diff --git a/CHANGES b/CHANGES
index 346154ec2..6731940ea 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1705,4 +1705,5 @@
 * Allow setting a custom CSP policy
 * ticket: when email is down, add a field to provide alternate contact email
 * Re-work app import flow
+* Add pagination and search to mailbox and mail alias listing
 
diff --git a/src/mail.js b/src/mail.js
index d77d19c8a..e6cd76275 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -1057,11 +1057,13 @@ function sendTestMail(domain, to, callback) {
     });
 }
 
-function listMailboxes(domain, callback) {
+function listMailboxes(domain, page, perPage, callback) {
     assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof page, 'number');
+    assert.strictEqual(typeof perPage, 'number');
     assert.strictEqual(typeof callback, 'function');
 
-    mailboxdb.listMailboxes(domain, function (error, result) {
+    mailboxdb.listMailboxes(domain, page, perPage, function (error, result) {
         if (error) return callback(new MailError(MailError.INTERNAL_ERROR, error));
 
         callback(null, result);
@@ -1146,11 +1148,13 @@ function removeMailbox(name, domain, auditSource, callback) {
     });
 }
 
-function listAliases(domain, callback) {
+function listAliases(domain, page, perPage, callback) {
     assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof page, 'number');
+    assert.strictEqual(typeof perPage, 'number');
     assert.strictEqual(typeof callback, 'function');
 
-    mailboxdb.listAliases(domain, function (error, result) {
+    mailboxdb.listAliases(domain, page, perPage, function (error, result) {
         if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new MailError(MailError.NOT_FOUND, error.message));
         if (error) return callback(new MailError(MailError.INTERNAL_ERROR, error));
 
diff --git a/src/mailboxdb.js b/src/mailboxdb.js
index 18d8cf45b..d5952686a 100644
--- a/src/mailboxdb.js
+++ b/src/mailboxdb.js
@@ -183,11 +183,13 @@ function getMailbox(name, domain, callback) {
         });
 }
 
-function listMailboxes(domain, callback) {
+function listMailboxes(domain, page, perPage, callback) {
     assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof page, 'number');
+    assert.strictEqual(typeof perPage, 'number');
     assert.strictEqual(typeof callback, 'function');
 
-    database.query('SELECT ' + MAILBOX_FIELDS + ' FROM mailboxes WHERE type = ? AND domain = ? ORDER BY name',
+    database.query(`SELECT ${MAILBOX_FIELDS} FROM mailboxes WHERE type = ? AND domain = ? ORDER BY name LIMIT ${(page-1)*perPage},${perPage}`,
         [ exports.TYPE_MAILBOX, domain ], function (error, results) {
             if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
 
@@ -280,11 +282,13 @@ function getAliasesForName(name, domain, callback) {
         });
 }
 
-function listAliases(domain, callback) {
+function listAliases(domain, page, perPage, callback) {
     assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof page, 'number');
+    assert.strictEqual(typeof perPage, 'number');
     assert.strictEqual(typeof callback, 'function');
 
-    database.query('SELECT ' + MAILBOX_FIELDS + ' FROM mailboxes WHERE domain = ? AND type = ? ORDER BY name',
+    database.query(`SELECT ${MAILBOX_FIELDS} FROM mailboxes WHERE domain = ? AND type = ? ORDER BY name LIMIT ${(page-1)*perPage},${perPage}`,
         [ domain, exports.TYPE_ALIAS ], function (error, results) {
             if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
 
diff --git a/src/routes/mail.js b/src/routes/mail.js
index a3f34d292..4fef919d7 100644
--- a/src/routes/mail.js
+++ b/src/routes/mail.js
@@ -214,7 +214,13 @@ function sendTestMail(req, res, next) {
 function listMailboxes(req, res, next) {
     assert.strictEqual(typeof req.params.domain, 'string');
 
-    mail.listMailboxes(req.params.domain, function (error, result) {
+    var page = typeof req.query.page !== 'undefined' ? parseInt(req.query.page) : 1;
+    if (!page || page < 0) return next(new HttpError(400, 'page query param has to be a postive number'));
+
+    var perPage = typeof req.query.per_page !== 'undefined'? parseInt(req.query.per_page) : 25;
+    if (!perPage || perPage < 0) return next(new HttpError(400, 'per_page query param has to be a postive number'));
+
+    mail.listMailboxes(req.params.domain, page, perPage, function (error, result) {
         if (error && error.reason === MailError.NOT_FOUND) return next(new HttpError(404, error.message));
         if (error) return next(new HttpError(500, error));
 
@@ -280,7 +286,13 @@ function removeMailbox(req, res, next) {
 function listAliases(req, res, next) {
     assert.strictEqual(typeof req.params.domain, 'string');
 
-    mail.listAliases(req.params.domain, function (error, result) {
+    var page = typeof req.query.page !== 'undefined' ? parseInt(req.query.page) : 1;
+    if (!page || page < 0) return next(new HttpError(400, 'page query param has to be a postive number'));
+
+    var perPage = typeof req.query.per_page !== 'undefined'? parseInt(req.query.per_page) : 25;
+    if (!perPage || perPage < 0) return next(new HttpError(400, 'per_page query param has to be a postive number'));
+
+    mail.listAliases(req.params.domain, page, perPage, function (error, result) {
         if (error && error.reason === MailError.NOT_FOUND) return next(new HttpError(404, error.message));
         if (error) return next(new HttpError(500, error));