diff --git a/make/vars.mk b/make/vars.mk
index 12f93f7..8849ecb 100644
--- a/make/vars.mk
+++ b/make/vars.mk
@@ -8,7 +8,7 @@ IP_ADDR_blade-canongate := 192.168.178.75
 MASTER_NODE := blade-canongate
 IS_MASTER_NODE := $(filter $(MASTER_NODE),$(HOSTNAME))
 MODULES_pi-broughton := http smtp vaultwarden ln
-MODULES_blade-canongate := etherpad gemini
+MODULES_blade-canongate := etherpad gemini mox
 ALL_NGINX_MODULES := http vaultwarden ln etherpad
 NGINX_MODULES := $(if $(IS_MASTER_NODE),$(ALL_NGINX_MODULES))
 MODULES := $(MODULES_$(HOSTNAME))
@@ -22,6 +22,7 @@ SUBDOMAIN_http := @
 SUBDOMAIN_vaultwarden := pwd
 SUBDOMAIN_etherpad := docs
 SUBDOMAIN_ln := ln
+SUBDOMAIN_mox := mail
 
 PORT_etherpad := 9001
 PORT_http := 8080
diff --git a/mox/dnssec.conf b/mox/dnssec.conf
new file mode 100644
index 0000000..9b8cd35
--- /dev/null
+++ b/mox/dnssec.conf
@@ -0,0 +1,8 @@
+server:
+    auto-trust-anchor-file: /var/lib/unbound/root.key
+    qname-minimisation: yes
+    interface: 0.0.0.0
+    access-control: 192.168.0.0/16 allow
+
+remote-control:
+    control-enable: yes
diff --git a/mox/install.mk b/mox/install.mk
new file mode 100644
index 0000000..6e76162
--- /dev/null
+++ b/mox/install.mk
@@ -0,0 +1,51 @@
+.PHONY: install
+install: install_unbound install_mox
+
+.PHONY: install_unbound
+install_unbound: /usr/sbin/unbound /etc/resolv.conf /var/lib/unbound/root.key install_unbound_anchor_crontab /etc/unbound/unbound.conf.d/dnssec.conf
+
+/usr/sbin/unbound:
+	sudo apk add unbound
+	sudo rc-update add unbound default
+	sudo rc-service unbound start
+
+/etc/resolv.conf: resolv.conf /etc/resolv.conf.joeac.net-backup
+	sudo mv /etc/resolv.conf /etc/resolv.conf.joeac.net-backup
+	sudo mv resolv.conf /etc/resolv.conf
+
+/var/lib/unbound/root.key:
+	sudo mkdir -p /var/lib/unbound && unbound-anchor -a /var/lib/unbound/root.key
+
+UNBOUND_ANCHOR_CRONTAB_ENTRY := @reboot unbound-anchor -a /var/lib/unbound/root.key # managed by joeac.net
+IS_CRONTAB_UP_TO_DATE := $(sudo grep "$(UNBOUND_ANCHOR_CRONTAB_ENTRY)" /etc/crontabs/root)
+.PHONY: install_unbound_anchor_crontab
+install_unbound_anchor_crontab:
+	$(if $(IS_CRONTAB_UP_TO_DATE),,\
+		sudo crontab -l > crontab.tmp; \
+		sed -i "s/.*unbound-anchor.*# managed by joeac.net//" crontab.tmp; \
+		echo "$(UNBOUND_ANCHOR_CRONTAB_ENTRY)" >> crontab.tmp; \
+		sudo crontab crontab.tmp; \
+		rm crontab.tmp; \
+	)
+
+/etc/unbound/unbound.conf.d/dnssec.conf: dnssec.conf
+	sudo mkdir -p $(dir $@) && sudo cp $< $@
+
+.PHONY: install_mox
+install_mox: /usr/local/bin/mox /home/mox/config/domains.conf
+
+MOX_PLATFORM := $(if $(filter armv7% arm32%,$(CPU_ARCH)),arm,amd64)
+MOX_VERSION := 0.0.15
+MOX_GO_VERSION := 1.26.4
+MOX_CHECKSUM_amd64_v0.0.15_go1.26.4 := 09OE-1QkNVgmpoRj53mtX9gxoEmY
+MOX_CHECKSUM_arm_v0.0.15_go1.26.4 := 038X9nQx6hhai60Fk1BhcP3r6Mew
+MOX_CHECKSUM := $(MOX_CHECKSUM_$(MOX_PLATFORM)_v$(MOX_VERSION)_go$(MOX_GO_VERSION))
+MOX_URL_BASE := https://beta.gobuilds.org/github.com/mjl-/mox
+MOX_URL := $(MOX_URL_BASE)@v$(MOX_VERSION)/linux-$(MOX_PLATFORM)-go$(MOX_GO_VERSION)/$(MOX_CHECKSUM)
+/usr/local/bin/mox:
+	wget -O- $(MOX_URL) | gzip -d > mox
+	chmod +x mox
+	sudo mv mox /usr/local/bin/mox
+
+/home/mox/config/domains.conf:
+	$(error Now configure mox for mail.joeac.net. To get started, create a user 'mox' if there isn't one already, cd to /home/mox, and run 'mox -hostname mail.joeac.net -existing-webserver quickstart me@mail.joeac.net'. See https://www.xmox.nl for more information on how to configure mox.)
diff --git a/mox/resolv.conf b/mox/resolv.conf
new file mode 100644
index 0000000..b3cb117
--- /dev/null
+++ b/mox/resolv.conf
@@ -0,0 +1 @@
+nameserver: 127.0.0.1