Setting up the mail server

Everything here happens on Server → Services → Mail delivery & DNS, which shows its mail cards once Email Server is installed under Server → System → Features. A new mail server is closed to the internet: webmail works, but mail apps and other mail servers can't connect until you open it. Work down the page in this order and each step unlocks the next.

Open mail stays greyed out until four things are in place: delivery through Dovecot, a mail certificate, Spam Protection and fail2ban. The Public mail card lists whichever is missing.

Check delivery into mailboxes

The Delivery into mailboxes card should show Dovecot and its version. If it says "Postfix (not switched)", press Switch to Dovecot. If the switch was refused, the card gives the reason and mail keeps being delivered by Postfix meanwhile. Fix what it names, then press Switch to Dovecot again.

Give the server a mail hostname

Under Mail certificates, enter the Server mail hostname, such as mail.yourcompany.com, and press Save and request. Its A or AAAA record must point at this server; the card shows the addresses to use.

Hostctl requests a Let's Encrypt certificate for the name and installs it in Postfix and Dovecot. If the name sits under a hosted domain with an active wildcard certificate, that certificate is used instead. The badge next to the name shows progress:

• Requesting… while Let's Encrypt is asked.
• Waiting for DNS until the name points here. Fix the record, then press Check again.
• Couldn't be issued, with What Let's Encrypt said underneath. Press Check again once you've fixed the cause.
• Let's Encrypt · until a date once it's in place. Renewals install themselves.

This is the name mail apps can always use, and the one FTP's certificate comes from (see FTP encryption). Ask your server provider to set the reverse DNS (PTR) of the server's IPv4 address to the same name; many receiving servers distrust mail without it.

Mail names for each domain

Each domain with mail hosting and at least one mailbox gets a row for its mail.example.com name. Mail apps that connect to that name are shown a certificate for it:

• The domain's own certificate is used when it covers the name: an active Let's Encrypt wildcard, or an uploaded certificate that names it.
• Otherwise, once mail.example.com points at this server, Hostctl requests a separate Let's Encrypt certificate for it.
• Until then the row shows Waiting for DNS. It's checked daily, or press Check again. Customers can use the server mail hostname meanwhile.

Publish SPF, DKIM and DMARC

Pick a domain under Choose a domain at the bottom of the page.

Receiving mail. Press Check receiving DNS to see where the domain's MX record points and whether its mail hostname resolves. It only reads DNS. An MX at another provider shows as Other provider: leave it if that provider should keep receiving the domain's mail.

Sending. The card shows the route: Direct from this server, or Relay through a smarthost.

For direct sending:

1. Fill in Mail server hostname / HELO and Public outbound IPv4 (and Public outbound IPv6 (if used)). Use the addresses mail actually leaves from.
2. Press Prepare DKIM key. This needs Spam Protection applied and healthy (see spam protection).
3. Press Save and preview DNS. The preview marks each record create, update, keep or blocked. A blocked record, such as two SPF records or a different DKIM record at the same name, has to be sorted out by hand first:
   • SPF on the domain. An existing SPF record keeps its senders and gets this server's addresses added; a new one ends in ~all.
   • DMARC at _dmarc. An existing policy is kept; a new one is p=none.
   • DKIM at the key's selector under _domainkey.
   • Mail hostname A and AAAA records, when the hostname is under this domain.
4. Publish the records. When the domain's DNS is on Cloudflare with an API token in Hostctl, press Publish reviewed changes to Cloudflare. Otherwise copy the records to your DNS provider. A preview expires after 15 minutes.
5. Press Verify public DNS (it runs by itself after publishing to Cloudflare). Repeat it once DNS has had time to update.
6. Press Enable signing after DNS verification. Hostctl checks the published key matches, then signs mail that mailboxes send after signing in. Mail apps may reconnect briefly.

For a relay, enter the Relay provider's SPF include hostname and the Relay provider's DKIM records (one per line) from the provider's dashboard, then preview and publish the same way. The relay provider does the signing.

Send a real test message to an outside mailbox afterwards and check its SPF, DKIM and DMARC results.

Open mail to the internet

Once the Public mail card shows "Ready", press Open mail. Hostctl opens these ports and checks each one from the server itself:

Port	For
25	Mail from other servers. No sign-in on this port.
587	Mail apps sending, with STARTTLS
465	Mail apps sending, with SSL/TLS
993	IMAP, with SSL/TLS
995	POP3, with SSL/TLS

Plain IMAP and POP3 stay on the server for webmail only. Signing in always needs encryption, a mailbox can send only as its own address (or a plus form of it), and messages can be up to 50 MB. The card then shows the settings to give customers; setting up email walks them through it.

Hostctl's firewall opens these ports while they're in use. If your server provider also filters traffic, open them there too.

The card may also warn, without blocking:

• A domain's MX record points elsewhere. Its mail keeps arriving at the other provider until you change the MX.
• Reverse DNS doesn't match. Ask your server provider to set it.
• This server can't reach other mail servers on port 25. Many providers block outgoing port 25. See below.

Close mail undoes all of it. While mail is open, Spam Protection can't be turned off.

Outgoing port 25 is blocked

Receiving mail and IMAP still work, but outgoing mail waits in the queue until the provider unblocks port 25. Either ask them to, or send through a relay (smarthost) such as SendGrid, Mailgun or Mailjet:

1. Open Server → Services → Smarthost.
2. Turn on Enable smarthost, and enter the SMTP relay hostname (in brackets, such as [smtp.sendgrid.net]) and Port.
3. Turn on Authentication required and enter the relay's Username and Password / API key.
4. Press Save & Apply.

To use a relay for one domain only, use that domain's Smarthost tab instead. Then publish the relay's SPF and DKIM records as described above.

Sending limits

Under Sending limits, set how many recipients a mailbox may send to An hour and A day from mail apps and webmail, then press Save limits. The defaults are 100 and 500; 0 means no limit. A message to 10 people counts as 10. Mail that websites send isn't counted.

A message that would go over is refused with "Sending limit reached for this mailbox; try again later", which the mail app shows. Nothing bounces or is lost. Held by the sending limits in the last day lists who hit a limit. A sudden burst from one mailbox often means a stolen password, so check with its owner before raising anything.

To give one mailbox its own limits, choose it under Mailbox, enter both numbers and press Set for this mailbox. Use the server's puts it back on the defaults. Up to 1,000 mailboxes can have their own limits.