Setting up email

Everything to do with email lives on one page: mailboxes, aliases, forwarders, vacation replies and the button to webmail. This page walks through them one by one.

Written for: Customer, Reseller, Administrator

Everything to do with email lives on one page: mailboxes, aliases, forwarders, vacation replies and the button to webmail. This page walks through them one by one.

If what you want to know is why mail sometimes lands in the spam folder, and what SPF, DKIM and DMARC are, that has a page of its own: Making sure your email arrives.

Screenshot — Panel → Hosting → Accounts → your account → Mail. At the top is the Email for picker: if your account has more than one domain, that is where you choose the one you are working on. Screenshots of this page are captured with openwolf designqc into .wolf/designqc-captures/.

First: does this server deliver your mail at all?

At the top of the mail page there is one switch: Deliver this domain's mail here.

On — this server accepts mail for your domain and drops it into the mailboxes below. This is what you want if you read your mail here.
Off — your mail goes somewhere else (Google Workspace, Microsoft 365, your old provider). The server accepts nothing for this domain, and the mailbox list is empty because there is nothing to deliver.

Turning it on makes the server generate a DKIM key for your domain right away. If the DNS zone is here too, the matching records are written into it for you.

# on the server
corectl mail status                 # per domain: delivered here, or elsewhere
corectl mail enable yoursite.com    # deliver here (generates the DKIM key)
corectl mail disable yoursite.com   # mail follows the MX records elsewhere

Creating a mailbox

Click Create mailbox.
Fill in the address — only the part before the @; the domain is already there.
Fill in a quota, in MB. 0 means no limit of its own: only the disk quota of the whole account counts.
Click Create.

The password is generated by the server and shown once, on a card with a copy button. CoreCP keeps it nowhere — not even in the task log. Put it in your password manager straight away; if you lose it, you simply generate a new one.

corectl mailbox add anna@yoursite.com --quota 2048
corectl mailbox list yoursite.com
corectl mailbox quota anna@yoursite.com --quota 5120
corectl mailbox remove anna@yoursite.com --purge   # --purge throws the messages away too

Leave --password out and the server generates one and prints it once. That is the recommended way.

Changing a mailbox password

Click the mailbox in the list; the panel slides open a panel with New password. Same rule: the server makes it, you see it once.

corectl mailbox passwd anna@yoursite.com

Anybody signed in on a phone or in Outlook at that moment is thrown out until the new password is entered there as well. Which is exactly what you want when you suspect somebody is reading along.

Settings for your mail program

In Outlook, Apple Mail or Thunderbird, fill in:

	value
Username	your full address, so `anna@yoursite.com`
Incoming (IMAP)	`mail.yoursite.com`, port 993, SSL/TLS
Outgoing (SMTP)	`mail.yoursite.com`, port 465 (SSL) or 587 (STARTTLS)
Authentication	password, for outgoing as well

POP3 (port 995) works too, but IMAP is nearly always better: it keeps your mail on the server, so your phone and your laptop see the same thing.

Aliases and forwarders

Under Aliases and forwarders are the addresses that have no mailbox of their own but pass mail on.

An alias is a second name for a mailbox that lives here: info@yoursite.com → anna@yoursite.com. The mail stays on this server.
A forwarder sends it outside: info@yoursite.com → anna@gmail.com.

Click Add forwarder and fill in the address and the destination. One address may have several destinations; add them one at a time.

corectl alias add info@yoursite.com anna@yoursite.com
corectl alias add info@yoursite.com accounts@yoursite.com   # second destination
corectl alias list yoursite.com
corectl alias remove info@yoursite.com anna@yoursite.com

Leave the destination off alias remove and every destination of that address goes.

Forwarding to Gmail or Outlook.com has a known sharp edge: those providers see a forwarded message as post from your server while the sender inside the mail is somebody else. Forward a lot of spam and your server gets the bill for it. For an address that receives a lot, a real mailbox over IMAP is a quieter answer than forwarding.

Catch-all: collecting what does not exist

If you want post to an address that does not exist to arrive somewhere anyway, use @ as the address. That is the catch-all for the whole domain.

corectl alias add @yoursite.com anna@yoursite.com

Think about it twice. A catch-all also collects every typo and every guessed address spammers try (info@, sales@, admin@, and a thousand more), so in practice it is mostly a spam funnel. A handful of aliases for the addresses you actually use is nearly always better.

Removing it again is the same line:

corectl alias remove @yoursite.com

Vacation reply (out of office)

Click a mailbox and choose Vacation reply. You fill in:

Subject and Message — what the sender gets back.
From and Until — outside that period nothing happens. Leave them empty and the reply stays on until you switch it off.
Interval — how many days the same sender goes without a second reply. The default is 1 day, which stops a colleague you are mailing back and forth with from receiving your vacation note ten times.

The reply is sent by Pigeonhole, the mail server's sieve engine. It knows the rules of replying politely: never to mailing lists, never to bounces or other automated post, and never twice to the same sender inside the interval.

corectl autoresponder set anna@yoursite.com \
  --subject "Away for a bit" \
  --message "I am back on 2 September. Anything urgent: info@yoursite.com." \
  --start 2026-08-15 --end 2026-09-01 --interval 1

corectl autoresponder show anna@yoursite.com
corectl autoresponder list yoursite.com
corectl autoresponder clear anna@yoursite.com

Opening webmail

Every mailbox has a Webmail button. It opens Roundcube in a new tab and signs you in as that mailbox — you do not type the password again. The ticket behind it is single-use and expires within a minute.

Webmail is also reachable on its own at https://webmail.yoursite.com, where you sign in with your full address and your mailbox password.

# a single-use webmail sign-on from the command line
corectl webmail sso anna@yoursite.com

# is webmail served on this node at all?
corectl webapps status
corectl webapps set --webmail on

What else is on this page

Status per mailbox: how much of the quota is in use, whether it has forwarders and whether a vacation reply is on.
DNS for this domain — a direct link to the DNS zone, where the mail records live.
Read again — the panel shows what it last heard from the server; this button fetches it again now.

When something is not right

What you see	What it usually is
The mailbox list is empty and the page says mail is delivered elsewhere	The switch at the top is off. Turn it on if you want to read your mail here.
New mailbox created, but nothing arrives	Your domain's MX records still point at your old provider. See Making sure your email arrives.
You can send, but everything lands in spam	SPF/DKIM/DMARC. See Making sure your email arrives.
The webmail button does nothing	Your browser blocked the new tab. Allow pop-ups for the panel, or go straight to `https://webmail.yoursite.com`.
"The server did not answer in full"	The node was briefly unreachable. Click Read again; if it stays, tell your hosting provider.

If the webmail button seems to do nothing

Webmail opens in a new tab, and that tab is requested at the moment you click. For a while it happened a fraction too late — only after the server had returned a one-time ticket — and a browser refuses a tab it cannot attribute to your click, without saying so. The button really did nothing. That is fixed: the tab is now reserved on the click itself and sent to webmail afterwards.

If nothing still happens, your browser is blocking pop-ups for the panel's address altogether. Allow them for that one address — in Safari under Settings → Websites → Pop-up Windows, in Chrome through the icon at the right of the address bar right after you click.

If you would rather not go through the panel, the server prints the same address:

ssh root@stck1.corecp.dev 'corectl mail webmail-url info@test100.nl'

Mail for one of your website's extra names

If your website has an extra name — mycompany.co.uk beside mycompany.com, say — mail to that name arrives in your main domain's mailboxes by default. info@mycompany.co.uk lands in info@mycompany.com, and the same goes for every other address. There is nothing to create for it.

If you do not want that, switch it off per name in the panel under the website's Extra names, or from the command line:

corectl domain alias set mycompany.com mycompany.co.uk --mail off

The server then refuses mail to that name right at the door, with a message the sender sees. That is on purpose: mail that quietly disappears is worse than mail that is refused, because at least a refusal tells the sender to look elsewhere.

Spam, and how much you may send

Every mailbox on this page is filtered from the moment it exists. Click a mailbox and open the Spam tab to change how hard the filter looks, what it does when it finds something, and which senders must always get through or never get through.

There is also a ceiling on outgoing mail — 100 messages an hour per mailbox by default — which exists to keep the whole server off blocklists when a website gets broken into. Mail over it is held and delivered later, not refused.

Both have a page of their own: Keeping spam out.