Mail

The Mail section of a server (/servers/:id/mail) turns the box into a real, self-hosted mail server: Postfix (SMTP), Dovecot (IMAP/POP3) and OpenDKIM (signing), with optional spam and antivirus filtering. It’s receive-first — installing sets up inbound mail and mailboxes, and sending stays off until you deliberately enable it. Available on all plans.

Set up mail, step by step

1. Open Mail on the server. If mail isn’t installed yet you’ll see an Install mail server card — click Install. This sets up Postfix + Dovecot + OpenDKIM on the box; it’s idempotent, so re-running it is safe.
2. Set the mail hostname (the server’s public FQDN, e.g. mail.example.com). Use Set mail name / Change name in the server card header. This is the name the box announces on SMTP and the host your MX record points at — a valid FQDN gates the deliverability story, so set it early. Tick cert to also issue a TLS certificate for that hostname.
3. Click Add new ▾ → Add domain and enter a domain the server should accept mail for. MZPanel generates that domain’s DKIM key and shows its DNS auth records (MX / SPF / DKIM / DMARC) to publish.
4. Publish the DNS records. Each record row has a Copy button and a live Verify state; if the domain is connected to Cloudflare, MZPanel can push the records for you. A green check means the record is live in public DNS.
5. Click Add new ▾ → Add mailbox, pick the domain, set the local part, a password (there’s a generator) and an optional quota. The mailbox starts receiving mail immediately.
6. (Optional) Enable sending and webmail — see below.

Set the hostname and publish DNS before you rely on it

Mailboxes receive as soon as they exist, but inbound only works once the domain’s MX points at your mail hostname, and inbox placement depends on SPF, DKIM and DMARC being live. Use the per-record Verify to confirm.

What else you can do

• Add aliases & forwarders — Add new ▾ → Add alias creates an address that forwards to one or more mailboxes.
• Edit a mailbox — change the display name, quota and password, and set an autoresponder (subject + message) — all saved in one action.
• Catch-all — route every unmatched address on a domain to a chosen mailbox.
• Enable sending — off by default. Turn it on to send outbound directly from the box, or point it at an SMTP relay (host, port, user, password) for better deliverability.
• Send a test — once sending is on, the Send test button delivers a probe message to any address to confirm outbound works.
• Spam & antivirus — toggle inbound spam filtering and ClamAV antivirus in the Deliverability check & Protection panel.
• Deliverability check — a preflight of outbound port 25, rDNS and IP reputation. These are warnings that surface real inbox-placement problems — they never block you.
• Open the firewall — one click opens the SMTP/IMAP/POP3 ports (25, 587, 465, 993, 995, 143, 110) in the box’s firewall so mail can reach it.
• Mail queue — view queued/deferred messages, flush the queue, or delete a stuck message.
• Webmail — enable a public webmail app at webmail.<domain> per domain, and open any mailbox’s inbox with one click (a short-lived signed auto-login, no password re-entry).
• Connection details — copyable IMAP/POP3/SMTP host, ports and encryption for setting up mail clients.

How it works

Every action dispatches a mail.* job to the server’s agent, which runs it natively (no mz shell-out) and returns JSON. State lives on the box, not in MZPanel’s database:

Action	Job	Notes
Status	mail.status	services, TLS, sending state, queue counts
Preflight	mail.preflight	port 25 / rDNS / IP-reputation checks
List	mail.list	domains, mailboxes, aliases
Install / reinstall	mail.install	idempotent Postfix + Dovecot + OpenDKIM setup
Set hostname	mail.hostname-set	mail FQDN, optional cert
Add / remove domain	mail.domain-add · mail.domain-del	generates DKIM per domain
Mailbox CRUD	mail.mailbox-add · mail.mailbox-del · mail.mailbox-passwd · mail.mailbox-quota
Alias	mail.alias-set · mail.alias-del	forward to one or more targets
Catch-all	mail.catchall-set
Autoresponder	mail.autoresponder-set
Sending	mail.send-set	direct or via SMTP relay
Test send	mail.test-send
Spam / antivirus	mail.spam-set · mail.av-set
Queue	mail.queue · mail.flush · mail.queue-del
Webmail	mail.webmail-set · mail.webmail-status · mail.webmail-login	public webmail.<domain> + signed auto-login

DKIM keys and maildirs live on the box under Postfix/Dovecot’s own layout. The DNS auth records shown on each domain are computed from the box (the DKIM value is the real public key from the VPS). Firewall toggles reuse the server’s security.fw job, and record verification reads live public DNS (with an optional Cloudflare push when the domain is connected there).

CLI & automation

Every action maps to an mz mail … command on the box — the same engine the dashboard drives. SSH in and run them directly, or let an on-box AI (ClaudeCode) run them:

mz mail status --json                                   # services, TLS, queue
mz mail list --json                                     # domains, mailboxes, aliases
mz mail domain add example.com --json                   # add a mail domain (+DKIM)
mz mail mailbox add [email protected] --password 's3cret' --quota 2048 --json
mz mail hostname set mail.example.com --cert --json     # set FQDN + issue TLS

Always pass --json for machine output. See The mz CLI and the command catalog.

Gotchas & troubleshooting

• Fully live — not a mock. Postfix/Dovecot/OpenDKIM (plus optional spam/antivirus), mailboxes, aliases, DNS records, webmail and the queue are all real and driven through the agent.
• Sending is opt-in. After install the box only receives. Until you enable sending, the Send test button is disabled and outbound won’t work.
• Set the mail hostname first. Much of the page (TLS, deliverability, MX) keys off a valid FQDN. If the hostname is unset or not a real FQDN, the header shows Set mail name — do that before adding domains.
• Port 25 is often blocked. Many providers block outbound port 25 by default. The preflight flags this as a warning; if it’s blocked, either ask your provider to open it or enable sending via an SMTP relay instead.
• Deliverability needs DNS. A domain won’t place in the inbox until SPF, DKIM and DMARC are live. Use each record’s Verify state, or push to Cloudflare if connected.
• Firewall. If mail can’t reach the box, open the mail ports from the Firewall ports panel — a common cause on locked-down VPSes.
• Needs the agent online. Every action needs a live agent; offline, the section can’t install, list, or run mail actions.

Related

• DNS & TLS — publish and verify the MX/SPF/DKIM/DMARC records.
• Cron jobs — scheduled tasks on the same server.
• The mz CLI — driving the box from the command line.