Mail queue warn
- -3 deferred, 0 bounce-hold. Oldest 18 minutes.
+ +Overall warn
+Running, with warnings below.
+Mail queue warn
+3 Kbytes in 3 Requests.
View queue - -Inbound ok
-Accepting on port 25 for 1 domain. Last forward 2 minutes ago.
- Inbound domains -Inbound
Module off (INBOUND_RELAY_ENABLE=false). The outbound path is unchanged.
Machine ok
- -Processes ok
TLS certificate ok
- -TLS certificate ok
2026-11-02 12:00 UTC -Let’s Encrypt, 78 days left. Mounted for port 465.
- -Milter sockets ok
Hostname / rDNS ok
- -Valid for another 78 day(s).
+Milter sockets ok
+| Milter | State | Detail |
|---|---|---|
| OpenDKIM | +ok | +Listening | +
| send-log | +ok | +Listening | +
Hostname and reverse DNS ok
mail.example.org - - mail.example.org → 203.0.113.10 → mail.example.org + + 203.0.113.10 → mail.example.org +mail.example.org resolves to 203.0.113.10 and the reverse lookup points back at it.
- +Inbound warn
+INBOUND_RELAY_ENABLE is on. Port 25 accepts mail for 2 domains and forwards it upstream — not to local mailboxes.
One domain has no MX pointing at this server. Recipients are a list or any address at the domain. Open Inbound for the list, MX checks, upstream, and recipient maps.
+ Inbound domains +Machine ok
+| Resource | Usage | Detail |
|---|---|---|
| CPU | +4 cores · 4 threads | +|
| Memory | +1.6 GiB used of 4.0 GiB. | +|
| Network | +↓ 2.0 KiB/s ↑ 1.0 KiB/s |
+
+ eth0: 1.0 MiB in, 512.0 KiB out
+ |
+
Processes ok
+| Program | State | Detail |
|---|---|---|
| opendkim | +RUNNING | +pid 21, uptime 3 days, 4:12:01 | +
| panel | +RUNNING | +pid 18, uptime 3 days, 4:12:03 | +
| postfix | +RUNNING | +pid 42, uptime 3 days, 4:11:58 | +
| postfix-reload | +STOPPED | +Not started | +
| cert-reload | +STOPPED | +Not started | +
| logrotate | +STOPPED | +Not started | +
Configuration
+Regenerates the OpenDKIM and Postfix configuration from the + database and reloads both daemons. Use it if you edited the files by hand, + restored a backup, or the running configuration looks out of step with the + domain and application lists. It does not touch the mail queue or the TLS + certificate, and it is safe to run at any time.
+SelfPost 1.2.3 · © Mixeme · License (AGPL-3.0)
@@ -253,7 +337,10 @@example.com
← All domainsNew application password
+New application password
+ +Shown once only and not stored. Copy it now.
DNS status ok
+DNS status ok
+ +DKIM and SPF records
+DKIM and SPF records
+ +DKIM
SPF
DMARC record
+DMARC record
+ +Connection settings
+Connection settings
+ +Add an application
+Add an application
+ +Applications
+Applications
+ +-
newsletter
@@ -361,8 +466,11 @@
Domain settings
+Domain settings
+ +DMARC reports
@@ -381,8 +489,11 @@Export domain
+Export domain
+ +Secret file — transfer securely, or encrypt as .spde.
Backup & migration
-Full backup
-Download a full backup of all persistent state. Restore into a container of the same SelfPost version. TLS certificates and the mail queue are not included. The file is a secret.
-Keep this password: without it the file cannot be opened.
+Full backup
+Download a full backup of all persistent state — the database, every domain’s DKIM key and the application credentials. Restore into a container of the same SelfPost version, with the same data mount, before first start. TLS certificates and the mail queue are not included.
+The backup file is a secret. Encrypting it is the simplest way to store it: the download is then a .spbk that only the password opens.
Keep this password: without it the file cannot be opened.
+Import a domain
+Move a single domain here from another SelfPost instance — plain .json or encrypted .spde. Its DKIM key and application passwords come across, so the published DNS record needs no change. The export file is a secret, like a full backup.
Needed for a .spde file. Leave empty for plain .json.
Import a domain
-Plain .json or encrypted .spde.
Settings
-Panel credentials
-These are the credentials for this control panel only. Applications keep their own logins.
- - - - -DMARC aggregate reports
-Default rua= for every sending domain. When ingest is on, this can be an address SelfPost accepts.
DMARC reports in the panel.
-Sending rate limits
-Level 1 is set in Compose. Domain and application ceilings live on each domain’s page.
-Level 1 is set in Compose; restart the container to change it. Domain and application ceilings live on each domain’s page.
+Level 1 — per client IP
+ 100 messages / 60 seconds +RATE_LIMIT_MESSAGES_PER_IP / RATE_LIMIT_WINDOW_SECONDS. Hard ceiling for every connecting IP; the panel cannot raise a domain or application limit above this.
Level 2 — domain
+Optional ceiling for all senders on a domain. When unset, only level 1 applies. Must be ≤ level 1.
+Level 2 — application
+Optional override for trusted IPs: a ceiling strictly above the domain limit (still ≤ level 1). Those IPs skip the domain check; everyone else stays under the domain (or level 1).
+Inbound 1.x
Backup-MX / forwarder. Accepts on port 25 only for listed domains; unknown recipients are rejected at RCPT. Off by default in Compose.
+Backup-MX / forwarder. Accepts on port 25 only for listed domains. Recipients are either an allow-list or any address at that domain. Off by default in Compose.
Add inbound domain
Danger zone
+Stops accepting mail for this domain. Does not touch outbound sending domains.
+ Delete inbound domain +backup.example.net
+ ← All inbound domains +Danger zone
-Stops accepting mail for this domain. Does not touch outbound sending domains.
- +DNS status error
+Cached a few minutes — use Re-check after publishing. Unlike outbound, inbound needs an MX pointing at this server.
+No MX points at mail.example.org (this server). Publish the record below, or wait for DNS to propagate and Re-check.
+Upstream
+Where accepted mail is handed off. Not a mailbox.
+ + + + + +MX record to publish
+Add this MX so the internet delivers here. Keep any existing primary MX if this is backup-MX.
+Valid recipients
+Who this domain accepts on port 25. Same idea as an application’s address mode: a list, or any address at the domain.
+ + +Unknown recipients are rejected at RCPT so this relay does not generate backscatter.
+Every address at this domain is accepted and forwarded. Prefer a list unless the upstream rejects unknowns — otherwise this relay may generate backscatter.
+ +Danger zone
+Stops accepting mail for this domain. Does not touch outbound sending domains.
+ Delete inbound domain +Delete lists.example.com
+ ← Back to lists.example.com +Confirm deletion
+You are about to stop accepting inbound mail for lists.example.com. This will:
+-
+
- remove it from
relay_domainsand the recipient map;
+ - stop forwarding to 10.0.0.8:25; +
- leave outbound sending domains untouched. +
This cannot be undone from a backup of inbound maps alone unless you restore one. Remove the MX if you do not plan to re-add the domain.
+Help candidate
Short operator notes inside the panel — not a second copy of the full guide. Seeded from the Status blurbs that left the cards.
+Short operator notes inside the panel — not a second copy of the full guide. Seeded from the Status explanations that do not belong on the cards (what a kernel counter is, why PTR is set at the host, what Reload does not touch). The cards themselves keep their readings, Detail columns, and the Configuration control.
On this panel
-
@@ -837,9 +1143,10 @@ abuse@lists.example.com
- TLS certificate — port 465, reverse-proxy mount
- Hostname / reverse DNS — forward-confirmed PTR at the hosting provider
- Mail queue retries — time-based, no attempt budget -
- Inbound — not mailboxes; reject unknown recipients +
- Inbound — not mailboxes; listed recipients or any address at the domain +
- Domain page — DNS, records, connection, applications, export (drawer from each card’s «?»)
The same texts open in the drawer from a card’s «?» — so a Status page can stay dense.
+The same texts open in the drawer from Status’s «?» — so a card can stay a reading, not a paragraph, without throwing the reading away.