Mail and webmail

Built and lab-tested

• Mail domains, mailboxes with quotas, aliases, forwarders that can keep a copy, catch-all addresses and autoresponders.
• DKIM keys generated on the mail server; the private key never enters the database, logs or events. Two-step key rotation, and ARC sealing for forwarded mail.
• MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, autoconfig and autodiscover records published into the domain's zone automatically.
• Submission on ports 587 and 465 requires the login to match the sender. Open relay is refused, and senders can be held or blocked from sending.
• Queue control: list, hold, release, retry, delete and flush.
• Every configuration is checked with postfix check, doveconf and rspamadm configtest before it goes live; the previous files come back on any failure.
• Webmail gateway: threaded conversations, search with operators (from:, has:attachment, before:), send with an undo window, Sieve rules, vacation replies and live updates over IMAP IDLE.
• Incoming HTML is rebuilt from an allow-list. Remote images and tracking pixels are blocked by default. The sanitiser is tested against about 55 XSS vectors and a fuzzer.
• Webmail screens in the panel: conversations and search across folders, scheduled send held on the server, snooze, and a calendar over CalDAV with invitations.
• Contacts over CardDAV as its own service, off until you enable it, and app passwords for phones.
• App-password sign-ins carry the real client address (believed only from the panel's own proxy), so a ban hits the offender, and the last use of a password is recorded for contacts and calendar. Reverse-name and blocklist findings appear in the set-up check, with a score per domain.
• Deliverability: a flooding mailbox is held (queued, never bounced), DMARC aggregate reports are explained with the DNS fix, and reverse-name and blocklist checks run daily.