# Email

> Source: https://www.allsweb.com/sixpanel/docs/email
> Markdown for agents: https://www.allsweb.com/sixpanel/docs/email.md
> Publisher: AllsWeb (www.allsweb.com)

Part of: SixPanel documentation

**What this page is for:** host mailboxes for your domains on this server —
`info@yourshop.com`, `sales@yourshop.com` — with forwarders, an autoresponder,
filters, webmail in the browser, and spam filtering, all managed from the panel's
**Email** page (right after **Projects** in the menu).

**You need**

- A domain whose DNS you control. On Cloudflare (an account added to the panel) the
  panel writes every record for you; anywhere else it lists them for you to create.
- Five ports open at your server provider's firewall: **25, 465, 587, 993 and 995**
  (below). Mail reaches this server directly, not through Cloudflare. A sixth only if you
  turn on an [extra port for mail apps](#extra-ports-for-mail-apps) — 2525, 2587 or 2465.
- About **350 MB of memory** while it is quiet, and a server with at least 1.4 GB in
  all. It runs on every release SixPanel supports — Ubuntu 26.04, Ubuntu 24.04 and
  Debian 13 — on amd64 and arm64.

---

## What gets installed

| Part | Does | Where it listens |
|---|---|---|
| **Postfix** | receives mail for your domains and sends what your mailboxes write | 25, 465, 587 |
| **Dovecot** | keeps every mailbox, lets mail apps read it (IMAP, POP3) and checks every password | 993, 995 |
| **Rspamd** | scores spam, signs every message you send (DKIM), checks SPF, DKIM and DMARC of what arrives, and limits how much one mailbox can send | a socket only Postfix can reach |
| **Redis** (its own) | holds the spam filter's counters | a socket on this server only — your shops' and websites' Redis are untouched |
| **Roundcube** (optional) | webmail in the browser | through nginx, like a website |

All of it comes from the release's own packages (Roundcube from its own published
release, checked against its published checksum). Each service has a memory ceiling
sized from this server's memory, so the mail server can never take memory your shops
need.

## The ports

**SixPanel opens these on this server's own firewall while Email is installed, and closes them
when it is removed** — an extra port for mail apps too, when you switch it on or off. They show on
**Server → Firewall → Port rules** as *Opened by SixPanel Email — follows the service*, with no
Remove button; to keep one closed anyway, add a **deny** rule for it. A port a rule of yours
already opens to everybody gets no second rule, and your rule is never touched. With the firewall
off the rules are kept and apply the moment you turn it on. Panels that had Email before this
release get the rules when they start.

What SixPanel cannot open is your **server provider's** firewall (the security group, firewall
rules or network settings of the server) — open these there:

| Port | For |
|---|---|
| **25** | other mail servers delivering mail to you — and this server delivering yours |
| **465** | mail apps sending, over TLS |
| **587** | mail apps sending (STARTTLS) |
| **993** | mail apps reading, IMAP over TLS |
| **995** | mail apps downloading, POP3 over TLS |

There is no unencrypted way in: every password goes over TLS. Plain IMAP (143) answers
on this server only, for the webmail, and plain POP3 is off.

**Port 25 cannot move.** Other mail servers deliver only to port 25 — a domain's MX record
names a host, never a port — so no other port can receive mail for your domains, and
SixPanel offers none in its place: when 25 is blocked coming in, your provider has to open
it. Sending to other mail servers is port 25 as well; when that is blocked going out, mail
leaves through a relay (below). Mail **apps** are different — they can send on another port:
[Extra ports for mail apps](#extra-ports-for-mail-apps).

### Can mail reach this server?

The **Can mail reach this server?** card on the Email page — on **Overview**, and before
the install too — checks all of these at once when you press **Check reachability**:
AllsWeb tries 25, 465, 587, 993 and 995 from the internet (this server's own address only,
nothing sent), and the server tries port 25 going out. A port your provider's firewall
closes reads **Blocked by your server provider**, with where to open it at the provider
this server runs at; one nothing listens on yet reads **Nothing listens** (normal before the
install). Inbound port 25 can read **Not checked from outside**: AllsWeb itself runs where
outgoing 25 is blocked, so it cannot always try it. How the check works:
**[Check that the internet can reach a port](https://www.allsweb.com/sixpanel/docs/firewall-and-ssh#check-that-the-internet-can-reach-a-port)**.

Above the ports, the card says what a block means for your mail and what SixPanel does about
it:

- **Port 25 going out is blocked and a relay is set:** "Port 25 is blocked by Google Cloud, so
  mail leaves through smtp.example.com on port 587" — your provider's name and your relay.
- **Port 25 going out is blocked and no relay is set:** your provider's own rule for port 25,
  and the way round it until they open it: a relay service of your own. A relay usually also
  takes port 2525 (some 2587 or 2465), for a network that blocks 587 as well — the card says
  whether this server reaches relay services on 2525.
- **Port 25 coming in is blocked:** other mail servers deliver only to port 25, so no other port
  can receive mail for your domains — your provider must open it (the card says where), or, when
  it is this server's own firewall, allow it on **Server → Firewall**.
- **587 or 465 is blocked from the internet and the email server has an alternate port on:** the
  card names the alternate as the port to set your mail apps to.

The same is on **Server → Health**, in the row **Ports SixPanel needs**.

### Port 25 going OUT

Many providers block mail leaving on port 25 to stop spam from new servers: **Google
Cloud always**, **AWS** until you ask them to lift it, and several others. The install
tests it, and **Email → Overview → Test port 25** tests it again whenever you like
(a connection to a big mail server; nothing is sent).

When it is blocked, mail to other servers waits in the queue. Two ways out:

- ask the provider to open outbound port 25 (AWS has a form for it), or
- **send through a relay** — **Email → Settings → Send through a relay**: a sending
  service of your own choice, with its host, user name and password. The password is kept
  in a file only the system can read; the panel never shows it again. Put the relay
  service's SPF name in **Its SPF name** so your domains' SPF names it too.

**The relay's port is found from this server.** With **Port** on **Automatic** (the
default), saving the relay asks it for its greeting on 587, 465, 2525, 2587 and 2465 at
once — a connection only: nothing is sent and no password goes anywhere — and takes the
first in that order that answers. The card says which and why, for instance "587 is blocked
here, so the relay is reached on 2525". A port reads **blocked here** when a well-known mail
service does not answer on it from this server either (your provider blocks it); one that is
open from here and that the relay does not take is named as such. When none answers, nothing
is saved and the card says so. Choose the port yourself when the relay service names one —
changing only the port keeps the saved password.

**The relay is tried before it is saved.** Saving signs in to the relay the way Postfix will —
its greeting, TLS (from the first byte on 465 and 2465, STARTTLS on the others) and your user
name and password — and sends nothing. When that fails, nothing is saved and the card says which
kind of failure it was: **could not be reached on that port** (no connection, or a connection
and no greeting — your provider blocks the port; choose another of the relay's ports), or
**refused the sign-in** (check the user name and password). **Test the relay** asks the same of
the saved relay at any time.

**Which relay ports leave this server** is written above the form, from the last reachability
check: for example "relay ports that leave: 465, 587, 2465 — blocked going out: 25". Use one
of those your relay service takes; its own instructions list them.

**Use the alert mail's relay.** When **Settings → Alert email** already sends through a relay
with a user name and password (on port 2465, say), the card offers it in one press — with
"its last message was accepted" when it has proven to work. SixPanel uses the saved password on
the server; it is never sent to your browser.

**Waiting mail goes at once.** Once a relay is saved, the messages that waited in the queue for
a way out are sent again straight away.

Nothing else about sending moves: without a relay, mail to other mail servers goes on port
25, the only port they take it on.

**IPv6.** SixPanel Email sends over IPv6 only when this server has an IPv6 route to the
internet; without one (many Google Cloud and AWS servers) it uses IPv4 alone, so no message
waits on "Network is unreachable". It looks again every five minutes, and restarts Postfix when
a route appears or goes.

### Why cPanel "does not have this problem"

It does, on the same cloud. Google Cloud blocks port 25 going out for every server, whatever
runs on it, and AWS, Azure, DigitalOcean, Hetzner, Vultr and Oracle do the same until you ask
— cPanel on those clouds also needs a relay (cPanel calls it a smarthost) or the provider's
permission. cPanel is usually met on hosting where the provider already set that up. SixPanel
tests port 25 at the install, says when it is blocked and by whom, and sets the relay up for
you — in one press, when the panel's alert mail already has one.

**The smarthost route, as cPanel does it.** In cPanel/WHM, Exim is told to hand every message
leaving the server to a smarthost: a relay service's host on a port the provider leaves open
(587, 465, 2525, 2465), signed in with its user name and password. The relay then delivers it
on port 25 from its own servers. SixPanel's **Send through a relay** is that same setting for
Postfix (`relayhost`, with the sign-in in a root-only file): mail from every mailbox, every
autoresponder and forward, and the panel's own alerts when they go through this server's mail
server, all leave that way. You do not need to change provider.

**A relay sends for your domain only once the domain says it may.** Every relay service asks you
to verify the domain in its own account and to publish a few records of its own — put them
under [Records this relay needs](#records-this-relay-needs). Until then it refuses the sender,
and SixPanel says so in plain words ([below](#when-the-relay-says-no)).

### Records this relay needs

**Email → Settings → Send through a relay → Records this relay needs** (shown once a relay is
saved). The relay service's instructions list the records it wants: usually an SPF `include:`,
one or two DKIM keys (a TXT, or a CNAME to a key it rotates itself), and often a return-path or
bounce name (a CNAME, or an MX and a TXT). Choose the mail domain and paste them as the service
shows them, one a line — type, name, value:

```
TXT   @                 v=spf1 include:spf.relay.example ~all
CNAME s1._domainkey     s1.dkim.relay.example
MX    bounce            10 feedback.relay.example
TXT   bounce            v=spf1 include:spf.relay.example ~all
```

Names may be written relative to the domain (`s1._domainkey`, `@` for the domain itself) or
whole; quotes and a trailing dot are fine. Each line is checked before anything is saved:

- the type is **TXT, CNAME or MX** — nothing else is a relay's;
- the name is **inside the mail domain** — not another domain, not the mail host, not
  `_dmarc` (the domain's own policy, which the panel keeps), and not this server's own DKIM
  selector;
- no CNAME or MX at the domain itself (a CNAME there would replace every record of it; an MX
  there would send your incoming mail to the relay), and a CNAME is the only record of its name.

An SPF line for the domain itself is **merged** into the domain's one SPF record — two SPF
records make receivers ignore both — so `include:spf.relay.example` is added next to `mx` and
this server's address. Then press **Apply DNS records** on the domain (**Email → Domains**):
the relay's records are written with the domain's own, through Cloudflare, each marked as the
panel's. A CNAME goes behind the orange cloud like every record Cloudflare can proxy; mail
lookups still work through a proxied CNAME (measured: its TXT and MX answer as the target's).
A name Cloudflare never proxies (`smtp`, `mail`, `_dmarc`…) cannot be a relay CNAME here — ask
the service for another. TXT and MX records have no proxy at all. **Check delivery** then asks
public DNS for each of them, and names the one that is missing.

No relay company is suggested here: use the one you have an account with.

### When the relay says no

A relay answers a refusal in its own words. SixPanel puts one plain line before them — in the
**Queue**, in **Test the relay**, when a relay you save is refused, in **Send a test message**
and on **Server → Health**:

| The relay says | Means | Do |
|---|---|---|
| 550/554 5.7.x … not verified, or the domain is not allowed | the sender's domain is not verified with the relay | verify the domain in the relay service's account, add its records (above), Apply |
| 535 | the sign-in was refused | check the relay's user name and password |
| 421 / 451 / 452 … rate, quota, limit | a sending rate or quota is used up | wait, or raise the limit with the relay service; Postfix tries again by itself |
| 5xx … spam, policy, block list | the message was refused as spam or by policy | **Check delivery** (SPF, DKIM, DMARC, PTR), and look at the message itself |

**Test the relay** signs in and also offers a sender — `postmaster@` your first mail domain —
then resets: no recipient and no message, nothing is sent. A relay that has not verified the
domain usually says so right there.

### Send a test message

**Email → Settings → Send a test message**: choose one of this server's mailboxes, type an
address of yours at another provider, and press **Send**. The message goes the way mail really
leaves this server — straight out on port 25, or through the relay — and the card waits up to
30 seconds for the mail log's answer for it: its **queue id**, **status=sent / deferred /
bounced**, where it went (the receiving server or the relay) and that server's own reply, with
the plain line above when it is a refusal. Still no answer after 30 seconds: it is in the
**Queue** and the **Delivery log**. At most ten test messages an hour leave the server.

### Alerts through this server's mail server

The panel's own alert email (**Settings → Alert email**) can go out two ways:

- **an SMTP server** — a mail provider's host, port, user name and password, as before; or
- **this server's mail server (SixPanel Email)** — offered once Email is installed. Nothing is
  typed but the **from** address and the recipients: no password is stored for it and no port
  is opened. The panel hands each alert to Postfix on this server, so it leaves exactly as your
  mailboxes' mail does — signed with the domain's DKIM key, straight out or through the relay.
  The **from** must be an address of one of this server's mail domains (the field offers its
  mailboxes); an address of another domain is refused.

**Send a test email** there proves it end to end: it waits for the mail log's answer and shows
the queue id, the status and the relay's reply. The SMTP settings are kept while this server's
mail server is chosen, so switching back needs nothing typed again. If the email server is
removed, the alerts read as not set up until you choose an SMTP server.

### Every port mail uses

**Email → Overview → Every port mail uses** (and the same card on **Server → Firewall** while
the email server is installed) lists every port in both directions:

- **coming in** — 25, 465, 587, 993, 995 and any extra port for mail apps that is on. 143,
  110 and 4190 appear only when something answers on them from the internet, marked
  **not needed**: SixPanel keeps 143 for the webmail on this server only and never opens 110 or
  4190;
- **going out** — 25, and the relay ports 465, 587, 2525, 2465 and 2587.

Each says whether something listens (IPv4, IPv6), what this server's own firewall does, and
what the last reachability check saw from the internet. A port held up at your provider's
firewall carries the exact rule to add there (for Google Cloud: VPC network → Firewall →
Create firewall rule, TCP and the port). SixPanel opens the mail ports on this server's own
firewall when Email is installed and closes them when it is removed. With a working relay
saved, port 25 going out reads **blocked — mail goes through the relay**, and neither the
card nor **Server → Health** warns about it.

### Extra ports for mail apps

Mail apps send on 587 or 465, and some networks block those two — a firewall at your server
provider in front of this server, or a hotel's or an office's network the app sends from.
**Email → Settings → Extra ports for mail apps** has three more that answer exactly as they
do:

| Port | Works like | Security |
|---|---|---|
| **2525** | 587 | STARTTLS |
| **2587** | 587 | STARTTLS |
| **2465** | 465 | SSL/TLS, from the first byte |

The rules are those of 587 and 465: a mailbox's sign-in over TLS only, the sender must be
the mailbox's own address (or a forwarder that delivers to it) and never empty, the hourly
limit of **Email → Settings** counted per mailbox whichever port it sends on, and five wrong
passwords ban the address that tried them on every mail port.

- **Each is off** until the server owner turns it on; the panel asks first. Turning one off
  asks too: a mail app set to it stops sending until it is set back to 587 or 465.
- **SixPanel suggests one — it never turns one on by itself.** When the last port check (the
  **Can mail reach this server?** card, or the one on **Server → Firewall**) found 587 or 465
  blocked from the internet by your server provider or a firewall in front of this server,
  the card says so and which to turn on: "587 is blocked by <provider> on this network, so
  mail apps cannot send through it. Turn on 2525 for them" — your provider's name when the
  panel recognises it. It suggests 2525 for 587 (2587 when the check saw 2525 blocked too) and
  2465 for 465.
- **Once one is on** it is a mail port like the others: on **Overview → Listening**, tried
  from the internet by the next port check, and on **Server → Firewall**, which suggests
  allowing it while this server's own firewall is on (the card names it until you do). A
  provider that blocks ports until you open them needs TCP 2525 (or 2587, 2465) opened there
  too.
- **Mail apps are told.** While 587 or 465 is blocked and its extra port is on, the
  mailbox page's **Settings for mail apps** card names the extra port in its place and says
  why — "587 is blocked by <provider> on this network, so use 2525." — and so do the settings
  files Thunderbird and Outlook read (`autoconfig.<domain>`, `autodiscover.<domain>`, where
  the domain's webmail is on).

Port 25 has none, and none is offered: other mail servers deliver only to 25 (above).

## Installing

**Software → Email server → Install**, or the **Install the email server**
button on the **Email** page. You can name your first domain and the mail host there,
or leave both for later. Software's Install opens the Email page, because the install
starts with a check.

### The check before the install

Pressing Install first checks every mail port. AllsWeb tries 25, 465, 587, 993 and 995
from the internet, and this server tries 25 and the relay ports going out. The dialog
then says what it found, in one line per case:

- **Everything reachable**: Install.
- **This server's own firewall closes them**: the install allows them there itself. The
  rules belong to Email and are removed with it. A **deny rule of yours** is never
  removed. The dialog names it, and you remove it on **Server → Firewall**.
- **The cloud firewall in front of the server closes them** (an AWS security group, a
  Google Cloud VPC rule, a Hetzner firewall…): the dialog lists the rule to add there,
  one line per port, in that provider's own click-path. Nothing on the server can open
  it. Until port 25 is let in there, mail from other servers will not *arrive*. You can
  still press **Install anyway** and check again afterwards.
- **Port 25 going out is blocked**: "This server's provider blocks port 25 going out;
  nothing on the server opens it. Mail to other servers will leave only through a relay
  (smarthost). Set one up after install in Email → Settings." Receiving, webmail,
  mailboxes and mail between this server's own addresses all work without it. Press
  **Install anyway**, and once the install is done the page opens on **Email → Settings →
  Send through a relay**. The dialog also lists which relay ports leave this server.

The install is refused only when it really cannot run, for example when another mail
server already answers on port 25. A port you have to open somewhere else never stops it.
**Check again** repeats the check.

Before the install, port 25 cannot be tried from outside: AllsWeb's own network does not
dial out on 25, and nothing listens on it yet. The dialog therefore goes by the other four
ports. When the provider holds all of them, it takes 25 to be held too. When all of them
pass, 25 most likely passes as well. **After the install, the mail server's own log
measures port 25.** A connection from any public address in the last three days means
the internet reaches it. Mail servers and scanners find an open port 25 within hours.
A day or more of Postfix listening on 25 with no outside connection at all means
something in front holds it. The window starts again when the firewall changes.

The install itself takes a few minutes: the packages, a mail account that owns every
mailbox's files, the configuration, a first certificate, and the port 25 test.

### Before mail can go out

After the install, **Email → Overview** shows a short checklist until every line is
ticked. Each line has the one press that fixes it, or the exact thing to do outside
this server:

| Line | Ticked when | The fix |
|---|---|---|
| Mail ports reachable from the internet | all five reach the server | the rule per port at the provider, then **Check reachability**; or **Open Server → Firewall** |
| DNS records applied | every mail domain's records were applied | **Apply DNS records** (or **Open Domains** when there is none yet) |
| Certificate of the mail host | Let's Encrypt's, not self-signed | **Get the certificate** |
| A way out for mail | port 25 going out is open, or the relay's last message was accepted | **Set up a relay**, **Send a test message**, or **Test port 25** |
| Reverse DNS (PTR) | the server's address names the mail host | your provider's own setting (a warning only: mail still leaves) |

The list uses only what the panel already knows, from the last check, the mail log and
DNS. Opening the page tests nothing. While a relay carries the mail, a wrong PTR does not
keep the list open, because receivers see the relay's address instead.

## The mail host

The **mail host** is the name other mail servers and mail apps connect to — usually
`mail.yourdomain.com`. The panel suggests `mail.<your first domain>` and you can change
it on **Email → Settings**. One mail host serves every domain on the server.

It is the one record the panel writes **DNS only** (not proxied): Cloudflare's proxy
carries web traffic, and mail must reach this server itself. Every other record that
can be proxied stays proxied. The mail host must be a name of its own — never a
website's, a shop's or the panel's address, and never one of a mail domain's webmail
names. Every door a name comes in by asks the same question: a website, a shop (its
www twin included), its live-updates address, the panel's own address (from the panel or
over SSH) and a project restored or moved here are each refused a name the mail server
answers on, with the reason. If a name is shared anyway (from before), neither Apply
writes it: the **Email** page names the clash and the **DNS** tab of the **Cloudflare** page shows it blocked. Nor is
it ever a domain itself — `example.com`, or `example.co.uk` under a two-label suffix — whose
record is that domain's own address.

**Renaming it** keeps the old name's DNS-only record while your domains' MX still name it.
Apply each domain's DNS records (that moves its MX to the new name); the Apply after the
last one removes the old record, as long as it is still the one the panel wrote and points
here. Until then the Cloudflare page's **DNS** tab lists it among the records the panel wrote that nothing
needs any more.

### Reverse DNS (PTR)

Big mail providers refuse mail from a server whose address has no matching reverse
name. **Email → Overview** shows the exact line to ask your server provider for —
"set the reverse DNS of `203.0.113.10` to `mail.yourdomain.com`". It is set at the
provider (their dashboard, or a support ticket), not in your DNS zone.

**Server → Health** warns (it never fails the row: mail still leaves) while this server's IPv4
reverse name is not the mail host, and says where it is set at the provider it runs at:

- **Google Cloud** — Compute Engine → VM instances → the VM → **Edit** → **Network interfaces**
  → the interface → **External IPv4 address** → turn on **public DNS PTR record** and enter the
  mail host (Google first asks you to verify the domain);
- **AWS** — reverse DNS is set on an **Elastic IP**: EC2 → Elastic IPs → the address →
  **Actions → Update reverse DNS** (the mail host's A record must point at it first);
- **any other provider** — ask them, by name when SixPanel recognises it.

While a relay carries your mail, receivers see the relay's address rather than this server's.

### The certificate

The install gives the mail host a self-signed certificate so everything works at once;
mail apps warn about it. Once the mail host's DNS record points here, press
**Email → Overview → Get the certificate**: Let's Encrypt issues one (through Cloudflare
when its token holds the zone, otherwise over port 80) and it renews by itself.

## Domains

**Email → Domains → Add a mail domain.** Each domain can be tied to the website it
belongs to.

### DNS records

**DNS records** shows what the domain needs against what its DNS holds now:

| Record | Name | Why |
|---|---|---|
| A (and AAAA) | the mail host | where mail servers and apps connect — DNS only |
| MX | the domain | mail for the domain comes here |
| TXT (SPF) | the domain | this server may send for it |
| TXT (DKIM) | `<selector>._domainkey.<domain>` | the key every message is signed with |
| TXT (DMARC) | `_dmarc.<domain>` | what receivers do with forged mail |
| SRV | `_submissions._tcp`, `_submission._tcp`, `_imaps._tcp`, `_pop3s._tcp` | mail apps find the servers |

**Apply** writes what is missing and corrects what is SixPanel's own. It reads the zone
again right before it writes, **merges SPF** (anything already allowed to send for the
domain stays allowed), keeps a DMARC record you already have, and **deletes nothing**.
A record that sends mail somewhere else today — an MX to Google Workspace, say — is
shown with where it points, and is changed only when you tick it — and only while it still
points there: one that changed after the list was drawn is left as it is, for you to look
at again. New domains get DMARC `quarantine`, or `none` when their SPF already names another
sending service.

The **DNS** tab of the panel's **Cloudflare** page shows the same records beside every other record of the zone.

### Check delivery

**Check delivery** answers "why does my mail go to spam?": MX points here, the mail
host's address, reverse DNS, SPF (with the relay's include when one is set), DKIM, DMARC,
the [relay's own records](#records-this-relay-needs), the big block lists, outbound port 25
and the certificate — each with what to do.

### Unrouted mail (catch-all)

Mail to an address of the domain that is no mailbox and no forwarder is **refused** by
default. **Unrouted mail** can instead **forward it** to one mailbox of the same domain
(for example `info@`) or **refuse it with your own message**. It is never forwarded
outside the domain: most of it is spam, and sending it on to another provider would put
this server's name on it. Refusing one domain's unrouted mail never refuses its
subdomains' — `shop.example.com` hosted here keeps its own mailboxes and its own rule.

### More

**New DKIM key** makes a fresh signing key (apply the DNS records right after).
**Suspend** stops mail for the whole domain without deleting anything: nothing is
received for it, and its mailboxes neither sign in nor send until you resume it. **Remove** takes
the domain and its forwarders away; its mailboxes go only when you tick it, and their
mail is kept on the server unless you tick that too.

## Mailboxes

**Email → Mailboxes → Create a mailbox**: the address, a password (or **Make one**), a
size limit (0 = none) and a name. **Write the password down** — it is stored hashed and
never shown again; **Password** sets a new one, and every mail app signed in with the
old one has to sign in again.

With more than five mailboxes, **Find a mailbox** narrows the list by address or name,
and by domain when there is more than one.

**Edit** changes the size limit and can **suspend sign-in** (the mailbox keeps receiving
but nobody can read or send from it) or **suspend incoming mail** (senders are told the
mailbox is not accepting mail). **Remove** keeps its mail on the server, moved aside,
unless you tick **Delete its mail too**.

**Send a test email** (the owner's, on each mailbox) sends one short fixed message from
that mailbox to any address you type, the way the mailbox sends mail: signed with the
domain's DKIM key, and through the relay when one is set. Send it to an address of yours
at another provider (Gmail, Outlook) and see whether it arrives and where it lands;
**Open the delivery log** follows it. At most ten test messages an hour leave the server.

A mailbox may send only as itself (or as a forwarder that delivers to it) — never with an
empty sender address — at most the number of messages an hour set on **Email → Settings**
(300 by default) — so a leaked password sends a few hundred messages, not a hundred
thousand. Five wrong passwords in ten minutes ban the address that tried them for an hour.

**Programs on this server send the same way.** A shop, a website's contact form or any
other program signs in with a mailbox's address and password on port 465 or 587, like a
mail app. Port 25 trusts no address, this server's own included: it takes mail for your
domains from anyone and sends nothing onward for anybody, so a website's code cannot use
it to send mail as you.

### PHP mail() and sendmail

The other way a program sends mail is without signing in at all: PHP's `mail()` function,
or the `sendmail` command, hands a message to the mail server here with any sender on it.
It is **off** on every website and 6amMart project, as cPanel and the other panels keep it:
while it is on, any code on that website — a hacked plugin or theme too — can send mail as
any address with no password, and spam sent from it puts this server's address on block
lists, after which the mail of **every** website here goes to spam or is refused.

While it is off, `mail()` returns false and hands nothing on, and the website's account may
not use the `sendmail` command — from a scheduled task or a terminal either. The mail
server's own mail is not affected: autoresponders, the **forward a copy** filter and the
panel's alerts still go out. The `sendmail` half is SixPanel Email's: on a server without it
there is no mail server here for `sendmail` to hand mail to, and only `mail()` is decided.

**The better way is a mailbox:** the website signs in with a mailbox's address and password
(above) — WordPress through an SMTP plugin such as WP Mail SMTP or FluentSMTP — or with the
SMTP details of a sending service of its own. 6amMart sends through SMTP (its **Mail
Config** page) and needs neither.

**Turning it on** is for one website at a time — its **PHP** page; a Node.js, Python or Java
website's **Settings** page, where the switch is called **sendmail**; a 6amMart project's
**Advanced → PHP** — and it is the server owner's alone: the panel asks first and says the
risk. An account and a temporary login may turn it off, never on. While it is on, the page
says the risk beside **Turn off**.

A server updated from an earlier SixPanel kept it **on** for every website and project it
already had, so nothing that sent mail stopped; each of them shows the risk with **Turn
off**, and **Security → Security score** lists every one still on, with **Turn off** beside
each. A website or project moved to another server takes its switch with it (one from an
older SixPanel arrives on, as it was there).

### Mail apps

Most apps (Thunderbird, Outlook, the iPhone and Android mail apps) find the settings by
themselves from the address. Otherwise:

| | Server | Port | Security |
|---|---|---|---|
| Incoming (IMAP) | the mail host | 993 | SSL/TLS |
| Incoming (POP3) | the mail host | 995 | SSL/TLS |
| Outgoing (SMTP) | the mail host | 465 or 587 | SSL/TLS or STARTTLS |

The user name is the whole address; the password is the mailbox's. The mailbox page's
**Settings for mail apps** card shows the same, for this server. When the last port check
found 587 or 465 blocked on this server's network and an
[extra port](#extra-ports-for-mail-apps) is on for it, the card names that port instead and
says why — "587 is blocked by <provider> on this network, so use 2525." — and with none on,
it marks the blocked one and says the owner can turn one on.

### Autoresponder and filters

**Autoresponder & filters** on a mailbox: an automatic answer (subject, message, how many
days before the same sender is answered again, and optional first and last days — it
never answers spam or mailing lists), and filters that **move** a message to a folder,
**forward a copy**, **mark it read** or **delete it** when its sender, recipient or
subject matches.

Spam goes to each mailbox's **Junk** folder; Junk and Trash empty themselves after 30
days.

## Forwarders

**Email → Forwarders**: mail to an address goes to one or more other addresses. When the
address is also a mailbox, a copy stays in it. Forwarded mail keeps the original
sender's DKIM signature and carries this server's ARC seal, which the big providers read
to trust a forward.

## Webmail

**Email → Webmail → Install the webmail** installs Roundcube in its own PHP workers,
which run only while someone uses it. Then **Turn on** each domain: it asks first, then
points the domain's webmail names here through Cloudflare (proxied) — those records and no
other: the domain's mail records are written by its own **DNS records** Apply — gets their
certificate, and serves:

- the webmail at `webmail.<domain>` (for a domain that is itself a subdomain, a name
  Cloudflare's free certificate covers, like `webmail-shop.example.com`),
- the settings files mail apps read, at `autoconfig.<domain>` (Thunderbird) and
  `autodiscover.<domain>` (Outlook).

These names are kept for the mail domain from the moment it is added, its webmail on or
off: a website or a shop cannot take them. A name something else took before is named
when you press **Turn on**, and the webmail stays off until it is free.

They answer behind **Allow traffic from Cloudflare only** like every website, so that
switch is refused while one of them points straight at this server instead of through
Cloudflare (a domain whose DNS is kept elsewhere, say) — it names the address. Mail
itself is not behind it: the mail ports and the mail host never go through Cloudflare.

Sign in with the whole address and the mailbox's password.

## Queue and delivery log

**Queue** lists the messages waiting to be delivered, how long each has waited, and why, in
one plain line — "port 25 going out is blocked by this server's provider", "the relay refused
the sign-in", "the receiving server refused it" — with the mail server's own words under it.
**Retry now** tries a message (or all of them) again at once, releasing a held one first;
**Delete** drops one, the selected ones or **all** — asked first, since they are never
delivered and their senders are not told. Only the owner can retry or delete. **Delivery log** shows what became of each message of
the last hours — delivered, waiting, bounced or refused — with the receiving server's
own answer; search by address.

## Settings

The **mail host**, the **relay** (its port found from this server, above) with the
[records it needs](#records-this-relay-needs), [Send a test message](#send-a-test-message), the
[extra ports for mail apps](#extra-ports-for-mail-apps), the **largest message** (25 MB by
default), how many messages a mailbox may send in an hour, and the **spam filter** (lenient,
normal or strict).

The server's own name (the OS hostname) is shown on **Overview** and is separate from the
mail host: mail does not need it, and it changes only when you press **Change the
server's name** — some providers (Google Cloud) set it back at every boot.

## Email marketing (BillionMail)

For newsletters and campaigns, install **BillionMail** from **Software**. It
runs its own mail server, so it and SixPanel Email cannot run on the same server — two
mail servers cannot share port 25. The panel refuses whichever one comes second and says
why.

## Removing it

**Email → Overview → Remove the email server.** The programs and their settings go, and
so does the mail host's DNS-only record where it is still the one the panel wrote (it exists
for the mail server alone; the domains' other mail records stay, and their Apply writes it
back after an install again). Every mailbox, its mail, its password and each domain's DKIM
key **stay**, so installing again brings every mailbox back as it was. To delete all of that too, tick **Also delete
every mailbox and its mail** and type `DELETE MAIL`.

## Tia and email

Tia reads everything on the Email page and can add domains, write their DNS records and
turn on their webmail (she always asks first: both write DNS records), set forwarders, unrouted mail and autoresponders, check why mail
goes to spam, turn an extra port for mail apps on or off, and read the queue and the delivery log. She never handles a password:
creating a mailbox, changing its password and the relay's password are yours, on the
Email page.

## When something is wrong

| You see | Do |
|---|---|
| Mail goes to spam | **Check delivery** on the domain, and fix each red line — most often the reverse DNS (PTR) or a missing DNS record. |
| No mail arrives | **DNS records**: the MX must point at the mail host, and the mail host at this server. Port 25 must be open INBOUND at your provider. |
| Mail does not leave | **Overview → Test port 25**. Blocked: ask the provider, or set a relay. Then **Settings → Send a test message** shows what the receiving server or the relay answered. |
| The relay refuses the sender ("not verified") | Verify the domain in the relay service's account and add its [records](#records-this-relay-needs), then **Apply DNS records**. |
| **Server → Health** says the relay's last message was refused | The row names the refusal in one line; [When the relay says no](#when-the-relay-says-no) says what to do. |
| A mail app cannot send (it waits on 587 and 465) | **Check reachability** on **Overview**. Blocked from the internet: turn on the [extra port](#extra-ports-for-mail-apps) it suggests on **Email → Settings**, and set the app to it. |
| A mail app warns about the certificate | **Get the certificate** once the mail host points here. |
| A service is not running | **Overview → Restart the mail server**; the **Email server** row on **Server → Health** says which one. |

## The software card on this page

The cards of **Email**, its three parts (**Postfix**, **Dovecot**, **Rspamd**) and the **Webmail**, each with its own state. It is the same card as on **Software**: its state, its version, a waiting update and, for the owner, Restart (asked first, and refused while another job runs). **On Software** opens its card there, with who else uses it. See [Software, search and the system monitor](https://www.allsweb.com/sixpanel/docs/software-search-monitor).