FlashPanel

Mail ​

Requirements ​

  • The Mail Server feature is available on paid plans only.
  • You need a domain and access to edit its DNS records.
  • A server with 2 GB of RAM or more is recommended. On servers with less than 2.5 GB of RAM, the ClamAV antivirus is turned off by default so the mail server stays stable.

Setup ​

Step 1: Install the Mail Server app ​

  1. Go to your server management page and select Mail Server in the menu. If it is not installed yet, you will find it in the Explore group.
  2. Click Install and wait for the installation to finish (a few minutes). If Docker is not installed yet, FlashPanel installs it first.

Once installed, the Mail Server page has three tabs: Accounts, Domain and Settings. The buttons at the top start, stop and restart the mail server.

Step 2: Add an email domain ​

  1. Open the Domain tab and click Add New Domain.
  2. Enter the Domain: the part after @ in your email addresses (e.g., domain.tld). You can also paste a website address or an email address; FlashPanel keeps only the domain.
  3. The Mail server subdomain is mail by default, which gives the mail server name mail.domain.tld. Mail apps and MX records use this name.
  4. Click Add New Domain.

The first domain becomes the default domain: the mail server name of every domain on the server comes from it.

Automatic DNS records

If the domain's DNS is on a Cloudflare account connected in DNS Management, FlashPanel creates the missing records (A, MX, SPF, DKIM, DMARC) as soon as you add the domain. Records you already have are never overwritten: other TXT records (such as google-site-verification) stay as they are, an existing SPF record only gets the server IP added, and MX records pointing elsewhere (such as Google Workspace) are kept and shown as a warning in the checklist.

Step 3: Complete the domain setup ​

Click a domain to open its checklist. FlashPanel checks the domain when you open it (and again every day); click Check now to check again after a change. The checklist has three steps:

1. DNS records: each record shows its status, the value it has now and the value it needs. Use the copy buttons to copy the Name (Host) and the Value. The name is relative to the DNS zone (for example mail, or @ for the root domain), with the full name next to it for DNS providers that need full names. If the domain uses a connected Cloudflare account, click Fix DNS automatically to create or correct the failing records.

2. SSL certificate of the mail hostname site: the mail server name needs a website (for example mail.domain.tld) with an SSL certificate that the mail server reuses. Click Create site if it does not exist, then click Install Let's Encrypt.

3. SSL of the mail server: once the site has a Let's Encrypt certificate, FlashPanel installs it on the mail server automatically (and again whenever you switch to another certificate). Click Install SSL for mail server to install it right away if needed.

When every required item passes, the domain status changes to Completed. Other (non-default) domains only need their DNS records, because they share the mail server name and certificate of the default domain.

The Mail server section at the top of the tab also checks two items of the server:

  • Reverse DNS (PTR): the server IP should have a PTR record pointing to the mail server name (for example mail.domain.tld) to keep your mail out of spam folders. You cannot create it in your domain's DNS; set the Reverse DNS of the IP in your VPS provider's control panel.
  • Outbound port 25: many VPS providers block port 25 on new accounts, and outgoing mail then stays in the queue. Ask your provider to open port 25, or use an SMTP relay service.

Using Cloudflare

  • The A record of the mail server name (for example mail.domain.tld) must be DNS only (grey cloud). The Cloudflare proxy does not forward the mail ports 25, 465, 587 and 993.
  • When that record is proxied, Cloudflare rewrites your MX records to _dc-mx.xxxxxxxx.domain.tld. Mail still reaches the server, but mail apps cannot connect. Click Fix DNS automatically (or turn off the proxy yourself) and the MX record shows correctly again.
  • Do not use a Cloudflare certificate (Origin Certificate) for the mail hostname site: mail apps connect directly to the server and do not trust it. FlashPanel blocks this option on the site's SSL page; use Let's Encrypt instead.
  • With Email Routing enabled, the MX records point to route*.mx.cloudflare.net and mail does not reach the server. To receive mail on the server, turn off Email Routing for the domain and create the MX record again.

Manage domains ​

  • Set Default: moves the mail server name (and the server hostname) to another domain. The mail server restarts for about a minute. The new mail server name needs its own site and SSL certificate, then SSL must be installed for the mail server again. The MX records of all your domains should point to the new name.
  • Regenerate DKIM key: use it when the checklist says the server has no DKIM key. After regenerating, update the DKIM record (or click Fix DNS automatically).
  • Delete domain: type the domain to confirm. Every email account of the domain is deleted together with its mail; a backup of the mail is kept on the server in /opt/mailserver/backups for 7 days. The default domain can only be deleted when no other domain is left, so set another default domain first.

Manage accounts ​

Open the Accounts tab to manage email accounts:

  1. Click Add Email Account.
  2. Enter the Email name (the part before @) and choose the Domain.
  3. Enter a Password (at least 6 characters), or click the key icon to generate a random one.
  4. Optional:
    • Storage limit: for example 500M or 2G. Leave it empty for no limit.
    • Aliases: other addresses that deliver to this mailbox. Type the name (for example info) and press Enter; FlashPanel adds @domain for you.
    • Catch-all: mail sent to any address of the domain that does not exist is delivered to this account. Each domain has a single catch-all account.
  5. Click Add Email Account.

In the account list you can:

  • Edit an account: only the fields you change are saved; leave the password empty to keep the current one.
  • Click Open webmail signed in as this account to open Roundcube without typing the password (install Roundcube first). Each click creates a link that works once, within 60 seconds.
  • Open Mail client settings (server, port and encryption for IMAP, SMTP and POP3).
  • Remove a single alias, or delete the account. The mail server needs at least one account to run; FlashPanel keeps a hidden system account, so you can delete all of your own accounts.

Mail Server settings ​

The Settings tab lets you:

  • Enable POP3: lets mail apps download mail over POP3 (port 995). IMAP is always on.
  • Enable Email Filter: lets users create mail filter rules in Roundcube webmail.
  • Enable Fail2Ban: blocks IP addresses that fail to sign in many times.
  • Enable antivirus (ClamAV): scans mail for viruses; needs about 1 GB of extra RAM.
  • Message Size Limit: the largest mail that can be sent or received (MB). Enter 0 for no limit (not recommended). When the server has no limit set, the mail server default of 10 MB applies.

Click Save to apply. The mail server restarts for about a minute; if it is stopped, the settings apply the next time it starts.

When your paid plan ends

You can still view mail data, change passwords, delete accounts or domains and check DNS. Adding domains or accounts, changing storage limits, aliases or catch-all, SSL, auto login and settings need a paid plan.

Connecting email clients ​

Webmail (Roundcube) ​

You can access your email in a web browser with Roundcube Webmail:

  1. Install Roundcube

    • Open the website of your mail server name (e.g., mail.domain.tld) or create a new one
    • In the website menu, select Install Source Code and choose Roundcube
    • Follow the installation steps shown. See also Roundcube
    • After installation, a Webmail button appears at the top of the Mail Server page to open this website quickly

  2. Access Webmail

    • Open a web browser and go to https://mail.domain.tld
    • Log in with your email address and password

  3. Using Roundcube

    • Intuitive, easy-to-use interface
    • Send/receive email, manage contacts and calendars
    • Supports file attachments
    • Works on any device with a web browser

INFO

Once set up, you can also use an email client (e.g., macOS Mail, Mozilla Thunderbird, Microsoft Outlook) to manage your email.

General settings ​

  • Incoming Mail Server: Use IMAP (recommended).
  • IMAP Server: mail.domain.tld
  • IMAP Port: 993 (SSL/TLS enabled)
  • Outgoing SMTP Server: mail.domain.tld
  • SMTP Port: 465 (SSL/TLS enabled), or 587 (STARTTLS) when port 465 is blocked
  • POP3 Port: 995 (SSL/TLS enabled), if POP3 is enabled
  • Authentication: Use the account's email address and password.

macOS Mail ​

  1. Open Mail and go to Mail > Add Account.
  2. Select Other Mail Account and click Continue.
  3. Enter your email address and password, then click Sign In.
  4. Set up the Incoming Mail Server:
    • IMAP Server: mail.domain.tld
    • Username: Your full email address
    • Password: Your email password
  5. Set up the Outgoing Mail Server:
    • SMTP Server: mail.domain.tld
    • Username: Your full email address
    • Password: Your email password
  6. Click Sign In, then save the settings.

Mozilla Thunderbird ​

  1. Open Thunderbird and go to Account Settings.
  2. Click Add Mail Account.
  3. Enter your name, email address and password, then click Continue.
  4. Thunderbird tries to detect the settings automatically; if it cannot, enter them manually:
    • Incoming Server (IMAP): mail.domain.tld, Port 993, SSL/TLS
    • Outgoing Server (SMTP): mail.domain.tld, Port 465, SSL/TLS
    • Authentication: Normal password
  5. Click Done to finish.

Microsoft Outlook ​

  1. Open Outlook and go to File > Add Account.
  2. Select Manual setup or additional server types, then click Next.
  3. Select IMAP and enter:
    • Incoming Mail Server: mail.domain.tld
    • Outgoing Mail Server: mail.domain.tld
  4. Click More Settings > Outgoing Server tab:
    • Select My outgoing server (SMTP) requires authentication.
  5. Go to the Advanced tab:
    • IMAP Port: 993, Use SSL
    • SMTP Port: 465 (SSL)
  6. Click OK, then Next, and Finish.

Troubleshooting ​

Every failing item in the checklist has a View guide link to the matching section below. After changing DNS, click Check now; new records usually take effect within a few minutes.

A record ​

No A record ​

The mail server name (for example mail.domain.tld) does not point to the server yet. Create an A record with the server IP (an AAAA record if the server uses IPv6), set to DNS only on Cloudflare.

The A record is proxied by Cloudflare ​

The Cloudflare proxy (orange cloud) returns Cloudflare IPs and does not forward the mail ports, so mail apps cannot connect. Click Fix DNS automatically, or switch the record to DNS only (grey cloud) in Cloudflare.

The A record points to the wrong IP ​

The mail server name points to another machine. Change the A record to the server IP.

The A record has extra IPs ​

The mail server name has several A records and other servers pick one at random. Keep only the record that points to the server IP.

The mail server name is a CNAME ​

The mail server name should not be a CNAME because MX records must not point to a CNAME. Delete the CNAME and create an A record pointing to the server IP.

An AAAA record points elsewhere ​

Sending servers with IPv6 try the AAAA address first. Delete the AAAA record, or point it to the server's IPv6 address.

MX record ​

No MX record ​

The domain does not say where to deliver its mail. Create an MX record named @ with the mail server name as the value and priority 10.

Null MX ​

The MX 0 . record means the domain refuses all mail. Delete it and create an MX record pointing to the mail server name.

Cloudflare _dc-mx MX record ​

Cloudflare rewrites the MX record to _dc-mx.xxxxxxxx.domain.tld because the mail server name is proxied. Mail still reaches the server, but mail apps cannot connect. Turn off the proxy on the A record of the mail server name (or click Fix DNS automatically) and the MX record shows correctly again.

The MX record points to Cloudflare Email Routing ​

Email Routing receives the mail instead of the server. In Cloudflare, turn off Email Routing for the domain, then create an MX record pointing to the mail server name.

The MX record points to another email service ​

The domain receives mail at another service (for example Google Workspace or Microsoft 365). To receive mail on this server, delete those MX records and create one pointing to the mail server name. If you keep using the other service, ignore this warning.

Another MX record has a higher priority ​

Sending servers use the MX record with the lowest priority number first. Delete the other MX record, or give the server's MX record a lower number.

The MX target does not point to the server ​

The MX record uses the right name, but that name resolves to another IP or does not resolve at all. Create or fix the A record of that name so it points to the server IP.

The MX record uses another name of the server ​

Mail still reaches the right server, but the MX record should use the mail server name because the SSL certificate is issued for that name.

SPF record ​

No SPF record ​

Create a TXT record on the domain with the value suggested in the checklist (for example v=spf1 a mx ip4:SERVER_IP ~all).

Several SPF records ​

A name may have only one SPF record; with two, receiving servers report an error. Merge them into one record with the suggested value.

SPF does not allow the server ​

Add ip4:SERVER_IP to your existing SPF record and keep your other sending services (for example include:_spf.google.com). Fix DNS automatically does this for you.

SPF ends with +all ​

+all lets any server send mail as you. Change it to ~all or -all.

SPF needs more than 10 DNS lookups ​

Each include, a and mx costs one lookup; above 10, receiving servers treat SPF as broken. Remove include entries you no longer use.

SPF of the mail server name ​

We recommend a TXT SPF record on the mail server name itself (for example mail.domain.tld), used when the server greets other mail servers. Use the same value as the domain's SPF record.

DKIM record ​

No DKIM record ​

Create a TXT record named mail._domainkey with the value from the checklist, pasted on a single line. If your DNS provider limits strings to 255 characters it splits them itself; do not add quotes yourself.

Several DKIM records ​

Keep a single TXT record at mail._domainkey with the value from the checklist.

The DKIM key does not match ​

The DNS record has an old key, usually because the domain or its DKIM key was created again. Replace the record value with the current key (or click Fix DNS automatically).

The DKIM value has extra quotes ​

The quotes were saved as part of the value, so receiving servers cannot read the key. Remove the quotes and save again.

The server has no DKIM key ​

The previous key generation failed. Click Regenerate DKIM key, wait for it to finish, then update the DKIM record.

DMARC record ​

No DMARC record ​

Create a TXT record named _dmarc with the suggested value (for example v=DMARC1; p=quarantine).

Several DMARC records ​

With two records, receiving servers ignore both. Keep only one.

Invalid DMARC record ​

The value must start with v=DMARC1 and contain p=none, p=quarantine or p=reject.

DMARC only monitors ​

p=none is valid but does not protect the domain from spoofing. Once your mail is delivered reliably, raise it to p=quarantine.

DMARC is inherited from the parent domain ​

The domain has no DMARC record of its own, so the parent domain's record applies. No change is required; create a _dmarc record if you want a different policy.

SSL certificate of the mail hostname site ​

No site ​

Click Create site to create a website for the mail server name, then install Let's Encrypt.

The site has no certificate ​

Click Install Let's Encrypt. The A record of the mail server name must point to the server for the certificate to be issued.

The site uses a Cloudflare certificate ​

Mail apps do not trust Cloudflare certificates. Turn off the Cloudflare proxy of the mail server name, then click Install Let's Encrypt; FlashPanel installs the new certificate on the mail server automatically.

SSL of the mail server ​

Waiting for the site SSL ​

Finish the SSL step of the mail hostname site first.

The mail server does not use the certificate ​

Click Install SSL for mail server. The mail server restarts for about a minute.

The mail server uses an old certificate ​

The site switched to another certificate but the mail server was not updated. Click Install SSL for mail server.

The certificate on port 993 has expired ​

Click Install SSL for mail server to install the site's latest certificate. If the site's certificate has expired too, renew it on the site's SSL page first.

The certificate on port 993 has the wrong name ​

The certificate in use does not cover the mail server name. Click Install SSL for mail server.

Self-signed certificate ​

The mail server uses a self-signed certificate and mail apps show a warning. Click Install SSL for mail server.

Port 993 is unreachable ​

FlashPanel cannot connect to port 993 of the server. Check that the mail server is running and that port 993 is open in the server firewall and at your VPS provider.

Reverse DNS (PTR) ​

No PTR record ​

Gmail and Outlook often reject mail from IPs without a PTR record. Set the Reverse DNS of the IP to the mail server name in your VPS provider's control panel.

The PTR record is not the mail server name ​

Change the PTR record to the mail server name (for example mail.domain.tld) at your VPS provider so your mail is less likely to be marked as spam.

The PTR name does not point back to the IP ​

The name in the PTR record must resolve back to the server IP. Set the PTR record to the mail server name, or create an A record for the current name pointing to the server IP.

Outbound port 25 ​

Port 25 is blocked ​

The server cannot connect out on port 25, so outgoing mail stays in the queue. Many VPS providers block this port on new accounts: ask your provider to open port 25, or use an SMTP relay service.

General errors ​

The mail server is not ready ​

The mail server container did not become ready after starting, or reports an error. The usual cause is a lack of RAM: the ClamAV antivirus needs about 1 GB more. Turn off Enable antivirus (ClamAV) in the Settings tab and click Save, or click Restart Mail Server. If it still fails, check the free disk space and RAM of the server.

The check could not run ​

FlashPanel could not look up the record (the nameserver did not answer or timed out) or could not reach the Agent on the server. Click Check now again in a few minutes. If DNS lookups keep failing, check the domain's nameservers and DNSSEC (broken DNSSEC makes every lookup fail).

DNS is still updating ​

The domain's nameservers already have the right value, but public resolvers may keep the old one until its TTL expires. Nothing else to do; check again after the time shown in the checklist.

Duplicate records ​

There are several records of the same type at one name. Keep only one, with the value from the checklist.