Email

What this page is for: host mailboxes for your domains on this server — [email protected], [email protected] — with forwarders, an autoresponder, filters, webmail in the browser, and spam filtering, all managed from the panel's Email page (right after Projects in the menu).

You need

• A domain whose DNS you control. On Cloudflare (an account added to the panel) the panel writes every record for you; anywhere else it lists them for you to create.
• Five ports open at your server provider's firewall: 25, 465, 587, 993 and 995 (below). Mail reaches this server directly, not through Cloudflare. A sixth only if you turn on an extra port for mail apps — 2525, 2587 or 2465.
• About 350 MB of memory while it is quiet, and a server with at least 1.4 GB in all. It runs on every release SixPanel supports — Ubuntu 26.04, Ubuntu 24.04 and Debian 13 — on amd64 and arm64.

What gets installed

All of it comes from the release's own packages (Roundcube from its own published release, checked against its published checksum). Each service has a memory ceiling sized from this server's memory, so the mail server can never take memory your shops need.

The ports

SixPanel opens these on this server's own firewall while Email is installed, and closes them when it is removed — an extra port for mail apps too, when you switch it on or off. They show on Server → Firewall → Port rules as Opened by SixPanel Email — follows the service, with no Remove button; to keep one closed anyway, add a deny rule for it. A port a rule of yours already opens to everybody gets no second rule, and your rule is never touched. With the firewall off the rules are kept and apply the moment you turn it on. Panels that had Email before this release get the rules when they start.

What SixPanel cannot open is your server provider's firewall (the security group, firewall rules or network settings of the server) — open these there:

There is no unencrypted way in: every password goes over TLS. Plain IMAP (143) answers on this server only, for the webmail, and plain POP3 is off.

Port 25 cannot move. Other mail servers deliver only to port 25 — a domain's MX record names a host, never a port — so no other port can receive mail for your domains, and SixPanel offers none in its place: when 25 is blocked coming in, your provider has to open it. Sending to other mail servers is port 25 as well; when that is blocked going out, mail leaves through a relay (below). Mail apps are different — they can send on another port: Extra ports for mail apps.

Can mail reach this server?

The Can mail reach this server? card on the Email page — on Overview, and before the install too — checks all of these at once when you press Check reachability: AllsWeb tries 25, 465, 587, 993 and 995 from the internet (this server's own address only, nothing sent), and the server tries port 25 going out. A port your provider's firewall closes reads Blocked by your server provider, with where to open it at the provider this server runs at; one nothing listens on yet reads Nothing listens (normal before the install). Inbound port 25 can read Not checked from outside: AllsWeb itself runs where outgoing 25 is blocked, so it cannot always try it. How the check works: Check that the internet can reach a port.

Above the ports, the card says what a block means for your mail and what SixPanel does about it:

• Port 25 going out is blocked and a relay is set: "Port 25 is blocked by Google Cloud, so mail leaves through smtp.example.com on port 587" — your provider's name and your relay.
• Port 25 going out is blocked and no relay is set: your provider's own rule for port 25, and the way round it until they open it: a relay service of your own. A relay usually also takes port 2525 (some 2587 or 2465), for a network that blocks 587 as well — the card says whether this server reaches relay services on 2525.
• Port 25 coming in is blocked: other mail servers deliver only to port 25, so no other port can receive mail for your domains — your provider must open it (the card says where), or, when it is this server's own firewall, allow it on Server → Firewall.
• 587 or 465 is blocked from the internet and the email server has an alternate port on: the card names the alternate as the port to set your mail apps to.

The same is on Server → Health, in the row Ports SixPanel needs.

Port 25 going OUT

Many providers block mail leaving on port 25 to stop spam from new servers: Google Cloud always, AWS until you ask them to lift it, and several others. The install tests it, and Email → Overview → Test port 25 tests it again whenever you like (a connection to a big mail server; nothing is sent).

When it is blocked, mail to other servers waits in the queue. Two ways out:

• ask the provider to open outbound port 25 (AWS has a form for it), or
• send through a relay — Email → Settings → Send through a relay: a sending service of your own choice, with its host, user name and password. The password is kept in a file only the system can read; the panel never shows it again. Put the relay service's SPF name in Its SPF name so your domains' SPF names it too.

The relay's port is found from this server. With Port on Automatic (the default), saving the relay asks it for its greeting on 587, 465, 2525, 2587 and 2465 at once — a connection only: nothing is sent and no password goes anywhere — and takes the first in that order that answers. The card says which and why, for instance "587 is blocked here, so the relay is reached on 2525". A port reads blocked here when a well-known mail service does not answer on it from this server either (your provider blocks it); one that is open from here and that the relay does not take is named as such. When none answers, nothing is saved and the card says so. Choose the port yourself when the relay service names one — changing only the port keeps the saved password.

The relay is tried before it is saved. Saving signs in to the relay the way Postfix will — its greeting, TLS (from the first byte on 465 and 2465, STARTTLS on the others) and your user name and password — and sends nothing. When that fails, nothing is saved and the card says which kind of failure it was: could not be reached on that port (no connection, or a connection and no greeting — your provider blocks the port; choose another of the relay's ports), or refused the sign-in (check the user name and password). Test the relay asks the same of the saved relay at any time.

Which relay ports leave this server is written above the form, from the last reachability check: for example "relay ports that leave: 465, 587, 2465 — blocked going out: 25". Use one of those your relay service takes; its own instructions list them.

Use the alert mail's relay. When Settings → Alert email already sends through a relay with a user name and password (on port 2465, say), the card offers it in one press — with "its last message was accepted" when it has proven to work. SixPanel uses the saved password on the server; it is never sent to your browser.

Waiting mail goes at once. Once a relay is saved, the messages that waited in the queue for a way out are sent again straight away.

Nothing else about sending moves: without a relay, mail to other mail servers goes on port 25, the only port they take it on.

IPv6. SixPanel Email sends over IPv6 only when this server has an IPv6 route to the internet; without one (many Google Cloud and AWS servers) it uses IPv4 alone, so no message waits on "Network is unreachable". It looks again every five minutes, and restarts Postfix when a route appears or goes.

Why cPanel "does not have this problem"

It does, on the same cloud. Google Cloud blocks port 25 going out for every server, whatever runs on it, and AWS, Azure, DigitalOcean, Hetzner, Vultr and Oracle do the same until you ask — cPanel on those clouds also needs a relay (cPanel calls it a smarthost) or the provider's permission. cPanel is usually met on hosting where the provider already set that up. SixPanel tests port 25 at the install, says when it is blocked and by whom, and sets the relay up for you — in one press, when the panel's alert mail already has one.

The smarthost route, as cPanel does it. In cPanel/WHM, Exim is told to hand every message leaving the server to a smarthost: a relay service's host on a port the provider leaves open (587, 465, 2525, 2465), signed in with its user name and password. The relay then delivers it on port 25 from its own servers. SixPanel's Send through a relay is that same setting for Postfix (relayhost, with the sign-in in a root-only file): mail from every mailbox, every autoresponder and forward, and the panel's own alerts when they go through this server's mail server, all leave that way. You do not need to change provider.

A relay sends for your domain only once the domain says it may. Every relay service asks you to verify the domain in its own account and to publish a few records of its own — put them under Records this relay needs. Until then it refuses the sender, and SixPanel says so in plain words (below).

Records this relay needs

Email → Settings → Send through a relay → Records this relay needs (shown once a relay is saved). The relay service's instructions list the records it wants: usually an SPF include:, one or two DKIM keys (a TXT, or a CNAME to a key it rotates itself), and often a return-path or bounce name (a CNAME, or an MX and a TXT). Choose the mail domain and paste them as the service shows them, one a line — type, name, value:

TXT   @                 v=spf1 include:spf.relay.example ~all
CNAME s1._domainkey     s1.dkim.relay.example
MX    bounce            10 feedback.relay.example
TXT   bounce            v=spf1 include:spf.relay.example ~all

Names may be written relative to the domain (s1._domainkey, @ for the domain itself) or whole; quotes and a trailing dot are fine. Each line is checked before anything is saved:

• the type is TXT, CNAME or MX — nothing else is a relay's;
• the name is inside the mail domain — not another domain, not the mail host, not _dmarc (the domain's own policy, which the panel keeps), and not this server's own DKIM selector;
• no CNAME or MX at the domain itself (a CNAME there would replace every record of it; an MX there would send your incoming mail to the relay), and a CNAME is the only record of its name.

An SPF line for the domain itself is merged into the domain's one SPF record — two SPF records make receivers ignore both — so include:spf.relay.example is added next to mx and this server's address. Then press Apply DNS records on the domain (Email → Domains): the relay's records are written with the domain's own, through Cloudflare, each marked as the panel's. A CNAME goes behind the orange cloud like every record Cloudflare can proxy; mail lookups still work through a proxied CNAME (measured: its TXT and MX answer as the target's). A name Cloudflare never proxies (smtp, mail, _dmarc…) cannot be a relay CNAME here — ask the service for another. TXT and MX records have no proxy at all. Check delivery then asks public DNS for each of them, and names the one that is missing.

No relay company is suggested here: use the one you have an account with.

When the relay says no

A relay answers a refusal in its own words. SixPanel puts one plain line before them — in the Queue, in Test the relay, when a relay you save is refused, in Send a test message and on Server → Health:

Test the relay signs in and also offers a sender — postmaster@ your first mail domain — then resets: no recipient and no message, nothing is sent. A relay that has not verified the domain usually says so right there.

Send a test message

Email → Settings → Send a test message: choose one of this server's mailboxes, type an address of yours at another provider, and press Send. The message goes the way mail really leaves this server — straight out on port 25, or through the relay — and the card waits up to 30 seconds for the mail log's answer for it: its queue id, status=sent / deferred / bounced, where it went (the receiving server or the relay) and that server's own reply, with the plain line above when it is a refusal. Still no answer after 30 seconds: it is in the Queue and the Delivery log. At most ten test messages an hour leave the server.

Alerts through this server's mail server

The panel's own alert email (Settings → Alert email) can go out two ways:

• an SMTP server — a mail provider's host, port, user name and password, as before; or
• this server's mail server (SixPanel Email) — offered once Email is installed. Nothing is typed but the from address and the recipients: no password is stored for it and no port is opened. The panel hands each alert to Postfix on this server, so it leaves exactly as your mailboxes' mail does — signed with the domain's DKIM key, straight out or through the relay. The from must be an address of one of this server's mail domains (the field offers its mailboxes); an address of another domain is refused.

Send a test email there proves it end to end: it waits for the mail log's answer and shows the queue id, the status and the relay's reply. The SMTP settings are kept while this server's mail server is chosen, so switching back needs nothing typed again. If the email server is removed, the alerts read as not set up until you choose an SMTP server.

Every port mail uses

Email → Overview → Every port mail uses (and the same card on Server → Firewall while the email server is installed) lists every port in both directions:

• coming in — 25, 465, 587, 993, 995 and any extra port for mail apps that is on. 143, 110 and 4190 appear only when something answers on them from the internet, marked not needed: SixPanel keeps 143 for the webmail on this server only and never opens 110 or 4190;
• going out — 25, and the relay ports 465, 587, 2525, 2465 and 2587.

Each says whether something listens (IPv4, IPv6), what this server's own firewall does, and what the last reachability check saw from the internet. A port held up at your provider's firewall carries the exact rule to add there (for Google Cloud: VPC network → Firewall → Create firewall rule, TCP and the port). SixPanel opens the mail ports on this server's own firewall when Email is installed and closes them when it is removed. With a working relay saved, port 25 going out reads blocked — mail goes through the relay, and neither the card nor Server → Health warns about it.

Extra ports for mail apps

Mail apps send on 587 or 465, and some networks block those two — a firewall at your server provider in front of this server, or a hotel's or an office's network the app sends from. Email → Settings → Extra ports for mail apps has three more that answer exactly as they do:

The rules are those of 587 and 465: a mailbox's sign-in over TLS only, the sender must be the mailbox's own address (or a forwarder that delivers to it) and never empty, the hourly limit of Email → Settings counted per mailbox whichever port it sends on, and five wrong passwords ban the address that tried them on every mail port.

• Each is off until the server owner turns it on; the panel asks first. Turning one off asks too: a mail app set to it stops sending until it is set back to 587 or 465.
• SixPanel suggests one — it never turns one on by itself. When the last port check (the Can mail reach this server? card, or the one on Server → Firewall) found 587 or 465 blocked from the internet by your server provider or a firewall in front of this server, the card says so and which to turn on: "587 is blocked by <provider> on this network, so mail apps cannot send through it. Turn on 2525 for them" — your provider's name when the panel recognises it. It suggests 2525 for 587 (2587 when the check saw 2525 blocked too) and 2465 for 465.
• Once one is on it is a mail port like the others: on Overview → Listening, tried from the internet by the next port check, and on Server → Firewall, which suggests allowing it while this server's own firewall is on (the card names it until you do). A provider that blocks ports until you open them needs TCP 2525 (or 2587, 2465) opened there too.
• Mail apps are told. While 587 or 465 is blocked and its extra port is on, the mailbox page's Settings for mail apps card names the extra port in its place and says why — "587 is blocked by <provider> on this network, so use 2525." — and so do the settings files Thunderbird and Outlook read (autoconfig.<domain>, autodiscover.<domain>, where the domain's webmail is on).

Port 25 has none, and none is offered: other mail servers deliver only to 25 (above).

Installing

Software → Email server → Install, or the Install the email server button on the Email page. You can name your first domain and the mail host there, or leave both for later. Software's Install opens the Email page, because the install starts with a check.

The check before the install

Pressing Install first checks every mail port. AllsWeb tries 25, 465, 587, 993 and 995 from the internet, and this server tries 25 and the relay ports going out. The dialog then says what it found, in one line per case:

• Everything reachable: Install.
• This server's own firewall closes them: the install allows them there itself. The rules belong to Email and are removed with it. A deny rule of yours is never removed. The dialog names it, and you remove it on Server → Firewall.
• The cloud firewall in front of the server closes them (an AWS security group, a Google Cloud VPC rule, a Hetzner firewall…): the dialog lists the rule to add there, one line per port, in that provider's own click-path. Nothing on the server can open it. Until port 25 is let in there, mail from other servers will not arrive. You can still press Install anyway and check again afterwards.
• Port 25 going out is blocked: "This server's provider blocks port 25 going out; nothing on the server opens it. Mail to other servers will leave only through a relay (smarthost). Set one up after install in Email → Settings." Receiving, webmail, mailboxes and mail between this server's own addresses all work without it. Press Install anyway, and once the install is done the page opens on Email → Settings → Send through a relay. The dialog also lists which relay ports leave this server.

The install is refused only when it really cannot run, for example when another mail server already answers on port 25. A port you have to open somewhere else never stops it. Check again repeats the check.

Before the install, port 25 cannot be tried from outside: AllsWeb's own network does not dial out on 25, and nothing listens on it yet. The dialog therefore goes by the other four ports. When the provider holds all of them, it takes 25 to be held too. When all of them pass, 25 most likely passes as well. After the install, the mail server's own log measures port 25. A connection from any public address in the last three days means the internet reaches it. Mail servers and scanners find an open port 25 within hours. A day or more of Postfix listening on 25 with no outside connection at all means something in front holds it. The window starts again when the firewall changes.

The install itself takes a few minutes: the packages, a mail account that owns every mailbox's files, the configuration, a first certificate, and the port 25 test.

Before mail can go out

After the install, Email → Overview shows a short checklist until every line is ticked. Each line has the one press that fixes it, or the exact thing to do outside this server:

The list uses only what the panel already knows, from the last check, the mail log and DNS. Opening the page tests nothing. While a relay carries the mail, a wrong PTR does not keep the list open, because receivers see the relay's address instead.

The mail host

The mail host is the name other mail servers and mail apps connect to — usually mail.yourdomain.com. The panel suggests mail.<your first domain> and you can change it on Email → Settings. One mail host serves every domain on the server.

It is the one record the panel writes DNS only (not proxied): Cloudflare's proxy carries web traffic, and mail must reach this server itself. Every other record that can be proxied stays proxied. The mail host must be a name of its own — never a website's, a shop's or the panel's address, and never one of a mail domain's webmail names. Every door a name comes in by asks the same question: a website, a shop (its www twin included), its live-updates address, the panel's own address (from the panel or over SSH) and a project restored or moved here are each refused a name the mail server answers on, with the reason. If a name is shared anyway (from before), neither Apply writes it: the Email page names the clash and the DNS tab of the Cloudflare page shows it blocked. Nor is it ever a domain itself — example.com, or example.co.uk under a two-label suffix — whose record is that domain's own address.

Renaming it keeps the old name's DNS-only record while your domains' MX still name it. Apply each domain's DNS records (that moves its MX to the new name); the Apply after the last one removes the old record, as long as it is still the one the panel wrote and points here. Until then the Cloudflare page's DNS tab lists it among the records the panel wrote that nothing needs any more.

Reverse DNS (PTR)

Big mail providers refuse mail from a server whose address has no matching reverse name. Email → Overview shows the exact line to ask your server provider for — "set the reverse DNS of 203.0.113.10 to mail.yourdomain.com". It is set at the provider (their dashboard, or a support ticket), not in your DNS zone.

Server → Health warns (it never fails the row: mail still leaves) while this server's IPv4 reverse name is not the mail host, and says where it is set at the provider it runs at:

• Google Cloud — Compute Engine → VM instances → the VM → Edit → Network interfaces → the interface → External IPv4 address → turn on public DNS PTR record and enter the mail host (Google first asks you to verify the domain);
• AWS — reverse DNS is set on an Elastic IP: EC2 → Elastic IPs → the address → Actions → Update reverse DNS (the mail host's A record must point at it first);
• any other provider — ask them, by name when SixPanel recognises it.

While a relay carries your mail, receivers see the relay's address rather than this server's.

The certificate

The install gives the mail host a self-signed certificate so everything works at once; mail apps warn about it. Once the mail host's DNS record points here, press Email → Overview → Get the certificate: Let's Encrypt issues one (through Cloudflare when its token holds the zone, otherwise over port 80) and it renews by itself.

Domains

Email → Domains → Add a mail domain. Each domain can be tied to the website it belongs to.

DNS records

DNS records shows what the domain needs against what its DNS holds now:

Apply writes what is missing and corrects what is SixPanel's own. It reads the zone again right before it writes, merges SPF (anything already allowed to send for the domain stays allowed), keeps a DMARC record you already have, and deletes nothing. A record that sends mail somewhere else today — an MX to Google Workspace, say — is shown with where it points, and is changed only when you tick it — and only while it still points there: one that changed after the list was drawn is left as it is, for you to look at again. New domains get DMARC quarantine, or none when their SPF already names another sending service.

The DNS tab of the panel's Cloudflare page shows the same records beside every other record of the zone.

Check delivery

Check delivery answers "why does my mail go to spam?": MX points here, the mail host's address, reverse DNS, SPF (with the relay's include when one is set), DKIM, DMARC, the relay's own records, the big block lists, outbound port 25 and the certificate — each with what to do.

Unrouted mail (catch-all)

Mail to an address of the domain that is no mailbox and no forwarder is refused by default. Unrouted mail can instead forward it to one mailbox of the same domain (for example info@) or refuse it with your own message. It is never forwarded outside the domain: most of it is spam, and sending it on to another provider would put this server's name on it. Refusing one domain's unrouted mail never refuses its subdomains' — shop.example.com hosted here keeps its own mailboxes and its own rule.

More

New DKIM key makes a fresh signing key (apply the DNS records right after). Suspend stops mail for the whole domain without deleting anything: nothing is received for it, and its mailboxes neither sign in nor send until you resume it. Remove takes the domain and its forwarders away; its mailboxes go only when you tick it, and their mail is kept on the server unless you tick that too.

Mailboxes

Email → Mailboxes → Create a mailbox: the address, a password (or Make one), a size limit (0 = none) and a name. Write the password down — it is stored hashed and never shown again; Password sets a new one, and every mail app signed in with the old one has to sign in again.

With more than five mailboxes, Find a mailbox narrows the list by address or name, and by domain when there is more than one.

Edit changes the size limit and can suspend sign-in (the mailbox keeps receiving but nobody can read or send from it) or suspend incoming mail (senders are told the mailbox is not accepting mail). Remove keeps its mail on the server, moved aside, unless you tick Delete its mail too.

Send a test email (the owner's, on each mailbox) sends one short fixed message from that mailbox to any address you type, the way the mailbox sends mail: signed with the domain's DKIM key, and through the relay when one is set. Send it to an address of yours at another provider (Gmail, Outlook) and see whether it arrives and where it lands; Open the delivery log follows it. At most ten test messages an hour leave the server.

A mailbox may send only as itself (or as a forwarder that delivers to it) — never with an empty sender address — at most the number of messages an hour set on Email → Settings (300 by default) — so a leaked password sends a few hundred messages, not a hundred thousand. Five wrong passwords in ten minutes ban the address that tried them for an hour.

Programs on this server send the same way. A shop, a website's contact form or any other program signs in with a mailbox's address and password on port 465 or 587, like a mail app. Port 25 trusts no address, this server's own included: it takes mail for your domains from anyone and sends nothing onward for anybody, so a website's code cannot use it to send mail as you.

PHP mail() and sendmail

The other way a program sends mail is without signing in at all: PHP's mail() function, or the sendmail command, hands a message to the mail server here with any sender on it. It is off on every website and 6amMart project, as cPanel and the other panels keep it: while it is on, any code on that website — a hacked plugin or theme too — can send mail as any address with no password, and spam sent from it puts this server's address on block lists, after which the mail of every website here goes to spam or is refused.

While it is off, mail() returns false and hands nothing on, and the website's account may not use the sendmail command — from a scheduled task or a terminal either. The mail server's own mail is not affected: autoresponders, the forward a copy filter and the panel's alerts still go out. The sendmail half is SixPanel Email's: on a server without it there is no mail server here for sendmail to hand mail to, and only mail() is decided.

The better way is a mailbox: the website signs in with a mailbox's address and password (above) — WordPress through an SMTP plugin such as WP Mail SMTP or FluentSMTP — or with the SMTP details of a sending service of its own. 6amMart sends through SMTP (its Mail Config page) and needs neither.

Turning it on is for one website at a time — its PHP page; a Node.js, Python or Java website's Settings page, where the switch is called sendmail; a 6amMart project's Advanced → PHP — and it is the server owner's alone: the panel asks first and says the risk. An account and a temporary login may turn it off, never on. While it is on, the page says the risk beside Turn off.

A server updated from an earlier SixPanel kept it on for every website and project it already had, so nothing that sent mail stopped; each of them shows the risk with Turn off, and Security → Security score lists every one still on, with Turn off beside each. A website or project moved to another server takes its switch with it (one from an older SixPanel arrives on, as it was there).

Mail apps

Most apps (Thunderbird, Outlook, the iPhone and Android mail apps) find the settings by themselves from the address. Otherwise:

The user name is the whole address; the password is the mailbox's. The mailbox page's Settings for mail apps card shows the same, for this server. When the last port check found 587 or 465 blocked on this server's network and an extra port is on for it, the card names that port instead and says why — "587 is blocked by <provider> on this network, so use 2525." — and with none on, it marks the blocked one and says the owner can turn one on.

Autoresponder and filters

Autoresponder & filters on a mailbox: an automatic answer (subject, message, how many days before the same sender is answered again, and optional first and last days — it never answers spam or mailing lists), and filters that move a message to a folder, forward a copy, mark it read or delete it when its sender, recipient or subject matches.

Spam goes to each mailbox's Junk folder; Junk and Trash empty themselves after 30 days.

Forwarders

Email → Forwarders: mail to an address goes to one or more other addresses. When the address is also a mailbox, a copy stays in it. Forwarded mail keeps the original sender's DKIM signature and carries this server's ARC seal, which the big providers read to trust a forward.

Webmail

Email → Webmail → Install the webmail installs Roundcube in its own PHP workers, which run only while someone uses it. Then Turn on each domain: it asks first, then points the domain's webmail names here through Cloudflare (proxied) — those records and no other: the domain's mail records are written by its own DNS records Apply — gets their certificate, and serves:

• the webmail at webmail.<domain> (for a domain that is itself a subdomain, a name Cloudflare's free certificate covers, like webmail-shop.example.com),
• the settings files mail apps read, at autoconfig.<domain> (Thunderbird) and autodiscover.<domain> (Outlook).

These names are kept for the mail domain from the moment it is added, its webmail on or off: a website or a shop cannot take them. A name something else took before is named when you press Turn on, and the webmail stays off until it is free.

They answer behind Allow traffic from Cloudflare only like every website, so that switch is refused while one of them points straight at this server instead of through Cloudflare (a domain whose DNS is kept elsewhere, say) — it names the address. Mail itself is not behind it: the mail ports and the mail host never go through Cloudflare.

Sign in with the whole address and the mailbox's password.

Queue and delivery log

Queue lists the messages waiting to be delivered, how long each has waited, and why, in one plain line — "port 25 going out is blocked by this server's provider", "the relay refused the sign-in", "the receiving server refused it" — with the mail server's own words under it. Retry now tries a message (or all of them) again at once, releasing a held one first; Delete drops one, the selected ones or all — asked first, since they are never delivered and their senders are not told. Only the owner can retry or delete. Delivery log shows what became of each message of the last hours — delivered, waiting, bounced or refused — with the receiving server's own answer; search by address.

Settings

The mail host, the relay (its port found from this server, above) with the records it needs, Send a test message, the extra ports for mail apps, the largest message (25 MB by default), how many messages a mailbox may send in an hour, and the spam filter (lenient, normal or strict).

The server's own name (the OS hostname) is shown on Overview and is separate from the mail host: mail does not need it, and it changes only when you press Change the server's name — some providers (Google Cloud) set it back at every boot.

Email marketing (BillionMail)

For newsletters and campaigns, install BillionMail from Software. It runs its own mail server, so it and SixPanel Email cannot run on the same server — two mail servers cannot share port 25. The panel refuses whichever one comes second and says why.

Removing it

Email → Overview → Remove the email server. The programs and their settings go, and so does the mail host's DNS-only record where it is still the one the panel wrote (it exists for the mail server alone; the domains' other mail records stay, and their Apply writes it back after an install again). Every mailbox, its mail, its password and each domain's DKIM key stay, so installing again brings every mailbox back as it was. To delete all of that too, tick Also delete every mailbox and its mail and type DELETE MAIL.

Tia and email

Tia reads everything on the Email page and can add domains, write their DNS records and turn on their webmail (she always asks first: both write DNS records), set forwarders, unrouted mail and autoresponders, check why mail goes to spam, turn an extra port for mail apps on or off, and read the queue and the delivery log. She never handles a password: creating a mailbox, changing its password and the relay's password are yours, on the Email page.

When something is wrong

The software card on this page

The cards of Email, its three parts (Postfix, Dovecot, Rspamd) and the Webmail, each with its own state. It is the same card as on Software: its state, its version, a waiting update and, for the owner, Restart (asked first, and refused while another job runs). On Software opens its card there, with who else uses it. See Software, search and the system monitor.