diff --git a/src/mail.js b/src/mail.js
index 0143361ac..424692cd2 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -25,6 +25,7 @@ exports = module.exports = {
     removeMailboxes: removeMailboxes,
     getMailbox: getMailbox,
     addMailbox: addMailbox,
+    updateMailbox: updateMailbox,
     removeMailbox: removeMailbox,
 
     listAliases: listAliases,
@@ -34,6 +35,7 @@ exports = module.exports = {
     getLists: getLists,
     getList: getList,
     addList: addList,
+    updateList: updateList,
     removeList: removeList,
 
     _readDkimPublicKeySync: readDkimPublicKeySync,
@@ -910,6 +912,20 @@ function addMailbox(name, domain, userId, callback) {
     });
 }
 
+function updateMailbox(name, domain, userId, callback) {
+    assert.strictEqual(typeof name, 'string');
+    assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof userId, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    mailboxdb.update(name, domain, userId, mailboxdb.TYPE_USER, function (error) {
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new MailError(MailError.NOT_FOUND, 'no such mailbox'));
+        if (error) return callback(new MailError(MailError.INTERNAL_ERROR, error));
+
+        callback(null);
+    });
+}
+
 function removeMailbox(name, domain, callback) {
     assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof name, 'string');
@@ -1018,6 +1034,20 @@ function addList(domain, listName, groupId, callback) {
     });
 }
 
+function updateList(name, domain, groupId, callback) {
+    assert.strictEqual(typeof name, 'string');
+    assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof groupId, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    mailboxdb.update(name, domain, groupId, mailboxdb.TYPE_GROUP, function (error) {
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new MailError(MailError.NOT_FOUND, 'no such mailbox'));
+        if (error) return callback(new MailError(MailError.INTERNAL_ERROR, error));
+
+        callback(null);
+    });
+}
+
 function removeList(domain, listName, callback) {
     assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof listName, 'string');
diff --git a/src/mailboxdb.js b/src/mailboxdb.js
index 4a891df24..d990012da 100644
--- a/src/mailboxdb.js
+++ b/src/mailboxdb.js
@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     add: add,
+    update: update,
     del: del,
 
     listAliases: listAliases,
@@ -50,6 +51,21 @@ function add(name, domain, ownerId, ownerType, callback) {
     });
 }
 
+function update(name, domain, ownerId, ownerType, callback) {
+    assert.strictEqual(typeof name, 'string');
+    assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof ownerId, 'string');
+    assert.strictEqual(typeof ownerType, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    database.query('UPDATE mailboxes SET ownerId = ? WHERE name = ? AND domain = ? AND ownerType = ?', [ ownerId, name, domain, ownerType ], function (error, result) {
+        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (result.affectedRows === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+
+        callback(null);
+    });
+}
+
 function clear(callback) {
     assert.strictEqual(typeof callback, 'function');
 
diff --git a/src/routes/mail.js b/src/routes/mail.js
index 11563f944..37d3262c4 100644
--- a/src/routes/mail.js
+++ b/src/routes/mail.js
@@ -20,6 +20,7 @@ exports = module.exports = {
     getMailboxes: getMailboxes,
     getMailbox: getMailbox,
     addMailbox: addMailbox,
+    updateMailbox: updateMailbox,
     removeMailbox: removeMailbox,
 
     listAliases: listAliases,
@@ -29,6 +30,7 @@ exports = module.exports = {
     getLists: getLists,
     getList: getList,
     addList: addList,
+    updateList: updateList,
     removeList: removeList
 };
 
@@ -238,6 +240,20 @@ function addMailbox(req, res, next) {
     });
 }
 
+function updateMailbox(req, res, next) {
+    assert.strictEqual(typeof req.params.domain, 'string');
+    assert.strictEqual(typeof req.params.name, 'string');
+
+    if (typeof req.body.userId !== 'string') return next(new HttpError(400, 'userId must be a string'));
+
+    mail.updateMailbox(req.params.name, req.params.domain, req.body.userId, function (error) {
+        if (error && error.reason === MailError.NOT_FOUND) return next(new HttpError(404, error.message));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(204));
+    });
+}
+
 function removeMailbox(req, res, next) {
     assert.strictEqual(typeof req.params.domain, 'string');
     assert.strictEqual(typeof req.params.name, 'string');
@@ -333,6 +349,20 @@ function addList(req, res, next) {
     });
 }
 
+function updateList(req, res, next) {
+    assert.strictEqual(typeof req.params.domain, 'string');
+    assert.strictEqual(typeof req.params.name, 'string');
+
+    if (typeof req.body.groupId !== 'string') return next(new HttpError(400, 'groupId must be a string'));
+
+    mail.updateList(req.params.name, req.params.domain, req.body.groupId, function (error) {
+        if (error && error.reason === MailError.NOT_FOUND) return next(new HttpError(404, error.message));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(204));
+    });
+}
+
 function removeList(req, res, next) {
     assert.strictEqual(typeof req.params.domain, 'string');
     assert.strictEqual(typeof req.params.name, 'string');
diff --git a/src/server.js b/src/server.js
index 2a47e384c..e13bdeb56 100644
--- a/src/server.js
+++ b/src/server.js
@@ -228,6 +228,7 @@ function initializeExpressSync() {
     router.get ('/api/v1/mail/:domain/mailboxes',  settingsScope, routes.user.requireAdmin, routes.mail.getMailboxes);
     router.get ('/api/v1/mail/:domain/mailboxes/:name',  settingsScope, routes.user.requireAdmin, routes.mail.getMailbox);
     router.post('/api/v1/mail/:domain/mailboxes',  settingsScope, routes.user.requireAdmin, routes.mail.addMailbox);
+    router.post('/api/v1/mail/:domain/mailboxes/:name',  settingsScope, routes.user.requireAdmin, routes.mail.updateMailbox);
     router.del ('/api/v1/mail/:domain/mailboxes/:name',  settingsScope, routes.user.requireAdmin, routes.mail.removeMailbox);
     router.get ('/api/v1/mail/:domain/aliases', settingsScope, routes.user.requireAdmin, routes.mail.listAliases);
     router.get ('/api/v1/mail/:domain/aliases/:name', settingsScope, routes.user.requireAdmin, routes.mail.getAliases);
@@ -235,6 +236,7 @@ function initializeExpressSync() {
     router.get ('/api/v1/mail/:domain/lists', settingsScope, routes.user.requireAdmin, routes.mail.getLists);
     router.post('/api/v1/mail/:domain/lists', settingsScope, routes.user.requireAdmin, routes.mail.addList);
     router.get ('/api/v1/mail/:domain/lists/:name', settingsScope, routes.user.requireAdmin, routes.mail.getList);
+    router.post('/api/v1/mail/:domain/lists/:name', settingsScope, routes.user.requireAdmin, routes.mail.updateList);
     router.del ('/api/v1/mail/:domain/lists/:name', settingsScope, routes.user.requireAdmin, routes.mail.removeList);
 
     // feedback