -deststorepass changeit -destkeypass changeit -destkeystore keystore.jks -srckeystore davmail.p12 -srcstoretype PKCS12 -srcstorepass changeit -alias davmail
3. Point davmail.keystore to keystore.jks and set keystore password securely. ### Securing backend connection to Exchange - Ensure davmail.url uses https:// and that certificate validation is enforced. - If Exchange uses client certs or specialized auth, configure accordingly. - For Office 365, confirm compatibility — DavMail primarily uses OWA/EWS endpoints. Use modern auth if DavMail supports it or use an app password. ### Authentication options - Use encrypted storage for account credentials on the DavMail host; prefer connecting clients to DavMail over TLS and authenticate using standard IMAP/SMTP credentials. - Consider two-factor authentication (2FA) at the Exchange/identity provider level; for accounts protected by MFA where app passwords are required, use app passwords for DavMail. ### Network protections - Run DavMail behind a firewall, allow only necessary ports (e.g., 993 for IMAPS and 465/587 for SMTPS). - Prefer access via a VPN or internal network. If public exposure is necessary, restrict access via IP allowlists, reverse proxy with authentication, or mutual TLS. --- ## Mobile client setup (iOS and Android) Recommended settings for IMAP/SMTP clients that only support standard protocols: IMAP (incoming): - Server: your.davmail.server (or IP) - Port: 993 (IMAPS) or custom port you configured - Security: SSL/TLS (Always) - Username: full Exchange email address - Password: account password or app password SMTP (outgoing): - Server: your.davmail.server - Port: 465 (SMTPS) or 587 (STARTTLS) - Security: SSL/TLS or STARTTLS - Authentication: required (same credentials as IMAP) Calendar/Contacts (CalDAV/CardDAV): - Server URLs are exposed by DavMail; use the CalDAV/CardDAV endpoints provided in the DavMail logs or admin UI. Notes: - On iOS, you can add an "Other" account and choose IMAP with the above settings. - On Android, many mail apps let you add an IMAP account with SSL/TLS and custom ports. --- ## Example: secure deployment behind a reverse proxy Using Nginx as a TLS-terminating reverse proxy in front of DavMail helps centralize certificates and add access controls. 1. Configure DavMail to listen on localhost (non-public ports). 2. Configure Nginx with a server block for mail.example.com that proxies TLS to DavMail. 3. Use stream proxying for raw IMAPS/SMTPS or TCP proxies; or terminate TLS in Nginx and proxy in plaintext on localhost if Nginx and DavMail run on the same host. Example Nginx stream block (simplified): stream { upstream imap_up { server 127.0.0.1:1143; } server {
listen 993 ssl; ssl_certificate /etc/letsencrypt/live/mail.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/mail.example.com/privkey.pem; proxy_pass imap_up; } } “`
Be careful with cipher suites and TLS versions; disable old protocols (TLS 1.0/1.1) and enable strong ciphers.
Troubleshooting common issues
- Connection refused: check DavMail service status and firewall rules.
- Certificate errors on mobile devices: verify the TLS certificate chain and that the device trusts the CA.
- Authentication failures: confirm credentials and whether the Exchange server requires app passwords or modern auth.
- Missing calendar/contacts: ensure CalDAV/CardDAV services are enabled and that client supports them.
- Performance issues: check DavMail logs, increase JVM memory if needed, and ensure network latency to Exchange is low.
Best practices checklist
- Use TLS on both client-facing and server-facing connections.
- Use valid CA-signed certificates for mobile clients.
- Prefer VPN or internal-only exposure where possible.
- Restrict inbound access with firewall rules or IP allowlists.
- Keep DavMail and the host OS updated.
- Monitor logs for unusual authentication or connection patterns.
- Test with a single device before broad deployment.
When not to use DavMail
- If you require full Exchange feature parity (shared mailboxes, server-side search, advanced calendar features), a native Exchange ActiveSync or Exchange-aware client is preferable.
- If organizational policy requires centralized identity flows (modern OAuth flows) not compatible with DavMail’s authentication options.
- If you cannot securely host and manage an intermediate gateway — exposing DavMail insecurely risks credential leakage.
Conclusion
DavMail Gateway is a practical tool to let standard IMAP/SMTP and CalDAV/CardDAV mobile clients access Microsoft Exchange accounts. The core of a secure deployment is encrypting all connections, protecting credentials, and limiting network exposure. With proper TLS certificates, firewalling, and careful configuration, you can provide secure mobile access to Exchange mail, calendar, and contacts for clients that otherwise lack native Exchange support.
Leave a Reply