Skip to content

Running mail

The Mail menu has three pages: Mail domains shows whether each domain's mail would arrive, Mail server shows whether this server can deliver at all, and Email routing decides where each domain's mail is delivered. This page explains how to read them.

For the setup checklist (port 25, PTR, SPF, DKIM, DMARC) read Email that arrives. For what your customers do with mailboxes, read Email.

Mail domains

Open Mail › Mail domains. It lists every domain this server handles mail for. Mail is turned on per account, so a new server shows No mail domains yet with a Go to accounts button.

Each row shows:

  • Domain, with a webmail link to webmail.<domain>.
  • Account that owns it.
  • Sends from: the address its mail leaves from, marked dedicated or shared.
  • Delivery health: five small badges, SPF, DKIM, DMARC, PTR and MX. A line under them names the first thing that is wrong. If the domain's DNS is at another provider, the row says DNS at that provider, so you know the records must be changed there.
  • Mailboxes: how many it has.
  • Manage: opens that account's Mail page, where you can create mailboxes, aliases and see the DNS records to publish.

The tabs above the table show how many domains are in each group:

  • All: every domain.
  • Problems: something is failing, or SPF, DKIM or reverse DNS (PTR) is only a warning. These three decide whether other servers accept the mail.
  • Waiting for DNS: a record was just added and is not visible yet. Wait and check again.
  • Fine: nothing wrong.
  • Not verified: shown only when there is such a domain. See below.

A DMARC policy of none, or an MX record that points elsewhere, is a warning but does not count as a problem, because many domains start that way on purpose.

Use the search box on the right of the tabs to find a domain or an account. The tab counts follow your search.

Not verified

Not verified means the panel cannot vouch for the result. There are three causes, each explained in the row:

  1. An update to the mail server stopped part-way, so which address the domain's mail leaves from is not certain until the next update succeeds.
  2. The newest check could not reach public DNS. The last result that did is shown.
  3. No public DNS resolver could be reached, so this server's own answers were used, and they may not match what the internet sees.

Do not treat these domains as fine or as broken. Check again later.

Checking

The panel checks every domain in the background every 6 hours, and again when a domain's sending address changes. Click Check all now to start a check at once. It takes a minute or two; reload the page to see the results. The time of the last check is shown under the table.

DKIM

Turning mail on for a domain creates its DKIM signing key. The panel does not publish it for you unless this server answers DNS for the domain. Open Manage and look at DNS records to publish for the DKIM record. If the DNS is at another provider, copy the record there. The DKIM badge turns green once the public record matches. The same page has Will mail from … arrive?, which lists each check with what it found and how to fix it.

Mail server

Open Mail › Mail server. If it says Mail is not installed on this server, there is nothing to manage yet. Otherwise it has four tabs: Overview, Queue, Deliveries and Relay.

Overview

  • Outbound port 25: open, blocked or not checked. Some providers block port 25 on new servers. If it is blocked, ask your provider to open it, or use the Relay tab.
  • Sending: Direct (this server delivers to each recipient itself) or Relay. While a relay is on, dedicated sending addresses do not apply.
  • Mail host certificate: one certificate for SMTP, IMAP and POP3. It shows valid, or check if it does not cover the mail hostname, is self-signed, or expires soon.
  • Queue: how many messages are waiting, and how many for over a day.
  • Blacklists: each sending address against the common blacklists. A cell reads clean, listed or no answer. A listed address usually clears by itself once the spam stops. The list's own page, linked under the table, says why.
  • Reverse DNS: what each address points back to, and whether that matches the mail host. If not, set it to the name shown, at whoever owns the IP.

Click Check now in the Blacklists box to run the port 25, blacklist and reverse DNS checks again. It takes about ten seconds.

Queue

Queue lists mail the server could not deliver yet. Columns: Queued, From, To, Account and Why it is waiting. Use the account selector and Show to look at one account, or (the server itself).

On each row:

  • Retry tries that message again now.
  • View shows its headers only. The message itself is never shown.
  • Delete throws it away. The sender is not told. A message queued before long queue ids were switched on shows no delete; retry it or let it expire.

At the top, Retry all now retries everything, and Delete all… deletes every message matching the current view, on every page. You must type delete to confirm, and the senders are not told.

The server retries for five days, then returns the message to its sender with the reason.

Deliveries

Deliveries reads the mail log for the last 7 days. Filter by result: Delivered, Deferred, Bounced or Rejected on arrival. Filter by direction: Sent, Received or both. The Detail column gives the receiving server's answer. If the log could not be read completely, a red line above the table says so, so a short list is not mistaken for a quiet server.

Relay

A relay sends all outgoing mail through an email service. Use it when your provider blocks port 25, or for a service with a strong sending reputation.

  1. Open Mail › Mail server › Relay.
  2. Choose a Provider. MailBaby, SendGrid, Mailgun (US), Mailgun (EU), Brevo, SMTP2GO, Amazon SES and Postmark fill in the host and port, and a hint says where to find the login. Choose Custom for any other service.
  3. Check Relay host and Port.
  4. Enter the Username and Password. A saved password shows "saved - leave blank to keep it".
  5. Optional: enter an address in Send a test message to.
  6. Tick Send all outgoing mail through this relay and click Save.

Before switching, the panel connects to the relay, encrypts, signs in and sends the test message. It switches only if all of that works, so a wrong password cannot stop your outgoing mail. A relay that will not encrypt is refused. If the firewall blocks the port (465, 2500, 2525), the panel opens it to that relay only, and closes it again when you change or turn off the relay. Add the provider's SPF include to your domains.

To go back to direct sending, untick the box and click Save.

Sending limits

The Mail server page has no limit settings. The limit on messages sent per hour is Mail per hour on each plan (counted per recipient). See Plans and performance.

Email routing

Open Mail › Email routing. It lists every mail domain on the server with the account that owns it. Open How it works above the table for a short reminder.

For each domain, choose a setting and click Change:

  • Automatic (the default): delivered here while the domain's MX record points to this server, otherwise to the server the MX names. The panel checks every 30 minutes.
  • Local: always delivered to the mailboxes on this server. As administrator you can set this even when the MX points elsewhere.
  • Remote: always delivered to the server the MX names (Google Workspace, Microsoft 365, another host), even mail sent from websites on this server.

The Mail is delivered column shows Here or Elsewhere, with the reason. The MX record column shows Points here or Points elsewhere. Click Check now to look again at once.

Use the search box (domain or user name), the Delivered here and Delivered elsewhere tabs and the Any routing selector to narrow a long list.

When moving a domain to this server, create its mailboxes and move the mail in first, then point the DNS here. Automatic starts delivering here by itself. Customers and resellers have the same page for their own domains; see Email.

Webmail

Webmail is Roundcube. Every mail domain has its own address, https://webmail.<domain>/. Roundcube also answers on port 2096 (2095 without HTTPS) on every mail domain.

  • From Mail › Mail domains, click webmail under a domain.
  • To sign in as a mailbox without its password, click Manage on the domain, then Webmail on the mailbox row. This ends any webmail session the owner has open.

If a domain gets mail but webmail does not answer, check Roundcube on Server › Services.