Mail Configuration

Mail Configuration gives you control over mailbox storage limits, sending rates, greylisting, and queue delivery behavior directly from the dashboard. No SSH or config file editing required.

Mailbox quotas

Quotas limit how much storage each mailbox can use. When a user reaches their quota, Dovecot rejects new messages with a "mailbox full" error until they free up space.

Global default quota

1. Go to Settings > Mail > Mailbox Quotas
2. Toggle quotas on
3. Set the default quota (e.g., 1 GB)
4. Click Save

The default quota applies to every mailbox that does not have a per-user override.

Per-user quota overrides

You can set a custom quota for individual users that overrides the global default:

1. Go to the Users page
2. Click the edit (pencil) icon on any user
3. Uncheck "Use server default" and enter a custom quota
4. Click Save

The Quota column in the users table shows "Default" for users using the global quota and the specific quota (e.g., "500 MB") for users with a custom override.

To remove a per-user override and revert to the server default, edit the user and check "Use server default" again.

How it works

CeyMail enables the Dovecot quota plugin and configures it to enforce limits via the count backend. Quota values are stored per-user in the database. A value of 0 means "use the global default."

Rate limits

Rate limiting prevents any single client from sending excessive email, protecting your server's IP reputation and preventing abuse.

Configuration

1. Go to Settings > Mail > Rate Limits
2. Toggle rate limiting on
3. Configure the limits:
   • Messages - maximum messages per time period (required)
   • Connections - maximum SMTP connections per time period (0 = unlimited)
   • Recipients - maximum recipients per time period (0 = unlimited)
4. Choose the time period: per hour or per day
5. Click Save

What gets limited

All three limits apply per client IP address and share the same time period. When a client exceeds any limit, Postfix temporarily rejects additional requests with a 450 error. The client's mail server will automatically retry later.

Greylisting

Greylisting temporarily rejects email from unknown senders, requiring them to retry after a delay. Legitimate mail servers always retry; most spam bots do not.

Configuration

1. Go to Settings > Mail > Greylisting
2. Toggle greylisting on
3. Set the delay (1-60 minutes). The default is 5 minutes.
4. Click Save

How it works

CeyMail uses Postgrey as the greylisting policy server. When enabled:

1. CeyMail installs and configures Postgrey automatically
2. Postfix is configured to check Postgrey before accepting mail
3. First-time sender/recipient/IP combinations are temporarily rejected
4. After the configured delay, retries from the same combination are accepted
5. Known sender/recipient pairs are whitelisted for 35 days

When you disable greylisting, CeyMail stops the Postgrey service and removes it from the Postfix policy chain.

Queue & delivery

These settings control how Postfix handles undeliverable messages - how long it retries before giving up, and how frequently it retries.

Configuration

Go to Settings > Mail > Queue & Delivery and adjust:

• Queue lifetime - how long Postfix retries delivery before sending a bounce notification to the sender (default: 5 days)
• Bounce lifetime - how long bounce notification messages themselves are retried (default: 5 days)
• Min retry interval - the shortest time between delivery attempts for a deferred message (default: 300 seconds)
• Max retry interval - the longest time between delivery attempts, reached after repeated failures (default: 4,000 seconds)

How retry intervals work

Postfix uses exponential backoff between delivery attempts. The first retry happens after the minimum interval. Each subsequent retry waits longer, up to the maximum interval. Lower values deliver faster but generate more server traffic. Higher values are gentler on destination servers but delay delivery.

When to adjust these

• Reduce queue lifetime if you want senders notified faster when delivery fails (e.g., 1 day instead of 5)
• Increase queue lifetime if destination servers have extended downtime windows
• Reduce retry intervals for time-sensitive mail that needs faster delivery attempts
• Increase retry intervals to reduce load on your server and be gentler on destination servers

Sender relay routing

Route outbound mail from specific sender domains through different SMTP relays. For example, route all mail from @marketing.com through a dedicated relay while other domains use direct delivery.

1. Go to Settings > Mail > Sender Relay Routing
2. Toggle on
3. Add entries: sender pattern (@domain.com) and relay host ([relay.example.com]:587)
4. Relays must accept connections from your server without authentication

TLS policy

Force TLS encryption when sending to specific destination domains. Useful for ensuring sensitive communications with partners or banks are always encrypted.

1. Go to Settings > Mail > TLS Policy
2. Toggle on
3. Add entries: destination domain and policy level

Available policy levels:

• may - encrypt if the destination supports it (default Postfix behavior)
• encrypt - require TLS but do not verify certificates
• dane - use DANE/TLSA records for opportunistic verification
• verify - require TLS with a valid CA-signed certificate
• secure - strictest: verify + DNS forgery protection
• none - disable TLS entirely (use with caution)

Audit copies (BCC)

Send copies of sent or received mail to archive addresses for compliance or auditing. BCC copies are sent silently - senders and recipients are never notified.

Sender BCC

Copies of all outgoing mail from matching senders are sent to the archive address.

1. Go to Settings > Mail > Audit Copies
2. Toggle Sender BCC on
3. Add entries: sender pattern (@domain.com or user@domain.com) and BCC address

Recipient BCC

Copies of all incoming mail to matching recipients are sent to the archive address.

1. Toggle Recipient BCC on
2. Add entries: recipient pattern and BCC address

Domain aliases

Mirror all mailboxes from one domain to another. Mail sent to the alias domain is delivered to the matching mailbox on the primary domain. For example, if company.com is an alias of org.com, then user@company.com delivers to user@org.com.

1. Go to Settings > Mail > Domain Aliases
2. Enter an alias domain name and select the primary domain
3. Click Add

To remove an alias, click the delete button and confirm. Alias domains that have mailboxes cannot be deleted until the mailboxes are removed first.

SRS (Sender Rewriting Scheme)

SRS rewrites the envelope sender on forwarded mail so that SPF checks pass at the final destination. Without SRS, forwarded mail may fail SPF because the forwarding server is not authorized to send on behalf of the original sender's domain.

1. Go to Settings > Mail > SRS
2. Toggle on
3. Enter your server's primary mail domain as the SRS domain
4. Click Save

CeyMail installs PostSRSD automatically when SRS is first enabled.

Per-user spam preferences

Override the SpamAssassin spam score threshold for individual users. Lower scores are more aggressive (catch more spam but risk more false positives). Higher scores are more permissive.

1. Go to Settings > Mail > Per-User Spam Preferences
2. Toggle on
3. Add entries: email address and required score (default: 5.0)

Users not listed use the server default threshold.

Settings summary