# Mailboxes and Forwarders > Create mailboxes, forward addresses, set a catch-all, redirect a whole domain, and give each mailbox an autoresponder and filters. Source: https://www.corepanel.net/docs/email/mailboxes/ Last updated: 2026-09-14 Part of the CorePanel documentation — https://www.corepanel.net/docs --- CorePanel runs a full mail stack — Postfix, Dovecot and Rspamd — and manages it per domain. This page covers the day-to-day: the addresses themselves. For how the stack fits together, see [Mail System](https://www.corepanel.net/docs/mail-system). ## Which domains can have mail | | Mail | |---|---| | **Primary domain** | Yes — its own mailboxes and DKIM identity | | **Addon domain** | Yes — its own mailboxes and DKIM identity | | **Alias (parked) domain** | No mailboxes of its own; its mail is redirected to the primary | | **Subdomain** | No. Mail belongs to domains, not to subdomains | ## Mailboxes **Email accounts** in the panel lists mailboxes per domain. Creating one asks for the local part, a password and a **quota in MB** (`0` = unlimited). You can afterwards: - change the password; - resize the quota; - enable or disable the account without deleting it; - delete it. Mailbox creation is capped by the account's *Email accounts* limit (`0` = unlimited). ### Mail to an address that does not exist The server refuses it **during the SMTP session**, so the sending server is told immediately and no message is ever accepted. Writing to an address that was mistyped, or to a mailbox that was deleted, produces an instant "no such recipient here" rather than a bounce arriving minutes later. That matters for more than tidiness. Accepting a message first and discovering afterwards that it has nowhere to go leaves the server owing its sender a bounce — and the senders on spam runs are forged, so those bounces go to people who never wrote to you. A server doing that is emitting **backscatter**, and mail providers score it against the server's reputation. Refusing during the session emits none. A mailbox that exists but is [suspended](#suspended-and-the-state-in-between) is refused with a different reason — "this mailbox is suspended" — so a correspondent is not told to delete an address that is coming back. ### Suspended, and the state in between A mailbox has two halves that can be shut independently: | State | Receives mail | Can sign in | |---|---|---| | **Active** | yes | yes | | **Sign-in blocked** | yes | no | | **Suspended** | no — the sender gets a bounce | no | Suspending from the panel closes both: the address stops accepting mail and the sender is told so, which is the honest signal for an account that is really shut. > **Servers upgraded from before 1.6.14** > > Until 1.6.14 the mail lookup database could not record a mailbox as suspended — the value > was dropped on the way in and the row was written active. The panel showed the mailbox as > suspended and Postfix went on delivering to it, with nothing on either side saying so. The > same applied to a forwarder switched off. Upgrading fixes new changes but does not go back > and repair the rows already written: run > [`corepanel mail sync`](https://www.corepanel.net/docs/cli#corepanel-mail-sync) once to rewrite them from the > panel's data. **Sign-in blocked** is the state you inherit rather than choose. Other panels suspend a mailbox's *login* while the address keeps receiving — cPanel does it by locking the password hash — so an [imported](https://www.corepanel.net/docs/cpanel-import) mailbox arrives that way: the mail keeps arriving and piling up, and the owner cannot read it until you turn sign-in back on. Reactivating the mailbox opens both halves. > **A full mailbox bounces, it does not drop mail** > > Dovecot refuses delivery to a mailbox that is over its quota with > `552 5.2.2 Quota exceeded`, and Postfix bounces the message back to the sender. The mailbox > still authenticates and everything in it stays readable; deleting messages resumes > delivery. Remember that messages also count against the **account's** disk quota, which > stops mail for every mailbox at once — see > [Quotas and Usage](https://www.corepanel.net/docs/accounts/quotas#mailbox-quotas). ### Recent access The mailbox's **Security** section also shows its own sign-in record: when it last signed in successfully, when it was last rejected, how many rejections there have been and from how many distinct addresses, above the most recent events. This is usually the fastest way to settle *"my email stopped working"* — whether the last accepted sign-in was minutes or months ago, and whether anything has been rejected since, answers the question before any setting is touched. The full picture, for every mailbox on the server, is in [Access Protection](https://www.corepanel.net/docs/security/access-protection). ### Connecting a mail client Use the server's hostname, the full email address as the username, and TLS: | | | |---|---| | **IMAP** | 993, SSL/TLS | | **SMTP** | 587 with STARTTLS, or 465 with SSL/TLS — either way, authentication is required | | **Username** | The full address, `info@example.com` | Both submission ports are open and equivalent, so a client migrated from another panel keeps whichever it was already set to. [Webmail](https://www.corepanel.net/docs/email/webmail) is available at `webmail.` — provisioned automatically for every domain, which is why `webmail` is a reserved subdomain label. The username there is the full address too. Webmail is reachable from the whole internet for every domain on the server, so mailbox passwords are what stands between an attacker and the mail. Set strong ones — the panel generates them for you when you create or edit a mailbox. ## Forwarders A **forwarder** (alias) sends mail arriving at one address on to one or more other addresses. It is not a mailbox: nothing is stored, the message is passed along. Use them for role addresses (`sales@`, `billing@`) that should land in a person's existing mailbox, or to deliver one address to a whole team. You can forward to any address, inside or outside the server. Every destination is validated as a real email address. ### Destinations on this server must be able to receive A forwarder pointing at an address **on one of your own domains** is only accepted when something there can actually take delivery: a mailbox, another forwarder, or a [catch-all](#catch-all). If there is nothing — or the destination mailbox is [suspended](#suspended-and-the-state-in-between) — saving is refused, and the error names the address. The reason is what happens otherwise. The forwarder saves, lists, and looks perfectly healthy, while every message through it is accepted by the server, passed on, found to have nowhere to go, and **bounced back to whoever wrote to you**. Nothing in the panel shows it; the only trace is in the mail log. That check runs when you save, so a destination deleted or suspended *later* can still leave a forwarder pointing at nothing. Those are flagged where you see them: ```bash corepanel mail forwarder list example.com ``` ``` support@example.com -> old-staff@example.com !! cannot receive: old-staff@example.com 1 forwarder(s) point at an address that cannot receive mail; every message through them bounces back to the sender. Create or reactivate the mailbox, or repoint the forwarder with `corepanel mail forwarder set`. ``` Destinations on domains this server does not host are never flagged — there is no way to check them from here. ### Keeping a copy in the mailbox An address is normally either a mailbox or a forwarder: mail is delivered, or it is passed along. The one way to have both is to **list the address among its own destinations**. `sales@example.com` forwarding to `sales@example.com` and `boss@partner.tld` delivers the message into the `sales@` mailbox and sends a copy to `boss@`. It is the arrangement you want for a role address somebody still reads locally while a manager, an archive or a ticketing system gets a copy. Two conditions, both checked when you save: - **A mailbox must exist at that address, and its delivery must be open.** Pointing at yourself with no mailbox there resolves to an unknown user, and a [suspended](#suspended-and-the-state-in-between) mailbox bounces — so both are refused rather than silently generating bounces later. - **Deleting the mailbox removes the copy.** The self-reference goes with it, and the forwarder goes too if that was its only destination. Nothing is left pointing at an address that no longer resolves. Any *other* forwarder on the address of a mailbox is still rejected. Postfix resolves forwarders before mailbox delivery, so it would divert every message away from the mailbox without saying so. > **Loops** > > A forwarder that would send mail back round to itself is refused — `a@` to `b@` while > `b@` already forwards to `a@`. An address that keeps a local copy is the exception: it is > where the mail stops, so a path arriving back at it ends there instead of going round. > **Forwarding to an external provider and SPF** > > Forwarding a message to Gmail or Outlook means your server re-sends mail that was > authorised for someone else's domain, which some providers treat as suspicious. If > forwarded mail lands in spam at the destination, that is why — and it is a limitation of > forwarding itself, not of your server's configuration. ## Catch-all A **catch-all** delivers everything sent to an address that does not exist at the domain to one mailbox of your choice. Convenient — nothing is ever lost to a typo — and expensive: spammers enumerate addresses, and a catch-all accepts every one of them. Prefer explicit addresses and forwarders, and use a catch-all only temporarily, for example just after a migration while you find out which addresses people actually use. ## Whole-domain redirect A **domain redirect** sends every address at one domain to the same local part at another: `anything@olddomain.com` → `anything@newdomain.com`. This is what CorePanel sets up automatically when you add a domain alias, so that mail to the alias never bounces. You can also configure one by hand after a rename, so the old domain's mail keeps arriving without recreating every mailbox. A domain has one route: a catch-all and a redirect are mutually exclusive. ## Per-mailbox: autoresponder and filters Opening a mailbox gives you its own workspace. ### Autoresponder An out-of-office reply with a subject, a body, a start and end date, and a minimum interval between replies to the same sender (so one correspondent does not receive twenty identical answers). ### Filters Rules applied at delivery: match on sender, recipient, subject or body, and file the message into a folder, forward it, or discard it. Filters are compiled to Sieve and run in Dovecot, so they apply no matter which client you read the mail with — including webmail and your phone. ## Email authentication The **Email authentication** page shows, per domain, the state of the records that decide whether your mail is trusted: | Record | Role | |---|---| | **SPF** | Lists which servers may send for the domain | | **DKIM** | Signs outgoing mail with the domain's key | | **DMARC** | Tells receivers what to do when SPF and DKIM fail, and where to send reports | For a domain whose DNS CorePanel serves, SPF and DKIM are published automatically when the domain is created. For a domain on external DNS, the page gives you the exact record values to paste into your provider, and **Verify** re-checks what is actually visible in DNS. Publishing a DMARC record is the step most often skipped, and it is the one that turns SPF and DKIM into an enforceable policy. Start with `p=none` and reports, then tighten. > **BIMI is not implemented** > > The interface lists BIMI, but it is a placeholder — CorePanel does not publish or manage > BIMI records yet. ## From the CLI ```bash corepanel mail list example.com corepanel mail quota sales@example.com 1024 corepanel mail suspend sales@example.com corepanel mail forwarder set sales@example.com owner@example.com corepanel mail catchall set example.com bucket@example.com corepanel mail redirect set old-example.com example.com corepanel mail vacation set sales@example.com --subject "Away" --message "Back on Monday" ``` Mailboxes are **created** from the panel; the CLI covers listing, quotas, suspension, deletion, forwarders, catch-alls, redirects, autoresponders and filters. The full command list is in the [CLI reference](https://www.corepanel.net/docs/cli).