Mail server settings

StackRegent hosts mail with MailEnable Standard: SMTP, POP3 and IMAP, mailing lists and DKIM signing, with mailboxes managed in the panel. Roundcube Webmail is available as a second webmail. The server-wide mail tools are in the Mail group of Tools & Settings.

If MailEnable is not installed, each mail page says so. Install MailEnable Standard (and optionally Roundcube Webmail, which needs PHP) under Tools & Settings › Server Components. The settings you save apply as soon as it is installed.

Mail Server Settings#

Go to Tools & Settings › Mail Server Settings. The top card shows the MailEnable version, the mail host name clients connect to, and the state of the mail services. Apply to all domains writes the mail configuration of every domain again.

Mail to other servers is relayed only for users who log in with their mailbox password (and for the listed networks); the server is never an open relay.

Click Save.

Webmail#

Tools & Settings › Webmail lists the webmail services domains can choose. The chosen one answers on webmail.<domain>. It is served over HTTPS when a certificate of the subscription covers webmail.<domain>: tick it under Let's Encrypt on the website's SSL/TLS Certificates page (it is offered when the domain has mail), or let free SSL add it. This also works when the website itself is hosted elsewhere and only mail and webmail.<domain> point at this server: the certificate then covers just the webmail name.

• MailEnable WebMail comes with MailEnable.
• Roundcube is available once it is installed under Server Components.
• Click Register external webmail to add another one with a Name and Link; <domain> in the link is replaced by the customer's domain.

Tick or untick Available to domains, then click Save. Domains choose their webmail in their mail settings, or follow the plan default.

Spam Filter#

Tools & Settings › Spam Filter:

• Sender checks: check the sender domain's SPF record, check the sending server against DNS block lists, greylisting (delay mail from unknown servers once), and ban servers that keep making bad requests.
• DNS block lists: the zones to check, one per line.
• Content check: score incoming mail and mark spam.
• SpamAssassin: score incoming mail with SpamAssassin instead of the built-in check (needs the SpamAssassin component, below). SpamAssassin score: mail scoring this or more is spam; 5 is SpamAssassin's default.
• Spam score (Built-in score while SpamAssassin is on): mail scoring this or more is spam; 7 is a good start, lower catches more.
• Spam is: delivered with a marked subject (set the Subject tag) or deleted.
• Block list and Allow list: addresses, domains (example.com, *.example.com) or IP networks, one per line.
• Mailbox owners: let mailbox owners change the filter of their mailbox.

Click Save.

The block and allow lists and each mailbox's own settings apply whichever check scores the message. Every checked message gets an X-Spam-Status header with its score and the tests that hit; var\logs\mail-pickup.log records spam and which check scored it.

SpamAssassin#

Install SpamAssassin under Tools & Settings › Server Components (group Mail). StackRegent downloads JAM Software's free Windows build of Apache SpamAssassin, checks the Authenticode signature of its programs, loads the current rules and runs spamd as the Windows service StackRegent SpamAssassin (StackRegentSpamd). It listens on 127.0.0.1 port 783 only, so nothing is opened to the internet. Rules are updated daily (sa-update); spamd restarts when new rules arrive.

Then turn on SpamAssassin on the Spam Filter page. SpamAssassin only scores messages: the panel still decides whether spam is tagged or deleted. If spamd does not answer within 8 seconds, is restarting, or a message is larger than 512 KB, the built-in check scores that message, so mail is never held up. Messages from logged-in senders are not checked.

SpamAssassin checks the sending servers and the links in a message against DNS block lists (Spamhaus, URIBL and others). These refuse lookups that come through big public resolvers, so set Recursive DNS to This server and the networks below under Tools & Settings › DNS Settings › Server-wide Settings (leave Forwarders empty): StackRegent then points SpamAssassin at this server's own DNS Server, which asks the block lists directly. The DNS Server stays closed to recursive queries from anyone else.

The installer refuses to run when another SpamAssassin service (spamd or SpamAssassin) is installed, so two copies never compete for port 783. Removing the component deletes the service and the program folder; the built-in check takes over.

Antivirus#

Tools & Settings › Antivirus uses Microsoft Defender. It scans mail as MailEnable writes it to the queues and mailboxes, and infected messages are quarantined before anyone reads them.

• The page shows whether Defender is running, whether real-time protection is on (it must be, or mail is not scanned), the signature and engine versions, and the mail folders.
• Tick Scan incoming and outgoing mail.
• Update signatures updates Defender at once.
• Mailboxes that are not scanned: enter an address and click Stop scanning, for example for a security team's sample inbox; Scan again reverses it.
• Threats found in mail lists detections.

Outgoing Mail Control#

Tools & Settings › Outgoing Mail Control shows the hourly recipient limits and who is close to them. Two tables, Domains and Subscriptions, show each limit, the count for the last hour and the messages refused in the last 24 hours; rows at the limit are marked At limit.

Change the server defaults in Mail Server Settings. Service plans and individual domains can set their own limits. A domain's limit is set in the subscription under Mail › Mail Settings, Change, Outgoing limit.

Smarthost#

Use Tools & Settings › Smarthost when the provider blocks port 25 or you send through a relay service.

1. Tick Relay all outgoing mail through this server.
2. Enter Server and port (587 is the default).
3. Enter User name and Password, or leave the user name empty if the smarthost accepts mail from this server's IP address.
4. Click Save.

MailEnable uses STARTTLS when the smarthost offers it; use port 587 rather than 465.

The Check mail delivery card, Check now, tests whether the server can reach other mail servers on port 25, logs in to the saved smarthost, and shows the outgoing queue.

External SMTP Server#

Tools & Settings › External SMTP Server sets how the panel sends its own email: notifications, password resets and mass email.

1. Under Send through, choose This server's mail server or An external SMTP server.
2. Set Sender address (empty: the main administrator's address) and Sender name.
3. For an external server, enter Server and port, Security (STARTTLS, SSL/TLS or None), User name and Password.
4. Click Save.
5. Under Send a test message, enter an address and click Send test.

DKIM#

DKIM signing has two switches:

1. Server-wide: Mail Server Settings › DKIM – Allow DKIM signing of outgoing mail. Turning it off stops all signing.
2. Per domain: open the subscription, click Mail, choose the Mail Settings tab, click Change for the domain and tick Sign outgoing mail with DKIM.

The key is created with the next update of the domain's mail. When the domain's DNS is on this server, the key is published in its zone. When DNS is hosted elsewhere, the domain's card shows the TXT record to add there (<selector>._domainkey.<domain>). The same card shows the domain's SPF and DMARC records.

Planned#

SmarterMail (use SmarterMail as an alternative mail server) is listed under Tools & Settings › Mail but is planned and not built yet.

Troubleshooting#

Related#

• Security (certificates)
• DNS and FTP
• Server settings (notifications)