# Settings

## Panel credentials

These are the credentials for this control panel only. Applications keep their own logins and passwords, which are not affected.

Username Current password New password Confirm new password

Leave both new-password fields empty to change the username or DMARC address only. Changing the password signs out every other session; this one stays signed in.

## DMARC aggregate reports

Default `rua=` for every sending domain (overridable per domain). When ingest is on, this can be an address SelfPost accepts.

Default report address

When `rua=` points at another domain, that hub must publish a report-authorisation record. DMARC reports in the panel.

Host / name
mail.example.org._report._dmarc.example.com
Type TXT
Value
v=DMARC1;
Report authorization DNS ok

Published at mail.example.org._report._dmarc.example.com — aggregate reports addressed to dmarc@mail.example.org are authorised.

## Sending rate limits

Level 1 is set in Compose; restart the container to change it. Domain and application ceilings live on each domain’s page.

Level 1 — per client IP

100 messages / 60 seconds

`RATE_LIMIT_MESSAGES_PER_IP` / `RATE_LIMIT_WINDOW_SECONDS`. Hard ceiling for every connecting IP; the panel cannot raise a domain or application limit above this.

Level 2 — domain

Optional ceiling for all senders on a domain. When unset, only level 1 applies. Must be ≤ level 1.

Level 2 — application

Optional override for trusted IPs: a ceiling strictly above the domain limit (still ≤ level 1). Those IPs skip the domain check; everyone else stays under the domain (or level 1).