diff --git a/bin/Makefile b/bin/Makefile
index cda55d79..348a87fd 100644
--- a/bin/Makefile
+++ b/bin/Makefile
@@ -42,10 +42,11 @@ vzrestore.1.pod: vzrestore
 	perl -I.. ./vzrestore printmanpod >$@
 
 .PHONY: install 
-install: ${SCRIPTS} ${MANS}
+install: ${SCRIPTS} ${MANS} pvemailforward
 	perl -I.. ./pvesh verifyapi
 	install -d ${BINDIR}
 	install -m 0755 ${SCRIPTS} ${BINDIR}
+	install -m 2755 -g www-data pvemailforward ${BINDIR}
 	install -d ${MAN1DIR}
 	install -m 0644 ${MANS} ${MAN1DIR}
 	install -d ${PODDIR}
diff --git a/bin/pvemailforward b/bin/pvemailforward
new file mode 100755
index 00000000..10d0b655
--- /dev/null
+++ b/bin/pvemailforward
@@ -0,0 +1,40 @@
+#!/usr/bin/perl -w -T
+
+use strict;
+use warnings;
+use PVE::Tools;
+use PVE::SafeSyslog;
+use PVE::AccessControl;
+
+# NOTE: we need to run this with setgid www-data
+# else we cant read /etc/pve/user.cfg
+
+$ENV{'PATH'} = '/sbin:/bin:/usr/sbin:/usr/bin';
+
+initlog('pvemailforward');
+
+eval {
+    # note: that fails because we run with wrong uid (nobody)
+    #my $usercfg = cfs_read_file("user.cfg");
+    my $filename = "/etc/pve/user.cfg";
+    my $raw = PVE::Tools::file_get_contents($filename);
+    my $usercfg = PVE::AccessControl::parse_user_config($filename, $raw);
+
+    my $rootcfg = $usercfg->{users}->{'root@pam'} || {};
+    my $mailto = $rootcfg->{email};
+
+    die "user 'root\@pam' does not have a email address\n" if !$mailto;
+
+    syslog("info", "forward mail to <$mailto>");
+
+    # we never send DSN (avoid mail loops)
+    open(CMD, "|sendmail -bm -N never $mailto") ||
+	die "can't exec sendmail - $!\n";
+    while (<>) { print CMD $_; }
+    close(CMD);
+};
+if (my $err = $@) {
+    syslog('err', "mail forward failed: $err");
+}
+
+exit(0);
diff --git a/debian/postinst b/debian/postinst
index 50469d63..1df1c3c9 100755
--- a/debian/postinst
+++ b/debian/postinst
@@ -38,7 +38,16 @@ case "$1" in
     mkdir /etc/pve 2>/dev/null || true
 
     test -e /var/lib/pve-manager/apl-available || cp /usr/share/doc/pve-manager/aplinfo.dat /var/lib/pve-manager/apl-available
-    
+
+    if test -f /root/.forward; then
+	if ! grep -q '|/usr/bin/pvemailforward' /root/.forward; then 
+	    echo "|/usr/bin/pvemailforward\n$(cat /root/.forward)" >/root/.forward.tmp
+	    mv /root/.forward.tmp /root/.forward
+	fi
+    else
+	echo '|/usr/bin/pvemailforward' >/root/.forward
+    fi
+	
     update-rc.d pvedaemon defaults 21 79 >/dev/null
     update-rc.d pvestatd defaults 21 79 >/dev/null
     update-rc.d pvebanner start 99 2 3 4 5 >/dev/null