All chapters

Email and webmail

Each site's mail can live on this server, at Google Workspace or Microsoft 365, at another provider, or nowhere at all. cpleks publishes and checks the DNS records each choice needs. When mail lives here, you create mailboxes and forwarders in the panel, and people read their mail in webmail or in any mail client.

Choose where a domain's mail lives

  1. Open the site and its Email tab.
  2. Under Who handles it, press Choose (or Change).
  3. Pick one: Google Workspace, Microsoft 365, Another provider, No mail at all, or This server. This server is offered only once an administrator has installed a mail server and switched it on (below): a choice that would fail at the moment you pressed it is not offered.

The tab then lists the records the choice needs (MX, SPF, DMARC and so on), each with what it should say and what is published now: IN PLACE, DOES NOT MATCH, NOT PUBLISHED or NOT CHECKED. They are checked every time you open the page. When this server runs the domain's DNS, the records change on their own; otherwise create them at your DNS provider.

No mail at all is a real answer: its records say the domain sends nothing, which stops others forging mail from it.

A site's Email tab with its mail on this server: the notice saying what that means and where webmail is, Who handles it set to this server, and the first of its mailboxes.
The Email tab of example.com, with its mail on this server.

Run mail on this server

An administrator does this once, on Modules ▸ Mail servers:

  1. Install Postfix + Dovecot. (Exim + Dovecot and Sendmail are the other two implementations; a server runs one of the three.) Installing opens nothing.
  2. Switch it on. The confirmation names the ports it opens: 25 for other mail servers, 587 for sending from a mail client, 993 and 143 for reading mail. POP3 is a separate switch on the same card.
  3. Switching mail on changes the firewall, so it is armed with a ten-minute rollback. Open Server and press Keep this firewall. If nobody does, the firewall goes back to what it was.
The Mail servers group on the Modules screen: Postfix + Dovecot switched ON with its POP3 switch off, Exim + Dovecot and Sendmail not installed, and the Mail server elsewhere and Sending mail cards.
The mail server cards. Only one implementation runs at a time.

Sending to other providers. Out of the box this server does not send mail to other servers: mail between mailboxes here is delivered, and anything for another server waits in the queue and is not returned to the sender. The Sending mail card says so. Press Set it up and choose where outgoing mail goes: An SMTP service (a provider, a smarthost, or another machine you run) or Amazon SES with tenants, then Check to test the sign-in. A relay is written into Postfix's configuration; on a server running Exim or Sendmail the dialog says the setting is kept and does not yet change how mail leaves. The same dialog can instead let this machine deliver mail itself, which opens port 25 in this server's firewall for the mail server's account only. Two things stay outside cpleks either way: most cloud providers block outgoing port 25 until you ask them not to, and large receivers check that your server's address has a matching reverse name.

Mailboxes

  1. Set the site's mail to This server.
  2. Under Accounts, press Add a mailbox.
  3. Type the Address (the part before the @), a Password of at least 12 characters twice, and optionally a Size limit in MB.
  4. Press Create it. The settings for a mail client are written under the list of mailboxes: incoming server on port 993, outgoing server on port 587, and the full address as the username.
The Add a mailbox form with the address support typed in before @example.com, the two password fields, the size limit left empty for no limit, and a Create it button.
Adding a mailbox, filled in and not yet created. The form says the address will be support@example.com.
The Accounts and Forwarders sections of the Email tab: hello@example.com and info@example.com with Change password and Delete, the mail client settings, and a forwarder from sales@example.com to info@example.com.
Mailboxes and a forwarder on the test machine, whose panel is at panel.example.test:8443; yours names its own address.

Each mailbox has Change password and Delete. Deleting stops anyone signing in; the mail already in it stays on disk, and creating the same mailbox again finds it there.

The server name the tab gives a mail client is the one this server has a certificate for: mail. under the site's name when the site's certificate covers it, otherwise the site's own name, which every certificate cpleks gets covers. While a site has no certificate yet, as on the test machine, it names mail.example.com and says that the first connection asks the client to accept a self-signed certificate.

Forwarders

A forwarder is an address with no mailbox of its own. Press Add a forwarder, type the address, and choose where it delivers: A mailbox here (sales@ into info@) or An address somewhere else. The form warns about the second: forwarded mail keeps its original sender's address and is not rewritten, so Gmail, Outlook and others may reject it or file it as spam. Send a test from an outside address before relying on it.

Webmail

On Modules ▸ Webmail clients, install Roundcube (SnappyMail, Rainloop and Horde are the other cards, and each card says what it is before you press anything: Rainloop is no longer maintained upstream, and Horde's bundle has no mail application in it). The client installed last is the one served, for the whole server, at webmail. under each site's own domain whose mail lives here, for example webmail.example.com: over HTTPS once the site's certificate covers that name, and over plain HTTP until then. Mailbox holders sign in with their full address and password.

The Webmail clients group on the Modules screen: Roundcube installed and ON, and the SnappyMail, Rainloop and Horde cards with an Install button each.
Webmail clients: one for the whole server.

What a mailbox holder can do alone

  • Change their own password in Roundcube under Settings ▸ Password, or on the panel's own page at https://<your panel's address>:8443/mail/password, which needs no panel account. The Email tab shows both to whoever manages the site.
  • Filters and out-of-office replies, in Roundcube under Settings.

What is not here yet

  • No DKIM signing, and no spam or virus filtering.
  • A forwarder is not rewritten (no SRS), as the form says.