Email Management¶

Email management covers mailboxes, forwards, autoresponders, DKIM settings, and spam filter configuration.

Overview¶

Mailboxes¶

The mailbox table shows all email accounts:

Column	Description
Email	Full email address
Domain	Associated domain
Customer	Assigned customer
Quota	Storage usage / Maximum in MB
Status	Active or Disabled
Autoresponder	Active/Inactive
Created	Creation date

Forwards¶

Column	Description
Source	Source email address
Destination	Destination address(es)
Customer	Assigned customer
Created	Creation date

Create Mailbox¶

Click Create Mailbox
Fill out the form:

Field	Required	Description
Username	Yes	Local part of the email (before the @)
Domain	Yes	Select domain
Password	Yes	Mailbox password
Quota (MB)	No	Storage limit (0 = unlimited)

Click Create

The system sets up:

Dovecot mailbox
Postfix configuration entries
Maildir directory structure

Webmail Access

After creation, the mailbox can be used immediately via webmail (SOGo) — over the server hostname at /webmail, or, when enabled for the domain, at webmail.<domain>. Calendar and contacts are available in the same interface.

Set up the mailbox on a device¶

Every new mailbox automatically receives a welcome email (in the customer's language) with step-by-step setup for iPhone/iPad/Mac and Android — delivered as the first message in the mailbox. It can be turned off via the mailbox_welcome_email panel setting.

The connection settings dialog (info icon on the mailbox row) also shows everything needed:

Apple (iPhone, iPad, Mac): a signed configuration profile (.mobileconfig) via a download button or QR code sets up email (and calendar & contacts) in one step — no manual server entry.
Android: IMAP/SMTP details for manual setup, plus DAVx⁵ (Play Store) for calendar & contacts using the address shown.
Manual (any client): incoming IMAP 993 (SSL/TLS), outgoing SMTP 587 (STARTTLS), username = full email address.

Edit Mailbox¶

Click the Edit icon
Change quota or status
Click Save

Change Password¶

Click the Key icon in the action column
Enter the new password
Confirm the change

Enable / Disable Mailbox¶

Click the Status toggle in the action column
Disabled mailboxes cannot send or receive emails

Delete Mailbox¶

Click the Delete icon
Confirm the deletion

Emails Will Be Deleted

When deleting a mailbox, all emails are permanently removed.

Autoresponder¶

The autoresponder sends automatic replies to incoming emails (e.g. out-of-office notifications).

Configure Autoresponder¶

Click the Clock icon in the action column of a mailbox
Fill out the form:

Field	Required	Description
Enabled	Yes	Enable/disable autoresponder
Subject	Yes	Subject of the automatic reply
Message	Yes	Text of the automatic reply
Start Date	No	When the autoresponder should become active
End Date	No	When the autoresponder should deactivate

Click Save

Time-Based Control

If start and end dates are set, the autoresponder is only active during this period. Without date specifications, it is permanently active.

Forwards¶

Create Forward¶

Switch to the Forwards tab
Click Create Forward

Field	Required	Description
Source	Yes	Source email address
Destination	Yes	Destination address(es), comma-separated for multiple

Click Create

Catch-All Address¶

A catch-all address receives all emails sent to a domain for which no explicit mailbox or forward exists. Catch-All is its own dedicated feature with its own tab — not a wildcard forward.

Permission

For customers, Catch-All is gated per package by the Catch-All (perm_catch_all) permission.

Set Up Catch-All¶

Navigate to Email > Catch-All
Click Add
Enter the domain (e.g. example.com, without @)
Enter the destination address (e.g. info@example.com)
Click Create

Increased spam volume

A catch-all address also catches emails sent to random, non-existent addresses on the domain — this noticeably increases the spam volume in the destination mailbox. A corresponding warning is shown permanently in the panel.

To disable it, delete the catch-all rule from the table.

Webmail¶

Every mailbox owner can access webmail directly from the panel.

Open Webmail¶

Navigate to Email > Mailboxes
Click the Webmail icon next to the mailbox
The webmail interface opens in a new tab

Delete Forward¶

Click the Delete icon
Confirm the deletion

IMAP Migration (Import Emails)¶

IMAP migration allows you to import existing emails from an external mail server into a mailbox — ideal when switching providers.

Start Migration¶

Navigate to Email > Mailboxes
Click the Migrate button next to the desired mailbox
Fill out the migration form:

Field	Required	Description
IMAP Server	Yes	Hostname of the source mail server (e.g. `imap.old-provider.com`)
Port	Yes	IMAP port (default: `993` for SSL, `143` for STARTTLS)
Username	Yes	Login on the source server (usually the full email address)
Password	Yes	Password of the source mailbox
Use SSL	No	Enable SSL/TLS encryption (default: enabled)

Click Start Migration

Background Process

The migration runs server-side in the background. The backend uses doveadm import with automatic fallback to imapsync if the import fails. The folder structure (Inbox, Sent, Drafts, etc.) is preserved.

Duration

Depending on the mailbox size, migration can take several minutes to hours. Existing emails in the target mailbox are not overwritten — only new messages are added.

Check Before Migrating

Make sure the source server allows IMAP access and the credentials are correct. Some providers require an app-specific password (e.g. Google, Microsoft 365).

DKIM Settings¶

DKIM can be enabled per domain:

Navigate to Domain Management or DNS > Email Security
Enable DKIM for the desired domain
The DKIM key is automatically generated
The required DNS TXT record is displayed

MTA-STS¶

MTA-STS (RFC 8461) tells sending mail servers to require TLS when delivering to your domain, protecting against downgrade and man-in-the-middle attacks. Enable it per domain in Domains → Mail Security → MTA-STS:

Choose a mode:
Testing – failures are reported (via TLS-RPT) but mail is still delivered. Start here.
Enforce – delivery is rejected if TLS cannot be negotiated. Switch once testing is clean.
Click Enable. enconf automatically issues a certificate for mta-sts.<domain> and serves the policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.
Two DNS records are required:
mta-sts.<domain> A → the domain's serving IP
_mta-sts.<domain> TXT → v=STSv1; id=<timestamp>

For zones hosted on enconf's own DNS these records are set automatically. With external DNS, add the displayed records manually.

The mta-sts.<domain> host must resolve publicly before enabling, so the certificate can be issued via HTTP validation.

TLS-RPT¶

TLS-RPT (RFC 8460) is the ideal complement to MTA-STS testing mode: it tells sending servers to report TLS negotiation problems so you can see whether encrypted delivery actually works. Enable it per domain under Domains → Mail Security → TLS-RPT:

Set the report address (rua) — an email (mailto:) or an https:// URL. Defaults to the admin email.
Click Enable. Only one DNS record is needed (no certificate):
_smtp._tls.<domain> TXT → v=TLSRPTv1; rua=mailto:<address>

For enconf-managed zones the record is set automatically; for external DNS, add it manually. Reports then arrive as daily summaries at the address you configured.

DMARC reports¶

DMARC aggregate reports (RFC 7489) show you who sends mail as your domain and whether SPF/DKIM pass — the best way to spot spoofing and delivery problems. enconf collects and analyzes these reports directly in the panel. Enable it per domain under Domains → Mail Security → DMARC reports:

Click Enable. enconf provisions an invisible system mailbox dmarc@<domain> (it does not appear in the mailbox list) and sets the _dmarc record with rua=mailto:dmarc@<domain>:
_dmarc.<domain> TXT → v=DMARC1; p=none; rua=mailto:dmarc@<domain>; fo=1

For enconf-managed zones the record is set automatically (monitoring policy p=none); you can later tighten the policy under DNS → Email Security without losing the rua. 2. Receiving servers (Google, Microsoft, …) send their daily reports to the address. A background worker fetches them every 30 minutes, decompresses and parses the XML. 3. The Mail Security view shows a summary (report count, messages, pass rate) and the most recent reports per reporting provider.

First reports

The first reports usually arrive within 24 hours once the DNS record is publicly live.

Spam Settings¶

enconf uses rspamd as a spam filter. Configuration is done per domain:

Settings¶

Setting	Description
Spam Score Threshold	Score at which an email is marked as spam
Spam Action	`mark`, `quarantine`, or `reject`
Greylisting	Temporarily reject unknown senders

Whitelist / Blacklist¶

Whitelist: Emails from these addresses are never treated as spam
Blacklist: Emails from these addresses are always treated as spam

Email Rate Limiting¶

To prevent spam sending through compromised accounts:

Setting	Description
Max. Emails/Hour (Total)	Limit for all mailboxes combined
Max. per Mailbox/Hour	Limit per individual mailbox
Max. per Domain/Hour	Limit per domain

These limits are configured in the hosting package.

Compromised accounts (auto-suspend)¶

As part of the mail-deliverability protection, enconf monitors outbound mail per mailbox. If a single mailbox suddenly starts sending an abnormal volume of mail — typical of a hijacked/compromised account sending spam — enconf steps in automatically:

Detection: abnormal outbound volume from a single mailbox.
Automatic response: sending for that mailbox is suspended immediately and a mail_account_compromised notification event is raised to inform the administrator.

Once the account has been secured (reset the mailbox password), the administrator can re-enable the mailbox.

Forwards and distribution lists: the SPF problem and SRS¶

With a forward or a distribution list the original sender is preserved (the envelope sender). When that mail is then passed on to an SPF-strict recipient (Gmail, Zoho, Outlook), they check the SPF of the foreign sender's domain against the IP of your server — which is not authorised there, so the mail is rejected (SPF Policy Failure). This affects every forwarding mail server and cannot be fixed through the SPF records of your own domains.

The solution: SRS (Sender Rewriting Scheme)¶

SRS rewrites only the technical envelope sender to a domain of your own when forwarding; the visible From: stays the real sender. The recipient then checks the SPF of your SRS domain, which passes.

Enabling it: Settings → Mail → Enable SRS, plus an SRS domain. SRS runs on the mail server, and there is exactly one mail gateway per installation — hence a single central setting rather than one per web server.

Set up once per server, after which it covers all domains automatically, new ones included.
Your own hosted domains are not rewritten — only forwarded foreign senders.
The SRS domain needs two DNS records, which the panel shows you:
- MX pointing at this server, so bounces come back
- SPF authorising the outbound path: v=spf1 a mx ~all when sending directly, or v=spf1 include:<gateway> ~all behind a gateway

A note on strict DMARC

SRS repairs SPF. If an upstream gateway alters the mail — a subject tag, a footer — the original DKIM signature can break, and then ARC is needed as well. rspamd already signs ARC.

ARC sealing (forwards under strict DMARC)¶

SRS repairs SPF for forwards. For recipients with strict DMARC (Gmail, Zoho, Outlook) that is not always enough: DMARC requires SPF or DKIM to be aligned with the From: domain. After SRS, SPF is no longer aligned, and the original DKIM signature can break as soon as the mail is modified in transit — so DMARC fails.

ARC (Authenticated Received Chain) solves this. The forwarding server seals the mail and documents cryptographically that "when I received this mail, SPF, DKIM and DMARC were valid". Recipients that evaluate ARC then accept the forward despite direct DMARC having broken, as a local policy override. This is exactly how Gmail accepts forwarded mail.

What enconf does¶

ARC sealing is active automatically through rspamd; no setting is required.

Forwarded and relayed mail is sealed on arrival (sign_inbound), using the local forwarding domain, whose DKIM key already exists and is published in DNS.
That forwarding or distribution domain therefore needs valid DKIM, which you can inspect and enable per domain under Mail security. It is the same key the ARC seal is made with.
No additional DNS records are needed as long as DKIM for the forwarding domain is in place.

Limits¶

ARC only helps with recipients that evaluate ARC — Gmail, Microsoft/Outlook, Zoho. Smaller or self-run servers sometimes ignore it; there, preserving DKIM or using SRS remains the safeguard.
ARC complements SRS rather than replacing it: SRS covers SPF-only recipients, ARC the DMARC-strict ones.

How they work together

SRS (SPF when forwarding), ARC (DMARC when forwarding) and DKIM per domain together give forwards and distribution lists the best possible deliverability. All three are built into enconf; DKIM and ARC run automatically, SRS is enabled once per server.