Server
The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear, Required holds the mail until a TLS session is possible, Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.
Choose whom this domain accepts. Listed addresses only: the relay accepts exactly the addresses you list, one per line or comma-separated, and refuses any other while the sender is still connected, so it never has to send a bounce for them. Any recipient: everything at the domain is accepted and passed on, and an address the upstream then rejects comes back as a bounce from this server to a sender who is often forged — backscatter. Prefer a list, and keep it in step with the mailboxes upstream.
The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's .env, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or deferred, so the sending server tries again later, as the server's setting says; the box states which.
One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: accept — handed on to the upstream; reject — refused for good; tempfail — the sender was asked to come back later; quarantine — held by the filter. Why names who decided. rspamd is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; postfix is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; selfpost means nobody judged the message: it was relayed with no filter attached. Accept says what this server did, not what the upstream did with the message afterwards.
Accepted mail is recorded as it passes; refused mail is read from mail.log, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.
Two lists for the whole server that correct the spam filter by hand. An entry is a sender address, a sender domain — that domain, not its subdomains — or a client address or network in CIDR form. A sender on the Deny list is refused outright. A sender on the Allow list is given a weight no spam score outweighs, so the filter lets it through. When entries of both lists match one message, Deny wins.
SelfPost does not apply the lists itself: it writes them as files under /data/antispam/, and rspamd rereads a file within seconds of a change. With the spam filter off the lists are kept and can be edited, but nothing reads them. The sender matched is the envelope sender — the one in the log — not the From line a mail program shows.
Full backup downloads one archive of the whole instance: data/ (the database, DKIM keys and application credentials), docker-compose.yml, .env and certs/. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in certs/ has to be readable by the panel: give it to group 998 on the host (chgrp 998, chmod 640). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as .spbk, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a .spbk first with selfpost-backup -decrypt) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and mail.log are not included. One domain moves on its own: Export domain on its settings page writes a .json (or encrypted .spde) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.
The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); All includes domains added later, and a domain user needs at least one domain or All on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out of their other sessions.
Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast /data grows. It does not change the rotation of mail.log, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in .env: changing it needs a restart, and no level-2 limit can exceed it.
Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast /data grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of mail.log, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in .env: changing it needs a restart, and no level-2 limit can exceed it.
| Value | Note | Added | |
|---|---|---|---|
| @bulk.example domain | newsletter nobody subscribed to | 2026-09-02 | Remove |
| 198.51.100.0/24 ip | dictionary attack on lists.example.org | 2026-08-19 | Remove |
| win@lottery.example address | — | 2026-07-30 | Remove |
| bulk.example domain | newsletter nobody subscribed to | 2026-09-02 | |
| 198.51.100.0/24 ip | dictionary attack on lists.example.org | 2026-08-19 | |
| win@lottery.example address | — | 2026-07-30 |
INBOUND_ANTISPAM_MILTER is set.Inbound
What port 25 decided about each message, one row per recipient. Accepts come from the inbound journal, rejects from mail.log; the filter's reasons appear when the spam filter is on.
What port 25 decided about each message, one row per recipient. Accepted mail is recorded as it passes, refused mail is read from mail.log; the filter's verdict appears when the spam filter is on. Rows older than 90 days are deleted — change that in Settings.
| Time, UTC | From · client | To | Subject | Decision | Why | |
|---|---|---|---|---|---|---|
| 09-21 14:00:18 | t.berg@ 192.0.2.77 | dev@ | Re: [dev] patch series v3 | accept | rspamd · score 0.4 | Deny sender |
| 09-21 13:59:02 | invoice@ 203.0.113.140 | owner@ | Outstanding invoice — action required | quarantine | rspamd · score 9.8 · PHISHING, FORGED_SENDER | Review |
| 09-21 13:57:41 | promo@ 198.51.100.90 | sales@ | — | reject | postfix · 550 5.1.1 unknown recipient | Deny sender |
| 09-21 13:51:30 | billing@ 198.51.100.12 | owner@ | Invoice 2026-0917 | reject | rspamd · score 16.2 · BAYES_SPAM | Allow sender |
| 09-21 13:44:02 | hr@ 192.0.2.31 | jobs@ | Application: backend engineer | tempfail | selfpost · upstream 10.0.4.12 timed out | |
| 09-21 13:30:55 | noreply@ 192.0.2.200 | security@ | [advisory] new report | accept | rspamd · allow list | |
| 09-21 14:00:18 | t.berg@ 192.0.2.77 | dev@ | Re: [dev] patch series v3 | accept | rspamd · no action, score 0.40 / 15.00 | Deny sender |
| 09-21 13:59:02 | invoice@ 203.0.113.140 | owner@ | Outstanding invoice — action required | accept | rspamd · add header, score 9.80 / 15.00; PHISHING(5.00) FORGED_SENDER(3.00) R_SPF_FAIL(1.00) | Deny sender |
| 09-21 13:57:41 | promo@ 198.51.100.90 | sales@ | — | reject | postfix · 550 5.1.1 <sales@lists.example.org>: Recipient address rejected: User unknown in relay recipient table | Deny sender |
| 09-21 13:51:30 | billing@ 198.51.100.12 | owner@ | — | reject | rspamd · 5.7.1 Spam message rejected | Allow sender |
| 09-21 13:44:02 | hr@ 192.0.2.31 | jobs@ | — | tempfail | rspamd · 4.7.1 Try again later | Allow sender |
| 09-21 13:30:55 | noreply@ 192.0.2.200 | security@ | [advisory] new report | accept | rspamd · no action, score -98.10 / 15.00; SELFPOST_ALLOW_FROM(-100.00) R_DKIM_ALLOW(-0.20) | Deny sender |
The main driver of /data growth. Does not affect mail.log rotation (fourteen daily files).
The inbound log also never holds more than 10 000 rows: refused mail is logged at the rate strangers knock on port 25.
Server
The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear, Required holds the mail until a TLS session is possible, Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.
Choose whom this domain accepts. Listed addresses only: the relay accepts exactly the addresses you list, one per line or comma-separated, and refuses any other while the sender is still connected, so it never has to send a bounce for them. Any recipient: everything at the domain is accepted and passed on, and an address the upstream then rejects comes back as a bounce from this server to a sender who is often forged — backscatter. Prefer a list, and keep it in step with the mailboxes upstream.
The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's .env, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or deferred, so the sending server tries again later, as the server's setting says; the box states which.
One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: accept — handed on to the upstream; reject — refused for good; tempfail — the sender was asked to come back later; quarantine — held by the filter. Why names who decided. rspamd is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; postfix is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; selfpost means nobody judged the message: it was relayed with no filter attached. Accept says what this server did, not what the upstream did with the message afterwards.
Accepted mail is recorded as it passes; refused mail is read from mail.log, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.
Two lists for the whole server that correct the spam filter by hand. An entry is a sender address, a sender domain — that domain, not its subdomains — or a client address or network in CIDR form. A sender on the Deny list is refused outright. A sender on the Allow list is given a weight no spam score outweighs, so the filter lets it through. When entries of both lists match one message, Deny wins.
SelfPost does not apply the lists itself: it writes them as files under /data/antispam/, and rspamd rereads a file within seconds of a change. With the spam filter off the lists are kept and can be edited, but nothing reads them. The sender matched is the envelope sender — the one in the log — not the From line a mail program shows.
Full backup downloads one archive of the whole instance: data/ (the database, DKIM keys and application credentials), docker-compose.yml, .env and certs/. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in certs/ has to be readable by the panel: give it to group 998 on the host (chgrp 998, chmod 640). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as .spbk, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a .spbk first with selfpost-backup -decrypt) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and mail.log are not included. One domain moves on its own: Export domain on its settings page writes a .json (or encrypted .spde) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.
The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); All includes domains added later, and a domain user needs at least one domain or All on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out of their other sessions.
Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast /data grows. It does not change the rotation of mail.log, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in .env: changing it needs a restart, and no level-2 limit can exceed it.
Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast /data grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of mail.log, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in .env: changing it needs a restart, and no level-2 limit can exceed it.
| Value | Note | Added | |
|---|---|---|---|
| @bulk.example domain | newsletter nobody subscribed to | 2026-09-02 | Remove |
| 198.51.100.0/24 ip | dictionary attack on lists.example.org | 2026-08-19 | Remove |
| win@lottery.example address | — | 2026-07-30 | Remove |
| bulk.example domain | newsletter nobody subscribed to | 2026-09-02 | |
| 198.51.100.0/24 ip | dictionary attack on lists.example.org | 2026-08-19 | |
| win@lottery.example address | — | 2026-07-30 |
INBOUND_ANTISPAM_MILTER is set.Inbound
What port 25 decided about each message, one row per recipient. Accepts come from the inbound journal, rejects from mail.log; the filter's reasons appear when the spam filter is on.
What port 25 decided about each message, one row per recipient. Accepted mail is recorded as it passes, refused mail is read from mail.log; the filter's verdict appears when the spam filter is on. Rows older than 90 days are deleted — change that in Settings.
| Time, UTC | From · client | To | Subject | Decision | Why | |
|---|---|---|---|---|---|---|
| 09-21 14:00:18 | t.berg@ 192.0.2.77 | dev@ | Re: [dev] patch series v3 | accept | rspamd · score 0.4 | Deny sender |
| 09-21 13:59:02 | invoice@ 203.0.113.140 | owner@ | Outstanding invoice — action required | quarantine | rspamd · score 9.8 · PHISHING, FORGED_SENDER | Review |
| 09-21 13:57:41 | promo@ 198.51.100.90 | sales@ | — | reject | postfix · 550 5.1.1 unknown recipient | Deny sender |
| 09-21 13:51:30 | billing@ 198.51.100.12 | owner@ | Invoice 2026-0917 | reject | rspamd · score 16.2 · BAYES_SPAM | Allow sender |
| 09-21 13:44:02 | hr@ 192.0.2.31 | jobs@ | Application: backend engineer | tempfail | selfpost · upstream 10.0.4.12 timed out | |
| 09-21 13:30:55 | noreply@ 192.0.2.200 | security@ | [advisory] new report | accept | rspamd · allow list | |
| 09-21 14:00:18 | t.berg@ 192.0.2.77 | dev@ | Re: [dev] patch series v3 | accept | rspamd · no action, score 0.40 / 15.00 | Deny sender |
| 09-21 13:59:02 | invoice@ 203.0.113.140 | owner@ | Outstanding invoice — action required | accept | rspamd · add header, score 9.80 / 15.00; PHISHING(5.00) FORGED_SENDER(3.00) R_SPF_FAIL(1.00) | Deny sender |
| 09-21 13:57:41 | promo@ 198.51.100.90 | sales@ | — | reject | postfix · 550 5.1.1 <sales@lists.example.org>: Recipient address rejected: User unknown in relay recipient table | Deny sender |
| 09-21 13:51:30 | billing@ 198.51.100.12 | owner@ | — | reject | rspamd · 5.7.1 Spam message rejected | Allow sender |
| 09-21 13:44:02 | hr@ 192.0.2.31 | jobs@ | — | tempfail | rspamd · 4.7.1 Try again later | Allow sender |
| 09-21 13:30:55 | noreply@ 192.0.2.200 | security@ | [advisory] new report | accept | rspamd · no action, score -98.10 / 15.00; SELFPOST_ALLOW_FROM(-100.00) R_DKIM_ALLOW(-0.20) | Deny sender |
The main driver of /data growth. Does not affect mail.log rotation (fourteen daily files).
The inbound log also never holds more than 10 000 rows: refused mail is logged at the rate strangers knock on port 25.