diff --git a/src/ldap.js b/src/ldap.js
index d4656a2ae..4d11e3daf 100644
--- a/src/ldap.js
+++ b/src/ldap.js
@@ -341,14 +341,15 @@ function mailingListSearch(req, res, next) {
         if (error) return next(new ldap.OperationsError(error.toString()));
 
         // http://ldapwiki.willeke.com/wiki/Original%20Mailgroup%20Schema%20From%20Netscape
+        // members are fully qualified (https://docs.oracle.com/cd/E19444-01/816-6018-10/groups.htm#13356)
         var obj = {
             dn: req.dn.toString(),
             attributes: {
                 objectclass: ['mailGroup'],
                 objectcategory: 'mailGroup',
-                cn: group.name,
-                mail: group.name + '@' + group.domain,
-                mgrpRFC822MailMember: group.members
+                cn: `${group.name}@${group.domain}`, // fully qualified
+                mail: `${group.name}@${group.domain}`,
+                mgrpRFC822MailMember: group.members.map(function (m) { return `${m}@${group.domain}`; })
             }
         };
 
diff --git a/src/test/ldap-test.js b/src/test/ldap-test.js
index ea7956966..96daad05c 100644
--- a/src/test/ldap-test.js
+++ b/src/test/ldap-test.js
@@ -810,8 +810,8 @@ describe('Ldap', function () {
             ldapSearch('cn=developers@example.com,ou=mailinglists,dc=cloudron', 'objectclass=mailGroup', function (error, entries) {
                 if (error) return done(error);
                 expect(entries.length).to.equal(1);
-                expect(entries[0].cn).to.equal('developers');
-                expect(entries[0].mgrpRFC822MailMember).to.eql([ USER_0.username.toLowerCase(), USER_1.username.toLowerCase() ]);
+                expect(entries[0].cn).to.equal('developers@example.com');
+                expect(entries[0].mgrpRFC822MailMember).to.eql([ USER_0.username.toLowerCase() + '@example.com', USER_1.username.toLowerCase() + '@example.com' ]);
                 done();
             });
         });