Koapanel
IT Try it free
All manual sections

DocumentationMail

Mail

The panel includes an optional mail service: mailboxes on your sites' domains, forwarders, autoresponder, antispam, DKIM signing and a webmail opened from the panel with one click. Under the hood: Postfix (receives and sends), Dovecot (keeps the mailboxes, IMAP and POP3), Rspamd (antispam and DKIM signing, with a small private Redis) and SnappyMail (the webmail).

Enabling mail

Only the administrator enables the service: Mail › Mail server. Before enabling it the panel runs a few checks and explains them plainly:

  • Outbound port 25: many cloud providers (Vultr, Hetzner, AWS, Google Cloud) block it. With the port closed the server receives mail but cannot deliver it to other servers: you need an SMTP relay (see below) or the provider to open it.
  • Reverse DNS (PTR) of the server address: it must return the mail server name (e.g. mail.yourdomain.com). If it is different, Gmail and Outlook treat your messages as suspicious.
  • Mail server name: it must point to the server address (A record).
  • Blacklists (Spamhaus, Barracuda, SpamCop): a listed address gets its outgoing messages refused. Spamhaus does not answer public DNS: the check then shows "cannot be checked", which is normal.
  • Memory: mail works on a 2 GB server, with Rspamd in lean mode (about 150-250 MB for all mail services).

Choose the mail server name (the panel suggests mail.<server name>), decide whether to enable POP3 too and press Enable mail. It takes a few minutes and does not touch the sites. The panel opens ports 25, 465, 587, 993 (and 995 with POP3) plus the webmail port, and enables fail2ban protection for mail and IMAP.

From the command line: sudo panel-agent setup mail -hostname mail.yourdomain.com. Panel upgrades refresh the configuration only when the service is active.

SMTP relay and port 25

If outbound port 25 is blocked, in Mail server › Outbound SMTP relay turn on Send through a relay and enter server, port (587 or 465), user and password of the sending service (Brevo, Mailgun, Amazon SES, your provider's relay…). The password stays encrypted on the server. Also enter the service's SPF include (e.g. spf.brevo.com): it is added to the suggested SPF records.

The message queue shows the waiting messages and why; Retry now resends them at once, Delete waiting messages removes them.

Reverse DNS (PTR)

The PTR is set in the server provider's panel, not in the domain's DNS:

  • Vultr: Server › Settings › IPv4 › Reverse DNS.
  • Hetzner: Server › Networking › Reverse DNS.

Set it to the mail server name, then press Check again.

Certificate

Until the mail server name points to the server, mail uses a self-signed certificate: webmail works, mail apps show a warning. Once the name points here and port 80 is reachable, press Request a Let's Encrypt certificate: it renews by itself.

Enabling mail on a domain

In Mail press Enable mail on a domain and choose a site's domain (or one of its aliases). The panel creates the domain's DKIM key (2048 bits) right away and takes you to the DNS records to publish. Resellers manage their clients' mail, users their own sites'.

Mailboxes

New mailbox: choose address, space and password: Generate a strong password (you see it only once, with a copy button) or I'll choose it. For each mailbox you see the space used and the number of messages, and you can:

  • change the password (open sessions in mail apps are closed);
  • change the space and set forwarding to other addresses, keeping a copy or not;
  • disable it: it keeps receiving mail but nobody can log in;
  • add simple filters (move to a folder, forward, delete) by sender, recipient or subject;
  • delete it with all its messages.

A mailbox over 75% and 90% of its space gets a notice; when it is full, new messages are refused. Messages recognised as spam go to the Spam (Junk) folder.

Packages can limit mail domains, number of mailboxes, default and maximum space of a mailbox; resellers' quotas can limit the mailboxes of all their clients.

Forwarders and aliases

In the Forwarders tab you create addresses without a mailbox that pass mail on to one or more addresses, external ones too (e.g. sales@ → mario@ and anna@). The target mailboxes can also send as the forwarder's address. The catch-all receives mail for the domain's non-existent addresses: it is off by default because it attracts a lot of spam.

Note: mail forwarded to external addresses keeps the original sender, so some providers may refuse it for SPF; for important forwards prefer a mailbox.

Autoresponder

Autoresponder on a mailbox: subject, text, optional start and end dates and how often to answer the same sender. It never answers automatic messages or mailing lists.

Mail DNS: MX, SPF, DKIM and DMARC

The Mail DNS tab shows the records to publish, with copy buttons, and checks what public DNS sees:

  • MX: the domain receives mail on this server;
  • SPF (v=spf1 mx a ip4:… ~all): this server may send for the domain;
  • DKIM (panel._domainkey): the public key that verifies the message signatures;
  • DMARC (_dmarc): starts in monitoring mode (p=none); once everything works you can move to quarantine or reject;
  • autoconfig and autodiscover (optional): automatic setup of Thunderbird and Outlook.

If the domain is on a connected Cloudflare or 1PrimeCDN account, Set up mail DNS shows the changes and then publishes them: an MX of another provider is replaced, an existing DMARC policy is never touched.

Webmail

Webmail next to a mailbox opens the mail in the browser without asking for the password: the link is valid 60 seconds and works once. The panel never uses the mailbox password nor a "master" password shared by all mailboxes: it creates a temporary access valid only for that mailbox, for a few hours.

Mailbox users can also log into the webmail on their own (address https://<server>:8445/) with the full address and password. The sign-in page shows the panel's name and colours.

Mail apps

The Mail apps tab lists server, ports and security for Outlook, Thunderbird, Apple Mail and phones:

  • incoming IMAP port 993 SSL/TLS (and POP3 995 when enabled);
  • outgoing SMTP port 465 SSL/TLS or 587 STARTTLS, with authentication;
  • user name: the full address.

You can only send as your own addresses (and the forwarders that deliver to the mailbox), only after logging in and only over an encrypted connection; each mailbox has a messages-per-hour limit (Mail server › Settings) that stops hacked accounts.

Mailbox migration

The migration imports mailboxes too, when the mail service is active:

  • cPanel backups (and cPanel over SSH as root): mailboxes are created with all their messages and their original password (cPanel keeps SHA512-CRYPT or MD5-CRYPT hashes, which the server verifies as they are), keeping the space they had;
  • Plesk backups: mailboxes are created; when the password in the backup is encrypted with the old server's key, the panel generates a new one and shows it in the summary, only once.

After the migration publish the domain's MX, SPF and DKIM records (Mail DNS tab) to receive mail here. A live migration from a generic Linux server does not copy mailboxes: recreate them and use a mail app to move the messages.