diff --git a/src/routes/user.js b/src/routes/user.js
index 6a346f9e8..58541159b 100644
--- a/src/routes/user.js
+++ b/src/routes/user.js
@@ -9,9 +9,7 @@ exports = module.exports = {
     verifyPassword: verifyPassword,
     requireAdmin: requireAdmin,
     sendInvite: sendInvite,
-    setGroups: setGroups,
-    setAliases: setAliases,
-    getAliases: getAliases
+    setGroups: setGroups
 };
 
 var assert = require('assert'),
@@ -198,33 +196,3 @@ function setGroups(req, res, next) {
         next(new HttpSuccess(204));
     });
 }
-
-function setAliases(req, res, next) {
-    assert.strictEqual(typeof req.params.userId, 'string');
-
-    if (!util.isArray(req.body.aliases)) return next(new HttpError(400, 'aliases must be an array'));
-
-    for (var i = 0; i < req.body.aliases.length; i++) {
-        if (typeof req.body.aliases[i] !== 'string') return next(new HttpError(400, 'alias must be a string'));
-    }
-
-    user.setAliases(req.params.userId, req.body.aliases, function (error) {
-        if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(404, 'No such user'));
-        if (error && error.reason === UserError.BAD_FIELD) return next(new HttpError(400, error.message));
-        if (error && error.reason === UserError.ALREADY_EXISTS) return next(new HttpError(409, 'One or more aliases already exist'));
-        if (error) return next(new HttpError(500, error));
-
-        next(new HttpSuccess(200));
-    });
-}
-
-function getAliases(req, res, next) {
-    assert.strictEqual(typeof req.params.userId, 'string');
-
-    user.getAliases(req.params.userId, function (error, aliases) {
-        if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(404, 'No such user'));
-        if (error) return next(new HttpError(500, error));
-
-        next(new HttpSuccess(200, { aliases: aliases }));
-    });
-}
diff --git a/src/server.js b/src/server.js
index f827c4683..dd186f9a1 100644
--- a/src/server.js
+++ b/src/server.js
@@ -135,8 +135,6 @@ function initializeExpressSync() {
     router.del ('/api/v1/users/:userId', usersScope, routes.user.requireAdmin, routes.user.verifyPassword, routes.user.remove);
     router.post('/api/v1/users/:userId', usersScope, routes.user.requireAdmin, routes.user.update);
     router.put ('/api/v1/users/:userId/groups', usersScope, routes.user.requireAdmin, routes.user.setGroups);
-    router.get ('/api/v1/users/:userId/aliases', usersScope, routes.user.requireAdmin, routes.user.getAliases);
-    router.put ('/api/v1/users/:userId/aliases', usersScope, routes.user.requireAdmin, routes.user.setAliases);
     router.post('/api/v1/users/:userId/invite', usersScope, routes.user.requireAdmin, routes.user.sendInvite);
 
     // Group management
@@ -220,11 +218,13 @@ function initializeExpressSync() {
     router.post('/api/v1/mail/:domain/catch_all',  settingsScope, routes.user.requireAdmin, routes.mail.setCatchAllAddress);
     router.post('/api/v1/mail/:domain/relay',         settingsScope, routes.user.requireAdmin, routes.mail.setMailRelay);
     router.post('/api/v1/mail/:domain/enable',        settingsScope, routes.user.requireAdmin, routes.mail.setMailEnabled);
-    router.post('/api/v1/mail/:domain/send_test_mail',  cloudronScope, routes.user.requireAdmin, routes.mail.sendTestMail);
-    router.get ('/api/v1/mail/:domain/mailboxes',  cloudronScope, routes.user.requireAdmin, routes.mail.getMailboxes);
-    router.get ('/api/v1/mail/:domain/mailboxes/:userId',  cloudronScope, routes.user.requireAdmin, routes.mail.getUserMailbox);
-    router.post('/api/v1/mail/:domain/mailboxes/:userId',  cloudronScope, routes.user.requireAdmin, routes.mail.enableUserMailbox);
-    router.del ('/api/v1/mail/:domain/mailboxes/:userId',  cloudronScope, routes.user.requireAdmin, routes.mail.disableUserMailbox);
+    router.post('/api/v1/mail/:domain/send_test_mail',  settingsScope, routes.user.requireAdmin, routes.mail.sendTestMail);
+    router.get ('/api/v1/mail/:domain/mailboxes',  settingsScope, routes.user.requireAdmin, routes.mail.getMailboxes);
+    router.get ('/api/v1/mail/:domain/mailboxes/:userId',  settingsScope, routes.user.requireAdmin, routes.mail.getUserMailbox);
+    router.post('/api/v1/mail/:domain/mailboxes/:userId',  settingsScope, routes.user.requireAdmin, routes.mail.enableUserMailbox);
+    router.del ('/api/v1/mail/:domain/mailboxes/:userId',  settingsScope, routes.user.requireAdmin, routes.mail.disableUserMailbox);
+    router.get ('/api/v1/mail/:domain/aliases/:userId', settingsScope, routes.user.requireAdmin, routes.mail.getAliases);
+    router.put ('/api/v1/mail/:domain/aliases/:userId', settingsScope, routes.user.requireAdmin, routes.mail.setAliases);
 
     // feedback
     router.post('/api/v1/feedback', usersScope, routes.cloudron.feedback);
diff --git a/src/user.js b/src/user.js
index 3acd343af..55d4837b2 100644
--- a/src/user.js
+++ b/src/user.js
@@ -19,9 +19,7 @@ exports = module.exports = {
     createOwner: createOwner,
     getOwner: getOwner,
     sendInvite: sendInvite,
-    setGroups: setGroups,
-    setAliases: setAliases,
-    getAliases: getAliases
+    setGroups: setGroups
 };
 
 var assert = require('assert'),
@@ -37,7 +35,6 @@ var assert = require('assert'),
     GroupError = groups.GroupError,
     hat = require('hat'),
     mailer = require('./mailer.js'),
-    mailboxdb = require('./mailboxdb.js'),
     safe = require('safetydance'),
     tokendb = require('./tokendb.js'),
     userdb = require('./userdb.js'),
@@ -80,7 +77,7 @@ UserError.WRONG_PASSWORD = 'Wrong User or Password';
 UserError.BAD_FIELD = 'Bad field';
 UserError.BAD_TOKEN = 'Bad token';
 
-// keep this in sync with validateGroupname
+// keep this in sync with validateGroupname and validateAlias
 function validateUsername(username) {
     assert.strictEqual(typeof username, 'string');
 
@@ -553,49 +550,3 @@ function sendInvite(userId, options, callback) {
     });
 }
 
-function setAliases(userId, aliases, callback) {
-    assert.strictEqual(typeof userId, 'string');
-    assert(util.isArray(aliases));
-    assert.strictEqual(typeof callback, 'function');
-
-    for (var i = 0; i < aliases.length; i++) {
-        aliases[i] = aliases[i].toLowerCase();
-
-        var error = validateUsername(aliases[i]);
-        if (error) return callback(error);
-    }
-
-    userdb.get(userId, function (error, user) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
-
-        if (!user.username) return new UserError(UserError.BAD_FIELD, 'Username must be set before settings aliases');
-
-        mailboxdb.setAliasesForName(user.username, config.fqdn(), aliases, function (error) {
-            if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new UserError(UserError.ALREADY_EXISTS, error.message));
-            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-            if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
-
-            callback(null);
-        });
-    });
-}
-
-function getAliases(userId, callback) {
-    assert.strictEqual(typeof userId, 'string');
-    assert.strictEqual(typeof callback, 'function');
-
-    userdb.get(userId, function (error, user) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-        if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
-
-        if (!user.username) return callback(null, [ ]);
-
-        mailboxdb.getAliasesForName(user.username, config.fqdn(), function (error, aliases) {
-            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new UserError(UserError.NOT_FOUND));
-            if (error) return callback(new UserError(UserError.INTERNAL_ERROR, error));
-
-            callback(null, aliases);
-        });
-    });
-}