A strategic and technical assessment for organisations evaluating on-premises email platforms for a 500-user base. Covering licensing costs, five-year total cost of ownership, protocol support, compliance capabilities, and the operational reality of running each platform.
Choosing a self-hosted email platform is not simply a technology decision: it determines your licensing obligations, your operational overhead, your Outlook compatibility story, and your compliance posture for the next five to ten years. The four platforms assessed here represent the credible options available to a 500-user organisation that has decided to retain email on-premises. They differ substantially in cost, capability, and the level of expertise they demand from your IT team.
Microsoft Exchange Server occupies the full-featured, highest-cost end of the spectrum. Zentyal occupies the lowest-cost position but is not suited to 500-user deployments at full scale. grommunio and Zimbra Network Edition sit between them, offering Linux-based alternatives with genuine Exchange protocol compatibility at materially lower total cost.
Self-hosting email is not the default choice for most organisations today. Cloud-hosted platforms offer lower operational overhead, automatic updates, and predictable per-seat pricing. Organisations that choose self-hosted email typically do so for one or more of the following reasons, each of which represents a genuine and defensible business requirement.
Some organisations, particularly in government, defence, financial services, and healthcare, face regulatory or contractual requirements that prohibit email data from leaving a specific jurisdiction or from being processed by a third-party cloud provider. On-premises hosting provides the clearest evidence of data residency.
Organisations operating air-gapped or highly restricted networks, including classified government environments, industrial control networks, and secure research facilities, cannot use cloud-hosted email by definition. Self-hosted email is the only viable option in these contexts.
Organisations with significant existing investment in on-premises server infrastructure, storage area networks, and Active Directory may find that self-hosted email represents a better use of sunk capital than cloud migration, particularly where the organisation is not otherwise pursuing a broader cloud migration programme.
At sufficiently large user counts, on-premises licensing can become cost-competitive with cloud per-user subscriptions, particularly when organisations own their own hardware. At 500 users, this argument is marginal; at 5,000 users, it may be compelling depending on the platforms compared.
Some compliance frameworks and audit regimes require direct evidence of data handling controls that is easier to demonstrate when the organisation operates the infrastructure itself. Self-hosted email provides full audit log ownership and the ability to implement bespoke retention, archiving, and access control policies.
Organisations with existing high dependency on Microsoft for productivity tools may prefer to diversify their critical communications infrastructure away from a single cloud provider. A Linux-based email platform provides meaningful operational independence from any single vendor's roadmap, pricing decisions, or service availability.
Licensing cost is only one component of the total cost of self-hosted email. Infrastructure (server hardware amortised over the refresh cycle, Windows Server licensing where applicable, storage), and the administrative overhead of managing the platform, collectively represent the majority of the real cost. The figures below model all three components for a 500-user deployment at indicative order-of-magnitude pricing.
Zentyal has the lowest licence cost by a substantial margin. However, its infrastructure and administrative overhead costs are comparable to the Linux alternatives, and its suitability for 500-user deployments is limited. The platforms with the best 5-year TCO for a full-featured 500-user deployment are Zimbra Network Edition and grommunio Enterprise.
Indicative order-of-magnitude figures in £000s. Includes licensing, infrastructure (hardware amortised + OS licensing), and estimated administrative overhead. Year 1 includes one-off setup and migration costs. Figures do not include spam/AV gateway add-ons.
Breakdown of Year 1 costs into licensing, infrastructure and OS, and estimated administrative overhead. £000s. Admin overhead modelled at blended UK IT specialist rate of £55,000 per FTE per year.
Each platform occupies a distinct position in the market. Understanding where they differ in origin, architecture, and commercial model is essential context for the technical and financial detail that follows.
The following sections are written for principal technologists, infrastructure architects, and email administrators. They cover the infrastructure requirements, protocol support depth, feature-level comparison, and deployment considerations for each platform in detail.
Infrastructure requirements vary significantly across the four platforms. Microsoft Exchange imposes the largest infrastructure footprint and dependency chain; the Linux-based alternatives are substantially leaner. The following assessments reflect a 500-user deployment with high availability, assuming two server nodes in an active-passive or active-active configuration.
Microsoft Exchange runs exclusively on Windows Server 2022 Standard or Datacenter. For a 500-user deployment with high availability, you will need a minimum of two servers in a Database Availability Group (DAG). Microsoft publish recommended hardware sizing guidelines; for 500 mailboxes the general guidance indicates 128 GB RAM per server as a reasonable starting point for production workloads, with CPU, storage IOPS, and network bandwidth sized to the mailbox profile.
Exchange uses its own Extensible Storage Engine (ESE) database format. Database and log volumes require separate, dedicated storage for performance and recovery reasons. For a 500-user deployment with a 50 GB average mailbox quota, plan for approximately 30 TB of raw storage across database, log, and backup volumes, allowing for white space and growth headroom per Microsoft guidance.
Exchange is administered primarily through the Exchange Admin Center (browser-based) and Exchange Management Shell (PowerShell). All significant configuration changes require PowerShell proficiency. Certificate lifecycle management, DAG maintenance, cumulative update (CU) application (approximately quarterly), and health monitoring are ongoing tasks requiring dedicated time from a Windows and Exchange specialist. Estimated administrative overhead for a 500-user deployment: 0.5 to 0.7 FTE.
grommunio runs on Linux, with SUSE Linux Enterprise Server and Red Hat Enterprise Linux (and compatible derivatives such as AlmaLinux and Rocky Linux) being the supported distributions. The platform is packaged as an RPM-based installation and has no dependency on Windows Server or Active Directory, though it integrates cleanly with AD via LDAP if one is present.
grommunio implements Exchange protocols natively. The MAPI/HTTP and EWS implementations allow Outlook to connect without any client-side connector software, which is a key differentiator from Zimbra. ActiveSync is fully implemented for mobile devices. The IMAP and POP3 services are also included for legacy clients.
grommunio provides a web-based administration console for domain, user, and policy management. Lower-level configuration is via standard Linux tools (systemd, configuration files). grommunio offers a REST API for automation and integration. Estimated administrative overhead for 500 users: 0.3 to 0.5 FTE, with the assumption that Linux system administration skills are present in the team.
Zimbra Network Edition runs on Linux, with Red Hat Enterprise Linux, CentOS (note: CentOS Linux reached end-of-life December 2021; use CentOS Stream, Rocky Linux, or AlmaLinux as replacements), and Ubuntu LTS being the supported distributions. Zimbra ships with its own bundled OpenLDAP directory service, which acts as the authoritative directory for the Zimbra deployment. Active Directory synchronisation is possible but requires additional configuration.
Zimbra does not implement native MAPI. Outlook clients connect via the Zimbra Connector for Outlook (ZCO), a COM add-in that must be deployed to each Outlook workstation. ZCO synchronises mail, calendar, and contacts over Zimbra's own SOAP-based protocol rather than MAPI. This introduces a connector management overhead (deployment, updates, compatibility testing with each Zimbra and Outlook release) that is absent from Microsoft Exchange and grommunio.
Zimbra provides a browser-based administration console (Zimbra Administration Console) and a command-line interface (zmprov, zmcontrol). Network Edition includes commercial support, a self-service portal, and automated update channels. Estimated administrative overhead for 500 users: 0.3 to 0.45 FTE.
Zentyal Server is built on Ubuntu 22.04 LTS and provides an integrated suite covering email (Postfix + Dovecot), a groupware layer (SOGo), Active Directory (Samba 4), DNS, DHCP, and a web-based firewall, all managed through Zentyal's own web administration dashboard. The all-in-one nature of the platform is its primary appeal for small businesses: a single server can provide most of the services a small organisation needs.
Zentyal is positioned for small and medium-sized business deployments. While there is no hard enforced user limit in the software, running 500 active mailboxes on Zentyal in a production environment introduces risks around performance, high availability architecture (Zentyal does not ship with a built-in HA clustering solution), and the lack of enterprise-class compliance tooling. At 500 users, you are operating above the platform's intended performance envelope and without the redundancy architecture that a Tier 1 business system requires.
Zentyal provides no native MAPI or EWS. Outlook clients can connect via ActiveSync (Z-Push) for mail, calendar, and contacts synchronisation, or via IMAP for mail only. There is no Outlook calendar sharing equivalent to Exchange or Zimbra's ZCO. For organisations where Outlook feature parity is important, Zentyal is not a suitable platform at 500 users.
The following table compares protocol support, client compatibility, compliance capabilities, and operational features across all four platforms. Assessments are based on publicly available vendor documentation. Verify specific capability details with each vendor for your version and edition.
| Feature | Microsoft Exchange | grommunio | Zimbra NE | Zentyal |
|---|---|---|---|---|
| Client Protocols | ||||
| MAPI/HTTP (native Outlook, no connector) | Full | Yes | No | No |
| Exchange ActiveSync (EAS) | Full | Full | Full | Via Z-Push |
| Exchange Web Services (EWS) | Full | Partial | Partial | No |
| IMAP / POP3 | Yes | Yes | Yes | Yes |
| CalDAV / CardDAV | Yes | Full | Full | Yes (SOGo) |
| Outlook Connector Required | No (native) | No (native) | Yes (ZCO) | No connector available |
| Webmail and Client Experience | ||||
| Browser Client | Outlook Web App (OWA) | grommunio Web | Zimbra Web App | SOGo |
| Shared Calendars | Full | Full | Full | Limited |
| Shared Contacts / Address Books | Full (GAL) | Full | Full | Limited |
| Resource Mailboxes (rooms, equipment) | Full | Yes | Yes | No |
| Public Folders | Yes | No | No | No |
| Dynamic Distribution Groups | Yes | No | Yes (NE) | No |
| Delegated Mailbox Access | Full | Yes | Yes | Limited |
| Video Conferencing (built-in) | No (Teams separate) | Yes (Meet) | No | No |
| Mail Hygiene | ||||
| Built-in Anti-Spam | Yes (basic; EOP add-on for full) | Yes | Yes (SpamAssassin) | Yes (SpamAssassin) |
| Built-in Anti-Virus | Yes (basic; Defender add-on) | Yes | Yes (ClamAV) | Yes (ClamAV) |
| DKIM Signing | Full | Full | Full | Yes |
| DMARC Policy Enforcement | Full | Full | Full | Basic |
| SPF Verification | Full | Full | Full | Yes |
| Security and Encryption | ||||
| S/MIME Message Encryption | Full | Full | Full | Limited |
| TLS Enforcement (Opportunistic and Required) | Full | Full | Full | Yes |
| Information Rights Management (IRM) | Yes (via Purview/RMS) | No | No | No |
| Compliance and eDiscovery | ||||
| Legal Hold / Litigation Hold | Full | No | Limited (NE) | No |
| eDiscovery / Mailbox Search | Full (via Purview) | No | Basic (NE) | No |
| Email Journaling | Full | Yes | Yes (NE) | No |
| Email Archiving | Built-in (In-Place Archive) | Add-on module | Yes (NE) | No |
| Data Loss Prevention (DLP) | Yes (Purview integration) | No | Limited | No |
| Audit Logging | Full | Yes | Yes | Basic |
| Retention Policies | Full | Basic | Yes (NE) | No |
| Infrastructure and Operations | ||||
| High Availability / Clustering | DAG (built-in) | Yes | Yes (multi-server) | No (manual only) |
| Multi-domain Support | Full | Full | Full | Yes |
| Active Directory / LDAP Integration | Native AD | LDAP / AD | LDAP (bundled OpenLDAP) | Native AD (Samba 4) |
| REST / Management API | Yes (EWS, PowerShell REST) | Full REST API | Yes (NE) | No |
| SIEM Integration | Yes (Sentinel, Syslog) | Yes (Syslog / API) | Yes (Syslog) | No |
| Mobile Device Management (MDM) Integration | Yes (Intune / ActiveSync policies) | Yes (ActiveSync policies) | Yes (ActiveSync policies) | Basic (ActiveSync policies only) |
| Operating System | Windows Server 2022 | Linux (SUSE / RHEL) | Linux (RHEL / Ubuntu) | Linux (Ubuntu 22.04) |
| Licensing Model | Subscription (SA required) | Per-user subscription | Per-user subscription | Per-server annual |
| Commercial Support SLA | Yes (Microsoft) | Yes (grommunio GmbH) | Yes (Zimbra/Synacor) | Basic (Zentyal S.L.) |
The radar chart below provides a visual comparison across eight dimensions relevant to a 500-user on-premises email deployment. Scores are qualitative assessments based on the documented capabilities of each platform. They are intended to communicate relative strengths and weaknesses, not absolute measurements.
Qualitative capability scores (1 to 5) across eight dimensions. Higher is better in all dimensions. Assessment based on publicly available product documentation and commercial feature sets.
Dimensions: Outlook Compatibility = native client fidelity; Mobile/ActiveSync = mobile device support completeness; Webmail = browser client quality; Compliance/eDiscovery = legal hold, retention, discovery tooling; Scalability = ability to grow beyond 500 users; Admin Simplicity = operational overhead for IT team; Cost Value = feature-to-cost ratio; Support Quality = commercial SLA and vendor responsiveness.
Migrating to a new self-hosted email platform is a more complex undertaking than changing a cloud email gateway. You are replacing both the mail server and potentially the client protocol, which means user-visible change, Outlook reconfiguration, and a risk window during mailbox data migration. The following phases apply broadly to all four platforms, with platform-specific notes where they differ.
Audit the current email environment: mailbox count and sizes, shared mailbox usage, public folder usage (critical if migrating from Exchange, as public folders have no equivalent in grommunio or Zimbra), distribution group structure, ActiveSync device inventory, and third-party integrations (CRM connectors, fax-to-email, line-of-business applications using SMTP relay). Identify any capabilities in the source platform that require a workaround or re-architecture in the target.
Weeks 1 to 3Provision and configure the target platform servers, including HA configuration, TLS certificates, DNS records (Autodiscover, MX, SPF, DKIM, DMARC), user provisioning (either via directory synchronisation or manual import), and mail routing. Configure Autodiscover so that clients will automatically discover the new server settings post-migration. For grommunio and Zimbra, configure Outlook client profiles or deploy the ZCO connector (Zimbra only) in test.
Weeks 2 to 5Migrate a representative pilot group covering different job functions, device types, and mailbox sizes. Validate: Outlook connectivity, mobile device resync, calendar and contact fidelity, shared mailbox and delegation access, and any line-of-business integrations. Identify issues before scaling to the full user base. Collect and address feedback. Update run-books based on pilot findings.
Weeks 4 to 7Migrate remaining mailboxes in cohorts (by department or business unit) to manage support load and reduce the blast radius of any issues. Use IMAP migration tools for cross-platform migrations or native export/import tools where available. Plan each cohort cutover outside business hours. Maintain the source system in read-only or receive mode during the migration window to prevent data loss.
Weeks 6 to 12 (scale dependent)Once all mailboxes are migrated and verified on the target platform, update MX records to point inbound mail to the new server. Reduce MX TTL 48 to 72 hours before cutover to allow rapid propagation. Maintain the old server as a backup MX or in monitoring mode for 2 to 4 weeks post-cutover to catch any misdirected mail or revert scenario.
Cutover day plus 2 to 4 weeks monitoringTune anti-spam rules based on real production traffic, enable advanced features (archiving, DLP policies, mobile wipe policies), update backup jobs and monitoring configuration for the new platform, and produce updated operational run-books. Once the stabilisation period is complete and no further issues are open, decommission the old mail infrastructure.
Weeks 10 to 16No single platform is the right answer for every organisation. The appropriate choice is determined by the intersection of your compliance obligations, your existing technology ecosystem, your Outlook dependency, and your tolerance for operational overhead. The following reflects the objective analysis presented in this assessment.
Choose Microsoft Exchange if your organisation has a hard requirement for native Outlook MAPI (including full delegate access, public folders, or Outlook for iOS/Android with full feature parity), if you require enterprise-grade eDiscovery and legal hold functionality on-premises, or if you are already deeply invested in the Microsoft Active Directory and Windows Server stack and have dedicated Windows administration expertise. Accept that this is the highest-TCO option by a substantial margin.
Choose grommunio if you want Exchange protocol compatibility (including native Outlook connectivity without a client-side connector) on a Linux platform, with a lower Windows Server licensing overhead. grommunio is the strongest choice if you want to eliminate Windows Server entirely while retaining native Outlook support. The inclusion of grommunio Meet provides built-in video conferencing without a separate licence. Best suited to organisations with Linux administration capability in-house and a European data residency preference.
Choose Zimbra NE if you are comfortable managing the Zimbra Connector for Outlook on client workstations, and if built-in anti-spam and AV (SpamAssassin + ClamAV) are valuable to reduce third-party security costs. Zimbra NE offers the best-documented migration path from legacy Lotus Notes and GroupWise environments. Before committing, conduct due diligence on the current Zimbra NE commercial roadmap relative to the Zextras Carbonio fork, which has emerged as a competing successor product.
Zentyal is appropriate for organisations under 200 to 250 users who need a low-cost, all-in-one server with email, Active Directory, DNS, DHCP, and firewall on a single managed platform. At 500 users, Zentyal lacks the HA architecture, compliance tooling, and Outlook integration depth that a deployment of this scale requires. It is not recommended as the primary email platform at this user count.