diff --git a/src/mail.js b/src/mail.js
index 37b6af623..bc23b680b 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -1032,13 +1032,14 @@ function sendTestMail(domain, to, callback) {
     });
 }
 
-function listMailboxes(domain, page, perPage, callback) {
+function listMailboxes(domain, search, page, perPage, callback) {
     assert.strictEqual(typeof domain, 'string');
+    assert(typeof search === 'string' || search === null);
     assert.strictEqual(typeof page, 'number');
     assert.strictEqual(typeof perPage, 'number');
     assert.strictEqual(typeof callback, 'function');
 
-    mailboxdb.listMailboxes(domain, page, perPage, function (error, result) {
+    mailboxdb.listMailboxes(domain, search, page, perPage, function (error, result) {
         if (error) return callback(error);
 
         callback(null, result);
@@ -1165,13 +1166,14 @@ function setAliases(name, domain, aliases, callback) {
     });
 }
 
-function getLists(domain, page, perPage, callback) {
+function getLists(domain, search, page, perPage, callback) {
     assert.strictEqual(typeof domain, 'string');
+    assert(typeof search === 'string' || search === null);
     assert.strictEqual(typeof page, 'number');
     assert.strictEqual(typeof perPage, 'number');
     assert.strictEqual(typeof callback, 'function');
 
-    mailboxdb.getLists(domain, page, perPage, function (error, result) {
+    mailboxdb.getLists(domain, search, page, perPage, function (error, result) {
         if (error) return callback(error);
 
         callback(null, result);
diff --git a/src/mailboxdb.js b/src/mailboxdb.js
index 2c5a3c974..ecf40d56f 100644
--- a/src/mailboxdb.js
+++ b/src/mailboxdb.js
@@ -37,6 +37,7 @@ exports = module.exports = {
 var assert = require('assert'),
     BoxError = require('./boxerror.js'),
     database = require('./database.js'),
+    mysql = require('mysql'),
     safe = require('safetydance'),
     util = require('util');
 
@@ -203,20 +204,24 @@ function getMailbox(name, domain, callback) {
         });
 }
 
-function listMailboxes(domain, page, perPage, callback) {
+function listMailboxes(domain, search, page, perPage, callback) {
     assert.strictEqual(typeof domain, 'string');
+    assert(typeof search === 'string' || search === null);
     assert.strictEqual(typeof page, 'number');
     assert.strictEqual(typeof perPage, 'number');
     assert.strictEqual(typeof callback, 'function');
 
-    database.query(`SELECT ${MAILBOX_FIELDS} FROM mailboxes WHERE type = ? AND domain = ? ORDER BY name LIMIT ?,?`,
-        [ exports.TYPE_MAILBOX, domain, (page-1)*perPage, perPage ], function (error, results) {
-            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+    let query = `SELECT ${MAILBOX_FIELDS} FROM mailboxes WHERE type = ? AND domain = ?`;
+    if (search) query += ' AND (name LIKE ' + mysql.escape('%' + search + '%') + ')';
+    query += 'ORDER BY name LIMIT ?,?';
 
-            results.forEach(function (result) { postProcess(result); });
+    database.query(query, [ exports.TYPE_MAILBOX, domain, (page-1)*perPage, perPage ], function (error, results) {
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
 
-            callback(null, results);
-        });
+        results.forEach(function (result) { postProcess(result); });
+
+        callback(null, results);
+    });
 }
 
 function listAllMailboxes(page, perPage, callback) {
@@ -234,20 +239,24 @@ function listAllMailboxes(page, perPage, callback) {
         });
 }
 
-function getLists(domain, page, perPage, callback) {
+function getLists(domain, search, page, perPage, callback) {
     assert.strictEqual(typeof domain, 'string');
+    assert(typeof search === 'string' || search === null);
     assert.strictEqual(typeof page, 'number');
     assert.strictEqual(typeof perPage, 'number');
     assert.strictEqual(typeof callback, 'function');
 
-    database.query(`SELECT ${MAILBOX_FIELDS} FROM mailboxes WHERE type = ? AND domain = ? ORDER BY name LIMIT ?,?`,
-        [ exports.TYPE_LIST, domain, (page-1)*perPage, perPage ], function (error, results) {
-            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+    let query = `SELECT ${MAILBOX_FIELDS} FROM mailboxes WHERE type = ? AND domain = ?`;
+    if (search) query += ' AND (name LIKE ' + mysql.escape('%' + search + '%') + ')';
+    query += 'ORDER BY name LIMIT ?,?';
 
-            results.forEach(function (result) { postProcess(result); });
+    database.query(query, [ exports.TYPE_LIST, domain, (page-1)*perPage, perPage ], function (error, results) {
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
 
-            callback(null, results);
-        });
+        results.forEach(function (result) { postProcess(result); });
+
+        callback(null, results);
+    });
 }
 
 function getList(name, domain, callback) {
diff --git a/src/routes/mail.js b/src/routes/mail.js
index 5b40852a0..c3c67c983 100644
--- a/src/routes/mail.js
+++ b/src/routes/mail.js
@@ -159,7 +159,9 @@ function listMailboxes(req, res, next) {
     var perPage = typeof req.query.per_page !== 'undefined'? parseInt(req.query.per_page) : 25;
     if (!perPage || perPage < 0) return next(new HttpError(400, 'per_page query param has to be a positive number'));
 
-    mail.listMailboxes(req.params.domain, page, perPage, function (error, result) {
+    if (req.query.search && typeof req.query.search !== 'string') return next(new HttpError(400, 'search must be a string'));
+
+    mail.listMailboxes(req.params.domain, req.query.search || null, page, perPage, function (error, result) {
         if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { mailboxes: result }));
@@ -254,7 +256,9 @@ function getLists(req, res, next) {
     const perPage = typeof req.query.per_page !== 'undefined'? parseInt(req.query.per_page) : 25;
     if (!perPage || perPage < 0) return next(new HttpError(400, 'per_page query param has to be a positive number'));
 
-    mail.getLists(req.params.domain, page, perPage, function (error, result) {
+    if (req.query.search && typeof req.query.search !== 'string') return next(new HttpError(400, 'search must be a string'));
+
+    mail.getLists(req.params.domain, req.query.search || null, page, perPage, function (error, result) {
         if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { lists: result }));