Email that arrives
BHPanel's mail server is Postfix and Dovecot, with Rspamd spam filtering, DKIM signing and Roundcube webmail. Whether mail arrives depends on a few things only you can set up — this page is the checklist.
Before the first mailbox
Open Mail › Mail server and work down the page:
- Outbound port 25. Many providers (Hetzner, AWS, Oracle and others) block it on new servers. The page checks it; if it is blocked, ask your provider to open it, or send through a relay (below).
- Reverse DNS (PTR). Every address the server sends from must point back to the mail host's name, and that name to the address. The table shows each address and whether it matches. PTR is set by whoever owns the IP — your server provider — not in the panel.
- Blacklists. Check now looks the server's addresses up on the common blacklists (it also re-runs the port 25 and reverse DNS checks).
- Mail host certificate. One certificate for SMTP (25, 465, 587), IMAP (993) and POP3 (995), issued for the mail host's name.
On Server › Network, Outgoing mail is sent from chooses the address; pick one whose reverse DNS is OK.
Each domain's records
A domain added in the panel gets its mail set up with MX, SPF, DKIM and DMARC records by itself (unless its mail is handled elsewhere):
- SPF
v=spf1 a mx ~all - DMARC
v=DMARC1; p=none; rua=mailto:postmaster@<domain> - DKIM with the server's key
If the domain's DNS is not on this server (at a registrar, or on Cloudflare without linking), copy these records there. The Mail DNS tab of each mail domain checks MX, SPF, DKIM, DMARC and reverse DNS from public resolvers and says what is wrong.
Sending limits
Each plan has Outbound recipients per hour (default 50), counted per
address: one message to ten people is ten. It covers mail sent with a mailbox
password (ports 587/465) and mail sent by websites (PHP's mail()), so one
customer's hacked script cannot get the whole server blacklisted. Raise it for
customers who send newsletters through a proper service — or better, have them
use one.
Sending through a relay
Mail › Mail server › Send through a relay sends all outgoing mail through an email service. Choose the provider — MailBaby, SendGrid, Mailgun (US or EU), Brevo, SMTP2GO, Amazon SES, Postmark — and its host and port are filled in (you can still change them); paste the username and password from the provider's dashboard. For any other service choose Custom and enter its host and port.
| Provider | Host | Port | Login |
|---|---|---|---|
| MailBaby | relay.mailbaby.net | 587 (or 2500) | from your MailBaby order |
| SendGrid | smtp.sendgrid.net | 587 | username apikey, password an API key |
| Mailgun | smtp.mailgun.org / smtp.eu.mailgun.org | 587 | the domain's SMTP credentials |
| Brevo | smtp-relay.brevo.com | 587 | SMTP login and SMTP key |
| SMTP2GO | mail.smtp2go.com | 2525 | an SMTP user from its dashboard |
| Amazon SES | email-smtp.region.amazonaws.com | 587 | SES SMTP credentials |
| Postmark | smtp.postmarkapp.com | 587 | Server API token as both |
The relay is tested before the server switches to it, and one without TLS is refused. The firewall needs nothing from you: if the port is one the firewall does not let out (465, 2500, 2525), it is opened to that relay only when you save, and closed again when you change or switch off the relay. Add the provider's SPF include to your domains.
The queue
Mail that could not be delivered is retried for five days. Retry all now and Delete all are on the same page.
Webmail
Roundcube answers on every mail domain, on its own port 2096 (2095 without HTTPS), and customers can sign in to it from their panel.