Mailboxes and Forwarders

CorePanel runs a full mail stack — Postfix, Dovecot and Rspamd — and manages it per domain. This page covers the day-to-day: the addresses themselves. For how the stack fits together, see Mail System.

Which domains can have mail

	Mail
Primary domain	Yes — its own mailboxes and DKIM identity
Addon domain	Yes — its own mailboxes and DKIM identity
Alias (parked) domain	No mailboxes of its own; its mail is redirected to the primary
Subdomain	No. Mail belongs to domains, not to subdomains

Mailboxes

Email accounts in the panel lists mailboxes per domain. Creating one asks for the local part, a password and a quota in MB (0 = unlimited).

You can afterwards:

• change the password;
• resize the quota;
• enable or disable the account without deleting it;
• delete it.

Mailbox creation is capped by the account’s Email accounts limit (0 = unlimited).

Mail to an address that does not exist

The server refuses it during the SMTP session, so the sending server is told immediately and no message is ever accepted. Writing to an address that was mistyped, or to a mailbox that was deleted, produces an instant “no such recipient here” rather than a bounce arriving minutes later.

That matters for more than tidiness. Accepting a message first and discovering afterwards that it has nowhere to go leaves the server owing its sender a bounce — and the senders on spam runs are forged, so those bounces go to people who never wrote to you. A server doing that is emitting backscatter, and mail providers score it against the server’s reputation. Refusing during the session emits none.

A mailbox that exists but is suspended is refused with a different reason — “this mailbox is suspended” — so a correspondent is not told to delete an address that is coming back.

Suspended, and the state in between

A mailbox has two halves that can be shut independently:

State	Receives mail	Can sign in
Active	yes	yes
Sign-in blocked	yes	no
Suspended	no — the sender gets a bounce	no

Suspending from the panel closes both: the address stops accepting mail and the sender is told so, which is the honest signal for an account that is really shut.

Servers upgraded from before 1.6.14

Until 1.6.14 the mail lookup database could not record a mailbox as suspended — the value was dropped on the way in and the row was written active. The panel showed the mailbox as suspended and Postfix went on delivering to it, with nothing on either side saying so. The same applied to a forwarder switched off. Upgrading fixes new changes but does not go back and repair the rows already written: run corepanel mail sync once to rewrite them from the panel’s data.

Sign-in blocked is the state you inherit rather than choose. Other panels suspend a mailbox’s login while the address keeps receiving — cPanel does it by locking the password hash — so an imported mailbox arrives that way: the mail keeps arriving and piling up, and the owner cannot read it until you turn sign-in back on. Reactivating the mailbox opens both halves.

A full mailbox bounces, it does not drop mail

Dovecot refuses delivery to a mailbox that is over its quota with 552 5.2.2 Quota exceeded, and Postfix bounces the message back to the sender. The mailbox still authenticates and everything in it stays readable; deleting messages resumes delivery. Remember that messages also count against the account’s disk quota, which stops mail for every mailbox at once — see Quotas and Usage.

Recent access

The mailbox’s Security section also shows its own sign-in record: when it last signed in successfully, when it was last rejected, how many rejections there have been and from how many distinct addresses, above the most recent events.

This is usually the fastest way to settle “my email stopped working” — whether the last accepted sign-in was minutes or months ago, and whether anything has been rejected since, answers the question before any setting is touched. The full picture, for every mailbox on the server, is in Access Protection.

Connecting a mail client

Use the server’s hostname, the full email address as the username, and TLS:

IMAP	993, SSL/TLS
SMTP	587 with STARTTLS, or 465 with SSL/TLS — either way, authentication is required
Username	The full address, info@example.com

Both submission ports are open and equivalent, so a client migrated from another panel keeps whichever it was already set to.

Webmail is available at webmail.<domain> — provisioned automatically for every domain, which is why webmail is a reserved subdomain label. The username there is the full address too.

Webmail is reachable from the whole internet for every domain on the server, so mailbox passwords are what stands between an attacker and the mail. Set strong ones — the panel generates them for you when you create or edit a mailbox.

Forwarders

A forwarder (alias) sends mail arriving at one address on to one or more other addresses. It is not a mailbox: nothing is stored, the message is passed along.

Use them for role addresses (sales@, billing@) that should land in a person’s existing mailbox, or to deliver one address to a whole team.

You can forward to any address, inside or outside the server. Every destination is validated as a real email address.

Destinations on this server must be able to receive

A forwarder pointing at an address on one of your own domains is only accepted when something there can actually take delivery: a mailbox, another forwarder, or a catch-all. If there is nothing — or the destination mailbox is suspended — saving is refused, and the error names the address.

The reason is what happens otherwise. The forwarder saves, lists, and looks perfectly healthy, while every message through it is accepted by the server, passed on, found to have nowhere to go, and bounced back to whoever wrote to you. Nothing in the panel shows it; the only trace is in the mail log.

That check runs when you save, so a destination deleted or suspended later can still leave a forwarder pointing at nothing. Those are flagged where you see them:

corepanel mail forwarder list example.com

support@example.com              -> old-staff@example.com
                                    !! cannot receive: old-staff@example.com

1 forwarder(s) point at an address that cannot receive mail; every
message through them bounces back to the sender. Create or reactivate the
mailbox, or repoint the forwarder with `corepanel mail forwarder set`.

Destinations on domains this server does not host are never flagged — there is no way to check them from here.

Keeping a copy in the mailbox

An address is normally either a mailbox or a forwarder: mail is delivered, or it is passed along. The one way to have both is to list the address among its own destinations.

sales@example.com forwarding to sales@example.com and boss@partner.tld delivers the message into the sales@ mailbox and sends a copy to boss@. It is the arrangement you want for a role address somebody still reads locally while a manager, an archive or a ticketing system gets a copy.

Two conditions, both checked when you save:

• A mailbox must exist at that address, and its delivery must be open. Pointing at yourself with no mailbox there resolves to an unknown user, and a suspended mailbox bounces — so both are refused rather than silently generating bounces later.
• Deleting the mailbox removes the copy. The self-reference goes with it, and the forwarder goes too if that was its only destination. Nothing is left pointing at an address that no longer resolves.

Any other forwarder on the address of a mailbox is still rejected. Postfix resolves forwarders before mailbox delivery, so it would divert every message away from the mailbox without saying so.

Loops

A forwarder that would send mail back round to itself is refused — a@ to b@ while b@ already forwards to a@. An address that keeps a local copy is the exception: it is where the mail stops, so a path arriving back at it ends there instead of going round.

Forwarding to an external provider and SPF

Forwarding a message to Gmail or Outlook means your server re-sends mail that was authorised for someone else’s domain, which some providers treat as suspicious. If forwarded mail lands in spam at the destination, that is why — and it is a limitation of forwarding itself, not of your server’s configuration.

Catch-all

A catch-all delivers everything sent to an address that does not exist at the domain to one mailbox of your choice.

Convenient — nothing is ever lost to a typo — and expensive: spammers enumerate addresses, and a catch-all accepts every one of them. Prefer explicit addresses and forwarders, and use a catch-all only temporarily, for example just after a migration while you find out which addresses people actually use.

Whole-domain redirect

A domain redirect sends every address at one domain to the same local part at another: anything@olddomain.com → anything@newdomain.com.

This is what CorePanel sets up automatically when you add a domain alias, so that mail to the alias never bounces. You can also configure one by hand after a rename, so the old domain’s mail keeps arriving without recreating every mailbox.

A domain has one route: a catch-all and a redirect are mutually exclusive.

Per-mailbox: autoresponder and filters

Opening a mailbox gives you its own workspace.

Autoresponder

An out-of-office reply with a subject, a body, a start and end date, and a minimum interval between replies to the same sender (so one correspondent does not receive twenty identical answers).

Filters

Rules applied at delivery: match on sender, recipient, subject or body, and file the message into a folder, forward it, or discard it. Filters are compiled to Sieve and run in Dovecot, so they apply no matter which client you read the mail with — including webmail and your phone.

Email authentication

The Email authentication page shows, per domain, the state of the records that decide whether your mail is trusted:

Record	Role
SPF	Lists which servers may send for the domain
DKIM	Signs outgoing mail with the domain’s key
DMARC	Tells receivers what to do when SPF and DKIM fail, and where to send reports

For a domain whose DNS CorePanel serves, SPF and DKIM are published automatically when the domain is created. For a domain on external DNS, the page gives you the exact record values to paste into your provider, and Verify re-checks what is actually visible in DNS.

Publishing a DMARC record is the step most often skipped, and it is the one that turns SPF and DKIM into an enforceable policy. Start with p=none and reports, then tighten.

BIMI is not implemented

The interface lists BIMI, but it is a placeholder — CorePanel does not publish or manage BIMI records yet.

From the CLI

corepanel mail list example.com
corepanel mail quota sales@example.com 1024
corepanel mail suspend sales@example.com
corepanel mail forwarder set sales@example.com owner@example.com
corepanel mail catchall set example.com bucket@example.com
corepanel mail redirect set old-example.com example.com
corepanel mail vacation set sales@example.com --subject "Away" --message "Back on Monday"

Mailboxes are created from the panel; the CLI covers listing, quotas, suspension, deletion, forwarders, catch-alls, redirects, autoresponders and filters. The full command list is in the CLI reference.