release: 2.14.0: password-reset - a confirmed e-mail, then a link to reset

Migration 0013; schema 13. The pins (README, compose, guide), the guide's
backup example, the planned cuts and the roadmap row.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,83 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+## [2.14.0] - 2026-10-17
+
+Password reset by e-mail, to a confirmed address. Migration 0013; schema 13.
+
+### Added
+
+- **Password reset by e-mail** (password-reset): *Forgot your password?* on
+  the sign-in page sends a one-time link, for 30 minutes, to the account's
+  e-mail - once that address has been confirmed by a link sent to it. A new
+  address is sent its confirmation link when it is saved (Account, or the
+  user form); Account shows whether it is confirmed and can send the link
+  again. Notifications go to the address confirmed or not. Setting a new
+  password from a link signs every session of the account out. Migration
+  0013; schema 13.
+
+### Changed
+
+- **Changing your e-mail on Account asks for your password**, as changing
+  the password does: the address is where a reset link goes.
+
+## [2.13.1] - 2026-10-17
+
+The documents and the panel's words checked against the code. No migration;
+schema 12.
+
+### Fixed
+
+- **A panel password's twelve characters are characters**: the minimum
+  counted bytes, so six letters of a non-Latin alphabet passed for twelve.
+  It counts characters now, as the backup password always did. Passwords
+  already set are not affected.
+
+### Changed
+
+- **The panel and its mockups say the same** (docs-audit): an inbound
+  domain's MX box says when it was checked and its side menu links the
+  domain's Inbound log; a deferred message's history ends with the wait in
+  the queue; Overview says it refreshes on its own; DMARC's hint for an
+  unaligned third party reads as the mockup. Help says what the code does:
+  an application's password is kept by the server so an export can carry
+  it, every password check of a backup counts, a password set for another
+  user signs them out everywhere, the limit mail is daily per sending
+  domain, and a domain administrator is no longer shown the Filter lists
+  topic (their page is the global role's).
+
+### Documentation
+
+- The documents checked against the code (docs-audit, 2026-10-17): the
+  guide, architecture, schema-migrations, security, development, README and
+  product say what the code does.
+
+## [2.13.0] - 2026-10-17
+
+The panel in the container's time zone. No migration; schema 12.
+
+### Added
+
+- **The panel in your time zone** (local-time): set `TZ` in `.env` (an IANA
+  name, e.g. `Europe/Moscow`) and every time the panel shows, every day it
+  counts - today on Health, the statistics' days, the days of the log
+  filters - and the stamps of `mail.log` are that zone's. The screens no
+  longer write "UTC" beside a time; **Server › Settings** names the zone in
+  a new read-only box. Unset, it is UTC as before. Changing it is a
+  restart; days counted before stay the old zone's.
+
+## [2.12.0] - 2026-10-17
+
+A test message from Server › Health. No migration; schema 12.
+
+### Added
+
+- **A test message from Server › Health** (test-email): one message to an
+  address you type, from `postmaster@` the hostname, the way notifications
+  go. The page that opens is its row in the Outbound log, which follows it
+  to the receiving server. It tests the server's own path, not a domain's.
+  Global role, ten an hour.
+
 ## [2.11.0] - 2026-10-16
 
 Health checks the certificate's name, Postfix's greeting and the reverse

README.md

@@ -27,11 +27,11 @@ send log and DNS checks in the panel, encrypted backups.
 - Optional inbound relay on port 25 (backup-MX / forwarder; off by default)
 - Optional DMARC aggregate report ingest on port 25 (off by default)
 - In-panel Help: a page of topics, opened from the `?` in the head of a box
-- Per-application client IP allow-list for SMTP AUTH (optional)
+- Per-application client IP allow-list for submitting mail (optional; refused at MAIL FROM, not an authentication boundary)
 - Web panel grouped by mail direction — Overview, Outbound (domains, log, queue, DMARC reports), Inbound, Server (health, system log, backup, users, settings)
 - Multi-domain relay — each SASL application is bound to one sending domain
 - DNS status checks (PTR, SPF, DKIM, DMARC) with in-panel re-check
-- Two-level rate limiting — IP backstop (Postfix), per-domain ceilings, and trusted-IP app overrides
+- Two-level rate limiting — IP backstop (Postfix), per-domain ceilings, and per-application overrides
 - Full-server backup and single-domain export/import (optional password encryption)
 - Single Docker image; production data in a `./data` bind mount (the quick start below uses a named Docker volume instead)
 
@@ -112,8 +112,8 @@ outbound mail will not reach the real internet without DNS, PTR, and port 25.
 > local image and pulls nothing:
 >
 > ```sh
-> docker build -f build/Dockerfile --build-arg VERSION=2.11.0 \
->   -t ghcr.io/mixeme/selfpost:2.11.0 .
+> docker build -f build/Dockerfile --build-arg VERSION=2.14.0 \
+>   -t ghcr.io/mixeme/selfpost:2.14.0 .
 > ```
 
 ```sh
@@ -122,7 +122,7 @@ docker run --rm -d --name selfpost-try \
   -e SELFPOST_HOSTNAME=mail.local.test \
   -e PANEL_COOKIE_SECURE=false \
   -v selfpost-try-data:/data \
-  ghcr.io/mixeme/selfpost:2.11.0
+  ghcr.io/mixeme/selfpost:2.14.0
 ```
 
 **Get the setup URL** (pick one):

build/Dockerfile

@@ -64,6 +64,10 @@ ENV DEBIAN_FRONTEND=noninteractive
 # than with the whole of systemd, the first alternative of its "Depends:
 # systemd | systemd-standalone-sysusers | systemd-sysusers" (dpkg -s in the
 # image, 2026-10-15). Nothing here runs systemd.
+# tzdata is named for TZ (local-time): the zone of every time the panel shows
+# and of the stamps Postfix writes in mail.log. supervisor's python3.13 brings
+# it today (apt-cache rdepends --installed tzdata in the image, 2026-10-17);
+# a TZ the image did not have would leave both in UTC without a word.
 RUN echo "postfix postfix/mailname string localhost" | debconf-set-selections \
  && echo "postfix postfix/main_mailer_type string Internet Site" | debconf-set-selections \
  && apt-get update \
@@ -78,6 +82,7 @@ RUN echo "postfix postfix/mailname string localhost" | debconf-set-selections \
       openssl \
       curl \
       systemd-standalone-sysusers \
+      tzdata \
  && rm -rf /var/lib/apt/lists/*
 
 # Debian's postfix runs its chroot sync on every "postfix check" and "postfix

cmd/panel/envdoc_test.go

@@ -14,15 +14,17 @@ import (
 // are compared as they are, not as lists kept by hand beside them (audit
 // 2026-10-12, stage 5 - the three lists this file held were compared with each
 // other and with nothing else). Read: what the panel's code asks of the
-// environment (cmd/panel and internal, tests aside) and what the start-up
+// environment (cmd/panel, cmd/selfpost-backup and internal, tests aside) and what the start-up
 // scripts take with a default (build/*.sh, "${VAR:-…}"). Documented: the
 // operator's table in guide.md § Environment variables, with the paragraph
 // under it, and the internal list in architecture.md § Configuration.
 
 var (
-	goEnvRead     = regexp.MustCompile(`(?:envDefault|envInt|envBool|envSeconds|envDuration|os\.Getenv|os\.LookupEnv)\("([A-Z][A-Z0-9_]+)"`)
+	goEnvRead = regexp.MustCompile(`(?:envDefault|envInt|envBool|envSeconds|envDuration|os\.Getenv|os\.LookupEnv)\("([A-Z][A-Z0-9_]+)"`)
+	// A name kept in a constant, as the backup CLI keeps its password's.
+	goEnvConst    = regexp.MustCompile(`\w+Env\s*=\s*"([A-Z][A-Z0-9_]+)"`)
 	scriptEnvRead = regexp.MustCompile(`\$\{([A-Z][A-Z0-9_]+):[-?=]`)
-	docEnvName    = regexp.MustCompile("`([A-Z][A-Z0-9_]{2,})`")
+	docEnvName    = regexp.MustCompile("`([A-Z][A-Z0-9_]+)`")
 )
 
 func readFile(t *testing.T, path string) string {
@@ -38,12 +40,16 @@ func readFile(t *testing.T, path string) string {
 func envRead(t *testing.T) map[string]bool {
 	t.Helper()
 	keys := map[string]bool{}
-	for _, root := range []string{".", filepath.Join("..", "..", "internal")} {
+	for _, root := range []string{".", filepath.Join("..", "selfpost-backup"), filepath.Join("..", "..", "internal")} {
 		err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
 			if err != nil || d.IsDir() || !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
 				return err
 			}
-			for _, m := range goEnvRead.FindAllStringSubmatch(readFile(t, path), -1) {
+			text := readFile(t, path)
+			for _, m := range goEnvRead.FindAllStringSubmatch(text, -1) {
+				keys[m[1]] = true
+			}
+			for _, m := range goEnvConst.FindAllStringSubmatch(text, -1) {
 				keys[m[1]] = true
 			}
 			return nil

cmd/panel/httpserver.go

@@ -113,6 +113,7 @@ func newPanel(cfg config, st *store.Store) (*web.Server, error) {
 		TLSCertFile:                cfg.tlsCertFile,
 		TLSServedCertFile:          cfg.tlsServedCertFile,
 		SMTPBanner:                 cfg.smtpBanner,
+		TimeZone:                   cfg.timeZone,
 		TLSReloadInterval:          cfg.tlsReloadInterval,
 		SignSocket:                 cfg.signSocket,
 		SignLocalSocket:            cfg.signLocalSocket,
@@ -168,7 +169,9 @@ func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
 	srv := newHTTPServer(cfg.httpAddr, srvApp.Handler())
 
 	// Shut the server down cleanly when the process is asked to stop.
+	shutDown := make(chan struct{})
 	go func() {
+		defer close(shutDown)
 		<-ctx.Done()
 		shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 		defer cancel()
@@ -179,5 +182,13 @@ func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
 	if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
 		return err
 	}
+	// ListenAndServe returns at the stop, before its requests have
+	// (net/http, Server.Shutdown); Shutdown returns once they have. The links
+	// they mail after their answers go on after that, and end before the
+	// database closes.
+	<-shutDown
+	drainCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	srvApp.Drain(drainCtx)
 	return nil
 }

cmd/panel/main.go

@@ -100,6 +100,9 @@ type config struct {
 	// smtpBanner is Postfix's smtpd_banner, expanded, read from postconf at
 	// the start: Health shows the greeting it makes.
 	smtpBanner string
+	// timeZone is TZ as the container was started with ("" for none): the
+	// zone of every time and day the panel shows, which Settings names.
+	timeZone string
 
 	dkimDir         string
 	dkimSelectorDef string
@@ -150,6 +153,7 @@ func loadConfig() config {
 		manifestPath:   filepath.Join(dataDir, backup.ManifestName),
 		setupTokenPath: envDefault("SELFPOST_SETUP_TOKEN_FILE", filepath.Join(dataDir, "setup-token")),
 		hostname:       os.Getenv("SELFPOST_HOSTNAME"),
+		timeZone:       os.Getenv("TZ"),
 		// Secure cookies by default (security.md); PANEL_COOKIE_SECURE=false is a
 		// development-only escape hatch for testing over plain HTTP.
 		cookieSecure: envDefault("PANEL_COOKIE_SECURE", "true") != "false",
@@ -314,6 +318,13 @@ func openData(cfg config, resync func(*store.Store) error) (st *store.Store, res
 	}
 	if restored {
 		log.Printf("restore manifest accepted; regenerating mail-path maps from SQLite")
+		// A link taken after the backup was made would work again from it
+		// (security review, 2026-10-17); a link sent before a restore is
+		// asked for again.
+		if err := st.DeleteAllUserLinks(); err != nil {
+			_ = st.Close()
+			return nil, false, err
+		}
 		if err := resync(st); err != nil {
 			_ = st.Close()
 			return nil, false, err
@@ -326,8 +337,8 @@ func openData(cfg config, resync func(*store.Store) error) (st *store.Store, res
 	return st, restored, nil
 }
 
-// run starts the panel's three roles and blocks until a shutdown signal or the
-// first fatal error from any role. A signal triggers a clean stop of all
+// run starts the panel's roles (the list below) and blocks until a shutdown
+// signal or the first fatal error from any role. A signal triggers a clean stop of all
 // roles; a role error cancels the others and is returned so the process exits
 // non-zero (letting supervisord/Docker see the failure — architecture.md §
 // Image and processes).

cmd/panel/sendercheck.go

@@ -104,19 +104,21 @@ func senderCheckDowntime(markAt, now time.Time, ask func() postfixState) (down t
 	return 0, false
 }
 
-// dayPart is the part of a stretch of downtime that fell on one UTC day.
+// dayPart is the part of a stretch of downtime that fell on one day of the
+// container's zone.
 type dayPart struct {
 	day  time.Time
 	down time.Duration
 }
 
-// byDay cuts the time from 'from' to 'to' at the UTC midnights between them,
-// so that a night's outage is not all booked on the morning it ended.
+// byDay cuts the time from 'from' to 'to' at the midnights of the container's
+// zone between them, so that a night's outage is not all booked on the morning
+// it ended.
 func byDay(from, to time.Time) []dayPart {
-	from, to = from.UTC(), to.UTC()
+	from, to = from.Local(), to.Local()
 	var parts []dayPart
 	for from.Before(to) {
-		next := time.Date(from.Year(), from.Month(), from.Day(), 0, 0, 0, 0, time.UTC).AddDate(0, 0, 1)
+		next := time.Date(from.Year(), from.Month(), from.Day(), 0, 0, 0, 0, time.Local).AddDate(0, 0, 1)
 		if next.After(to) {
 			next = to
 		}

cmd/panel/sendercheck_test.go

@@ -62,3 +62,15 @@ func TestByDay(t *testing.T) {
 		t.Errorf("no time: %+v", none)
 	}
 }
+
+// In a container with TZ=Europe/Moscow a day is Moscow's: an outage from
+// 20:50 to 21:10 UTC crosses its midnight (21:00 UTC).
+func TestByDayInTheContainersZone(t *testing.T) {
+	inZone(t, "Europe/Moscow")
+	from := time.Date(2026, 10, 12, 20, 50, 0, 0, time.UTC)
+	got := byDay(from, from.Add(20*time.Minute))
+	if len(got) != 2 || got[0].down != 10*time.Minute || got[1].down != 10*time.Minute ||
+		got[1].day.Format("2006-01-02 15:04") != "2026-10-13 00:00" {
+		t.Errorf("parts = %+v, want ten minutes on the 12th and ten from Moscow's midnight", got)
+	}
+}

cmd/panel/zone_main_test.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"os"
+	"testing"
+	"time"
+)
+
+// TestMain runs the tests in UTC, whatever the zone of the machine they run
+// on: the panel shows times and counts days in time.Local, the container's
+// zone (TZ), and the fixtures are written in UTC. The tests of another zone
+// set it themselves (inZone).
+func TestMain(m *testing.M) {
+	time.Local = time.UTC
+	os.Exit(m.Run())
+}
+
+// inZone runs the rest of the test in the zone name, as a container started
+// with TZ=name; the test must not be parallel.
+func inZone(t *testing.T, name string) {
+	t.Helper()
+	loc, err := time.LoadLocation(name)
+	if err != nil {
+		t.Skipf("no zone %s here: %v", name, err)
+	}
+	time.Local = loc
+	t.Cleanup(func() { time.Local = time.UTC })
+}

deploy/.env.example

@@ -60,6 +60,12 @@ PANEL_SESSION_IDLE_DAYS=7
 # your own recursor, e.g. SELFPOST_DNS_RESOLVERS=10.0.0.2:53
 # SELFPOST_DNS_RESOLVERS=
 
+# Time zone of the container, an IANA name: every time the panel shows, the
+# days it counts (today on Health, the days of the statistics, the log
+# filters) and the stamps Postfix writes in mail.log. Leave unset for UTC;
+# changing it is a restart. Server > Settings shows the zone in use.
+# TZ=Europe/Moscow
+
 # Comma-separated CIDRs (bare IPs allowed) of reverse proxies allowed to
 # supply X-Forwarded-For for login/setup rate-limiting. Leave unset unless
 # you know the exact address of your reverse proxy — trusting the wrong

deploy/apache/selfpost-vhost.conf

@@ -1,6 +1,6 @@
 # Example host Apache vhost for the SelfPost panel (default scenario). Install
 # on the host running Apache — NOT inside the SelfPost container. Requires
-# mod_ssl and mod_proxy/mod_proxy_http enabled (`a2enmod ssl proxy proxy_http`).
+# mod_ssl, mod_proxy/mod_proxy_http and mod_rewrite enabled (`a2enmod ssl proxy proxy_http rewrite`).
 #
 # Certificates: obtain with the Apache certbot plugin against THIS vhost
 # (`certbot --apache -d mail.example.com`). Certbot edits this file in place to

deploy/docker-compose.yml

@@ -23,7 +23,7 @@
 
 services:
   selfpost:
-    image: ghcr.io/mixeme/selfpost:2.11.0
+    image: ghcr.io/mixeme/selfpost:2.14.0
     restart: unless-stopped
     environment:
       SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}"
@@ -56,6 +56,9 @@ services:
       # report what the internet sees rather than what this host's own stub
       # resolver synthesises. Empty uses public defaults.
       SELFPOST_DNS_RESOLVERS: "${SELFPOST_DNS_RESOLVERS:-}"
+      # The zone of every time the panel shows and of mail.log's stamps, e.g.
+      # Europe/Moscow. Empty is UTC.
+      TZ: "${TZ:-}"
       # Reverse-proxy CIDRs allowed to supply X-Forwarded-For for login/setup
       # rate-limiting. See docs/guide.md "Environment variables" — wrong value lets a
       # client spoof its rate-limit key.

docs/architecture.md

@@ -135,9 +135,10 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   Refusals come from `mail.log`: this listener logs as `postfix/inbound`
   (`syslog_name`), and the log tailer turns a `reject:` line of
   `postfix/inbound/smtpd` (Postfix's own policy) and a `milter-reject` /
-  `milter-hold` / `milter-discard` line of `cleanup` (the filter's verdict,
-  counted only for a queue id that listener opened) into a row, dated by the
-  line, when the recipient is at an inbound domain
+  `milter-discard` line of `cleanup` (the filter's verdict, counted only for
+  a queue id that listener opened) into a row, dated by the line, when the
+  recipient is at an inbound domain; a message the filter holds goes on to
+  the inbound journal milter, which writes its row as `held`
   ([internal/logtail/inbound.go](../internal/logtail/inbound.go)). A line
   names one recipient (the last), so a message refused at end-of-message is
   one row whatever its recipient count. The tailer saves its place every five seconds,
@@ -183,8 +184,9 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   an empty upstream host are omitted from the maps. Optional
   `INBOUND_ANTISPAM_MILTER` only when inbound relay is enabled (not on
   DMARC-only port 25); it is attached with its own `default_action`,
-  `INBOUND_ANTISPAM_MILTER_ACTION`, which is `accept` (fail-open) unless set
-  to `tempfail` (main.cf's `milter_default_action` is `tempfail`).
+  `INBOUND_ANTISPAM_MILTER_ACTION`, `accept` (fail-open, the default) or
+  `tempfail`, any other value stopping the start (main.cf's
+  `milter_default_action` is `tempfail`).
   **DMARC ingest** (`DMARC_REPORTS_ENABLE=true`): allow-listed
   report addresses via `check_recipient_access` on `postfix/dmarc_recipients`;
   messages pipe to `dmarc-ingest` (symlink to `panel`). When both flags are
@@ -217,8 +219,8 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   and to smtpd's `client=` line in mail.log.
 - **Chroot disabled** for all services (DNS/TLS inside container).
 - **TLS certs** — read-only mount at `TLS_CERT_FILE` / `TLS_KEY_FILE`, copied
-  at start into `/etc/postfix/tls-internal`, owned by root and `0600` as
-  Postfix's TLS_README advises (Postfix itself reads the key as root and does
+  at start into `/etc/postfix/tls-internal`, owned by root, the key `0600`
+  (the certificate `0644`) as Postfix's TLS_README advises (Postfix itself reads the key as root and does
   not check its mode), which the mount cannot give; Postfix reads the copy.
   `cert-reload` compares the mount with the copy daily; when they differ and
   the certificate and key belong together it renews the copy (each file
@@ -310,8 +312,8 @@ then OpenDKIM did, in a program of its own
   message has an hour from the end of its headers to its end - go-milter
   v0.4.1 tells a session nothing of a dropped connection - after which it is
   deferred, never signed over part of its body.
-- **Logs** go to the panel's stdout, the container's log, as `dkim-signer:`
-  lines; nothing is written to `mail.log` (nor did OpenDKIM write there).
+- **Logs** go to the panel's stderr, the container's log, as
+  `panel: … dkim-signer:` lines; nothing is written to `mail.log` (nor did OpenDKIM write there).
 - **The old tree,** `/data/opendkim` - the keys, `KeyTable` and
   `SigningTable` until `2.8.0`, shared with OpenDKIM through group
   `selfpost`. `2.8.x` copied its keys to `/data/dkim/keys` at its first
@@ -475,10 +477,10 @@ the hole it closed was the same.
   cleanup process serves message after message, so each such warning is
   counted as a message. The two are counted apart (the owner, 2026-10-14):
   connections turned away in `deferred`, messages deferred mid-message in
-  `messages` of `sender_check_days`, a row per UTC day kept a year, and
+  `messages` of `sender_check_days`, a row per day of the container's zone (`TZ`) kept a year, and
   Server › Health shows today, 30 days and 12 months in a column each. The
   counts also see a panel that is running and not answering, which the mark
-  does not. Downtime is cut at the UTC midnights it crossed. A log read again
+  does not. Downtime is cut at the midnights of that zone it crossed. A log read again
   after an unclean stop does not count again: the count and the place in the
   log it reached (the file's fingerprint and the offset past the line) are
   saved in one transaction, and while the tailer catches up a warning at or
@@ -574,9 +576,12 @@ and `MAIL_LOG` in [cmd/panel/main.go](../cmd/panel/main.go). Backups exclude
 Rotation uses rename + `postfix reload`
 ([build/logrotate-mail.conf](../build/logrotate-mail.conf)), not `copytruncate` —
 the latter can drop `status=sent` lines and leave send-log rows stuck at
-`queued`. After rename, logrotate runs `create 0640 postfix selfpost` (postlogd
-recreates the file on its first line after the reload, as root and mode
-`0600`, which the unprivileged panel user cannot read). `follow()` drains the
+`queued`. After rename, logrotate runs `create 0640 postfix selfpost`, so the
+file is there, readable by the panel through group `selfpost`, before postlogd
+writes its first line after the reload; a file postlogd makes itself (one
+removed while the container runs) is `0640` too, through
+`maillog_file_permissions=0640` - Postfix's default is `0600`, which the
+unprivileged panel user could not read. `follow()` drains the
 old inode once more before switching descriptors, and keeps it open and reads
 it for a minute after: postlogd keeps writing to the renamed file until the
 reload makes it exit, seconds later (Postfix 3.10.13, src/postlogd/postlogd.c;
@@ -590,6 +595,19 @@ inbound journal's. The tail of a line is the far end's words (a reply, a HELO
 name), and a pattern that could start there let a stranger's HELO name file a
 delivery (audit 2026-10-12, M12).
 
+**The test message** (test-email, `2.12.0`) is the one row the panel writes
+itself: Server › Health hands it to `sendmail(1)`, which tells nothing of the
+queue id, and the journal-milter does not see local mail. The row is written
+first, queued and with no queue id, and its Message-ID is awaited
+(`logtail.AwaitMessageID`, in memory, ten minutes); cleanup's line
+`<id>: message-id=<…>` (Postfix 3.10.13, `src/cleanup/cleanup_message.c:639`)
+gives the row its queue id, and from then on its delivery lines update it as
+any row's. A restart in the second between leaves it without one, and the
+reconcile sweep closes it once the id is no longer awaited
+(`CloseUnmatchedTestMessages`); an id awaited longer than that is not taken
+any more. sendmail out of time keeps the row and the id - postdrop may have
+queued the message all the same.
+
 **The upstream's answer** on the inbound journal (inbound-upstream-result,
 `2.10.0`). Mail accepted on port 25 is handed to its upstream by the same
 `smtp` client as outbound mail, and its delivery lines look alike; what tells
@@ -612,8 +630,9 @@ is mail of its own queue id and matches no row.
 
 **Read offset is persisted** (`logtail_state` table, in the baseline schema): the
 tailer stores its position plus a fingerprint of the log - the hash of its first
-512 bytes and the file's device and inode, so two logs that begin alike are two
-files and a renamed file keeps its fingerprint - and on start resumes from it,
+512 bytes and the file's inode (not the device, which can change across a
+host's reboot), so two logs that begin alike are two files and a renamed file
+keeps its fingerprint - and on start resumes from it,
 parsing the tail written while the panel was down. If the fingerprint no longer
 matches, the log was rotated in the meantime: the tailer first opens
 `mail.log.1` (left plain by `delaycompress`), and if that is the file the saved
@@ -622,7 +641,7 @@ start - what Postfix wrote between the stop and the rotation is not lost. A
 `mail.log.1` that is another file (rotated twice) is logged with the time from
 which nothing was read. Re-parsing lines is harmless because `UpdateStatus`
 writes the same status onto the same row. Only a first-ever start, with nothing
-stored, begins at end-of-file, so installing the panel does not replay a
+stored (or a stored place that cannot be read), begins at end-of-file, so installing the panel does not replay a
 pre-existing log.
 
 **A refusal's line, and a refusal the panel did not write.** A message refused
@@ -699,7 +718,7 @@ lines are gone for good — rotated past fourteen files while the panel was down
 or deleted — or that the tailer was not reading.
 
 Whether the sweep earns its place is measured, not argued (audit 2026-10-12,
-H3). `delivery_log_days` (migration `0007`) keeps, per UTC day for a year:
+H3). `delivery_log_days` (migration `0007`) keeps, per day of the container's zone for a year:
 `reconcile_closed`, the rows the sweep closed; `reconcile_missed`, those of
 them whose final line - sent, bounced, or the message's expiry - was in
 `mail.log` or `mail.log.1` when the sweep closed them - the tailer did not
@@ -802,7 +821,9 @@ building them only takes method values, so the route guard test can run it on
 a bare `Server` and ask which pattern answers a path:
 
 - **public** — `/healthz` (liveness), `/license` (the embedded `LICENSE`),
-  `/static/`, `/setup/`, `/login`, `/logout`;
+  `/static/`, `/setup/`, `/login`, `/logout`, and the links of
+  password-reset, opened from a mail signed in or not: `/login/reset`,
+  `/login/reset/<token>`, `/confirm/<token>` (`internal/web/auth/links.go`);
 - **authenticated** — everything else, behind `RequireAuth`: a request without
   a live session is redirected to `/login`.
 
@@ -825,8 +846,8 @@ only reads (the delete confirmation at `GET …/delete` renders a form).
 | Outbound › DMARC reports | `GET /outbound/dmarc` · `…/dmarc/domains/{id}` · `…/dmarc/reports/{id}` — registered only with `DMARC_REPORTS_ENABLE=true` |
 | Inbound › Domains | `GET, POST /inbound/domains` · `/inbound/domains/{id}` · `POST …/dns-recheck`, `…/upstream`, `…/recipients` · `GET, POST …/delete` — registered only with `INBOUND_RELAY_ENABLE=true` |
 | Inbound › Log, Filter lists | `GET /inbound/log` · `GET, POST /inbound/filter-lists` · `POST /inbound/filter-lists/{id}/delete` — registered only with `INBOUND_RELAY_ENABLE=true` |
-| Server | `GET /server/health` (+ `/fragment`) · `POST /server/health/recheck`, `/server/health/reload` · `GET /server/log` (+ `/fragment`) · `GET, POST /server/backup` · `POST /server/backup/import` · `/server/users`, `…/new`, `…/{uid}`, `…/{uid}/delete` · `GET, POST /server/settings` · `POST /server/settings/dns-recheck` · `GET /server/components` |
-| Account | `GET /account` · `POST /account/profile`, `/account/password` |
+| Server | `GET /server/health` (+ `/fragment`) · `POST /server/health/recheck`, `/server/health/reload`, `/server/health/test-message` · `GET /server/log` (+ `/fragment`) · `GET, POST /server/backup` · `POST /server/backup/import` · `/server/users`, `…/new`, `…/{uid}`, `…/{uid}/delete` · `GET, POST /server/settings` · `POST /server/settings/dns-recheck` · `GET /server/components` |
+| Account | `GET /account` · `POST /account/profile`, `/account/password`, `/account/email/confirm` |
 | User menu | `GET /help` · `POST /logout` (public mux) |
 
 An application is addressed under its domain, and an application id that does
@@ -927,9 +948,8 @@ is one layout and one way to render.
   package (`NewOutDomain`, `NewHelp`, …) that the handler fills. The shell is
   derived from `Meta` and the feature flags (`SetInboundEnabled`,
   `SetDMARCEnabled`) in one place, `Engine.shell`, so which entries the menu
-  has is decided once. No template reads a `map[string]any`; the one map left
-  in the handlers is the health sampler's, which is turned into a typed
-  `Health` before rendering.
+  has is decided once. No page's data is a map: the health sampler too
+  returns a typed `health.Machine`.
 - **The component kit.** [components.html](../internal/web/view/templates/components.html)
   holds one `{{define}}` per partial (page head, postmark, box and its head and
   foot, flash, health card, DNS record, facts, side menu, timeline, log pane,
@@ -969,8 +989,8 @@ has the component skeleton of its mockup), `TestRedesignedPagesLoadOnlyTheKit`,
 ratchet list `internal/web/view/legacy_pages.txt` is empty and can only shrink;
 the CI step
 [design-first](../.github/scripts/design-first.sh) rejects a commit that
-changes a guard together with the code it judges, and a template that is a
-byte-for-byte return of one from history. The design contract and the process
+changes a guard together with the code it judges, and a template that is
+the same as one from history, whitespace aside. The design contract and the process
 are in [plans/panel-redesign.md](plans/panel-redesign.md) § Enforcement.
 
 ### Security headers, CSP and scripts
@@ -1138,8 +1158,9 @@ single-connection trade-off that follows from it.
 | `postfix/dmarc_recipients` | Allow-listed DMARC aggregate report addresses |
 | `postfix/dmarc_transport` | Pipe transport for report ingest |
 | `postfix/dmarc_relay_domains` | Domains accepted for DMARC report delivery |
-| `postfix/queue/` | Postfix transit mail (deferred/active); survives container recreate. Handed to `postfix` / `postdrop` by name at every start, before `postfix check` (`own_queue` in `build/entrypoint.sh`): the package accounts' numbers moved in `2.8.0` (postfix 101 → 100, postdrop 103 → 102) |
+| `postfix/queue/` | Postfix transit mail (deferred/active); survives container recreate; excluded from backups. Handed to `postfix` / `postdrop` by name at every start, before `postfix check` (`own_queue` in `build/entrypoint.sh`): the package accounts' numbers moved in `2.8.0` (postfix 101 → 100, postdrop 103 → 102) |
 | `log/mail.log` | Postfix delivery log + rotated copies (excluded from backups) |
+| `antispam/` | The filter lists (six `.map` files) and the filter's key `filter.key`, which the spam filter's container mounts (`ANTISPAM_DIR`) |
 | `manifest.json` | Backup version stamp; removed by the first start after a restore once its Resync is done |
 | `contents.json` | A backup's last entry: the size and SHA-256 of each file under `data/`, compared by the first start after a restore before it opens the database (renamed `contents.checked.json` once compared, removed with the manifest) |
 
@@ -1190,7 +1211,7 @@ The tables that carry the panel's model:
   `inbound_spam_list` (the filter lists), `dmarc_reports`,
   `dmarc_report_records`, `notify_state` and `notify_addressees` (what the
   notifier has said and to whom, § Notifications), `sender_check_days` (the
-  sender check's downtime and the mail it deferred, per UTC day) and
+  sender check's downtime and the mail it deferred, per day of the container's zone) and
   `delivery_log_days` (the queue sweep's measurements, § Log tailer).
 
 Two processes write: the panel, on one connection, and `dmarc-ingest`, which
@@ -1208,8 +1229,9 @@ the stored log lines follow;
 `postfix reload` in `postrotate` — see § Log tailer above).
 
 **Restore:** panel button or `selfpost-backup` CLI — self-contained archive:
-`data/` (SQLite snapshot + tree minus `log/`, the setup token and any
-`tls/` under `/data`), `docker-compose.yml`, `.env`,
+`data/` (SQLite snapshot + tree minus `log/`, the Postfix queue
+`postfix/queue`, the copy `sasl/sasldb2.new` a password change is made on, the
+setup token and any `tls/` under `/data`), `docker-compose.yml`, `.env`,
 and `certs/` when present;
 version check on restore. Requires the project directory mounted read-only at
 `SELFPOST_DEPLOY_ROOT` (`/selfpost-deploy` in the default compose file). On the
@@ -1286,11 +1308,15 @@ unsupported rather than as a missing doc:
   `POSTFIX_DMARC_RECIPIENTS` (`/data/postfix/dmarc_recipients`),
   `POSTFIX_DMARC_TRANSPORT` (`/data/postfix/dmarc_transport`),
   `POSTFIX_DMARC_RELAY_DOMAINS` (`/data/postfix/dmarc_relay_domains`),
-  `POSTFIX_QUEUE_DIR` (`/data/postfix/queue` — set in `build/postfix-config.sh`),
+  `POSTFIX_QUEUE_DIR` (`/data/postfix/queue` — read in `build/postfix-config.sh`
+  for `queue_directory`; `build/entrypoint.sh` hands `/data/postfix/queue` to
+  Postfix by that path, so overriding it desyncs the queue's ownership),
   `SELFPOST_DEPLOY_ROOT` (`/selfpost-deploy` — operator project directory for
   full backups; mount `.:/selfpost-deploy:ro` in compose), `ANTISPAM_DIR`
   (`/data/antispam` — the filter lists and the filter's key, which the spam
-  filter's container mounts).
+  filter's container mounts). `SELFPOST_BACKUP_PASSWORD` is read by the
+  `selfpost-backup` CLI, not the panel: the encryption password, the other
+  way being `-password-file` (guide § Encrypting a backup).
 - **Milter and Postfix startup:** `MILTER_CONNECT_TIMEOUT` (`15s`),
   `MILTER_COMMAND_TIMEOUT` (`15s`), `MILTER_CONTENT_TIMEOUT` (`30s`),
   `MILTER_WAIT_TIMEOUT` (`30` seconds).

docs/assets/panel-redesign/panel/account.html

@@ -80,12 +80,18 @@
           <div class="sp-box-body">
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="username">Username</label><div class="control has-icons-left"><input class="input" id="username" name="username" value="admin" autocomplete="username" spellcheck="false" required><span class="icon is-left"><i class="ti ti-user"></i></span></div></div>
-              <div class="field"><label class="label" for="email">E-mail</label><div class="control has-icons-left"><input class="input" id="email" name="email" type="email" value="mix@example.org" autocomplete="email"><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
-                <p class="help">Your own address. A domain's report address can be filled with it from Domain settings.</p></div>
+              <div class="field"><label class="label" for="email">E-mail <span class="tag is-warning is-light">not confirmed</span></label><div class="control has-icons-left"><input class="input" id="email" name="email" type="email" value="mix@example.org" autocomplete="email"><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
+                <p class="help">Your own address. Saving a new one sends it a link to confirm it; once confirmed it is where a link to reset your password can go. A domain's report address can be filled with it from Domain settings.</p></div>
+              <div class="field"><label class="label" for="pcur">Current password</label><div class="control"><input class="input" id="pcur" name="current_password" type="password" autocomplete="current-password"></div>
+                <p class="help">Needed only to change the e-mail.</p></div>
               <div class="field"><label class="checkbox"><input type="checkbox" name="notify" checked> Send me notifications</label>
                 <p class="help">To this address, when something needs you: a DNS record of a domain stops matching, a rate limit refuses mail, the TLS certificate is about to expire, a message has waited in the queue for three days. <a href="help.html#notifications">What is sent and when</a></p></div>
               <button type="submit" class="button is-primary">Save profile</button>
             </form>
+            <form class="sp-form mt-4" method="post" action="#">
+              <p class="help mb-3">A link was sent to <span class="sp-mono">mix@example.org</span> at 14:02; it works once, for 24 hours.</p>
+              <button type="submit" class="button">Send the link again</button>
+            </form>
           </div>
         </div>
       </div>
@@ -108,7 +114,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/backup.html

@@ -111,7 +111,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/build.py

@@ -52,7 +52,7 @@ HEAD = """<!DOCTYPE html>
 </head>
 """
 
-FOOT = ('<footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a>'
+FOOT = ('<footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a>'
         ' · <a href="#">Source</a> · No warranty</footer>')
 
 

docs/assets/panel-redesign/panel/components.html

@@ -172,7 +172,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">07</span><h2>Table conventions</h2><div class="sp-end">Always inside <code>table-container</code> · an address breaks after its @</div></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Time, UTC</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
+            <thead><tr><th>Time</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td><a href="#"><strong>the row's link</strong></a></td><td class="sp-clip">A long subject is clipped with an ellipsis instead of wrapping the row</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="#">Details</a><form method="post" action="#"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
             </tbody>
@@ -207,9 +207,9 @@
           <div class="sp-box-head"><span class="sp-no">08</span><h2>timeline</h2></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Done</strong> — default</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — sp-warn</li>
-              <li class="sp-fail"><time>14:40:00 UTC</time><strong>Bounced</strong> — sp-fail</li>
+              <li><time>13:58:07</time><strong>Done</strong> — default</li>
+              <li class="sp-warn"><time>13:58:09</time><strong>Deferred</strong> — sp-warn</li>
+              <li class="sp-fail"><time>14:40:00</time><strong>Bounced</strong> — sp-fail</li>
               <li class="sp-pending"><time>not yet</time>Expected next — sp-pending</li>
             </ol>
           </div>
@@ -292,7 +292,7 @@
       <div class="sp-box-foot">Bulma's <code>is-small</code> and <code>is-size-7</code> are not used: a control is never small, and <code>sp-small</code> replaces the helper. The postmark's fine print is an imprint, not text.</div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/confirm-email.html

@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="light">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Confirm e-mail · SelfPost</title>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
+<link rel="stylesheet" href="../shared/brand.css">
+<link rel="stylesheet" href="theme.css">
+</head>
+<body>
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="account.html">
+      <p class="sp-kicker">mail.example.org · admin</p>
+      <h1 class="title is-3">Confirm e-mail</h1>
+      <p class="sp-muted mb-4"><span class="sp-mono">mix@example.org</span> becomes the confirmed address of this account: where a link to reset its password can be sent.</p>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Confirm</button></div>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>
+
+</body>
+</html>

docs/assets/panel-redesign/panel/dmarc-domain.html

@@ -92,7 +92,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Reports</h2></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Received, UTC</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+            <thead><tr><th>Received</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 02:15</td><td class="sp-muted">google.com</td><td>20 Sep</td><td>6 410</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
@@ -103,7 +103,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/dmarc-report.html

@@ -68,7 +68,7 @@
 <div class="sp-head">
       <div class="sp-grow">
         <p class="sp-kicker"><a href="dmarc.html">DMARC reports</a> / <a href="dmarc-domain.html">shop.example.org</a> /</p>
-        <h1 class="title is-4">Outlook.com · 20 Sep 2026</h1>
+        <h1 class="title is-4">Outlook.com · 20 Sep</h1>
         <p class="sp-route"><span>shop.example.org</span><span class="tag is-success is-light">1 903 pass</span><span class="tag is-warning is-light">7 fail</span></p>
       </div>
     </div>
@@ -81,8 +81,8 @@
             <dl class="sp-facts">
               <div><dt>Reporter</dt><dd>Outlook.com</dd></div>
               <div><dt>Report id</dt><dd class="sp-mono sp-small">5f1c9a0e7b2d4e61a3</dd></div>
-              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00 UTC</dd></div>
-              <div><dt>Received</dt><dd>2026-09-21 04:40 UTC</dd></div>
+              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00</dd></div>
+              <div><dt>Received</dt><dd>2026-09-21 04:40</dd></div>
             </dl>
           </div>
         </div>
@@ -112,7 +112,7 @@
       </table></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/dmarc.html

@@ -77,7 +77,7 @@
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Ingest</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#dmarc" title="What the reports are and where they go"><i class="ti ti-help-circle"></i></a></div>
       <div class="sp-box-body">
         <dl class="sp-facts">
-          <div><dt>Last report</dt><dd>2026-09-21 06:12 UTC</dd></div>
+          <div><dt>Last report</dt><dd>2026-09-21 06:12</dd></div>
           <div><dt>This week</dt><dd>14 kept · 0 parse failures</dd></div>
           <div><dt>Hosted addresses</dt><dd class="sp-mono sp-small">dmarc-reports+&lt;domain&gt;@mail.example.org</dd></div>
           <div><dt>Retention</dt><dd>500 reports a domain or 90 days</dd></div>
@@ -88,7 +88,7 @@
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">02</span><h2>Recent reports</h2></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Received, UTC</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+        <thead><tr><th>Received</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 06:12</td><td><a href="dmarc-domain.html">example.org</a></td><td class="sp-muted">google.com</td><td>20 Sep</td><td>412</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td><a href="dmarc-domain.html">shop.example.org</a></td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
@@ -98,7 +98,7 @@
       </table></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/health.html

@@ -69,7 +69,7 @@
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">Health</h1>
-        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes every 10 s.</p>
+        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes automatically.</p>
       </div>
       <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-refresh"></i>Re-check DNS</button></form>
     </div>
@@ -142,10 +142,10 @@
           <div class="sp-box-head"><span class="sp-no">04</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#certificate" title="When it warns and what to do"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14 UTC</dd></div>
+              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14</dd></div>
               <div><dt>Names <span class="tag is-success is-light">matches</span></dt><dd class="sp-mono">mail.example.org</dd></div>
-              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02 UTC</dd></div>
-              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12 UTC</dd></div>
+              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02</dd></div>
+              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12</dd></div>
             </dl>
             <p class="mt-4 sp-muted">Postfix still serves the certificate above. A renewed one is waiting in the mounted file; Postfix takes it up at its next check for a renewal, at most a day after it was mounted.</p>
           </div>
@@ -173,10 +173,23 @@
             <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-reload"></i>Reload configuration</button></form>
           </div>
         </div>
+        <div class="box" id="test-message" data-order="9">
+          <div class="sp-box-head"><span class="sp-no">09</span><h2>Test message</h2><div class="sp-end">Shows what the receiving server answers</div><a class="sp-help" href="help.html#test-message" title="What the test proves"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <form class="sp-form" method="post" action="out-message.html">
+              <div class="field"><label class="label" for="rcpt">Recipient</label>
+                <div class="field has-addons">
+                  <div class="control is-expanded has-icons-left"><input class="input" id="rcpt" name="recipient" type="email" placeholder="you@elsewhere.example" required><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
+                  <div class="control"><button type="submit" class="button is-primary"><i class="ti ti-send"></i>Send</button></div>
+                </div>
+                <p class="help">From <span class="sp-mono">postmaster@mail.example.org</span>, signed with the server's own key, through Postfix as its notifications go. It opens in the <a href="out-log.html">Outbound log</a>, where its page follows it to the receiving server. Ten an hour.</p></div>
+            </form>
+          </div>
+        </div>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/help.html

@@ -80,6 +80,7 @@
           <ul class="menu-list">
             <li><a class="is-active" href="#checks"><i class="ti ti-activity-heartbeat"></i>Health checks</a></li>
             <li><a href="#certificate"><i class="ti ti-certificate"></i>TLS certificate</a></li>
+            <li><a href="#test-message"><i class="ti ti-send"></i>Test message</a></li>
             <li><a href="#rdns"><i class="ti ti-arrows-exchange"></i>Reverse DNS</a></li>
           </ul>
           <p class="menu-label">Outbound</p>
@@ -119,15 +120,16 @@
           <div class="sp-box-head"><span class="sp-no">01</span><h2>Overview</h2></div>
           <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, and the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now. <a href="health.html">Health</a> shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total. <em>Your address</em>, in the Configuration card, is the address the panel sees your browser at: behind a reverse proxy it must be your own, taken from <code>X-Forwarded-For</code>; when it is the proxy's, every visitor shares one sign-in limit, and Health warns and names the address to put in <code>TRUSTED_PROXY_CIDR</code>.</p></div>
           <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. Postfix serves its own copy of the mounted file and looks for a renewed one once a day by default; until it takes one up, the card shows it as a renewal waiting, and warns once it has waited longer than that check allows - the container log's cert-reload lines say why. It warns 14 days before expiry unless a renewal is already waiting, and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect. It also fails when none of its names is the hostname (<code>SELFPOST_HOSTNAME</code>) - the tag beside <em>Names</em> says which: a client that verifies the name refuses it however valid it is.</p></div>
+          <div class="sp-help-topic" id="test-message"><h3>Test message</h3><p>A message from <code>postmaster@</code> the server's hostname to one address you type, sent the way notifications are: through Postfix, signed with the DKIM key of the server's own name. It proves the path from this server - TLS, its address's reputation, the SPF and DKIM records of its name - not your domains', which only mail from an application does. The page that opens is its row in the Outbound log: it shows whether the receiving server took it, put it off or refused it, with the lines of <code>mail.log</code>. Whether it then reached the inbox or the spam folder only the mailbox can say. The global role sends it, at most ten an hour.</p></div>
           <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname (<code>SELFPOST_HOSTNAME</code>) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone. <em>Greeting</em> is the line Postfix opens every connection with, <code>220</code> and its banner; it must name the hostname too - a receiver compares it with the name it looked up - and a container id or <code>localhost</code> there is a warning.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Outbound</h2></div>
           <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. A record DNS already holds as shown is folded to its name and status; Show values opens it to copy them again. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
-          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once at creation or regeneration and is not stored in readable form.</p></div>
+          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once, at creation or regeneration, and the panel does not show it again; the server keeps it, so a domain export can carry it.</p></div>
           <div class="sp-help-topic" id="sender-check"><h3>Sender check</h3><p>An application sends only as itself, and that holds for every sender a message names. The envelope sender is held against the login by Postfix. The <code>From:</code> line, the one a mail program shows and the one DMARC holds the DKIM signature to, is held against it by the panel, under the same rule: an application set to any address of its domain may write any address of that domain, and one with a list of addresses only those. A message with any other <code>From:</code> - another of your domains, the server's own name, an address somewhere else, or none at all - is refused for good with <code>550 5.7.1</code>. The line must hold one address, read as a mail program reads it: what a display name around it says is not judged, and a line holding more than one address is refused. A <code>Sender:</code> line, which a mail program shows beside <code>From:</code> as "on behalf of", is held to the same rule when the message has one. A system that writes for people outside your domains writes its own address in <code>From:</code> with the person's name, and the person's address in <code>Reply-To:</code>: their domain in <code>From:</code> would fail DMARC at the receiver anyway. It is a rejected row of the Outbound log, and its page says which address was refused. This is what keeps one application from sending, under this server's signature, as another domain or another application.<br><br>The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were refused with a temporary error in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message refused in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own.</p></div>
           <div class="sp-help-topic" id="limits"><h3>Rate limits</h3><p>Level 1 is a per-IP ceiling set in <code>.env</code>. Level 2 is optional, per domain and per application, entered by hand or computed from the last 30 days of sending, and can never exceed level 1. An application's own limit replaces its domain's.</p></div>
-          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient, with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> or <code>Sender:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
+          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient (a message refused for its From: or Sender: line is one row, however many recipients it had), with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> or <code>Sender:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
           <div class="sp-help-topic" id="queue"><h3>Queue and retries</h3><p>The page lists, as <code>postqueue -p</code> prints it, the messages Postfix has accepted and not yet delivered: mail being sent right now and mail deferred for a later attempt. Only the global role can open it, and it only shows; nothing here deletes or forces a message. A deferred message is tried again after the first retry delay, then at gaps that double up to a cap, until the receiving server takes it or the queue lifetime runs out and it bounces; there is no attempt counter, and the box on the page shows this server's values. A queue that keeps growing means a receiver is refusing or not answering: open the message from the Outbound log to read the reason Postfix logged.</p></div>
           <div class="sp-help-topic" id="dmarc"><h3>DMARC reports</h3><p>An aggregate report is the summary a receiving provider sends, usually daily, to the <code>rua=</code> address of your DMARC record: which servers sent mail as your domain and whether SPF or DKIM passed for it. A domain's report address is one of three choices, set in its Domain settings: no reports (the default for a new domain), the SelfPost hosted address (an address on this server whose reports are parsed and shown under DMARC reports; offered only while hosted reports are enabled on the server), or an address typed for the domain (an ordinary mailbox that receives the raw XML; a button fills in your own profile e-mail). When the typed address is on another domain than the one sending, that domain must publish a report-authorization record, or providers will not send; the domain's page shows it with the other DNS records and checks it. In the tables pass means SPF or DKIM passed and aligned, fail means neither did, and your own server shows as <em>this relay</em>. A fail from any other source is someone else sending as your domain — a forwarder, an application you forgot, or abuse — so do not tighten <code>p=</code> until that sender is fixed or removed. A domain administrator reads the reports of their own domains.</p></div>
         </div>
@@ -142,19 +144,19 @@
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Server</h2></div>
-          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. Both it and a domain's export ask for your account password - the one you sign in with - at every download, so a session left open is not enough to take them; wrong guesses count against the same limit as a password change. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10998 on the host (<code>chgrp 10998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
-          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out of their other sessions.</p></div>
-          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
-          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same limit. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish and whether they are in place, and its Re-check DNS checks them again once they are published; Server › Health shows them too. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
+          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. Both it and a domain's export ask for your account password - the one you sign in with - at every download, so a session left open is not enough to take them; every attempt, right or wrong, counts against the limit of a password change, ten in 15 minutes. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10998 on the host (<code>chgrp 10998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
+          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out everywhere; set for yourself, it keeps the session you set it from.</p></div>
+          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. The time zone is the container's, <code>TZ</code> in <code>.env</code> (UTC when it is not set): every time the panel shows and every day it counts is that zone's, as are the stamps Postfix writes in <code>mail.log</code>, so the two always agree; changing it is a restart of the container. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
+          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same sending domain. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish and whether they are in place, and its Re-check DNS checks them again once they are published; Server › Health shows them too. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">05</span><h2>Account</h2></div>
-          <div class="sp-help-topic" id="account"><h3>Your account</h3><p>Account is your own, whatever your role: your username and e-mail, whether the panel sends you notifications, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected.</p></div>
+          <div class="sp-help-topic" id="account"><h3>Your account</h3><p>Account is your own, whatever your role: your username and e-mail, whether the panel sends you notifications, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected. A new e-mail is sent a link that confirms it, which works once, for 24 hours; changing the e-mail asks for your password. Notifications go to the address whether it is confirmed or not, but only a confirmed one can get a link to reset a forgotten password: <em>Forgot your password?</em> on the sign-in page sends it, for 30 minutes and once, and setting the new password signs every session of the account out. Without a confirmed e-mail the global administrator sets a new password under Users, and the only global administrator recovers from the container.</p></div>
         </div>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-domain-delete.html

@@ -94,7 +94,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-domain.html

@@ -142,7 +142,7 @@
 dev@lists.example.org
 owner@lists.example.org
 security@lists.example.org</textarea></div>
-                    <p class="help">Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
+                    <p class="help">One per line or comma-separated. Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
                   <button type="submit" class="button is-primary">Save recipients</button>
                 </form>
               </div>
@@ -154,17 +154,16 @@ security@lists.example.org</textarea></div>
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Spam filter</h2><div class="sp-end"><span class="tag is-success is-light">on</span></div><a class="sp-help" href="help.html#filter" title="A server setting"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Engine</dt><dd>rspamd, for every inbound domain of this server</dd></div>
-              <div><dt>Suspicious mail</dt><dd>Held — <a href="in-quarantine.html">1 message in quarantine</a> for this domain</dd></div>
-              <div><dt>Spam</dt><dd>Refused at the door; see <em>reject</em> in the <a href="in-log.html">log</a></dd></div>
-              <div><dt>Allow and deny lists</dt><dd class="sp-muted">Kept by the global administrator, one pair for the whole server</dd></div>
+              <div><dt>Applies to</dt><dd>Every inbound domain of this server</dd></div>
+              <div><dt>Filter</dt><dd class="sp-mono">inet:antispam:11332</dd></div>
+              <div><dt>If the filter is down</dt><dd>Mail is accepted unfiltered</dd></div>
             </dl>
           </div>
         </div>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-domains.html

@@ -98,7 +98,7 @@
       <div class="sp-box-foot">The MX tag is green when at least one MX of the domain points at this server.</div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-filter-lists.html

@@ -132,13 +132,13 @@
         <dl class="sp-facts">
           <div><dt>Applied by</dt><dd>rspamd, from map files it rereads within seconds of a change</dd></div>
           <div><dt>Files</dt><dd><span class="sp-mono">/data/antispam/</span> — six, one for each list and kind of entry</dd></div>
-          <div><dt>Last written</dt><dd>2026-09-11 08:40 UTC</dd></div>
+          <div><dt>Last written</dt><dd>2026-09-11 08:40</dd></div>
           <div><dt>When both lists match</dt><dd>Deny wins, whichever entries they are.</dd></div>
         </dl>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-log.html

@@ -86,7 +86,7 @@
         <a class="sp-help" href="help.html#inbound-log" title="What the decisions mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th>Upstream</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th>Upstream</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:31</td><td>ci@<wbr>builds.example<br><span class="sp-mono sp-muted sp-small">192.0.2.90</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">[ci] nightly build passed</td><td><button type="button" class="tag is-success is-light" popovertarget="why-7">accept</button><div class="sp-sheet" id="why-7" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-7" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 1.10 / 15.00</td></tr><tr><th>Subject</th><td>[ci] nightly build passed</td></tr></tbody></table></div></div></div></div></td><td><span class="tag is-light">queued</span></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:18</td><td>t.berg@<wbr>uni.example<br><span class="sp-mono sp-muted sp-small">192.0.2.77</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">Re: [dev] patch series v3</td><td><button type="button" class="tag is-success is-light" popovertarget="why-1">accept</button><div class="sp-sheet" id="why-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 0.40 / 15.00</td></tr><tr><th>Subject</th><td>Re: [dev] patch series v3</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-success is-light" popovertarget="up-1">sent</button><div class="sp-sheet" id="up-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">sent</span><h2>Upstream</h2><button type="button" popovertarget="up-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Host</th><td class="sp-mono sp-small">mx.upstream.example[198.51.100.5]:25</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">250 2.0.0 Ok: queued as CE05D10261D</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 14:00:19</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
@@ -100,7 +100,7 @@
       <div class="sp-box-foot"><span>Page 1 of 38</span><a href="#">Older →</a><span class="sp-end">A decision opens its reason, an upstream result its last reply · Allow / Deny sender opens <a href="in-filter-lists.html">Filter lists</a> with the entry filled in</span></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-quarantine-message.html

@@ -81,7 +81,7 @@
             <dl class="sp-facts">
               <div><dt>Inbound domain</dt><dd><a href="in-domain.html">lists.example.org</a></dd></div>
               <div><dt>Client</dt><dd class="sp-mono">203.0.113.140</dd></div>
-              <div><dt>Held</dt><dd>2026-09-21 13:59:02 UTC</dd></div>
+              <div><dt>Held</dt><dd>2026-09-21 13:59:02</dd></div>
               <div><dt>Deleted on</dt><dd>2026-10-05 · in 14 days</dd></div>
               <div><dt>Size</dt><dd>48 kB · 1 attachment (<span class="sp-mono">invoice.html</span>)</dd></div>
               <div><dt>Would go to</dt><dd class="sp-mono">mx.internal:25</dd></div>
@@ -143,7 +143,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-quarantine.html

@@ -82,7 +82,7 @@
         </form>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Held, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
+        <thead><tr><th>Held</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example</td><td>owner@<wbr>lists.example.org</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Outstanding invoice — action required</strong></a></td><td class="sp-muted sp-small">score 9.8 · PHISHING</td><td class="sp-muted sp-nowrap">48 kB</td><td class="sp-nowrap">14 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-20 22:14:40</td><td>no-reply@<wbr>shipping-update.example</td><td>jobs@<wbr>acme.io</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Your parcel could not be delivered</strong></a></td><td class="sp-muted sp-small">score 8.1 · URL_SHORTENER</td><td class="sp-muted sp-nowrap">12 kB</td><td class="sp-nowrap">13 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>
@@ -92,7 +92,7 @@
       <div class="sp-box-foot"><span>3 messages · 3.0 MB of 500 MB</span><span class="sp-end">A domain administrator sees only their assigned inbound domains</span></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-queue.html

@@ -74,7 +74,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes every 10 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes on its own</div></div>
       <div class="sp-empty"><i class="ti ti-stack-2"></i>Nothing is waiting. Every accepted message has reached its upstream.</div>
     </div>
 
@@ -90,7 +90,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/login-no-admin.html

@@ -23,7 +23,7 @@
       <h1 class="title is-3">No administrator yet</h1>
       <p class="sp-muted">Open the one-time setup link printed in the container log to create one.</p>
     </div>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>
 

docs/assets/panel-redesign/panel/login-reset-sent.html

@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="light">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Sign in · SelfPost</title>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
+<link rel="stylesheet" href="../shared/brand.css">
+<link rel="stylesheet" href="theme.css">
+</head>
+<body>
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="overview.html">
+      <p class="sp-kicker">mail.example.org</p>
+      <h1 class="title is-3">Sign in</h1>
+      <div class="notification is-success is-light"><i class="ti ti-circle-check"></i>If that account has a confirmed e-mail, the link is on its way. It works once, for 30 minutes.</div>
+      <div class="field">
+        <label class="label" for="username">Username</label>
+        <div class="control has-icons-left"><input class="input" id="username" name="username" autocomplete="username" required><span class="icon is-left"><i class="ti ti-user"></i></span></div>
+      </div>
+      <div class="field">
+        <label class="label" for="password">Password</label>
+        <div class="control has-icons-left"><input class="input" id="password" name="password" type="password" autocomplete="current-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
+      </div>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Sign in</button></div>
+      <p class="mt-4"><a href="login-reset.html">Forgot your password?</a></p>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>
+
+</body>
+</html>

docs/assets/panel-redesign/panel/login-reset-set.html

@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="light">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>New password · SelfPost</title>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
+<link rel="stylesheet" href="../shared/brand.css">
+<link rel="stylesheet" href="theme.css">
+</head>
+<body>
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="login.html">
+      <p class="sp-kicker">mail.example.org · admin</p>
+      <h1 class="title is-3">New password</h1>
+      <p class="sp-muted mb-4">Setting it signs every session of this account out; sign in with it afterwards.</p>
+      <div class="field">
+        <label class="label" for="new_password">New password</label>
+        <div class="control has-icons-left"><input class="input" id="new_password" name="new_password" type="password" autocomplete="new-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
+      </div>
+      <div class="field">
+        <label class="label" for="new_password_confirm">Repeat</label>
+        <div class="control has-icons-left"><input class="input" id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
+      </div>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Set password</button></div>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>
+
+</body>
+</html>

docs/assets/panel-redesign/panel/login-reset.html

@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="light">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Reset password · SelfPost</title>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
+<link rel="stylesheet" href="../shared/brand.css">
+<link rel="stylesheet" href="theme.css">
+</head>
+<body>
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="login-reset-sent.html">
+      <p class="sp-kicker">mail.example.org</p>
+      <h1 class="title is-3">Reset password</h1>
+      <p class="sp-muted mb-4">A link to set a new password goes to the e-mail of the account, once that address is confirmed under Account. It works once, for 30 minutes.</p>
+      <div class="field">
+        <label class="label" for="username">Username</label>
+        <div class="control has-icons-left"><input class="input" id="username" name="username" autocomplete="username" required><span class="icon is-left"><i class="ti ti-user"></i></span></div>
+      </div>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Send the link</button></div>
+      <p class="mt-4"><a href="login.html">Back to sign in</a></p>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>
+
+</body>
+</html>

docs/assets/panel-redesign/panel/login.html

@@ -30,8 +30,9 @@
         <div class="control has-icons-left"><input class="input" id="password" name="password" type="password" autocomplete="current-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
       </div>
       <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Sign in</button></div>
+      <p class="mt-4"><a href="login-reset.html">Forgot your password?</a></p>
     </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>
 

docs/assets/panel-redesign/panel/out-app-created.html

@@ -100,7 +100,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-app.html

@@ -69,7 +69,7 @@
       <div class="sp-grow">
         <p class="sp-kicker"><a href="out-domains.html">Outbound domains</a> / <a href="out-domain.html">example.org</a> / Applications /</p>
         <h1 class="title is-3 sp-mono">prod-server</h1>
-        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h. The same form, empty, adds a new application.</p>
+        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h.</p>
       </div>
       <div class="buttons">
         <a class="button" href="out-app-created.html"><i class="ti ti-key"></i>New password</a>
@@ -85,7 +85,7 @@
             <div class="sp-box-body">
               <div class="field"><label class="label" for="login">Login</label>
                 <div class="control"><input class="input sp-mono" id="login" name="login" value="prod-server" autocomplete="off" spellcheck="false" required></div>
-                <p class="help">Unique across domains; letters, digits, <code>.</code> <code>-</code> <code>_</code>.</p></div>
+                <p class="help">Fixed: add a new application to use another login.</p></div>
               <div class="field"><label class="label" for="amode">May send as</label>
                 <div class="control"><div class="select is-fullwidth"><select id="amode" name="mode"><option selected>Any address of the domain</option><option>Specific addresses (list)</option></select></div></div></div>
               <div class="field"><label class="label" for="addresses">Addresses</label>
@@ -129,7 +129,7 @@
       </div>
     </form>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domain-delete.html

@@ -103,7 +103,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domain-settings.html

@@ -119,9 +119,9 @@
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="mode">Limit mode</label>
                 <div class="control"><div class="select is-fullwidth"><select id="mode" name="mode"><option>Manual</option><option selected>Auto (from statistics)</option></select></div></div></div>
-              <div class="field"><label class="label" for="mult">Multiplier (1.5–10, default 3)</label>
+              <div class="field"><label class="label" for="mult">Multiplier (1.5–5, default 2.5)</label>
                 <div class="control"><input class="input" id="mult" name="auto_multiplier" type="number" min="1.5" max="10" step="0.1" value="3"></div>
-                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00 UTC.</p></div>
+                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00.</p></div>
               <div class="buttons">
                 <button type="submit" class="button is-primary">Save limit</button>
                 <button type="submit" class="button" formaction="#recalc">Recalculate now</button>
@@ -142,7 +142,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domain.html

@@ -172,7 +172,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domains.html

@@ -100,7 +100,7 @@
       <div class="sp-box-foot">Each tag is one check. Green — published and correct; amber — published but weak; red — missing or wrong.</div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-log.html

@@ -87,7 +87,7 @@
         <a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td>shop@<wbr>shop.example.org</td><td>m.keller@<wbr>gmx.de</td><td class="sp-clip">Your order #48213 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:50</td><td>shop@<wbr>shop.example.org</td><td>anna.lind@<wbr>outlook.com</td><td class="sp-clip">Your order #48212 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
@@ -101,7 +101,7 @@
       <div class="sp-box-foot"><span>Page 1 of 412</span><a href="#">Older →</a><span class="sp-end">New rows appear on their own</span></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-message.html

@@ -81,8 +81,8 @@
             <dl class="sp-facts">
               <div><dt>Domain</dt><dd><a href="out-domain.html">example.org</a></dd></div>
               <div><dt>Application</dt><dd class="sp-mono"><a href="out-app.html">alerts</a></dd></div>
-              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07 UTC</dd></div>
-              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09 UTC</dd></div>
+              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07</dd></div>
+              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09</dd></div>
               <div><dt>Queue id</dt><dd class="sp-mono">4XcB7k2Jm9z1</dd></div>
               <div><dt>Journal id</dt><dd class="sp-mono">184220</dd></div>
             </dl>
@@ -94,9 +94,9 @@
           <div class="sp-box-head"><span class="sp-no">02</span><h2>History</h2><a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Accepted</strong> from <span class="sp-mono">alerts</span> at 198.51.100.7</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — the receiving server asked to retry later</li>
-              <li class="sp-pending"><time>next attempt ≈ 14:08 UTC</time>Still in the <a href="out-queue.html">queue</a>; kept for 5 days, then bounced</li>
+              <li><time>2026-09-21 13:58:07</time><strong>Accepted and queued</strong> — Postfix accepted the message over an authenticated submission and the journal-milter recorded it.</li>
+              <li class="sp-warn"><time>2026-09-21 13:58:09</time><strong>Deferred, will be retried</strong> — the receiving server could not take the message yet. Postfix retries: first after 5 minutes, then with increasing gaps up to 1 hour 7 minutes, for up to 5 days.</li>
+              <li class="sp-pending"><time>not yet</time>Still in the queue; the next attempt is Postfix's own, and after 5 days it is bounced.</li>
             </ol>
           </div>
         </div>
@@ -112,7 +112,7 @@
 </span></pre>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-queue.html

@@ -69,14 +69,14 @@
       <div class="sp-grow">
         <p class="sp-kicker">Outbound</p>
         <h1 class="title is-3">Outbound queue</h1>
-        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes every 10 s.</p>
+        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes on its own.</p>
       </div>
     </div>
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">1 message · 3.1 kB</div><a class="sp-help" href="help.html#queue" title="What waits here and how Postfix retries"><i class="ti ti-help-circle"></i></a></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Queue id</th><th>Arrived, UTC</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
+        <thead><tr><th>Queue id</th><th>Arrived</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono">4XcB7k2Jm9z1</td><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:58:07</td><td>alerts@<wbr>example.org</td><td>noc@<wbr>example.org</td><td class="sp-muted">451 4.7.1 Greylisted, try again in 5 minutes</td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
         </tbody>
@@ -95,7 +95,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/outlines.json

@@ -90,7 +90,8 @@
       "box[Milter sockets]:table",
       "box[TLS certificate]:body",
       "box[Notification mail]:table+body",
-      "box[Configuration]:body"
+      "box[Configuration]:body",
+      "box[Test message]:body"
      ]
     }
    ]
@@ -107,7 +108,7 @@
     },
     {
      "is-9": [
-      "box[Overview]:help×3",
+      "box[Overview]:help×4",
       "box[Outbound]:help×7",
       "box[Inbound]:help×6",
       "box[Server]:help×4",
@@ -402,7 +403,8 @@
     {
      "is-6": [
       "box[Notification mail]:record×2",
-      "box[Sending rate limits]:body"
+      "box[Sending rate limits]:body",
+      "box[Time zone]:body"
      ]
     }
    ]

docs/assets/panel-redesign/panel/overview.html

@@ -72,7 +72,7 @@
         <h1 class="title is-3">Mail is flowing. One thing needs attention.</h1>
         <p class="sp-lead">The TLS certificate expires in 12 days and has not renewed yet.</p>
       </div>
-      <div class="sp-muted sp-small">Updated 14:02:31 UTC<br>refreshes every 10 s</div>
+      <div class="sp-muted sp-small">Updated 14:02:31<br>refreshes on its own</div>
     </div>
 
     <div class="box">
@@ -115,7 +115,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/preflight.html

@@ -76,7 +76,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Checks</h2><div class="sp-end">Ran 14:02 UTC · 3.1 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Checks</h2><div class="sp-end">Ran 14:02 · 3.1 s</div></div>
       <div class="table-container"><table class="table is-fullwidth">
         <thead><tr><th>Check</th><th>Result</th><th>Found</th><th>What to do</th></tr></thead>
         <tbody>
@@ -108,7 +108,7 @@
           </div>
           <div class="column is-6">
             <dl class="sp-facts">
-              <div><dt>Last test</dt><dd>14:03 UTC to <span class="sp-mono">mix@elsewhere.example</span></dd></div>
+              <div><dt>Last test</dt><dd>14:03 to <span class="sp-mono">mix@elsewhere.example</span></dd></div>
               <div><dt>Result</dt><dd><span class="tag is-success is-light">queued</span> <span class="sp-mono sp-small">4XcC1d8Pq2z1</span></dd></div>
               <div><dt>Then</dt><dd><a href="out-message.html">Follow it in the outbound log</a></dd></div>
             </dl>
@@ -117,7 +117,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/settings.html

@@ -139,10 +139,20 @@
             </dl>
           </div>
         </div>
+
+        <div class="box" id="time-zone">
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>Time zone</h2><div class="sp-end">Read-only</div><a class="sp-help" href="help.html#settings" title="Times and days of the panel"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <dl class="sp-facts">
+              <div><dt>Zone</dt><dd class="sp-mono">Europe/Moscow</dd><dd class="sp-muted">UTC+03:00. Set in <code>.env</code> (<code>TZ</code>); restart to change.</dd></div>
+            </dl>
+            <p class="mt-4 sp-muted">Every time the panel shows, and every day it counts - today on Health, the days of the statistics - is this zone's, and so are the stamps of <code>mail.log</code>.</p>
+          </div>
+        </div>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/setup.html

@@ -36,7 +36,7 @@
       </div>
       <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Create administrator</button></div>
     </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>
 

docs/assets/panel-redesign/panel/src/account.html

@@ -14,12 +14,18 @@
           <div class="sp-box-body">
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="username">Username</label><div class="control has-icons-left"><input class="input" id="username" name="username" value="admin" autocomplete="username" spellcheck="false" required><span class="icon is-left"><i class="ti ti-user"></i></span></div></div>
-              <div class="field"><label class="label" for="email">E-mail</label><div class="control has-icons-left"><input class="input" id="email" name="email" type="email" value="mix@example.org" autocomplete="email"><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
-                <p class="help">Your own address. A domain's report address can be filled with it from Domain settings.</p></div>
+              <div class="field"><label class="label" for="email">E-mail <span class="tag is-warning is-light">not confirmed</span></label><div class="control has-icons-left"><input class="input" id="email" name="email" type="email" value="mix@example.org" autocomplete="email"><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
+                <p class="help">Your own address. Saving a new one sends it a link to confirm it; once confirmed it is where a link to reset your password can go. A domain's report address can be filled with it from Domain settings.</p></div>
+              <div class="field"><label class="label" for="pcur">Current password</label><div class="control"><input class="input" id="pcur" name="current_password" type="password" autocomplete="current-password"></div>
+                <p class="help">Needed only to change the e-mail.</p></div>
               <div class="field"><label class="checkbox"><input type="checkbox" name="notify" checked> Send me notifications</label>
                 <p class="help">To this address, when something needs you: a DNS record of a domain stops matching, a rate limit refuses mail, the TLS certificate is about to expire, a message has waited in the queue for three days. <a href="help.html#notifications">What is sent and when</a></p></div>
               <button type="submit" class="button is-primary">Save profile</button>
             </form>
+            <form class="sp-form mt-4" method="post" action="#">
+              <p class="help mb-3">A link was sent to <span class="sp-mono">mix@example.org</span> at 14:02; it works once, for 24 hours.</p>
+              <button type="submit" class="button">Send the link again</button>
+            </form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/src/components.html

@@ -106,7 +106,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">07</span><h2>Table conventions</h2><div class="sp-end">Always inside <code>table-container</code> · an address breaks after its @</div></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Time, UTC</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
+            <thead><tr><th>Time</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td><a href="#"><strong>the row's link</strong></a></td><td class="sp-clip">A long subject is clipped with an ellipsis instead of wrapping the row</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="#">Details</a><form method="post" action="#"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
             </tbody>
@@ -141,9 +141,9 @@
           <div class="sp-box-head"><span class="sp-no">08</span><h2>timeline</h2></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Done</strong> — default</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — sp-warn</li>
-              <li class="sp-fail"><time>14:40:00 UTC</time><strong>Bounced</strong> — sp-fail</li>
+              <li><time>13:58:07</time><strong>Done</strong> — default</li>
+              <li class="sp-warn"><time>13:58:09</time><strong>Deferred</strong> — sp-warn</li>
+              <li class="sp-fail"><time>14:40:00</time><strong>Bounced</strong> — sp-fail</li>
               <li class="sp-pending"><time>not yet</time>Expected next — sp-pending</li>
             </ol>
           </div>

docs/assets/panel-redesign/panel/src/confirm-email.html

@@ -0,0 +1,18 @@
+<!-- title: Confirm e-mail | shell: bare -->
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="account.html">
+      <p class="sp-kicker">mail.example.org · admin</p>
+      <h1 class="title is-3">Confirm e-mail</h1>
+      <p class="sp-muted mb-4"><span class="sp-mono">mix@example.org</span> becomes the confirmed address of this account: where a link to reset its password can be sent.</p>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Confirm</button></div>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>

docs/assets/panel-redesign/panel/src/dmarc-domain.html

@@ -26,7 +26,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Reports</h2></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Received, UTC</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+            <thead><tr><th>Received</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 02:15</td><td class="sp-muted">google.com</td><td>20 Sep</td><td>6 410</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>

docs/assets/panel-redesign/panel/src/dmarc-report.html

@@ -2,7 +2,7 @@
     <div class="sp-head">
       <div class="sp-grow">
         <p class="sp-kicker"><a href="dmarc.html">DMARC reports</a> / <a href="dmarc-domain.html">shop.example.org</a> /</p>
-        <h1 class="title is-4">Outlook.com · 20 Sep 2026</h1>
+        <h1 class="title is-4">Outlook.com · 20 Sep</h1>
         <p class="sp-route"><span>shop.example.org</span><span class="tag is-success is-light">1 903 pass</span><span class="tag is-warning is-light">7 fail</span></p>
       </div>
     </div>
@@ -15,8 +15,8 @@
             <dl class="sp-facts">
               <div><dt>Reporter</dt><dd>Outlook.com</dd></div>
               <div><dt>Report id</dt><dd class="sp-mono sp-small">5f1c9a0e7b2d4e61a3</dd></div>
-              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00 UTC</dd></div>
-              <div><dt>Received</dt><dd>2026-09-21 04:40 UTC</dd></div>
+              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00</dd></div>
+              <div><dt>Received</dt><dd>2026-09-21 04:40</dd></div>
             </dl>
           </div>
         </div>

docs/assets/panel-redesign/panel/src/dmarc.html

@@ -11,7 +11,7 @@
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Ingest</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#dmarc" title="What the reports are and where they go"><i class="ti ti-help-circle"></i></a></div>
       <div class="sp-box-body">
         <dl class="sp-facts">
-          <div><dt>Last report</dt><dd>2026-09-21 06:12 UTC</dd></div>
+          <div><dt>Last report</dt><dd>2026-09-21 06:12</dd></div>
           <div><dt>This week</dt><dd>14 kept · 0 parse failures</dd></div>
           <div><dt>Hosted addresses</dt><dd class="sp-mono sp-small">dmarc-reports+&lt;domain&gt;@mail.example.org</dd></div>
           <div><dt>Retention</dt><dd>500 reports a domain or 90 days</dd></div>
@@ -22,7 +22,7 @@
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">02</span><h2>Recent reports</h2></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Received, UTC</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+        <thead><tr><th>Received</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 06:12</td><td><a href="dmarc-domain.html">example.org</a></td><td class="sp-muted">google.com</td><td>20 Sep</td><td>412</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td><a href="dmarc-domain.html">shop.example.org</a></td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>

docs/assets/panel-redesign/panel/src/health.html

@@ -3,7 +3,7 @@
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">Health</h1>
-        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes every 10 s.</p>
+        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes automatically.</p>
       </div>
       <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-refresh"></i>Re-check DNS</button></form>
     </div>
@@ -76,10 +76,10 @@
           <div class="sp-box-head"><span class="sp-no">04</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#certificate" title="When it warns and what to do"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14 UTC</dd></div>
+              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14</dd></div>
               <div><dt>Names <span class="tag is-success is-light">matches</span></dt><dd class="sp-mono">mail.example.org</dd></div>
-              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02 UTC</dd></div>
-              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12 UTC</dd></div>
+              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02</dd></div>
+              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12</dd></div>
             </dl>
             <p class="mt-4 sp-muted">Postfix still serves the certificate above. A renewed one is waiting in the mounted file; Postfix takes it up at its next check for a renewal, at most a day after it was mounted.</p>
           </div>
@@ -107,5 +107,18 @@
             <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-reload"></i>Reload configuration</button></form>
           </div>
         </div>
+        <div class="box" id="test-message" data-order="9">
+          <div class="sp-box-head"><span class="sp-no">09</span><h2>Test message</h2><div class="sp-end">Shows what the receiving server answers</div><a class="sp-help" href="help.html#test-message" title="What the test proves"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <form class="sp-form" method="post" action="out-message.html">
+              <div class="field"><label class="label" for="rcpt">Recipient</label>
+                <div class="field has-addons">
+                  <div class="control is-expanded has-icons-left"><input class="input" id="rcpt" name="recipient" type="email" placeholder="you@elsewhere.example" required><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
+                  <div class="control"><button type="submit" class="button is-primary"><i class="ti ti-send"></i>Send</button></div>
+                </div>
+                <p class="help">From <span class="sp-mono">postmaster@mail.example.org</span>, signed with the server's own key, through Postfix as its notifications go. It opens in the <a href="out-log.html">Outbound log</a>, where its page follows it to the receiving server. Ten an hour.</p></div>
+            </form>
+          </div>
+        </div>
       </div>
     </div>

docs/assets/panel-redesign/panel/src/help.html

@@ -14,6 +14,7 @@
           <ul class="menu-list">
             <li><a class="is-active" href="#checks"><i class="ti ti-activity-heartbeat"></i>Health checks</a></li>
             <li><a href="#certificate"><i class="ti ti-certificate"></i>TLS certificate</a></li>
+            <li><a href="#test-message"><i class="ti ti-send"></i>Test message</a></li>
             <li><a href="#rdns"><i class="ti ti-arrows-exchange"></i>Reverse DNS</a></li>
           </ul>
           <p class="menu-label">Outbound</p>
@@ -53,15 +54,16 @@
           <div class="sp-box-head"><span class="sp-no">01</span><h2>Overview</h2></div>
           <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, and the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now. <a href="health.html">Health</a> shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total. <em>Your address</em>, in the Configuration card, is the address the panel sees your browser at: behind a reverse proxy it must be your own, taken from <code>X-Forwarded-For</code>; when it is the proxy's, every visitor shares one sign-in limit, and Health warns and names the address to put in <code>TRUSTED_PROXY_CIDR</code>.</p></div>
           <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. Postfix serves its own copy of the mounted file and looks for a renewed one once a day by default; until it takes one up, the card shows it as a renewal waiting, and warns once it has waited longer than that check allows - the container log's cert-reload lines say why. It warns 14 days before expiry unless a renewal is already waiting, and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect. It also fails when none of its names is the hostname (<code>SELFPOST_HOSTNAME</code>) - the tag beside <em>Names</em> says which: a client that verifies the name refuses it however valid it is.</p></div>
+          <div class="sp-help-topic" id="test-message"><h3>Test message</h3><p>A message from <code>postmaster@</code> the server's hostname to one address you type, sent the way notifications are: through Postfix, signed with the DKIM key of the server's own name. It proves the path from this server - TLS, its address's reputation, the SPF and DKIM records of its name - not your domains', which only mail from an application does. The page that opens is its row in the Outbound log: it shows whether the receiving server took it, put it off or refused it, with the lines of <code>mail.log</code>. Whether it then reached the inbox or the spam folder only the mailbox can say. The global role sends it, at most ten an hour.</p></div>
           <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname (<code>SELFPOST_HOSTNAME</code>) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone. <em>Greeting</em> is the line Postfix opens every connection with, <code>220</code> and its banner; it must name the hostname too - a receiver compares it with the name it looked up - and a container id or <code>localhost</code> there is a warning.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Outbound</h2></div>
           <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. A record DNS already holds as shown is folded to its name and status; Show values opens it to copy them again. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
-          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once at creation or regeneration and is not stored in readable form.</p></div>
+          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once, at creation or regeneration, and the panel does not show it again; the server keeps it, so a domain export can carry it.</p></div>
           <div class="sp-help-topic" id="sender-check"><h3>Sender check</h3><p>An application sends only as itself, and that holds for every sender a message names. The envelope sender is held against the login by Postfix. The <code>From:</code> line, the one a mail program shows and the one DMARC holds the DKIM signature to, is held against it by the panel, under the same rule: an application set to any address of its domain may write any address of that domain, and one with a list of addresses only those. A message with any other <code>From:</code> - another of your domains, the server's own name, an address somewhere else, or none at all - is refused for good with <code>550 5.7.1</code>. The line must hold one address, read as a mail program reads it: what a display name around it says is not judged, and a line holding more than one address is refused. A <code>Sender:</code> line, which a mail program shows beside <code>From:</code> as "on behalf of", is held to the same rule when the message has one. A system that writes for people outside your domains writes its own address in <code>From:</code> with the person's name, and the person's address in <code>Reply-To:</code>: their domain in <code>From:</code> would fail DMARC at the receiver anyway. It is a rejected row of the Outbound log, and its page says which address was refused. This is what keeps one application from sending, under this server's signature, as another domain or another application.<br><br>The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were refused with a temporary error in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message refused in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own.</p></div>
           <div class="sp-help-topic" id="limits"><h3>Rate limits</h3><p>Level 1 is a per-IP ceiling set in <code>.env</code>. Level 2 is optional, per domain and per application, entered by hand or computed from the last 30 days of sending, and can never exceed level 1. An application's own limit replaces its domain's.</p></div>
-          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient, with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> or <code>Sender:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
+          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient (a message refused for its From: or Sender: line is one row, however many recipients it had), with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> or <code>Sender:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
           <div class="sp-help-topic" id="queue"><h3>Queue and retries</h3><p>The page lists, as <code>postqueue -p</code> prints it, the messages Postfix has accepted and not yet delivered: mail being sent right now and mail deferred for a later attempt. Only the global role can open it, and it only shows; nothing here deletes or forces a message. A deferred message is tried again after the first retry delay, then at gaps that double up to a cap, until the receiving server takes it or the queue lifetime runs out and it bounces; there is no attempt counter, and the box on the page shows this server's values. A queue that keeps growing means a receiver is refusing or not answering: open the message from the Outbound log to read the reason Postfix logged.</p></div>
           <div class="sp-help-topic" id="dmarc"><h3>DMARC reports</h3><p>An aggregate report is the summary a receiving provider sends, usually daily, to the <code>rua=</code> address of your DMARC record: which servers sent mail as your domain and whether SPF or DKIM passed for it. A domain's report address is one of three choices, set in its Domain settings: no reports (the default for a new domain), the SelfPost hosted address (an address on this server whose reports are parsed and shown under DMARC reports; offered only while hosted reports are enabled on the server), or an address typed for the domain (an ordinary mailbox that receives the raw XML; a button fills in your own profile e-mail). When the typed address is on another domain than the one sending, that domain must publish a report-authorization record, or providers will not send; the domain's page shows it with the other DNS records and checks it. In the tables pass means SPF or DKIM passed and aligned, fail means neither did, and your own server shows as <em>this relay</em>. A fail from any other source is someone else sending as your domain — a forwarder, an application you forgot, or abuse — so do not tighten <code>p=</code> until that sender is fixed or removed. A domain administrator reads the reports of their own domains.</p></div>
         </div>
@@ -76,14 +78,14 @@
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Server</h2></div>
-          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. Both it and a domain's export ask for your account password - the one you sign in with - at every download, so a session left open is not enough to take them; wrong guesses count against the same limit as a password change. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10998 on the host (<code>chgrp 10998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
-          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out of their other sessions.</p></div>
-          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
-          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same limit. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish and whether they are in place, and its Re-check DNS checks them again once they are published; Server › Health shows them too. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
+          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. Both it and a domain's export ask for your account password - the one you sign in with - at every download, so a session left open is not enough to take them; every attempt, right or wrong, counts against the limit of a password change, ten in 15 minutes. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10998 on the host (<code>chgrp 10998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
+          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out everywhere; set for yourself, it keeps the session you set it from.</p></div>
+          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. The time zone is the container's, <code>TZ</code> in <code>.env</code> (UTC when it is not set): every time the panel shows and every day it counts is that zone's, as are the stamps Postfix writes in <code>mail.log</code>, so the two always agree; changing it is a restart of the container. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
+          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same sending domain. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish and whether they are in place, and its Re-check DNS checks them again once they are published; Server › Health shows them too. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">05</span><h2>Account</h2></div>
-          <div class="sp-help-topic" id="account"><h3>Your account</h3><p>Account is your own, whatever your role: your username and e-mail, whether the panel sends you notifications, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected.</p></div>
+          <div class="sp-help-topic" id="account"><h3>Your account</h3><p>Account is your own, whatever your role: your username and e-mail, whether the panel sends you notifications, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected. A new e-mail is sent a link that confirms it, which works once, for 24 hours; changing the e-mail asks for your password. Notifications go to the address whether it is confirmed or not, but only a confirmed one can get a link to reset a forgotten password: <em>Forgot your password?</em> on the sign-in page sends it, for 30 minutes and once, and setting the new password signs every session of the account out. Without a confirmed e-mail the global administrator sets a new password under Users, and the only global administrator recovers from the container.</p></div>
         </div>
       </div>
     </div>

docs/assets/panel-redesign/panel/src/in-domain.html

@@ -76,7 +76,7 @@
 dev@lists.example.org
 owner@lists.example.org
 security@lists.example.org</textarea></div>
-                    <p class="help">Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
+                    <p class="help">One per line or comma-separated. Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
                   <button type="submit" class="button is-primary">Save recipients</button>
                 </form>
               </div>
@@ -88,10 +88,9 @@ security@lists.example.org</textarea></div>
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Spam filter</h2><div class="sp-end"><span class="tag is-success is-light">on</span></div><a class="sp-help" href="help.html#filter" title="A server setting"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Engine</dt><dd>rspamd, for every inbound domain of this server</dd></div>
-              <div><dt>Suspicious mail</dt><dd>Held — <a href="in-quarantine.html">1 message in quarantine</a> for this domain</dd></div>
-              <div><dt>Spam</dt><dd>Refused at the door; see <em>reject</em> in the <a href="in-log.html">log</a></dd></div>
-              <div><dt>Allow and deny lists</dt><dd class="sp-muted">Kept by the global administrator, one pair for the whole server</dd></div>
+              <div><dt>Applies to</dt><dd>Every inbound domain of this server</dd></div>
+              <div><dt>Filter</dt><dd class="sp-mono">inet:antispam:11332</dd></div>
+              <div><dt>If the filter is down</dt><dd>Mail is accepted unfiltered</dd></div>
             </dl>
           </div>
         </div>

docs/assets/panel-redesign/panel/src/in-filter-lists.html

@@ -66,7 +66,7 @@
         <dl class="sp-facts">
           <div><dt>Applied by</dt><dd>rspamd, from map files it rereads within seconds of a change</dd></div>
           <div><dt>Files</dt><dd><span class="sp-mono">/data/antispam/</span> — six, one for each list and kind of entry</dd></div>
-          <div><dt>Last written</dt><dd>2026-09-11 08:40 UTC</dd></div>
+          <div><dt>Last written</dt><dd>2026-09-11 08:40</dd></div>
           <div><dt>When both lists match</dt><dd>Deny wins, whichever entries they are.</dd></div>
         </dl>
       </div>

docs/assets/panel-redesign/panel/src/in-log.html

@@ -20,7 +20,7 @@
         <a class="sp-help" href="help.html#inbound-log" title="What the decisions mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th>Upstream</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th>Upstream</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:31</td><td>ci@<wbr>builds.example<br><span class="sp-mono sp-muted sp-small">192.0.2.90</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">[ci] nightly build passed</td><td><button type="button" class="tag is-success is-light" popovertarget="why-7">accept</button><div class="sp-sheet" id="why-7" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-7" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 1.10 / 15.00</td></tr><tr><th>Subject</th><td>[ci] nightly build passed</td></tr></tbody></table></div></div></div></div></td><td><span class="tag is-light">queued</span></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:18</td><td>t.berg@<wbr>uni.example<br><span class="sp-mono sp-muted sp-small">192.0.2.77</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">Re: [dev] patch series v3</td><td><button type="button" class="tag is-success is-light" popovertarget="why-1">accept</button><div class="sp-sheet" id="why-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 0.40 / 15.00</td></tr><tr><th>Subject</th><td>Re: [dev] patch series v3</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-success is-light" popovertarget="up-1">sent</button><div class="sp-sheet" id="up-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">sent</span><h2>Upstream</h2><button type="button" popovertarget="up-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Host</th><td class="sp-mono sp-small">mx.upstream.example[198.51.100.5]:25</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">250 2.0.0 Ok: queued as CE05D10261D</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 14:00:19</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>

docs/assets/panel-redesign/panel/src/in-quarantine-message.html

@@ -15,7 +15,7 @@
             <dl class="sp-facts">
               <div><dt>Inbound domain</dt><dd><a href="in-domain.html">lists.example.org</a></dd></div>
               <div><dt>Client</dt><dd class="sp-mono">203.0.113.140</dd></div>
-              <div><dt>Held</dt><dd>2026-09-21 13:59:02 UTC</dd></div>
+              <div><dt>Held</dt><dd>2026-09-21 13:59:02</dd></div>
               <div><dt>Deleted on</dt><dd>2026-10-05 · in 14 days</dd></div>
               <div><dt>Size</dt><dd>48 kB · 1 attachment (<span class="sp-mono">invoice.html</span>)</dd></div>
               <div><dt>Would go to</dt><dd class="sp-mono">mx.internal:25</dd></div>

docs/assets/panel-redesign/panel/src/in-quarantine.html

@@ -16,7 +16,7 @@
         </form>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Held, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
+        <thead><tr><th>Held</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example</td><td>owner@<wbr>lists.example.org</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Outstanding invoice — action required</strong></a></td><td class="sp-muted sp-small">score 9.8 · PHISHING</td><td class="sp-muted sp-nowrap">48 kB</td><td class="sp-nowrap">14 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-20 22:14:40</td><td>no-reply@<wbr>shipping-update.example</td><td>jobs@<wbr>acme.io</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Your parcel could not be delivered</strong></a></td><td class="sp-muted sp-small">score 8.1 · URL_SHORTENER</td><td class="sp-muted sp-nowrap">12 kB</td><td class="sp-nowrap">13 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>

docs/assets/panel-redesign/panel/src/in-queue.html

@@ -8,7 +8,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes every 10 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes on its own</div></div>
       <div class="sp-empty"><i class="ti ti-stack-2"></i>Nothing is waiting. Every accepted message has reached its upstream.</div>
     </div>
 

docs/assets/panel-redesign/panel/src/login-no-admin.html

@@ -12,6 +12,6 @@
       <h1 class="title is-3">No administrator yet</h1>
       <p class="sp-muted">Open the one-time setup link printed in the container log to create one.</p>
     </div>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>

docs/assets/panel-redesign/panel/src/login-reset-sent.html

@@ -0,0 +1,27 @@
+<!-- title: Sign in | shell: bare -->
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="overview.html">
+      <p class="sp-kicker">mail.example.org</p>
+      <h1 class="title is-3">Sign in</h1>
+      <div class="notification is-success is-light"><i class="ti ti-circle-check"></i>If that account has a confirmed e-mail, the link is on its way. It works once, for 30 minutes.</div>
+      <div class="field">
+        <label class="label" for="username">Username</label>
+        <div class="control has-icons-left"><input class="input" id="username" name="username" autocomplete="username" required><span class="icon is-left"><i class="ti ti-user"></i></span></div>
+      </div>
+      <div class="field">
+        <label class="label" for="password">Password</label>
+        <div class="control has-icons-left"><input class="input" id="password" name="password" type="password" autocomplete="current-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
+      </div>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Sign in</button></div>
+      <p class="mt-4"><a href="login-reset.html">Forgot your password?</a></p>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>

docs/assets/panel-redesign/panel/src/login-reset-set.html

@@ -0,0 +1,26 @@
+<!-- title: New password | shell: bare -->
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="login.html">
+      <p class="sp-kicker">mail.example.org · admin</p>
+      <h1 class="title is-3">New password</h1>
+      <p class="sp-muted mb-4">Setting it signs every session of this account out; sign in with it afterwards.</p>
+      <div class="field">
+        <label class="label" for="new_password">New password</label>
+        <div class="control has-icons-left"><input class="input" id="new_password" name="new_password" type="password" autocomplete="new-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
+      </div>
+      <div class="field">
+        <label class="label" for="new_password_confirm">Repeat</label>
+        <div class="control has-icons-left"><input class="input" id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
+      </div>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Set password</button></div>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>

docs/assets/panel-redesign/panel/src/login-reset.html

@@ -0,0 +1,23 @@
+<!-- title: Reset password | shell: bare -->
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="login-reset-sent.html">
+      <p class="sp-kicker">mail.example.org</p>
+      <h1 class="title is-3">Reset password</h1>
+      <p class="sp-muted mb-4">A link to set a new password goes to the e-mail of the account, once that address is confirmed under Account. It works once, for 30 minutes.</p>
+      <div class="field">
+        <label class="label" for="username">Username</label>
+        <div class="control has-icons-left"><input class="input" id="username" name="username" autocomplete="username" required><span class="icon is-left"><i class="ti ti-user"></i></span></div>
+      </div>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Send the link</button></div>
+      <p class="mt-4"><a href="login.html">Back to sign in</a></p>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>

docs/assets/panel-redesign/panel/src/login.html

@@ -19,7 +19,8 @@
         <div class="control has-icons-left"><input class="input" id="password" name="password" type="password" autocomplete="current-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
       </div>
       <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Sign in</button></div>
+      <p class="mt-4"><a href="login-reset.html">Forgot your password?</a></p>
     </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>

docs/assets/panel-redesign/panel/src/out-app.html

@@ -3,7 +3,7 @@
       <div class="sp-grow">
         <p class="sp-kicker"><a href="out-domains.html">Outbound domains</a> / <a href="out-domain.html">example.org</a> / Applications /</p>
         <h1 class="title is-3 sp-mono">prod-server</h1>
-        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h. The same form, empty, adds a new application.</p>
+        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h.</p>
       </div>
       <div class="buttons">
         <a class="button" href="out-app-created.html"><i class="ti ti-key"></i>New password</a>
@@ -19,7 +19,7 @@
             <div class="sp-box-body">
               <div class="field"><label class="label" for="login">Login</label>
                 <div class="control"><input class="input sp-mono" id="login" name="login" value="prod-server" autocomplete="off" spellcheck="false" required></div>
-                <p class="help">Unique across domains; letters, digits, <code>.</code> <code>-</code> <code>_</code>.</p></div>
+                <p class="help">Fixed: add a new application to use another login.</p></div>
               <div class="field"><label class="label" for="amode">May send as</label>
                 <div class="control"><div class="select is-fullwidth"><select id="amode" name="mode"><option selected>Any address of the domain</option><option>Specific addresses (list)</option></select></div></div></div>
               <div class="field"><label class="label" for="addresses">Addresses</label>

docs/assets/panel-redesign/panel/src/out-domain-settings.html

@@ -53,9 +53,9 @@
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="mode">Limit mode</label>
                 <div class="control"><div class="select is-fullwidth"><select id="mode" name="mode"><option>Manual</option><option selected>Auto (from statistics)</option></select></div></div></div>
-              <div class="field"><label class="label" for="mult">Multiplier (1.5–10, default 3)</label>
+              <div class="field"><label class="label" for="mult">Multiplier (1.5–5, default 2.5)</label>
                 <div class="control"><input class="input" id="mult" name="auto_multiplier" type="number" min="1.5" max="10" step="0.1" value="3"></div>
-                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00 UTC.</p></div>
+                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00.</p></div>
               <div class="buttons">
                 <button type="submit" class="button is-primary">Save limit</button>
                 <button type="submit" class="button" formaction="#recalc">Recalculate now</button>

docs/assets/panel-redesign/panel/src/out-log.html

@@ -21,7 +21,7 @@
         <a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td>shop@<wbr>shop.example.org</td><td>m.keller@<wbr>gmx.de</td><td class="sp-clip">Your order #48213 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:50</td><td>shop@<wbr>shop.example.org</td><td>anna.lind@<wbr>outlook.com</td><td class="sp-clip">Your order #48212 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>

docs/assets/panel-redesign/panel/src/out-message.html

@@ -15,8 +15,8 @@
             <dl class="sp-facts">
               <div><dt>Domain</dt><dd><a href="out-domain.html">example.org</a></dd></div>
               <div><dt>Application</dt><dd class="sp-mono"><a href="out-app.html">alerts</a></dd></div>
-              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07 UTC</dd></div>
-              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09 UTC</dd></div>
+              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07</dd></div>
+              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09</dd></div>
               <div><dt>Queue id</dt><dd class="sp-mono">4XcB7k2Jm9z1</dd></div>
               <div><dt>Journal id</dt><dd class="sp-mono">184220</dd></div>
             </dl>
@@ -28,9 +28,9 @@
           <div class="sp-box-head"><span class="sp-no">02</span><h2>History</h2><a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Accepted</strong> from <span class="sp-mono">alerts</span> at 198.51.100.7</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — the receiving server asked to retry later</li>
-              <li class="sp-pending"><time>next attempt ≈ 14:08 UTC</time>Still in the <a href="out-queue.html">queue</a>; kept for 5 days, then bounced</li>
+              <li><time>2026-09-21 13:58:07</time><strong>Accepted and queued</strong> — Postfix accepted the message over an authenticated submission and the journal-milter recorded it.</li>
+              <li class="sp-warn"><time>2026-09-21 13:58:09</time><strong>Deferred, will be retried</strong> — the receiving server could not take the message yet. Postfix retries: first after 5 minutes, then with increasing gaps up to 1 hour 7 minutes, for up to 5 days.</li>
+              <li class="sp-pending"><time>not yet</time>Still in the queue; the next attempt is Postfix's own, and after 5 days it is bounced.</li>
             </ol>
           </div>
         </div>

docs/assets/panel-redesign/panel/src/out-queue.html

@@ -3,14 +3,14 @@
       <div class="sp-grow">
         <p class="sp-kicker">Outbound</p>
         <h1 class="title is-3">Outbound queue</h1>
-        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes every 10 s.</p>
+        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes on its own.</p>
       </div>
     </div>
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">1 message · 3.1 kB</div><a class="sp-help" href="help.html#queue" title="What waits here and how Postfix retries"><i class="ti ti-help-circle"></i></a></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Queue id</th><th>Arrived, UTC</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
+        <thead><tr><th>Queue id</th><th>Arrived</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono">4XcB7k2Jm9z1</td><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:58:07</td><td>alerts@<wbr>example.org</td><td>noc@<wbr>example.org</td><td class="sp-muted">451 4.7.1 Greylisted, try again in 5 minutes</td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
         </tbody>

docs/assets/panel-redesign/panel/src/overview.html

@@ -6,7 +6,7 @@
         <h1 class="title is-3">Mail is flowing. One thing needs attention.</h1>
         <p class="sp-lead">The TLS certificate expires in 12 days and has not renewed yet.</p>
       </div>
-      <div class="sp-muted sp-small">Updated 14:02:31 UTC<br>refreshes every 10 s</div>
+      <div class="sp-muted sp-small">Updated 14:02:31<br>refreshes on its own</div>
     </div>
 
     <div class="box">

docs/assets/panel-redesign/panel/src/preflight.html

@@ -10,7 +10,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Checks</h2><div class="sp-end">Ran 14:02 UTC · 3.1 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Checks</h2><div class="sp-end">Ran 14:02 · 3.1 s</div></div>
       <div class="table-container"><table class="table is-fullwidth">
         <thead><tr><th>Check</th><th>Result</th><th>Found</th><th>What to do</th></tr></thead>
         <tbody>
@@ -42,7 +42,7 @@
           </div>
           <div class="column is-6">
             <dl class="sp-facts">
-              <div><dt>Last test</dt><dd>14:03 UTC to <span class="sp-mono">mix@elsewhere.example</span></dd></div>
+              <div><dt>Last test</dt><dd>14:03 to <span class="sp-mono">mix@elsewhere.example</span></dd></div>
               <div><dt>Result</dt><dd><span class="tag is-success is-light">queued</span> <span class="sp-mono sp-small">4XcC1d8Pq2z1</span></dd></div>
               <div><dt>Then</dt><dd><a href="out-message.html">Follow it in the outbound log</a></dd></div>
             </dl>

docs/assets/panel-redesign/panel/src/settings.html

@@ -73,5 +73,15 @@
             </dl>
           </div>
         </div>
+
+        <div class="box" id="time-zone">
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>Time zone</h2><div class="sp-end">Read-only</div><a class="sp-help" href="help.html#settings" title="Times and days of the panel"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <dl class="sp-facts">
+              <div><dt>Zone</dt><dd class="sp-mono">Europe/Moscow</dd><dd class="sp-muted">UTC+03:00. Set in <code>.env</code> (<code>TZ</code>); restart to change.</dd></div>
+            </dl>
+            <p class="mt-4 sp-muted">Every time the panel shows, and every day it counts - today on Health, the days of the statistics - is this zone's, and so are the stamps of <code>mail.log</code>.</p>
+          </div>
+        </div>
       </div>
     </div>

docs/assets/panel-redesign/panel/src/setup.html

@@ -25,6 +25,6 @@
       </div>
       <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Create administrator</button></div>
     </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>

docs/assets/panel-redesign/panel/src/system-log.html

@@ -3,12 +3,12 @@
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">System log</h1>
-        <p class="sp-lead">The tail of <code>mail.log</code>, the log Postfix writes. For one message, open it from a log page instead.</p>
+        <p class="sp-lead">The tail of <code>mail.log</code>, the log Postfix writes. For one message, open it from the <a href="out-log.html">Outbound log</a> instead.</p>
       </div>
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Recent lines</h2><div class="sp-end">Last 200 · refreshes every 10 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Recent lines</h2><div class="sp-end">Last 200 lines · refreshes on its own</div></div>
 <pre class="sp-log"><span class="sp-ll"><span class="sp-d">Sep 21 14:01:52</span> postfix/smtp[2131]: 4XcB9q0Lw2z1: to=&lt;m.keller@gmx.de&gt;, relay=mx00.gmx.net[212.227.15.9]:25, delay=0.8, status=sent (250 Requested mail action okay)
 </span><span class="sp-ll"><span class="sp-d">Sep 21 14:01:52</span> postfix/qmgr[58]: 4XcB9q0Lw2z1: removed
 </span><span class="sp-ll"><span class="sp-d">Sep 21 14:00:18</span> postfix/smtpd[2129]: connect from mail.uni.example[192.0.2.77]

docs/assets/panel-redesign/panel/src/user-delete.html

@@ -14,9 +14,9 @@
             <p class="mb-3">Deleting the panel user <strong>acme-ops</strong> will:</p>
             <ul class="sp-list-check">
               <li><i class="ti ti-x"></i>end any signed-in session of this user at once;</li>
-              <li><i class="ti ti-x"></i>remove the assignments to <strong>all outbound domains</strong> and to <strong>acme.io</strong> (inbound).</li>
+              <li><i class="ti ti-x"></i>remove the assignments to <strong>all outbound domains</strong> (outbound) and to <strong>acme.io</strong> (inbound).</li>
             </ul>
-            <p class="sp-muted mb-4">The domains, their applications and passwords, upstreams and recipients are not affected.</p>
+            <p class="sp-muted mb-4">Applications and their passwords, upstreams and recipients are not affected.</p>
             <form method="post" action="users.html">
               <div class="buttons">
                 <button type="submit" class="button is-danger"><i class="ti ti-trash"></i>Delete acme-ops</button>

docs/assets/panel-redesign/panel/src/user.html

@@ -3,7 +3,6 @@
       <div class="sp-grow">
         <p class="sp-kicker"><a href="users.html">Users</a> /</p>
         <h1 class="title is-3">acme-ops</h1>
-        <p class="sp-lead">The same form, empty, creates a new user.</p>
       </div>
       <a class="button is-danger is-light" href="user-delete.html"><i class="ti ti-trash"></i>Delete user</a>
     </div>
@@ -15,8 +14,8 @@
             <div class="sp-box-head"><span class="sp-no">01</span><h2>Account</h2><a class="sp-help" href="help.html#users" title="Roles and domain assignments"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <div class="field"><label class="label" for="username">Username</label><div class="control"><input class="input" id="username" name="username" value="acme-ops" autocomplete="username" spellcheck="false" required></div></div>
-              <div class="field"><label class="label" for="email">E-mail</label><div class="control"><input class="input" id="email" name="email" type="email" value="ops@acme.io" autocomplete="off"></div>
-                <p class="help">For notifications and a password-reset link. The user can change it under Account.</p></div>
+              <div class="field"><label class="label" for="email">E-mail <span class="tag is-success is-light">confirmed</span></label><div class="control"><input class="input" id="email" name="email" type="email" value="ops@acme.io" autocomplete="off"></div>
+                <p class="help">The user's own address. They can change it under Account. A new one is sent a link to confirm it; until it is confirmed no reset link goes to it.</p></div>
               <div class="field"><label class="label" for="password">Password</label><div class="control"><input class="input" id="password" name="password" type="password" autocomplete="new-password"></div>
                 <p class="help">Leave empty to keep the current one.</p></div>
               <div class="field"><label class="label" for="role">Role</label>
@@ -33,7 +32,7 @@
               <div class="field"><label class="checkbox"><input type="checkbox" name="domain_ids" checked disabled> example.org</label></div>
               <div class="field"><label class="checkbox"><input type="checkbox" name="domain_ids" checked disabled> shop.example.org</label></div>
               <div class="field"><label class="checkbox"><input type="checkbox" name="domain_ids" checked disabled> notify.acme.io</label></div>
-              <p class="help">With <em>All</em> ticked the list below it is ignored — and greyed out where scripts run.</p>
+              <p class="help">With <em>All</em> ticked the single domains are ignored.</p>
             </div>
           </div>
           <div class="box">

docs/assets/panel-redesign/panel/system-log.html

@@ -69,12 +69,12 @@
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">System log</h1>
-        <p class="sp-lead">The tail of <code>mail.log</code>, the log Postfix writes. For one message, open it from a log page instead.</p>
+        <p class="sp-lead">The tail of <code>mail.log</code>, the log Postfix writes. For one message, open it from the <a href="out-log.html">Outbound log</a> instead.</p>
       </div>
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Recent lines</h2><div class="sp-end">Last 200 · refreshes every 10 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Recent lines</h2><div class="sp-end">Last 200 lines · refreshes on its own</div></div>
 <pre class="sp-log"><span class="sp-ll"><span class="sp-d">Sep 21 14:01:52</span> postfix/smtp[2131]: 4XcB9q0Lw2z1: to=&lt;m.keller@gmx.de&gt;, relay=mx00.gmx.net[212.227.15.9]:25, delay=0.8, status=sent (250 Requested mail action okay)
 </span><span class="sp-ll"><span class="sp-d">Sep 21 14:01:52</span> postfix/qmgr[58]: 4XcB9q0Lw2z1: removed
 </span><span class="sp-ll"><span class="sp-d">Sep 21 14:00:18</span> postfix/smtpd[2129]: connect from mail.uni.example[192.0.2.77]
@@ -87,7 +87,7 @@
 </span></pre>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/user-delete.html

@@ -80,9 +80,9 @@
             <p class="mb-3">Deleting the panel user <strong>acme-ops</strong> will:</p>
             <ul class="sp-list-check">
               <li><i class="ti ti-x"></i>end any signed-in session of this user at once;</li>
-              <li><i class="ti ti-x"></i>remove the assignments to <strong>all outbound domains</strong> and to <strong>acme.io</strong> (inbound).</li>
+              <li><i class="ti ti-x"></i>remove the assignments to <strong>all outbound domains</strong> (outbound) and to <strong>acme.io</strong> (inbound).</li>
             </ul>
-            <p class="sp-muted mb-4">The domains, their applications and passwords, upstreams and recipients are not affected.</p>
+            <p class="sp-muted mb-4">Applications and their passwords, upstreams and recipients are not affected.</p>
             <form method="post" action="users.html">
               <div class="buttons">
                 <button type="submit" class="button is-danger"><i class="ti ti-trash"></i>Delete acme-ops</button>
@@ -94,7 +94,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/user.html

@@ -69,7 +69,6 @@
       <div class="sp-grow">
         <p class="sp-kicker"><a href="users.html">Users</a> /</p>
         <h1 class="title is-3">acme-ops</h1>
-        <p class="sp-lead">The same form, empty, creates a new user.</p>
       </div>
       <a class="button is-danger is-light" href="user-delete.html"><i class="ti ti-trash"></i>Delete user</a>
     </div>
@@ -81,8 +80,8 @@
             <div class="sp-box-head"><span class="sp-no">01</span><h2>Account</h2><a class="sp-help" href="help.html#users" title="Roles and domain assignments"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <div class="field"><label class="label" for="username">Username</label><div class="control"><input class="input" id="username" name="username" value="acme-ops" autocomplete="username" spellcheck="false" required></div></div>
-              <div class="field"><label class="label" for="email">E-mail</label><div class="control"><input class="input" id="email" name="email" type="email" value="ops@acme.io" autocomplete="off"></div>
-                <p class="help">For notifications and a password-reset link. The user can change it under Account.</p></div>
+              <div class="field"><label class="label" for="email">E-mail <span class="tag is-success is-light">confirmed</span></label><div class="control"><input class="input" id="email" name="email" type="email" value="ops@acme.io" autocomplete="off"></div>
+                <p class="help">The user's own address. They can change it under Account. A new one is sent a link to confirm it; until it is confirmed no reset link goes to it.</p></div>
               <div class="field"><label class="label" for="password">Password</label><div class="control"><input class="input" id="password" name="password" type="password" autocomplete="new-password"></div>
                 <p class="help">Leave empty to keep the current one.</p></div>
               <div class="field"><label class="label" for="role">Role</label>
@@ -99,7 +98,7 @@
               <div class="field"><label class="checkbox"><input type="checkbox" name="domain_ids" checked disabled> example.org</label></div>
               <div class="field"><label class="checkbox"><input type="checkbox" name="domain_ids" checked disabled> shop.example.org</label></div>
               <div class="field"><label class="checkbox"><input type="checkbox" name="domain_ids" checked disabled> notify.acme.io</label></div>
-              <p class="help">With <em>All</em> ticked the list below it is ignored — and greyed out where scripts run.</p>
+              <p class="help">With <em>All</em> ticked the single domains are ignored.</p>
             </div>
           </div>
           <div class="box">
@@ -119,7 +118,7 @@
       </div>
     </form>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/users.html

@@ -88,7 +88,7 @@
       </table></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/development.md

@@ -107,7 +107,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 2. Git tag `vX.Y.Z` and publish the GitHub Release only on explicit request (see
    [§ Release image](#release-image)).
 
-**Planned version cuts** (from pin `2.11.0`; adjust if semver changes mid-track):
+**Planned version cuts** (from pin `2.14.0`; adjust if semver changes mid-track):
 
 | Stage | ID | Cut |
 |---|---|---|
@@ -148,6 +148,10 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 | 35 | backup-reauth | `2.10.3` (PATCH) |
 | 36 | origin-strict | `2.10.4` (PATCH) |
 | 37 | health-setup-checks | `2.11.0` |
+| 38 | test-email | `2.12.0` |
+| 39 | local-time | `2.13.0` |
+| 40 | docs-audit | `2.13.1` |
+| 41 | password-reset | `2.14.0` |
 
 Docs-only prep (checklists in plans, no product code) uses the same per-step
 commit rule but **no** version cut until the next product stage ships.
@@ -481,7 +485,8 @@ make e2e
 **Stack:** [deploy/docker-compose.yml](../deploy/docker-compose.yml) +
 [test/e2e/compose.override.yml](../test/e2e/compose.override.yml) — same
 `cap_drop`/`cap_add`/`no-new-privileges` as production. Override: high ports
-(`20465`/`20587`/`20080`), test hostname, self-signed TLS,
+(`20465`/`20587`/`20080`, port 25 at `20025`, the stand's CoreDNS at
+`20053/udp`), test hostname, self-signed TLS,
 `PANEL_COOKIE_SECURE=false`, isolated compose project, and the image's
 `VERSION` from `SELFPOST_E2E_VERSION` (unset locally: `e2e`). Mail is hermetic:
 CoreDNS (fake zone) + Postfix `smtp-sink` as sink-MX; DKIM TXT is scraped from
@@ -534,10 +539,10 @@ Workflows in [.github/workflows/](../.github/workflows/). What each job runs —
 ### `test.yml` — every push and PR to `main`
 
 `design-first` (needs the full history) → `gofmt -l` → `go vet ./...` →
-`go test ./...` (main module, no e2e; includes the panel guard tests, see
+Staticcheck 2026.1 → `go test ./...` (main module, no e2e; includes the panel guard tests, see
 [§ Panel pages](#panel-pages-the-component-kit-and-its-guards)) → the e2e
-module compiled, not run (`go vet ./...` and `go test -c -o /dev/null .` in
-`test/e2e`).
+module compiled, not run (`go vet ./...`, Staticcheck and
+`go test -c -o /dev/null .` in `test/e2e`).
 
 ### `release.yml` — published GitHub Release, or `workflow_dispatch` with SemVer
 

docs/guide.md

@@ -84,8 +84,9 @@ Since `2.7.0` a message sent on 465 or 587 does not tell its recipients
 where the application runs: the `Received:` header SelfPost adds reads
 `Received: by mail.example.com (Postfix) id 4AbC12xyz for <...>; <date>`,
 without the application's address, host name or login. To trace a message
-someone complains about, take that queue id to *Outbound › Log*; mail.log
-keeps the client address on smtpd's `client=` line for the same id.
+someone complains about, find its row in *Outbound › Log* (by domain,
+application and day; the message's page shows its queue id); mail.log keeps
+the client address on smtpd's `client=` line for the same id.
 
 ### Local trial
 
@@ -204,14 +205,14 @@ cat ./data/setup-token
 #### Fixed image tag
 
 `deploy/docker-compose.yml` pins an explicit version (`ghcr.io/mixeme/selfpost:X.Y.Z`),
-deliberately never `:latest`. The current pin is `2.11.0`. **No 2.x image is
+deliberately never `:latest`. The current pin is `2.14.0`. **No 2.x image is
 published on ghcr.io yet** (the newest there is `1.3.0`); until one is, build
 it from the checkout under the pinned name, and Compose uses the local image
 instead of pulling:
 
 ```sh
-docker build -f build/Dockerfile --build-arg VERSION=2.11.0 \
-  -t ghcr.io/mixeme/selfpost:2.11.0 .
+docker build -f build/Dockerfile --build-arg VERSION=2.14.0 \
+  -t ghcr.io/mixeme/selfpost:2.14.0 .
 ```
 
 `VERSION` must equal the tag: it is the version the backup check compares
@@ -249,7 +250,8 @@ expected to set; defaults match the code exactly.
 | `SEND_LOG_RETENTION_DAYS` | Initial default for how many days of send-log history are kept before the background sweep deletes rows, and with them the `mail.log` lines kept for each message (1–2 KB a message) — the main driver of `/data` growth over time and of the size of a full backup. After the first panel start, change retention under **Server › Settings** (global role); the env value is only used to seed SQLite when the setting has never been saved. | `90` | `.env` |
 | `PANEL_SESSION_IDLE_DAYS` | Sliding idle timeout for the panel login session, in days. There is no absolute cap: a user who keeps coming back stays signed in indefinitely. | `7` | `.env` |
 | `SELFPOST_DNS_RESOLVERS` | Comma-separated recursive resolvers the panel's PTR/SPF/DKIM/DMARC checks query directly (so they report what the internet sees, not what this host's stub resolver synthesises). Each is given 2 seconds to answer before the next is asked, and the one that answered last is asked first; a lookup none of them answered shows as not known, never as a wrong record. | `1.1.1.1:53`, `8.8.8.8:53`, `9.9.9.9:53` when unset | `.env` |
-| `TRUSTED_PROXY_CIDR` | Comma-separated CIDRs (bare IPs allowed) of reverse proxies allowed to supply `X-Forwarded-For` for login, setup, and account-change rate-limiting. **Leave unset unless you know the exact address of your reverse proxy.** A wrong value lets a client spoof its rate-limit key by sending a forged `X-Forwarded-For` header — the panel trusts the last hop only when the TCP peer matches one of these CIDRs. With Apache on the host (the default), the panel sees the proxy's connections come from the Docker network's gateway, e.g. `172.18.0.1` (`docker network inspect` shows it; measured 2026-10-15: the panel's `127.0.0.1:8080` is published through Docker's proxy, and a connection to such a port from the host arrives from the gateway). | *(empty — XFF ignored)* | `.env` |
+| `TZ` | Time zone of the container, an IANA name such as `Europe/Moscow`: every time the panel shows, every day it counts (today on Health, the days of the statistics, the days of the log filters) and the stamps Postfix writes in `mail.log`, so the two agree. Stored times stay UTC, so changing it is only a restart. *Server › Settings* shows the zone in use, and says so when the image does not know the name (the times are then UTC). | UTC | `.env` |
+| `TRUSTED_PROXY_CIDR` | Comma-separated CIDRs (bare IPs allowed) of reverse proxies allowed to supply `X-Forwarded-For` for sign-in and setup rate-limiting (account-change attempts are counted per user, whatever the address). **Leave unset unless you know the exact address of your reverse proxy.** A wrong value lets a client spoof its rate-limit key by sending a forged `X-Forwarded-For` header — the panel trusts the last hop only when the TCP peer matches one of these CIDRs. With Apache on the host (the default), the panel sees the proxy's connections come from the Docker network's gateway, e.g. `172.18.0.1` (`docker network inspect` shows it; measured 2026-10-15: the panel's `127.0.0.1:8080` is published through Docker's proxy, and a connection to such a port from the host arrives from the gateway). | *(empty — XFF ignored)* | `.env` |
 
 TLS certificate paths (`TLS_CERT_FILE`, `TLS_KEY_FILE`) are fixed in
 [deploy/docker-compose.yml](../deploy/docker-compose.yml) to match the `./certs`
@@ -421,7 +423,7 @@ changes.
 |---|---|---|
 | Overview | Overview | `/overview` |
 | Outbound | Domains · Log · Queue · DMARC reports | `/outbound/domains`, `/outbound/log`, `/outbound/queue`, `/outbound/dmarc` |
-| Inbound | Domains | `/inbound/domains` |
+| Inbound | Domains · Log · Filter lists (global role) | `/inbound/domains`, `/inbound/log`, `/inbound/filter-lists` |
 | Server | Health · System log · Backup · Users · Settings | `/server/health`, `/server/log`, `/server/backup`, `/server/users`, `/server/settings` |
 | User menu (your name) | Account · Help · Sign out | `/account`, `/help`, `POST /logout` |
 
@@ -459,19 +461,9 @@ their helpers), TLS certificate, queue, milter sockets and reverse DNS. A
 check the panel could not run shows as a warning, never as fine. Below the cards are the outbound domain list and, with the inbound relay
 on, the inbound one. Each card leads to its table on **Server › Health**
 (`/server/health`) — the queue card to the Outbound queue — and Health has the
-readings, in the order of what stops mail first:
+readings, numbered in the order of what stops mail first:
 
-- **Machine** — processor (core and thread counts), memory and swap of the
-  host (a memory limit set on the container is not reflected), and
-  per-interface network throughput and totals of the container's own network
-  interfaces, read from the kernel's counters; CPU and throughput are measured between refreshes, so they appear
-  one refresh after the page opens. A fully busy processor or a machine out of
-  memory is a warning, because both delay or kill the mail path; throughput is
-  only reported.
-- **Processes**, **TLS certificate** (validity and expiry, and whether its
-  names cover `SELFPOST_HOSTNAME` - the tag beside *Names*; a certificate for
-  another name fails, as a client that checks the name refuses it) and
-  **Milter sockets**: the DKIM signer's two - `dkim-signer · applications` for what
+- **Processes** and **Milter sockets**: the DKIM signer's two - `dkim-signer · applications` for what
   applications send on 465/587, `dkim-signer · notifications` for the
   panel's own mail - the sender check, the send log (the journal-milter)
   and, with one configured, the spam filter. Postfix attaches the signer
@@ -488,16 +480,28 @@ readings, in the order of what stops mail first:
   connects during an outage is counted too; a message refused in the middle
   is one the panel stopped answering for after it had begun. A time marked ≈
   is at most what it shows: at that start supervisord could not say since
-  when Postfix ran. Days are UTC days. The card warns when
+  when Postfix ran. Days are those of the container's zone (`TZ`). The card warns when
   a connection was turned away or a message refused in the last 24 hours. If these numbers do not stay
   at nothing, the panel is in the way of your mail more than it should be -
   report it.
+- **TLS certificate** — validity and expiry, and whether its names cover
+  `SELFPOST_HOSTNAME` (the tag beside *Names*); a certificate for another
+  name fails, as a client that checks the name refuses it.
 - **Hostname and reverse DNS** — compares `SELFPOST_HOSTNAME` against the PTR
   record the internet publishes for this server's IP (forward-confirmed
   reverse DNS), see [Server-level DNS](#server-level-dns-ptrrdns); use
   *Re-check DNS* after changing DNS. *Greeting* is the `220` line Postfix
   opens every connection with; it must name the hostname, and another name
   there is a warning.
+- **Notification mail** — whether the DNS records the panel's own mail is
+  signed and authorised with are in place (see [Notifications](#notifications)).
+- **Machine** — processor (core and thread counts), memory and swap of the
+  host (a memory limit set on the container is not reflected), and
+  per-interface network throughput and totals of the container's own network
+  interfaces, read from the kernel's counters; CPU and throughput are measured between refreshes, so they appear
+  one refresh after the page opens. A fully busy processor or a machine out of
+  memory is a warning, because both delay or kill the mail path; throughput is
+  only reported.
 - **Your address** (in the Configuration card) — the address the panel sees
   your browser at, and whether it took it from `X-Forwarded-For`. Behind a
   reverse proxy that the panel does not trust it is the proxy's own: every
@@ -514,6 +518,14 @@ readings, in the order of what stops mail first:
   if the daemons drifted from what the panel shows after manual edits under
   `/data`. A step that fails is named on the page, and the panel's log says
   why.
+- **Test message** — sends one message to an address you type, from
+  `postmaster@` the hostname, the way notifications go (through Postfix,
+  signed with the key of the server's own name). The page that opens is its
+  row in **Outbound › Log**, which follows it to the receiving server: sent,
+  put off or refused, with the lines of `mail.log`. It tests the server's
+  own path - TLS, its address, the records of its name - not a domain's,
+  which only an application's mail does; and whether it reached the inbox
+  only the mailbox can say. Ten an hour, global role.
 
 ### Queue and System log
 
@@ -546,14 +558,36 @@ readings, in the order of what stops mail first:
 ### Account
 
 **Account** (`/account`, every role) is the signed-in user's own: **Profile**
-(username and e-mail) and **Password**. Saving the profile does not ask for the
-password; changing the password asks for the current one and is rate-limited
-like a sign-in. The e-mail is the user's own address: it is where the panel
+(username and e-mail) and **Password**. Changing the username or the
+notifications switch does not ask for the password; changing the e-mail does,
+and so does changing the password, both on the limit of a sign-in's guesses
+(ten in 15 minutes per user). The e-mail is the user's own address: it is where the panel
 sends [notifications](#notifications) while *Send me notifications* is ticked
 beside it, and what a domain's *Use my e-mail* button fills in (see
 [Domain-level DNS](#domain-level-dns-spf-dkim-dmarc)). Application SASL logins
 are separate and are not changed here.
 
+**A confirmed e-mail and a forgotten password.** A new address - saved under
+Account, or typed for a user by the global role on the user form - is sent a
+link that confirms it (`https://<SELFPOST_HOSTNAME>/confirm/…`), which works
+once, for 24 hours, opened in a browser signed in as that account; its page
+has a button, and only the button confirms. The mail does not name the
+account, so a mistyped address cannot be confirmed by whoever reads it.
+Account tags the address *confirmed* or *not confirmed* and, while it is not,
+offers *Send the link again* (at most five links an hour to one address).
+Notifications go to the address either way. Only a confirmed address can be
+sent a reset link: *Forgot your password?* on the sign-in page asks for the
+username and always answers the same - whether the name exists, and whether
+its address is confirmed, is not said; another link is not sent within ten
+minutes of the last - and the link
+(`https://<SELFPOST_HOSTNAME>/login/reset/…`) works once, for 30 minutes, and
+only while the account's address is still the one it was sent to. Setting the
+new password signs every session of the account out. The links name the
+server by `SELFPOST_HOSTNAME`, so the panel must be served at that name. An
+account without a confirmed address recovers as before: the global role sets
+a new password on the user form, and the only global user from the container
+(see [Users](#users)).
+
 ### Settings
 
 **Server › Settings** (`/server/settings`, global role) holds what is true for
@@ -567,6 +601,18 @@ that make them arrive, with when they were last checked; **Re-check DNS** at
 the top of the page checks them again once they are published (results are
 otherwise kept a few minutes).
 
+The last box, **Time zone**, names the zone the panel is in: `TZ` in `.env`
+([Environment variables](#environment-variables)), UTC when it is not set,
+with its offset from UTC. Every time the panel shows is in that zone, and no
+time on the screens says which - this box is where it is said. Every day it
+counts is that zone's too: *today* on Health, the days of the statistics,
+the days of the log filters. Postfix runs in the same zone, so the stamps of
+the `mail.log` lines on Server › System log and on a message's page read the
+same clock as the rest of the page. The database keeps its times in UTC, so
+changing the zone is a restart and nothing more; the days counted before it
+stay days of the old zone, a shift of a few hours in the statistics. A name
+the image does not know leaves everything in UTC, and the box says so.
+
 ### Notifications
 
 The panel writes to its users when something needs them. Four things are
@@ -585,7 +631,9 @@ assigned to them. A message goes to the e-mail on the user's
 [Account](#account) page and only while *Send me notifications* is ticked
 there; a user without an e-mail gets none. **Server › Settings** has one switch
 that turns notifications off for everyone. With it off nothing is checked, so
-what is wrong when it is turned on again is reported then.
+what is wrong when it is turned on again is reported then. The first check runs
+three minutes after the panel starts, then every hour; the panel sends at
+most 60 notifications an hour, a ceiling nothing should come near.
 
 Notifications are the panel's own mail. They are sent from
 `postmaster@<SELFPOST_HOSTNAME>`, one message per recipient, are not rows of
@@ -641,7 +689,8 @@ What the *domain* role reaches inside what is assigned:
 | Overview, Server, the Outbound queue | yes | no (404) |
 | Outbound: domain page, applications, Domain settings, log | every domain | assigned domains |
 | Outbound › DMARC reports | every report, with the ingest statistics | reports of assigned domains, without the ingest box |
-| Inbound: domain page, upstream, recipients | every domain | assigned inbound domains |
+| Inbound: domain page, upstream, recipients, log | every domain | assigned inbound domains |
+| Inbound › Filter lists | yes | no (404) |
 | Add or delete a domain, either direction | yes | no |
 | Export a domain (Domain settings) | yes | assigned domains |
 | Import a domain (Server › Backup) | yes | no |
@@ -962,7 +1011,7 @@ A version mismatch at step 5 refuses to start and leaves `/data` untouched —
 the panel exits with a message naming the tag to use, e.g.:
 
 ```
-backup: this backup was created by SelfPost 2.10.4 but this image is 2.11.0 — restore into the matching image (selfpost:2.10.4)
+backup: this backup was created by SelfPost 2.13.1 but this image is 2.14.0 — restore into the matching image (selfpost:2.13.1)
 ```
 
 Fix the tag in `docker-compose.yml` (build that tag as under [Fixed image
@@ -1235,7 +1284,8 @@ inbound mail is being refused with a temporary error (`tempfail`) or going throu
 (`accept`).
 
 **Inbound mail is not in the Outbound log.** Port 25 runs its own milter chain:
-the optional anti-spam milter, and nothing else. The DKIM signer does not sign relayed
+the optional anti-spam milter and the panel's inbound journal (Inbound › Log,
+fail-open), not the signer, the sender check or the outbound journal. The DKIM signer does not sign relayed
 mail (and a signing outage therefore cannot hold it up), and the journal-milter
 does not file it — the [Outbound log](#outbound-log) stays a record of what
 *you* sent.
@@ -1500,9 +1550,10 @@ gateway, not its own address (see [Rate limiting — level
 1](#rate-limiting--level-1-ip-backstop)).
 
 It is **not an authentication boundary.** The SASL login itself still succeeds;
-the check runs in the journal-milter, on the same fail-open path as level 2
-(below), so if that milter does not answer the restriction is skipped rather
-than enforced. Use it to narrow where an application may send from, not to contain a
+the check runs in the journal-milter and is fail-open like level 2 (below):
+if that milter does not answer, or its lookup hits a store error, the
+restriction is skipped rather than enforced. A message whose client address
+Postfix did not pass is refused, not let through. Use it to narrow where an application may send from, not to contain a
 leaked password — for that, regenerate the password.
 
 **Level 2 — application** — optional override of the domain limit for one
@@ -1523,8 +1574,9 @@ hours and on demand via **Recalculate now**.
 
 **Level 2 is best-effort, not a guarantee.** It runs inside the
 journal-milter and is deliberately fail-open: if the rate-limit lookup hits
-a store error, or the connecting client's IP is not available to the
-milter, level 2 is skipped and the message is accepted rather than held up.
+a store error, level 2 is skipped and the message is accepted rather than
+held up. The client address plays no part: a ceiling is on a domain or an
+application, wherever its mail comes from.
 The same applies if the journal-milter itself does not answer — Postfix is
 configured to accept rather than refuse it when it cannot reach it. (Since
 `2.4.0` a panel that is down altogether makes Postfix refuse mail with a
@@ -1535,9 +1587,9 @@ the only one of the two that does not depend on the panel process.
 
 ### Outbound log
 
-**Outbound › Log** (`/outbound/log`) is a searchable send log with server-side
-filters by domain, application, status and day (from and to, UTC days, as on
-the Inbound log); the status *rejected* is the three kinds of refusal
+**Outbound › Log** (`/outbound/log`) is the send log, with server-side
+filters by domain, application, status and day (from and to, days of the container's zone, as on
+the Inbound log); the status *rejected* is the four kinds of refusal
 together, which the table tells apart by their tags. A user with the *domain*
 role sees only the rows of their domains. The filters are kept by the pages,
 the refresh and the way back from a message, and the log refreshes its rows
@@ -1554,19 +1606,20 @@ the row as a failure rather than show a delivery it cannot evidence, and
 counts that it did. A
 refused row says why in its tag: `rate-limited` (a [level-2 rate
 limit](#rate-limiting--level-2-domain-and-application)), `wrong client` (the
-application's client IP list) or `wrong From` (see [Who an application may
-send as](#who-an-application-may-send-as)); a row refused before `2.4.0`
+application's client IP list), `wrong From` or `wrong Sender` (see [Who an
+application may send as](#who-an-application-may-send-as)); a row refused before `2.4.0`
 says `rejected`. A refused message's page shows what Postfix wrote about the
-refusal: for `wrong From` the lines of the queue id the message had, for the
-other two the one `NOQUEUE` line; a row refused before `2.5.1` says the line
+refusal: for `wrong From` and `wrong Sender` the lines of the queue id the
+message had, for the other two the one `NOQUEUE` line; a row refused before `2.5.1` says the line
 was not kept, and one the panel wrote from `mail.log` after a restart - it
 had stopped before writing the refusal itself - says so;
 *Details* opens that row's own page (`/outbound/log/{id}`). That page carries
 the sending domain, the application it was submitted under, the Postfix
 queue id and the journal id, beside the message's history — when it was
 accepted and what Postfix later reported for the recipient. A `deferred`
-or `bounced` row includes this Postfix's retry intervals (first delay,
-backoff cap, queue lifetime), the same numbers the Outbound queue shows; users
+row includes this Postfix's retry intervals (first delay, backoff cap, queue
+lifetime), a `bounced` one the queue lifetime, the same numbers the Outbound
+queue shows; users
 with the *domain* role see them here because they cannot open the queue. Under
 both sit the `mail.log` lines for its queue id: the connection to the
 receiving server, the server's reply, and the status that reply was filed

docs/product.md

@@ -62,8 +62,9 @@ Explicitly excluded to prevent scope creep:
 - Organisations / tenancy beyond the `global` and `domain` roles; managing
   **multiple sending domains** under one global administrator is in scope (see
   below)
-- Inbound antispam/antivirus engines (rspamd, ClamAV, etc.) — SelfPost may
-  expose a milter hook; it does not ship or start a filter
+- Inbound antispam/antivirus engines (rspamd, ClamAV, etc.) — the image
+  ships no filter, only a milter hook; `deploy/antispam` offers an optional
+  rspamd sidecar that the panel's filter lists feed
 - A custom MTA — Postfix is used as-is
 - Dovecot or a full mail stack for SASL — Cyrus SASL (`sasldb2`) only
 

docs/roadmap.md

@@ -30,15 +30,15 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 |---|---|---|---|---|
 | inbound-upstream-result | Inbound › Log shows what the upstream answered: sent, deferred, bounced, with its last reply | shipped `2.10.0` | 7/7 | [plans/inbound-upstream-result.md](plans/inbound-upstream-result.md) |
 | health-setup-checks | Server › Health also checks the certificate's name, Postfix's greeting and the trusted proxy (was preflight) | shipped `2.11.0` | — | — |
-| test-email | Send a test message from the panel (was preflight) | agreed (2026-10-13) | — | — |
+| test-email | Send a test message from the panel (was preflight) | shipped `2.12.0` | — | — |
 | inbound-antispam-panel | Inbound antispam journal + allow/deny lists | shipped `2.1.0` | 12/12 | [plans/inbound-antispam-panel.md](plans/inbound-antispam-panel.md) |
 | origin-strict | Refuse a state-changing request that carries neither `Sec-Fetch-Site` nor `Origin` (was csrf-tokens) | shipped `2.10.4` | — | — |
 | backup-reauth | Ask for the account password before a backup or a domain export is downloaded | shipped `2.10.3` | — | — |
 | review-2026-08-followups | Remaining findings of the 2026-08-19 code review | closed 2026-10-14 (rows placed in [audit-2026-10-12](audit-2026-10-12.md)) | — | — |
 | panel-notifications | E-mail notifications about important events | shipped `2.3.0` | 10/10 | [plans/panel-notifications.md](plans/panel-notifications.md) |
 | delivery-log-storage | Keep a message's `mail.log` lines with its send-log row | shipped `2.2.0` | 8/8 | [plans/delivery-log-storage.md](plans/delivery-log-storage.md) |
-| password-reset | Password reset by e-mail | agreed (2026-10-13) | — | — |
-| local-time | The panel shows time, and counts its days, in a time zone other than UTC | agreed (2026-10-13; design questions open) | — | — |
+| password-reset | Password reset by e-mail | shipped `2.14.0` | — | — |
+| local-time | The panel shows time, and counts its days, in a time zone other than UTC | shipped `2.13.0` | — | — |
 | notification-mail-recheck | The Notification mail records on Server › Settings can be checked again from where they are shown | shipped `2.9.0` | — | — |
 | settings-save-row | Server › Settings: the Save button no longer stands alone under a long right column | shipped `2.9.0` | — | — |
 | dns-record-collapse | A DNS record that is right is shown folded: its name and its tag, the values on request | shipped `2.9.0` | — | — |
@@ -211,6 +211,13 @@ the mockup; mockup-first.
 rate-limited and refuses a recipient list, and it passes a security review -
 a form that sends mail is a new surface.
 
+**Done (2026-10-17):** from `postmaster@` the hostname (the owner,
+2026-10-16: "Да, адрес годится"), card 09 on Health in the static stack
+(mockups `e92769f`, `e3b2501`, `8f0ccf9`). The row is written before the
+hand-over and learns its queue id from cleanup's Message-ID line
+(`logtail.AwaitMessageID`); the browser lands on it. One address
+(`validate.AccountEmail`), ten an hour from the send log, global role.
+
 **Version:** `2.x` MINOR; `agreed`.
 
 ---
@@ -452,6 +459,22 @@ to come need it - they are not the owner and should not have to ask him for
 a new password). Mockup-first; changing the account e-mail asks for the
 current password in the same cut.
 
+**Notifications to an unconfirmed address (owner, 2026-10-17):** "Без
+подтверждения слать" - they go to it confirmed or not; only a reset link
+needs it confirmed. Every address saved before the release is unconfirmed,
+and cutting them off would have stopped every warning at once.
+
+**Done (2026-10-17):** design 2f5f5b2, route guard b7bbb2c, panel guard
+0774da2. Migration 0013 (`users.email_confirmed_at`, `user_links`). Links
+are 256 bits, kept as SHA-256, confirmation 24 h and reset 30 min, taken
+once (`DELETE … RETURNING`), built on `SELFPOST_HOSTNAME` (never `Host`);
+the request answers the same for every name and mails after answering;
+limits per client address and per account; a link's GET page has a button
+(mail scanners open links). A reset ends every session. Changing the
+e-mail on Account asks for the password. The global role's user form sends
+a typed address its link. e2e `password_reset_by_e_mail` runs it through
+the sink.
+
 ---
 
 ## local-time
@@ -518,6 +541,26 @@ the database's stored instants and the e2e stay as they are.
 
 **Version:** `2.x` MINOR; `agreed`; the plan is written when it is taken up.
 
+**Where the zone comes from, changed (owner, 2026-10-17):** not a setting
+in the panel but the container's own zone, `TZ` in `.env`; Settings only
+shows it ("Да" to "пояс в `.env`, на Settings только показ?"). His reason
+was the trap above: a container cannot change its zone without a restart,
+and only the container's zone moves Postfix's stamps with the rest. So the
+trap is closed by the third way - the container runs in the zone, Postfix
+stamps `mail.log` in it (`TZ` is in Postfix's `import_environment`), and the
+tailer reads the stamps in the same zone, as it always did (`lineTime`,
+`time.Local`).
+
+**Done (2026-10-17):** design c205106 (no "UTC" on any screen, Settings box
+05 *Time zone*, read-only, the help topic). The panel formats every time in
+`time.Local`; the day tables key their rows by the local date, the sender
+check cuts downtime at local midnights, the log filters' days run from local
+midnight; stored instants stay UTC. Notification mail and the test message
+write the zone's abbreviation after a time (they are read away from the
+panel). The year question settled as the mockups have it. `tzdata` is named
+in the image. Tests run in UTC (a `TestMain` in each package that formats
+or counts days) and in Moscow where the zone is the point.
+
 ---
 
 ## phone-desktop-mode

docs/schema-migrations.md

@@ -17,7 +17,7 @@ When you add or review a migration, update this file in the same change.
 
 | Field | Value |
 |---|---|
-| Chain head | `user_version = 12` |
+| Chain head | `user_version = 13` |
 | Files | `0001_init.sql` (the 2.0 baseline), `0002_inbound_spam_log.sql`, `0003_send_log_lines.sql`, `0004_notifications.sql`, `0005_send_log_rejected_index.sql`, `0006_sender_check.sql`, `0007_delivery_log_days.sql`, `0008_tenant_boundary.sql`, `0009_refusal_line.sql`, `0010_send_log_indexes.sql`, `0011_notify_addressees.sql`, `0012_inbound_upstream.sql` |
 | File mark | `PRAGMA application_id = 0x53503230` ("SP20") |
 | Database file | `/data/selfpost.db` (bind mount) |
@@ -86,10 +86,11 @@ audit (`2.5.0`), `0009_refusal_line.sql` (`2.5.1`) and
 | 6 | `0006_sender_check.sql` | 2.4.0 | DDL | `send_log.reason` and `send_log.header_from` (both default `''`: a row refused earlier keeps no reason), and `sender_check_days` |
 | 7 | `0007_delivery_log_days.sql` | 2.5.0 | DDL | `delivery_log_days`: what the reconcile sweep and the log tailer did, a row per UTC day, kept a year, shown nowhere - the measurement that decides the sweep's fate (audit 2026-10-12, stage 1). `send_log.reason` gains the values `reconcile` and `reconcile-contradicted` without a schema change |
 | 8 | `0008_tenant_boundary.sql` | 2.5.0 | DDL + data | `idx_applications_login_nocase`: an application login is unique without regard to case (audit 2026-10-12, H4). `send_log.domain_id` and `inbound_spam_log.inbound_domain_id` (`ON DELETE SET NULL`), each with an index, filled once by name from the registry as it was then: a row belongs to a domain by id, and a domain deleted and added again starts with an empty log (L12) |
-| 9 | `0009_refusal_line.sql` | 2.5.1 | DDL | `send_log.refusal_line`: Postfix's line about a refusal at MAIL FROM (a level-2 limit, a client address off the list), which has no queue id; the log tailer puts it on the row; `send_log.recovered`, a refusal row the tailer wrote from `mail.log` because the panel stopped before writing it; `sender_check_days.messages` (messages deferred mid-message, counted apart from the connections turned away) and `sender_check_days.estimated` (a day whose downtime is an upper bound) (audit 2026-10-12, stage 2b) |
+| 9 | `0009_refusal_line.sql` | 2.5.1 | DDL | `send_log.refusal_line`: Postfix's line about a refusal at MAIL FROM (a level-2 limit, a client address off the list), which has no queue id; the log tailer puts it on the row, found by `send_log.client_ip`, the client the refusal came from; `send_log.recovered`, a refusal row the tailer wrote from `mail.log` because the panel stopped before writing it; `sender_check_days.messages` (messages deferred mid-message, counted apart from the connections turned away) and `sender_check_days.estimated` (a day whose downtime is an upper bound) (audit 2026-10-12, stage 2b) |
 | 10 | `0010_send_log_indexes.sql` | 2.5.3 | DDL | Four indexes of `send_log`, each for a question that walked the table or sorted a domain's log (audit 2026-10-12, M2, stage 3): `idx_send_log_open`, partial, the queued and deferred rows by time (the tailer's sweep every 5 min); `idx_send_log_domain_id` and `idx_send_log_app_login`, a page of one domain's or one application's log in id order; `idx_send_log_refusal_line`, partial, whether a refusal line is already on a row. `TestSendLogQueriesUseTheirIndexes` checks the plans of these and of the other by-time and by-scope statements the store runs |
 | 11 | `0011_notify_addressees.sql` | 2.5.4 | DDL | `notify_addressees (key, address, told_at)`: who a subject's notification is owed to and who was handed it, so a copy that failed or was held back by the hourly ceiling goes out at a later check and a subject's end goes to those told (audit 2026-10-12, stage 4); deleted with its `notify_state` row |
 | 12 | `0012_inbound_upstream.sql` | 2.10.0 | DDL | `inbound_spam_log` gains `queue_id`, `upstream_status` (`''`, `queued`, `held`, `sent`, `deferred`, `bounced`; CHECK), `upstream_relay`, `upstream_reply` and `upstream_at`, and the partial index `idx_inbound_spam_log_queue_id` on rows that have a queue id: what the upstream answered about mail accepted on port 25, put on the row by the log tailer (inbound-upstream-result). Rows from before have none |
+| 13 | `0013_email_links.sql` | 2.14.0 | DDL | `users.email_confirmed_at` (`''` for every address saved before it: all unconfirmed) and `user_links`, the one-time links that confirm an address and reset a password, with `idx_user_links_user` (password-reset; owner, 2026-10-13 and 2026-10-17) |
 
 **Kind:** *DDL* — schema only; *data* — `INSERT`/`UPDATE` that must stay correct
 for operators upgrading from older 2.x images.
@@ -101,14 +102,15 @@ for operators upgrading from older 2.x images.
 | Table | Role |
 |-------|------|
 | `settings` | Key/value settings of the instance — what is true whoever is signed in (send-log retention). Nothing that belongs to a user |
-| `users` | Panel logins. `role` is `global` or `domain`; `email` is the user's own address; `notify` is the user's own switch for notification e-mails (v4); `all_domains` / `all_inbound_domains` widen a `domain` user to every domain of that direction |
+| `users` | Panel logins. `role` is `global` or `domain`; `email` is the user's own address; `notify` is the user's own switch for notification e-mails (v4); `all_domains` / `all_inbound_domains` widen a `domain` user to every domain of that direction; `email_confirmed_at` is when `email` was confirmed, `''` while it is not, cleared when it changes (v13) |
+| `user_links` | The one-time links of password-reset (v13): the SHA-256 of the token, the user, `purpose` (`confirm`, `reset`; CHECK), the address it was sent to, when, and until when; one live link per user and purpose |
 | `sessions` | Panel login sessions (token hash, owning user by id and deleted with them, sliding idle expiry) |
 | `domains` | Sending (outbound) domains. `dmarc_rua` is where aggregate reports go (`''` = no reports) |
 | `user_domains` | Outbound domains assigned to a `domain` user |
 | `applications` | SASL applications per domain, with the client-IP restriction (`auth_ip_restrict`, `auth_allowed_ips`) |
 | `application_addresses` | Explicit From addresses (`list` mode) |
 | `rate_limits` | Level-2 limits per domain / application, manual or auto |
-| `send_log` | Delivery journal. `reason` says why a row was refused (`limit`, `client`, `from`) or that the sweep closed it (`reconcile`, `reconcile-contradicted`), `header_from` what the From: line of a message refused for it said (v6), `refusal_line`, `client_ip` and `recovered` (v9), and `domain_id` (v8: the row belongs to a domain by id, `ON DELETE SET NULL`) |
+| `send_log` | Delivery journal. `reason` says why a row was refused (`limit`, `client`, `from`, and `sender` since 2.8.0) or that the sweep closed it (`reconcile`, `reconcile-contradicted`), `header_from` what the From: or Sender: line of a message refused for it said (v6), `refusal_line`, `client_ip` and `recovered` (v9), and `domain_id` (v8: the row belongs to a domain by id, `ON DELETE SET NULL`) |
 | `logtail_state` | Log-tailer read position |
 | `inbound_domains` | Inbound relay domains |
 | `inbound_transports` | Upstream host / port / TLS per inbound domain |
@@ -116,11 +118,11 @@ for operators upgrading from older 2.x images.
 | `user_inbound_domains` | Inbound domains assigned to a `domain` user — granted separately from the outbound ones |
 | `dmarc_reports` | Parsed aggregate report summaries |
 | `dmarc_report_records` | Per-source rows inside a report |
-| `inbound_spam_log` | Inbound antispam journal: one row per recipient of a message offered on port 25, with the decision (`accept`, `reject`, `tempfail`, `quarantine`) and who made it (`rspamd`, `postfix`, `selfpost`). Metadata only. `inbound_domain_id` (v8) ties a row to its domain by id (v2) |
+| `inbound_spam_log` | Inbound antispam journal: one row per recipient of a message offered on port 25, with the decision (`accept`, `reject`, `tempfail`, `quarantine`) and who made it (`rspamd`, `postfix`, `selfpost`). Metadata only (v2). `inbound_domain_id` (v8) ties a row to its domain by id; `queue_id` and `upstream_status`, `upstream_relay`, `upstream_reply`, `upstream_at` (v12) are what the upstream answered for an accepted message |
 | `inbound_spam_list` | Allow / deny entries for the external filter (`address`, `domain`, `ip`), instance-wide; unique per list (v2) |
 | `notify_state` | What the panel has already written to its users about, one row per subject (`dns:<domain>`, `cert`, `queue`, `limit:<domain>`), so that each thing is said once and a restart says nothing again (v4) |
-| `sender_check_days` | What the sender check costs, a row per UTC day that has something to say: seconds the panel did not answer while Postfix ran, connections turned away (`deferred`), messages deferred mid-message (`messages`), and whether the day's downtime is an upper bound (`estimated`). Kept a year (v6, v9) |
-| `delivery_log_days` | What the reconcile sweep and the log tailer did, a row per UTC day, kept a year. Read off a copy of the database; no page shows it (v7) |
+| `sender_check_days` | What the sender check costs, a row per day of the container's zone (`TZ`) that has something to say: seconds the panel did not answer while Postfix ran, connections turned away (`deferred`), messages deferred mid-message (`messages`), and whether the day's downtime is an upper bound (`estimated`). Kept a year (v6, v9) |
+| `delivery_log_days` | What the reconcile sweep and the log tailer did, a row per day of the container's zone, kept a year. Read off a copy of the database; no page shows it (v7) |
 | `notify_addressees` | Who a subject's notification is owed to and whether each was handed it; goes with the subject's `notify_state` row (v11) |
 | `send_log_lines` | The `mail.log` lines Postfix wrote under a queue id, with the line's own time; what a message's page shows once the log has rotated. No reference to `send_log`: a line belongs to a row by queue id and time, and goes when no row carries its id (v3) |
 

docs/security.md

@@ -138,7 +138,8 @@ The panel is exposed to the internet — the items below are **not optional**.
   after it was found, so the cookie of a deleted user is dead and cannot become
   the session of whoever is created under the same name later; renaming a user
   leaves their sessions alone.
-- **What ends a user's sessions:** deleting the user (all); a password change on
+- **What ends a user's sessions:** deleting the user (all); a password set
+  from a reset link (all, `2.14.0`); a password change on
   Account (that user's *other* sessions — never another user's); a password set
   for them by a global user on the user form (all of theirs, except the current
   one when they set their own); signing out (the current one only); signing
@@ -148,6 +149,36 @@ The panel is exposed to the internet — the items below are **not optional**.
   held.
 - Polling by the monitoring screens (`HX-Request` `GET`s) does not renew a
   session.
+- **Password reset by e-mail (`2.14.0`).** A link goes only to an address
+  its account has confirmed, by a link sent to that address; notifications
+  go to an unconfirmed one (owner, 2026-10-17) - they carry no secret. A link
+  is 256 random bits (`crypto/rand`); `user_links` keeps its SHA-256 only,
+  so the database or a backup opens nothing. A confirmation link lives 24
+  hours, a reset link 30 minutes; each is taken once, in the transaction
+  that deletes it (`DELETE … RETURNING`), and a newer link of the same kind
+  replaces the older. A reset link holds only while the account's address is
+  still the confirmed one it was sent to; a confirmation link only while the
+  address is the one it confirms. The link's host is `SELFPOST_HOSTNAME`,
+  never the request's `Host`, which an attacker would choose to receive the
+  token. The request form answers the same for every name and sends the mail
+  after answering, so neither the words nor the time tell whether a name
+  exists or is confirmed; requests are limited to five in 15 minutes per
+  client address, mails to five an hour per account, and a link's page to 30
+  requests in 15 minutes per client address. A link's page changes nothing
+  on `GET` (a mail scanner opens links): the button does. Setting a password
+  from a link ends every session of the account and every other reset link.
+  Changing the account e-mail asks for the current password, as the password
+  does: the address is where a reset link goes. From the security review
+  (2026-10-17): confirming an address also takes being signed in as its
+  account, and the confirmation mail does not name the account - a mistyped
+  address is a stranger's, who could otherwise confirm it and reset the
+  password; a reset request does not replace the links already sent, and
+  none is sent within ten minutes of the last, so a stranger repeating a
+  username neither kills the link in the mailbox nor spends the account's
+  links; the link is taken and the password set in one transaction that
+  checks the address again; a restore deletes every link; a rejected
+  request's log line hides a link's token; a stop waits for the links still
+  being mailed.
 
 ### Roles
 
@@ -229,8 +260,8 @@ operator can act on it.
   `selfpost` for files and does not reach it (`2.6.0`; OpenDKIM shared
   `selfpost` too until `2.8.0`).
 - **Group `selfpost` (gid 10998) has two members, `panel` and `postfix`.**
-  Through it Postfix reads what the panel writes - `sasldb2` and the maps
-  under `/data/postfix` (2750, files 0640) - and connects to the panel's
+  Through it Postfix reads what the panel writes - `sasldb2` under
+  `/data/sasl` and the maps under `/data/postfix` (both 2750, files 0640) - and connects to the panel's
   milter sockets in `/run/selfpost` (2750, sockets 0660); the panel reads
   `mail.log`, which `postfix` writes, through it the other way
   ([build/Dockerfile](../build/Dockerfile), `build/entrypoint.sh`). The DKIM
@@ -286,14 +317,12 @@ operator can act on it.
   signer reads them and never the database. The entrypoint sets these modes
   at every start (e2e `checkDKIMTree` holds the tree to them). Until `2.8.0`
   the keys were under `/data/opendkim`, 2750/0640 in group `selfpost` so
-  that OpenDKIM could read them - and so could every `postfix` process. That
-  tree is kept for a rollback to 2.7.x until the next release; since `2.8.0`
-  the entrypoint makes it the panel's alone as well (0700/0600, panel:panel)
-  at every start, copies its keys as the panel user (`setpriv`) while
-  `/data/dkim` holds none, and a backup leaves it out (§ Backup and domain
-  export). A root step of the entrypoint follows no symbolic link the panel
-  could plant in either tree (`drop_links`; `cp -RP`; `chown -R` and `find`
-  do not follow one).
+  that OpenDKIM could read them - and so could every `postfix` process.
+  2.8.x kept that tree, the panel's alone, for a rollback to 2.7.x and copied
+  its keys over; since `2.9.0` the entrypoint removes it at start, and refuses
+  to start when the keys are only there (start 2.8.x once first). A root step
+  of the entrypoint follows no symbolic link the panel could plant in the
+  tree (`drop_links`; `rm -rf`, `chown -R` and `find` do not follow one).
 - **An application signs only as itself (`2.4.0`).** The signature's `d=` is
   the login's domain, and a receiver holds it to the domain of the `From:`
   line (DMARC, RFC 7489 § 3.1.1): without a check of that line an
@@ -498,7 +527,8 @@ operator can act on it.
   CLI the password comes only from `SELFPOST_BACKUP_PASSWORD` or
   `-password-file`, never as an argument (the process list is readable by any
   process in the container).
-- Minimum password length matches the administrator password (12): the file
+- Minimum password length matches the administrator password (12
+  characters, counted as characters, not bytes, in both): the file
   sits offline and can be attacked without a time limit. The panel's forms and,
   since `2.5.3`, the CLI hold an encrypting password to it; decrypting takes
   any.
@@ -550,8 +580,9 @@ deferred item from the roadmap.
   keep a password would lose the ability to take a backup at all, and a
   permanently undecryptable archive is worse than an unencrypted one:
   SelfPost does not store the password. The trigger to make encryption
-  mandatory is a second administrator (at which point "who downloaded it"
-  stops being one person).
+  mandatory is a second person who takes backups or exports - a second
+  global user, or a domain user exporting their domain - at which point "who
+  downloaded it" stops being one person.
 - **A journal row left without delivery lines is closed as `bounced` rather
   than left as it is.** The "forever `queued`" risk is gone: `mail.log` moved to
   `/data/log/` and survives container recreation, and the log tailer keeps its
@@ -686,6 +717,22 @@ deferred item from the roadmap.
   a dozen times a day at most by someone who flaps the zone; a domain's
   limits once a day; and no more than 60 messages leave in any hour whatever
   the rules arrive at.
+- **The test message is a form that sends mail** (test-email, `2.12.0`):
+  Server › Health sends one message to an address a global user types. It is
+  bounded as notifications are - the same `sendmail(1)` call, a fixed argument
+  list, the address after `--` - and further: the global role only; one
+  address, held by `validate.AccountEmail` (no list, no separator, nothing
+  that reads as an option, any public host); a fixed subject and body the
+  panel composes; ten an hour, counted from the send log whoever asks; the
+  origin check of every form. It is written to the Outbound log before it
+  goes, so each one is on record with its recipient and who asked is in the
+  panel's log. It cannot be made to say anything but the panel's own text,
+  and the sender is always `postmaster@` the hostname. Its row learns its
+  queue id from the head of cleanup's `message-id=` line; cleanup logs a
+  client's own Message-ID the same way, but the panel's is 96 random bits,
+  known to nobody before the line is read, taken once and not after ten
+  minutes - a message of someone else's cannot take the row (security
+  review, 2026-10-17).
 - **Whatever is submitted with sendmail(1) is signed as the server.** The
   signer's local socket, the whole of `non_smtpd_milters`, signs every
   message submitted locally with the key of the server's own name, whatever

internal/dmarc/parse.go

@@ -255,7 +255,7 @@ func TightenPolicyHint(pass, fail int, sources []SourceHint) string {
 	if fail > 0 {
 		for _, s := range sources {
 			if s.FailCount > 0 && !s.ThisRelay {
-				return "A third-party source is not aligned. Do not tighten p= until that sender is fixed or removed."
+				return "Failures come from a source that is not this relay — review before tightening p=."
 			}
 		}
 	}

internal/dnscheck/dnscheck.go

@@ -264,6 +264,19 @@ func (c *Checker) InboundMX(name, hostname string, force bool) Result {
 	return result
 }
 
+// InboundMXCheckedAt is when the MX of name was last looked up for
+// hostname, zero when it has not been: the cache is filled when it is, and
+// keeps the result domainTTL.
+func (c *Checker) InboundMXCheckedAt(name, hostname string) time.Time {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	entry, ok := c.inbound[name+"\x00"+hostname]
+	if !ok {
+		return time.Time{}
+	}
+	return entry.expires.Add(-c.domainTTL)
+}
+
 func (c *Checker) checkInboundMX(ctx context.Context, name, hostname string) Result {
 	mxs, err := c.resolver.LookupMX(ctx, name)
 	if err != nil {

internal/health/cert.go

@@ -151,8 +151,8 @@ func CheckServedCertificate(served, mounted string, interval time.Duration, now
 	switch {
 	case r.Late:
 		c.Status = Worst(c.Status, StatusWarn)
-		c.Detail = fmt.Sprintf("A renewed certificate has been in the mounted file since %s UTC, longer than Postfix's check for a renewal allows, and Postfix still serves the one above. cert-reload's lines in the container log say why.",
-			r.Mounted.UTC().Format("2006-01-02 15:04"))
+		c.Detail = fmt.Sprintf("A renewed certificate has been in the mounted file since %s, longer than Postfix's check for a renewal allows, and Postfix still serves the one above. cert-reload's lines in the container log say why.",
+			r.Mounted.Local().Format("2006-01-02 15:04"))
 	case c.Status == StatusError:
 		c.Detail += " A renewed one is waiting in the mounted file; Postfix takes it up at its next check for a renewal, at most " + intervalText(interval) + " after it was mounted."
 	default:

internal/logtail/awaited.go

@@ -0,0 +1,88 @@
+package logtail
+
+import (
+	"regexp"
+	"sync"
+	"time"
+)
+
+// The panel's own test message (Server › Health, test-email) is handed to
+// Postfix through sendmail, which says nothing of the queue id it gets; the
+// journal-milter does not see local mail (non_smtpd_milters is the signer
+// alone). Its row is written first, with no queue id, and its Message-ID is
+// awaited here: cleanup logs each message's Message-ID with its queue id,
+//
+//	postfix/cleanup[52]: 4j5qN53nwRz791P4: message-id=<9f3c....1760600000@mail.example.org>
+//
+// (Postfix 3.10.13, src/cleanup/cleanup_message.c:639, msg_info("%s:
+// message-id=%s")), and the tailer puts that queue id on the row. From then on
+// the row is any row: the delivery lines of its queue id give it its status.
+// The awaited ids live in memory: a restart between the send and cleanup's
+// line, a matter of a second, leaves the row without a queue id, and the
+// reconcile sweep closes it once awaitedTTL has passed
+// (StatusStore.CloseUnmatchedTestMessages).
+
+// messageIDRe matches cleanup's Message-ID line from the head, after the time
+// stamp: the id is the client's text, so only a whole line of this shape counts.
+var messageIDRe = regexp.MustCompile(`^\S+ \S*/cleanup\[\d+\]: ([0-9A-Za-z]+): message-id=(<[^<>\s]+>)\s*$`)
+
+// awaitedTTL is how long an awaited Message-ID is kept: far longer than
+// sendmail's hand-over takes, and short enough that a lost one goes.
+const awaitedTTL = 10 * time.Minute
+
+type awaitedIDs struct {
+	mu  sync.Mutex
+	ids map[string]awaitedRow
+}
+
+type awaitedRow struct {
+	row   int64
+	since time.Time
+}
+
+var awaited = &awaitedIDs{ids: make(map[string]awaitedRow)}
+
+// AwaitMessageID registers the send-log row of a message about to be handed
+// to Postfix under its Message-ID ("<...>"), for the tailer to give it its
+// queue id. Call it before the message is sent.
+func AwaitMessageID(id string, row int64) {
+	awaited.mu.Lock()
+	defer awaited.mu.Unlock()
+	now := time.Now()
+	for k, v := range awaited.ids {
+		if now.Sub(v.since) > awaitedTTL {
+			delete(awaited.ids, k)
+		}
+	}
+	awaited.ids[id] = awaitedRow{row: row, since: now}
+}
+
+// ForgetMessageID drops an awaited id: the message was not handed over.
+func ForgetMessageID(id string) {
+	awaited.mu.Lock()
+	defer awaited.mu.Unlock()
+	delete(awaited.ids, id)
+}
+
+// takeAwaited returns the row awaiting a Message-ID line's id, if any, and
+// stops awaiting it.
+func takeAwaited(rest string) (queueID string, row int64, ok bool) {
+	m := messageIDRe.FindStringSubmatch(rest)
+	if m == nil {
+		return "", 0, false
+	}
+	awaited.mu.Lock()
+	defer awaited.mu.Unlock()
+	a, ok := awaited.ids[m[2]]
+	if !ok {
+		return "", 0, false
+	}
+	delete(awaited.ids, m[2])
+	// An id awaited too long belongs to a row the sweep has closed by now;
+	// whoever received the message knows the id, and a line of his with it
+	// must not reach that row.
+	if time.Since(a.since) > awaitedTTL {
+		return "", 0, false
+	}
+	return m[1], a.row, true
+}

internal/logtail/awaited_test.go

@@ -0,0 +1,62 @@
+package logtail
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+// The test message's row learns its queue id from cleanup's Message-ID line
+// - once, for the id awaited, and from no other program's line or shape.
+func TestAwaitedMessageID(t *testing.T) {
+	id := "<9f3c01.1760600000@mail.example.org>"
+	AwaitMessageID(id, 42)
+	for _, line := range []string{
+		"selfpost postfix/smtpd[52]: 4j5qN53nwRz791P4: message-id=" + id,
+		"selfpost postfix/cleanup[52]: 4j5qN53nwRz791P4: message-id=" + id + " trailing",
+		"selfpost postfix/cleanup[52]: 4j5qN53nwRz791P4: message-id=<other@mail.example.org>",
+	} {
+		if q, row, ok := takeAwaited(line); ok {
+			t.Fatalf("%q took row %d with %s", line, row, q)
+		}
+	}
+	q, row, ok := takeAwaited("selfpost postfix/cleanup[52]: 4j5qN53nwRz791P4: message-id=" + id)
+	if !ok || q != "4j5qN53nwRz791P4" || row != 42 {
+		t.Fatalf("cleanup's line = %q, %d, %v", q, row, ok)
+	}
+	if _, _, ok := takeAwaited("selfpost postfix/cleanup[52]: 4j5qN53nwRz791P4: message-id=" + id); ok {
+		t.Fatal("the same id was taken twice")
+	}
+	AwaitMessageID(id, 43)
+	ForgetMessageID(id)
+	if _, _, ok := takeAwaited("selfpost postfix/cleanup[52]: X: message-id=" + id); ok {
+		t.Fatal("a forgotten id was taken")
+	}
+}
+
+// Run puts the queue id on the row as the line is read.
+func TestRunGivesTheTestMessageItsQueueID(t *testing.T) {
+	old := pollInterval
+	pollInterval = 10 * time.Millisecond
+	t.Cleanup(func() { pollInterval = old })
+	path := filepath.Join(t.TempDir(), "mail.log")
+	if err := os.WriteFile(path, nil, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cs := &captureStore{}
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() { done <- Run(ctx, path, cs, func() int { return 90 }, nil, nil) }()
+	time.Sleep(50 * time.Millisecond)
+	AwaitMessageID("<t1@mail.example.org>", 7)
+	appendLine(t, path, "Oct 17 09:00:00 host postfix/cleanup[3]: Q7long: message-id=<t1@mail.example.org>")
+	waitFor(t, func() bool { return contains(cs.snapshot(), "7|Q7long|queue-id") })
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Run did not return after cancel")
+	}
+}

internal/logtail/logtail.go

@@ -30,6 +30,11 @@ import (
 // far into mail.log it has read. *store.Store satisfies it.
 type StatusStore interface {
 	UpdateStatus(queueID, recipient, status string) (int64, error)
+	// SetSendLogQueueID gives the panel's test message its queue id
+	// (awaited.go); CloseUnmatchedTestMessages closes the test messages
+	// that never got one.
+	SetSendLogQueueID(id int64, queueID string) error
+	CloseUnmatchedTestMessages(before time.Time) (int64, error)
 	ExpireMessage(queueID string) (int64, error)
 	ListOpenOlderThan(cutoff time.Time) ([]store.QueuedDelivery, error)
 	CloseUnreported(id int64) (int64, error)
@@ -256,6 +261,14 @@ func Run(ctx context.Context, path string, st StatusStore, retention RetentionDa
 		}
 		keeper.add(line, now, catchingUp)
 		refusals.handle(line, now, Place{FP: tr.line.FP, End: tr.lineStart})
+		// The panel's test message learns its queue id from cleanup's line.
+		if _, rest := SplitTimestamp(line); rest != "" {
+			if qid, row, ok := takeAwaited(rest); ok {
+				if err := st.SetSendLogQueueID(row, qid); err != nil {
+					log.Printf("log-tailer: test message %d -> %s: %v", row, qid, err)
+				}
+			}
+		}
 		// A delivery or expiry line no send-log row takes may be of mail
 		// accepted on port 25: the inbound journal's rows take its result.
 		queueID, recipient, status, ok := parseDelivery(line)
@@ -313,6 +326,9 @@ func reconcileLoop(ctx context.Context, st StatusStore, caughtUp <-chan struct{}
 			now := time.Now().UTC()
 			reconcile(st, now.Add(-reconcileGrace), path)
 			countStuck(st, now, overLifetime)
+			if _, err := st.CloseUnmatchedTestMessages(now.Add(-awaitedTTL)); err != nil {
+				log.Printf("log-tailer: close test messages with no queue id: %v", err)
+			}
 		}
 	}
 }

internal/logtail/logtail_test.go

@@ -345,6 +345,16 @@ func (c *captureStore) UpdateStatus(queueID, recipient, status string) (int64, e
 	return 1, nil
 }
 
+func (c *captureStore) CloseUnmatchedTestMessages(time.Time) (int64, error) { return 0, nil }
+
+// SetSendLogQueueID records a test message's queue id as "row|queue-id|queue-id".
+func (c *captureStore) SetSendLogQueueID(id int64, queueID string) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.calls = append(c.calls, strconv.FormatInt(id, 10)+"|"+queueID+"|queue-id")
+	return nil
+}
+
 // ExpireMessage records an expiry line's close as "queue-id|*|expired".
 func (c *captureStore) ExpireMessage(queueID string) (int64, error) {
 	c.mu.Lock()

internal/logtail/retention_test.go

@@ -19,6 +19,10 @@ func (s *retentionProbeStore) UpdateStatus(string, string, string) (int64, error
 	return 0, nil
 }
 
+func (s *retentionProbeStore) SetSendLogQueueID(int64, string) error { return nil }
+
+func (s *retentionProbeStore) CloseUnmatchedTestMessages(time.Time) (int64, error) { return 0, nil }
+
 func (s *retentionProbeStore) ListOpenOlderThan(time.Time) ([]store.QueuedDelivery, error) {
 	return nil, nil
 }

internal/notify/mailer.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"crypto/rand"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"mime"
 	"os/exec"
@@ -38,6 +39,21 @@ func From(hostname string) string { return "postmaster@" + hostname }
 
 // Send submits one message to one recipient.
 func (m *Mailer) Send(to, subject, body string) error {
+	id, err := NewMessageID(m.hostname)
+	if err != nil {
+		return err
+	}
+	return m.SendWithID(to, subject, body, id)
+}
+
+// NewMessageID makes a Message-ID of the server's own name, for a message the
+// caller wants to know again in mail.log (the panel's test message).
+func NewMessageID(hostname string) (string, error) { return messageID(hostname) }
+
+// SendWithID is Send with the Message-ID given: cleanup logs it with the
+// message's queue id, which is how the panel finds its test message in
+// mail.log (logtail.AwaitMessageID).
+func (m *Mailer) SendWithID(to, subject, body, id string) error {
 	// The address is a panel user's, validated when it was saved. It goes into
 	// a header and onto a command line all the same, so what cannot be part of
 	// an address is refused here as well (security.md).
@@ -47,10 +63,6 @@ func (m *Mailer) Send(to, subject, body string) error {
 		return fmt.Errorf("not an address a notification can go to: %q", to)
 	}
 	from := From(m.hostname)
-	id, err := messageID(m.hostname)
-	if err != nil {
-		return err
-	}
 
 	var b bytes.Buffer
 	fmt.Fprintf(&b, "From: SelfPost <%s>\r\n", from)
@@ -81,6 +93,10 @@ func messageID(hostname string) (string, error) {
 	return fmt.Sprintf("<%s.%d@%s>", hex.EncodeToString(raw[:]), time.Now().Unix(), hostname), nil
 }
 
+// ErrTimeout is sendmail not answering in time: postdrop may have queued the
+// message all the same.
+var ErrTimeout = errors.New("sendmail timed out")
+
 // sendmail submits msg through Postfix's sendmail command. The argument list is
 // fixed apart from the two addresses, which follow "--" so that neither can be
 // read as an option; nothing goes through a shell (security.md). -i keeps a
@@ -95,7 +111,7 @@ func sendmail(from, to string, msg []byte) error {
 	cmd.WaitDelay = 5 * time.Second
 	out, err := cmd.CombinedOutput()
 	if ctx.Err() == context.DeadlineExceeded {
-		return fmt.Errorf("sendmail timed out after %s", sendmailTimeout)
+		return fmt.Errorf("%w after %s", ErrTimeout, sendmailTimeout)
 	}
 	if err != nil {
 		return fmt.Errorf("sendmail: %w: %s", err, strings.TrimSpace(string(out)))