Skip to main content

Admin Console

The Mailez admin console makes mail-system administration simple instead of painful.

Domain Health Checks​

The console's Health page runs a live check-up for every mail domain, one item at a time with ok / warn / fail / unknown status and a fix hint, and a re-run button — use it for day-one self-checks and routine inspections:

  • DNS checks (grouped per domain):
    • MX — points at this host; pointing elsewhere (perhaps a gateway/relay) is a warning, not a false fail
    • SPF — a v=spf1 record exists, covers this host and uses a -all hard policy
    • DMARC — policy grade (p=reject / p=quarantine pass; p=none is monitoring-only and warns)
    • DKIM — the published key is compared character by character with the server's actual key, so a mis-published record surfaces immediately
    • Spamhaus ZEN blocklist — the server IP is queried; SBL/XBL hits fail, while the PBL listing common to cloud provider IPs is graded as its own advisory (use an outbound relay or request removal) — not spam evidence, and inbound delivery is unaffected
    • autoconfig / MTA-STS — whether the client-autoconfig and MTA-STS hostnames are published
  • System probes — engine IMAP / MTA dial, Redis, database, disk and memory headroom, and the remaining validity of the public TLS certificate (warns within 14 days, fails when expired)

The health checker distinguishes "record absent" from "probe failed", so it never renders a false pass or a false fail.

DNS Wizard​

The domains page ships a built-in DNS wizard for every domain: the nine records a deployment must publish — MX, SPF, DKIM, DMARC, the autoconfig / autodiscover / mta-sts CNAMEs, the MTA-STS policy TXT and the TLSRPT report TXT — each with the exact name and value to enter (the DKIM value comes straight from the current key) plus live verification: configured / missing / mismatch. Copy, paste, done.

Client Autoconfig & MTA-STS​

Built-in client autoconfiguration endpoints — Thunderbird / Outlook / Apple clients pick up the server settings from the email address alone:

  • Mozilla autoconfig: /mail/config-v1.1.xml (also under /.well-known/)
  • Microsoft autodiscover: /stack/autoconfig/microsoft(.json)
  • Apple configuration profile: /stack/autoconfig/apple
  • MTA-STS policy: /.well-known/mta-sts.txt (STSv1, default mode testing — reporting only, safe to publish)

Together with the autoconfig/mta-sts CNAMEs above, clients need zero manual configuration.

Self-Serve TOTP Enrollment​

Admins can enroll in TOTP two-factor authentication from the config page's Security tab: the page shows the secret and otpauth:// URI (scan into any authenticator app); verifying one code enables it, and a code is required to disable it.

Greylisting Switch​

The engine's built-in greylisting (first delivery from a borderline sender is temporarily deferred, retried within an hour and then let through) is exposed via the MAILEZINE_JUNK_GREYLIST variable in the compose files — available in both community and enterprise editions; off by default.

Admin Digest & Traffic Reports (Enterprise)​

  • Admin digest email — a daily (default 03:00) or weekly operations summary to the first global admin: account/domain counts, new users, logins and failed attempts, sends, and the health verdict; a database lease guarantees exactly one replica sends it
  • Traffic report — engine Prometheus counters are sampled every 5 minutes and aggregated per day (with counter-reset detection); the console's Reports page charts it with no external monitoring needed

Core Features​

Everything in One Place​

Manage all mail-related configuration from a single interface:

  • Domain management — add, verify and configure domains
  • Mailbox management — create, edit and delete mail accounts
  • Alias management — configure aliases, forwarding rules and anonymous aliases
  • Distribution groups — create, edit and delete groups; one address delivers to many members (including external addresses and nested groups)
  • Relay configuration — set up external SMTP relays
  • External mailbox fetching — pull mail from external mailboxes automatically
  • App tokens — dedicated passwords for third-party apps

One-Click DKIM Setup​

  • Generate DKIM signing keys with one click
  • Clear status feedback so mail never lands in spam
  • DNS records configured automatically

Directory & Identity​

  • AD / LDAP integration — LDAP/AD authentication fallback with account lifecycle sync
  • Organization contacts — department-tree browsing; LDAP groups expanded into mailing lists in real time
  • SSO — integrate with enterprise identity providers

Mail Archive​

  • Full capture of inbound/outbound mail at the engine
  • Retention policies and metadata search
  • Review notes, .eml download and mbox export

Outbound DLP Approval​

  • Keyword/regex rules scan outbound mail; hits are blocked or routed to approval
  • Approval desk can release or reject; auto-rejects on expiry
  • Fully audited

Announcements​

  • Publish global announcement banners with one click
  • Reaches every mailbox in the organization

Audit Log​

  • Records every admin action
  • Who did what and when, at a glance
  • Export and search supported

Role-Based Access​

  • Admin — full control
  • Manager — manages mailboxes and users
  • User — manages only their own settings

License & Mailbox Cap​

  • The enterprise edition is capped by the license file (MAILEZ_LICENSE_FILE): mailbox count (users/mailboxes)
  • Mailbox creation, self-signup and AD/LDAP auto-provisioning all enforce the cap; over-limit requests return 403
  • The overview page shows license status: edition, used/max and expiry

Technical Service​

  • Service (support/SLA/launch assistance) is a separate annual subscription available to both editions
  • The service certificate is loaded via MAILEZ_SERVICE_FILE; the overview shows the tier and coverage status

Config Import/Export​

  • Back up the entire configuration with one click
  • Restore quickly when migrating to a new server
  • Configuration versioning

Webhooks​

  • New-mail and approval events callback to external systems
  • HMAC signature verification; integrate with ticketing, CRM and monitoring

Security Features​

  • Two-factor authentication (TOTP)
  • Session management
  • IP allowlist (optional)
  • Action auditing

Horizontal Scaling & Multi-Replica HA​

The enterprise edition scales the control plane horizontally: mailezctl up ha (the enterprise stack plus the docker-compose.ha.yml overlay). The backend and both frontends run as stateless replicas; the gateway picks up new replicas automatically, so capacity grows on demand.

  • Atomic scheduled-send claims — no double delivery under any replica count; a replica that dies mid-delivery has its claim reclaimed and redelivered after 5 minutes
  • Lease-elected background workers — external mailbox fetch, web push, calendar reminders, attachment cleanup, archive retention, DLP approval expiry and LDAP sync run on exactly one lease holder; if the leader dies another replica takes over within 60 seconds, no operator action needed
  • Shared object storage — large attachments and the drive live in S3-compatible object storage (RustFS by default; MAILEZ_DRIVE_BACKEND=s3), so an upload may land on one replica and be downloaded from another
  • Natively distributed storage — control-plane MySQL, engine KV (TiDB) and blobs (S3 object storage) are distributed components; the engine cluster is either lease-based active-passive failover or the multi tier's fully multi-active serving tier (every replica serves every account, deliveries claimed per message with crash take-over — mailezctl up multi)

Scale out with docker compose … up -d --scale backend=4; the gateway picks up new replicas within 30 seconds. Operational notes (NTP, backups, rolling upgrades) live in the repository's docs/scaling.md.

Access the Console​

In production, go through the gateway — the webmail and the admin console share one domain and port:

  • Admin console: https://<mail host>/admin (e.g. https://mail.example.com/admin)
  • Webmail: https://<mail host>/

The direct host ports 8081 / 8082 / 8083 bind to loopback only by default (127.0.0.1), for debugging; CardDAV / CalDAV are likewise served through the gateway at https://<mail host>/dav/, so no backend port needs to be exposed.

For a local trial (no gateway), visit http://localhost:8082 (admin) and http://localhost:8083 (webmail).

After first startup, create the admin account: for container deployments run docker compose … exec backend mailez-seed; for source-based development run go run ./cmd/seed (default account admin@example.com / MailezDemo2026!, overridable via environment variables).