What you are actually getting
Mail is two halves, and they behave completely differently. Receiving works essentially everywhere. Once an MX record points at your server, mail arrives, is filtered, and lands in a maildir. Nothing about that depends on your hosting provider’s goodwill. Sending is the hard half, and Shipways does not pretend otherwise. Most cloud providers block outbound port 25 by default, several block it permanently, and a fresh address is often already on a blocklist from whoever had it before you. So mail goes out through a sending provider you already have an account with, configured under Sending on the Mail tab. Postmark, Amazon SES, Mailgun and anything else that speaks SMTP with a username and a password all work.This split is the point rather than a limitation we are working around. The
expensive, lock-in-heavy part of hosted mail is the mailboxes, the storage and
the addresses, and those stay on your server. Delivery is a commodity, and the
providers who do it have spent years building the sending reputation a single
machine cannot.
The mail hostname
One name for the machine, chosen when you install. Every domain you carry mail for points its MX record at this single name, and it is the name the certificate is issued for. Use a subdomain such asmail.example.com, never your bare domain. It has to
keep pointing at this one machine for as long as you host mail here, and your
bare domain is the record you change when your website moves.
Postfix and Dovecot will not start until the mail hostname has a certificate,
and getting one needs the name to already resolve to the server. Add its A
record first.
DNS
Shipways has no credential for your domain and never will, so publishing these is the one part of setting mail up that you do yourself. Each domain’s page lists exactly what to add, with a copy button on every value, and checks them for you.
A check that disagrees is not proof of a mistake. A record published five
minutes ago and one never published look identical from outside, and DNS takes
a while to spread. Press Check again.
The DKIM key
Shipways generates the keypair and holds the private half encrypted, rather than making it on the server. The public half lives in your zone until you go and change it, so a key that only existed on a disk would leave every signature failing the day you rebuilt the machine.Mailboxes
Each mailbox is an address, a password and a directory of mail. They are virtual, so creating one never creates a login on the server: a mailbox password cannot be used to reach anything but mail. The password is shown once, when the mailbox is made. Only a digest is stored, so Shipways cannot show it to you again and nor can anybody who reaches the database. Set a limit in megabytes, or zero for no limit. The server’s default is copied onto each mailbox when it is created, so raising the default later does not silently raise a mailbox you deliberately held down.Changing one, and resetting a password
Edit on a mailbox row changes its name, its address and its limit, and can give it a new password. Tick Give it a new password and save: the new one is shown once, the same as when the mailbox was made. Renaming changes where new mail is delivered. What is already in the mailbox stays on disk under the old name, so a rename is not a way to move somebody’s archive.How full a mailbox is
Sizes are measured rather than known. Nothing on the machine keeps a running total worth trusting, so Shipways walks the maildirs: once a night, and whenever you press Measure. That walk stats every message file on the server, which is why it is not done while a page is drawing. Every size on screen therefore has a date on it, and a mailbox nobody has delivered to yet reads as not measured rather than as empty. You get an alert at 90% and a louder one when a mailbox is full. That matters more than it sounds: a full mailbox does not slow down or warn anybody, it just stops accepting mail, and the person whose mailbox it is usually finds out when somebody phones to say an email bounced.Suspending rather than deleting
Suspending stops a mailbox accepting mail and logins, and keeps every message that is already in it. Senders are told during the SMTP conversation rather than getting a bounce afterwards. It is reversible. Deleting removes the address. The mail stays on the disk, under the domain’s directory, because removing years of somebody’s mail should be a thing you do deliberately with a shell rather than a consequence of pressing delete. The same is true of removing a whole domain.Aliases
An address that delivers somewhere else, on this server or anywhere. Add the same address twice with different destinations to fan it out to several people. Leave the address blank to make a catch-all, which takes everything nobody else claimed. A domain has at most one. An alias cannot share a name with a mailbox. Postfix consults the alias table first, so it would take the mailbox’s mail entirely rather than sitting beside it.Filtering
Rspamd sees every message before it is accepted, and the Filtering panel on the Mail tab says what it has been doing with them: how much was scanned, how much was spam, how much was turned away at the door, greylisted, or delivered with a mark on it so a mail client files it as junk. These counters are cumulative since Rspamd last started, which is why the panel says the window they cover. Twelve thousand messages means one thing over a fortnight and quite another over an afternoon. Beside them is how many messages are waiting to go out. That is the number worth watching. A few for a few minutes is ordinary; a number that keeps climbing means mail cannot leave, and the usual cause is the sending provider refusing the credentials under Sending. Nothing is lost while it climbs — Postfix holds a message for ten days before giving up — but nothing is arriving either. Read every few hours, and on demand with Read now.Rspamd answers these questions on a port bound to loopback and nothing else. The
same interface can be told to retrain the filter and move its thresholds, so it
is not something to expose, and Shipways never opens it.
Logs
A server carrying mail gets three more sources on its Logs tab. Mail is Postfix and Dovecot together, because both write to syslog’s mail facility and that is the distribution’s arrangement rather than something Shipways imposes. It is also what you want: a message’s journey is spread across the two, and “where did this message go” is answerable from the pair in order and from neither alone. Mail errors is the same stream narrowed to what went wrong. Rspamd is what each message scored on the way past.Ports
Installing mail opens these as ordinary firewall rules, so they appear on the Network tab like everything else.
Ports 465 and 587 behave identically. Mail clients have disagreed for twenty
years about which to use, so both are open.