panel-redesign: no report mailbox for the server as a whole

Follows the design commit before it.

  - internal/dmarc: the ingest allow-list is the report address of each
    domain that is on this host and nothing else;
    DefaultHostedReportAddress and DefaultHostedSuggestion are removed.
    Since 1.7.0 the general mailbox dmarc-reports@<hostname> was open
    while no panel-wide default existed; the three-choice scheme had
    left it open always.
  - The DMARC hub's Ingest box shows the form of a hosted address,
    dmarc-reports+<domain>@<hostname>.
  - guide.md: what port 25 accepts.

Evidence: docs/assets/panel-redesign/evidence/dmarc.png re-shot (the
address form wraps after the plus sign in its column at 1440 px).

  go test -count=1 ./internal/dmarc/... ./internal/web/... ./cmd/panel: ok

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/scripts/design-first.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# GUARD FILE — docs/plans/panel-redesign.md § Enforcement, "design-first".
+#
+# Checks every commit of a push or pull request, one by one:
+#
+#   1. Design first. A commit that touches the accepted design — the mockups
+#      under docs/assets/panel-redesign/panel/, the guard tests, this script —
+#      touches nothing else under internal/web/. The guards are not adjusted
+#      in the commit they are supposed to judge.
+#   2. The ratchet. internal/web/view/legacy_pages.txt only shrinks: a commit's
+#      list is a subset of its parent's. A page that was restyled stays held
+#      to its mockup; its name cannot be put back.
+#   3. No blob from the past. A template a commit adds or changes is not,
+#      whitespace aside, a template that already existed anywhere in the
+#      history before it. Taking an old page out of git is not a redesign.
+#
+# Usage: design-first.sh <base> <head>     (commits base..head are checked)
+# Needs the full history: actions/checkout with fetch-depth: 0.
+set -euo pipefail
+
+base="${1:?usage: design-first.sh <base> <head>}"
+head="${2:?usage: design-first.sh <base> <head>}"
+
+RATCHET=internal/web/view/legacy_pages.txt
+TEMPLATES=internal/web/view/templates/
+ZERO=0000000000000000000000000000000000000000
+
+# A new branch, or a force push whose old tip is gone, has no usable base:
+# check the tip commit alone rather than nothing.
+if [ "$base" = "$ZERO" ] || ! git cat-file -e "$base^{commit}" 2>/dev/null; then
+  base="$(git rev-parse "$head^" 2>/dev/null || true)"
+fi
+
+if [ -n "$base" ]; then
+  commits="$(git rev-list --reverse --no-merges "$base..$head")"
+else
+  commits="$(git rev-list --reverse --no-merges "$head")"
+fi
+
+is_guard() {
+  case "$1" in
+    docs/assets/panel-redesign/panel/*) return 0 ;;
+    .github/scripts/design-first.sh) return 0 ;;
+    internal/web/guard_*_test.go | internal/web/*/guard_*_test.go) return 0 ;;
+  esac
+  return 1
+}
+
+entries() { # the ratchet's entries at a commit, sorted; nothing if the file is absent
+  git show "$1:$RATCHET" 2>/dev/null | tr -d '\r' | sed -e 's/#.*//' -e 's/[[:space:]]//g' -e '/^$/d' | sort -u
+}
+
+normalised() { # a blob's hash with all whitespace removed
+  git cat-file blob "$1" | tr -d ' \t\r\n' | git hash-object --stdin
+}
+
+cache="$(mktemp -d)"
+trap 'rm -rf "$cache"' EXIT
+
+past_hash() { # normalised hash of a historical blob, computed once
+  if [ ! -f "$cache/$1" ]; then
+    normalised "$1" > "$cache/$1"
+  fi
+  cat "$cache/$1"
+}
+
+fail=0
+say() {
+  echo "::error::design-first: $*"
+  fail=1
+}
+
+for c in $commits; do
+  short="$(git rev-parse --short "$c")"
+  parent="$(git rev-parse --verify --quiet "$c^" || true)"
+  if [ -n "$parent" ]; then
+    changed="$(git diff --name-only --no-renames "$parent" "$c")"
+  else
+    changed="$(git ls-tree -r --name-only "$c")"
+  fi
+
+  # 1. design first
+  guards="" impl=""
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    if is_guard "$f"; then
+      guards="$guards $f"
+    elif [ "${f#internal/web/}" != "$f" ]; then
+      impl="$impl $f"
+    fi
+  done <<< "$changed"
+  if [ -n "$guards" ] && [ -n "$impl" ]; then
+    say "$short changes the design or its guards ($(echo $guards | cut -c1-200)) together with the implementation ($(echo $impl | cut -c1-200)). A design change is its own 'design:' commit, made and accepted first."
+  fi
+
+  # 2. the ratchet
+  if [ -n "$parent" ] && grep -qx "$RATCHET" <<< "$changed"; then
+    # Once the file has existed, a parent without it means an empty list.
+    if git cat-file -e "$parent:$RATCHET" 2>/dev/null || [ -n "$(git log -1 --format=%h "$parent" -- "$RATCHET")" ]; then
+      added="$(comm -13 <(entries "$parent") <(entries "$c"))"
+      if [ -n "$added" ]; then
+        say "$short adds to $RATCHET: $(echo $added). The list only shrinks — what was held to the design stays held."
+      fi
+    fi
+  fi
+
+  # 3. no blob from the past
+  if [ -n "$parent" ]; then
+    touched="$(git diff --name-only --no-renames --diff-filter=AM "$parent" "$c" -- "$TEMPLATES")"
+    if [ -n "$touched" ]; then
+      past="$(git log --format= --raw --no-abbrev --no-renames "$parent" -- "$TEMPLATES" | awk '$4 != "'$ZERO'" {print $4}' | sort -u)"
+      while IFS= read -r f; do
+        [ -n "$f" ] || continue
+        now="$(normalised "$(git rev-parse "$c:$f")")"
+        for blob in $past; do
+          if [ "$(past_hash "$blob")" = "$now" ]; then
+            say "$short: $f is, whitespace aside, a template that already existed in history (blob ${blob:0:12}). An old template is not a redesigned page."
+            break
+          fi
+        done
+      done <<< "$touched"
+    fi
+  fi
+done
+
+if [ "$fail" -ne 0 ]; then
+  exit 1
+fi
+echo "design-first: $(echo "$commits" | grep -c . || true) commit(s) checked, nothing to report"

.github/workflows/test.yml

@@ -10,6 +10,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          # design-first.sh reads each commit's parent and the template history.
+          fetch-depth: 0
+
+      - name: Design first
+        env:
+          BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+          HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: bash .github/scripts/design-first.sh "$BASE" "$HEAD"
 
       - uses: actions/setup-go@v5
         with:

CHANGELOG.md

@@ -5,6 +5,242 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Added
+
+- panel-redesign (stage 0): Bulma 1.0.4 and a 57-icon subset of Tabler Icons
+  3.49.0 are vendored under `/static` (MIT, listed in NOTICE). Nothing links
+  them yet; the old panel is unchanged.
+- panel-redesign (stage 0): the design contract as guard tests
+  (`guard_*_test.go` under `internal/web`) and a `design-first` CI step. The
+  tests read their rules from the accepted mockups — class vocabulary,
+  stylesheet, page structure, component outlines, the 2.0 route table — and
+  pin the vendored assets. `internal/web/view/legacy_pages.txt` lists what is
+  still pre-2.0 and may only shrink; CI also rejects a commit that changes a
+  guard together with the implementation, or brings back a template from
+  history. The kit and route tests stay skipped until their stages land.
+- panel-redesign (stage 0): the component kit. `panel.css` is the mockups'
+  stylesheet rule for rule; `components.html` holds every partial with its
+  typed input in `components.go`; the new `layout.html` is the shell (brick
+  navbar with the wordmark, perforated edge, sibling strip, user menu,
+  footer) and the signed-out screen; `GET /server/components` (global role)
+  renders every partial in every state. `@kit` is off the ratchet: the kit
+  is held to the design contract from here on.
+- panel-redesign (design): Sign out in the user menu is a POST form in the
+  mockups too, and its button takes the same hover, focus and press tint as
+  Account and Help (owner, 2026-10-09).
+
+- panel-redesign (stage 1): the 2.0 schema. `users.email` is the user's own
+  address; the default DMARC report address is a user's setting
+  (`dmarc_default_mode` / `dmarc_default_address`) and a domain either has an
+  address of its own or follows a named user's default
+  (`domains.dmarc_rua_user_id`) — a new domain follows whoever created it,
+  and deleting that user leaves it with no report address (replaced before
+  release — see the entry of 2026-10-10 below).
+  `user_inbound_domains` and the per-user `all_domains` /
+  `all_inbound_domains` flags are in the schema for the inbound delegation
+  that follows. Details: `docs/schema-migrations.md`.
+- panel-redesign (stage 1): inbound domains are delegated to domain
+  administrators, separately from outbound. The user form has two lists, each
+  with *All* (which includes domains added later; with it ticked the rows
+  under it are ignored); a domain administrator needs at least one assignment
+  on either. Such a user sees the inbound domains assigned to them — the list
+  is filtered in the query — and can change their upstream and recipients;
+  adding and deleting an inbound domain stays with the global role. Another
+  tenant's domain, a missing one and a user with no inbound reach all get the
+  same 404. A menu group with nothing assigned is absent, and `/` leads an
+  inbound-only administrator to Inbound.
+- panel-redesign (stage 1): **Account** (`/account`, every role) and
+  **Server › Settings** (`/server/settings`, global role) replace the one
+  Settings page. Account has three forms, each its own POST: profile
+  (username, e-mail), password, and the default DMARC report address
+  (SelfPost hosted, my account e-mail, another address, none) (replaced before
+  release — see the entry of 2026-10-10 below). Saving the profile no longer
+  asks for the password; changing the password still does.
+- panel-redesign (stage 1): the application form is one POST. Who the
+  application may send as, its client-IP allow-list and its rate limit
+  ("use the domain limit", manual or auto) are validated together and saved
+  together or not at all — also at creation, so an application can be added
+  with its limit already in place. The page that shows a generated password
+  is the response to its POST only and is sent with `Cache-Control: no-store`.
+- panel-redesign (stage 1): **Server › Health** (`/server/health`) holds the
+  tables of the old Status page and its two actions, *Re-check DNS* and
+  *Reload configuration*. **Overview** (`/overview`) is reduced to one
+  verdict per check — machine, processes, TLS certificate, queue, milter
+  sockets, reverse DNS — each leading to its table on Health; a check that
+  could not run shows as a warning, never as fine. Both read the same checks.
+- panel-redesign (stage 2): **Sign in** and **Create administrator** are the
+  first pages in the new design - the split brand / form screen, built from
+  the component kit. Sign in names the mail host above its title; a refused
+  attempt is shown as a notice above the fields. `login` and `setup` are off
+  the ratchet.
+- panel-redesign (design): the sign-in page before any administrator exists
+  is a drawn screen (`login-no-admin`): the heading *No administrator yet* and
+  the pointer to the one-time setup link, in the same column as the form. The
+  signed-out column is sized through `.sp-form`, not through `form` (owner,
+  2026-10-09).
+- panel-redesign (design): the Notifications boxes are out of the Account
+  and Server › Settings mockups. Event notifications are not built
+  (panel-notifications is a candidate), and 2.0 carries no box for a feature
+  that does not exist; they are drawn again as the first step of that
+  feature (owner, 2026-10-10).
+- panel-redesign (stage 2): **Overview**, **Server › Health**, **Account**
+  and **Server › Settings** are in the new design. Overview shows the verdict
+  as a stamp with one sentence, the six checks as cards and both domain
+  lists; Health holds the tables behind the cards. Both refresh themselves.
+  The Queue card reads "Empty" or "N queued". `status` and `settings` are
+  off the ratchet.
+- panel-redesign (stage 2): the **Outbound** domain pages are in the new
+  design: the domain list, the domain page (DNS records with what to
+  publish and what is in DNS now, applications, connection), **Domain
+  settings** as a page of its own (report address, rate limit, export,
+  delete), the application form, the password shown once and the delete
+  confirmation. `dashboard`, `domain_detail` and `domain_delete` are off
+  the ratchet.
+- panel-redesign (stage 2): the **Outbound log**, the message page (facts,
+  history, the lines of `mail.log`) and the three **DMARC report** pages are
+  in the new design. The log refreshes its rows without touching the filter
+  being chosen. `deliveries`, `delivery`, `dmarc`, `dmarc_domain` and
+  `dmarc_report` are off the ratchet.
+- panel-redesign (stage 2): the **Inbound** pages are in the new design: the
+  domain list, the domain page (MX record, upstream, valid recipients) and
+  the delete confirmation. Every inbound domain page has a **Spam filter**
+  box and the list names the filter's state: the panel reads
+  `INBOUND_ANTISPAM_MILTER` and `INBOUND_ANTISPAM_MILTER_ACTION` and says
+  whether inbound mail is filtered and what happens while the filter is
+  down. The filter's address is shown to the global role only. `inbound`,
+  `inbound_domain` and `inbound_delete` are off the ratchet.
+- panel-redesign (stage 2): the **Server** pages - System log, Backup,
+  Users, the user form and its delete confirmation - and **Help** are in the
+  new design. Help is a page of topics that the `?` in a box's head opens;
+  the help drawer is gone. The user form sets the user's e-mail. The backup
+  download is encrypted unless the box is unticked. Only the queue page is
+  left on the ratchet.
+- panel-redesign (design, stage 3): **Help** covers every section -
+  seventeen topics for Overview, Outbound, Inbound, Server and Account - and
+  the boxes of nearly every page carry a `?` that opens their topic (owner,
+  2026-10-10). A reader sees the topics of the sections their menu shows.
+- panel-redesign (design, stage 3): **a domain's DMARC report address is one
+  of three choices** - no reports (a new domain), the SelfPost hosted
+  address, or an address typed for the domain - set in Domain settings, with
+  a button that fills in one's own profile e-mail. The per-user default
+  report address, a domain "following" a user and the DMARC box on Account
+  are gone, and with them `users.dmarc_default_mode`,
+  `users.dmarc_default_address` and `domains.dmarc_rua_user_id` (owner,
+  2026-10-10; replaces the design of 2026-09-21 described above).
+- panel-redesign (stage 3): with the inbound spam filter on, its socket is one
+  of the milter sockets on **Server › Health** and counts in Overview's card.
+  The panel connects to the configured address (`inet:host:port` or
+  `unix:/path`, one second at most, nothing sent). A filter that does not
+  answer is an error with `INBOUND_ANTISPAM_MILTER_ACTION=tempfail` - inbound
+  mail is deferred - and a warning otherwise - mail goes through unfiltered.
+- **Port 25 no longer accepts `dmarc-reports@<hostname>`**, the report
+  mailbox of the server as a whole. Only an address a domain has chosen is
+  accepted: its hosted address `dmarc-reports+<domain>@<hostname>`, or a
+  typed address that is on this host. A domain whose published `rua=` still
+  names the general mailbox must be set to *SelfPost hosted* and its DMARC
+  record republished (owner, 2026-10-10).
+- panel-redesign (design, stage 3): **New password** and **Delete** are in
+  each row of a domain's Applications table again, as POST forms that look
+  like the links beside them.
+- panel-redesign (stage 2): the **Outbound queue** page is in the new shell
+  with its content unchanged - the listing of `postqueue -p` and how
+  retries work. With it every page is built from the component kit: the old
+  stylesheet, the old layout and the engine's second rendering path are
+  deleted, and the ratchet is empty.
+
+### Changed
+
+- **Breaking — every panel URL changed.** A path now reads like the menu
+  (`/overview`, `/outbound/…`, `/inbound/…`, `/server/…`, `/account`); the
+  old paths are removed, not redirected — see *Removed*. Polled fragments all
+  answer `<page>/fragment`. Everything under `/server/` is guarded for the
+  global role where the routes are registered, in addition to each handler's
+  own check. An application is addressed under its domain
+  (`/outbound/domains/{id}/applications/{aid}`), and an application id that
+  does not belong to the domain in the path is a 404.
+- **Breaking — the database starts from zero.** The 1.x migration chain
+  (`0001`–`0010`) is replaced by one baseline, `0001_init.sql`. A 1.x
+  `/data/selfpost.db` is refused at start-up with an explicit error and left
+  untouched; nothing is migrated. A domain can be carried over with its
+  export file.
+- The panel role `domain_admin` is stored as `domain`.
+- On the old domain page, "Same as Settings" makes the domain follow the
+  default report address of the user who chose it (replaced before release —
+  see the entry of 2026-10-10 below).
+- The old panel is untouched on screen but steps aside in the tree: its
+  stylesheet is `legacy.css` and its layout `layout_legacy.html` until the
+  last old page is restyled. The 2.0 menu paths in the new shell do not
+  exist before stage 1; only the kit page uses that shell so far (a stage-0
+  state: both files are deleted and every page is on the shell — see
+  *Removed*).
+- panel-redesign is `agreed` (owner, 2026-10-09); work starts with stage 0,
+  the component kit.
+- panel-redesign (stage 3): the operator guide, `architecture.md` (Panel HTTP
+  surface, Persistence) and `security.md` (roles, sessions, errors shown to
+  users) describe the 2.0 panel. `security.md` records two accepted risks from
+  the 2.0 review: a delegated inbound upstream may be any host and port, and
+  Account's profile is saved without the password.
+
+### Security
+
+- A panel session belongs to a user by id and ends with them. It used to be
+  keyed by user name: the cookie of a deleted or renamed user stayed valid
+  and became a session of whoever was next created under that name. Signing
+  in again is required after upgrading (there is no upgrade from 1.x; this
+  concerns development builds of 2.0).
+- Changing one's password ends one's own other sessions only; it used to
+  sign every other user out. A password set by an administrator on the user
+  form ends that user's sessions.
+- Internal errors (database, `saslpasswd2`, Postfix reload) are no longer
+  shown on the application, inbound upstream / recipients and limit forms;
+  they are logged and the page says so.
+- `/static/` no longer answers with a listing of the embedded files.
+- The DMARC reports hub is open to a domain administrator for the domains
+  assigned to them, without the server's ingest statistics; the list of
+  reports no longer treats "no domains" as "all domains".
+
+### Fixed
+
+- Saving a domain's report-address form untouched no longer moves a domain
+  that follows another user's default to whoever saved it: that user's
+  default is its own choice, and "My default instead" is the change
+  (replaced before release — see the entry of 2026-10-10 below).
+- The auto rate-limit fields follow the limit mode on the domain and
+  application forms (the script applied only the first matching rule).
+- The DMARC page of a domain no longer answers 500 once the domain has a
+  reported source.
+- The confirmation before deleting a user names the domains that follow
+  that user's default report address and will be left without one; it used
+  to say the domains were not affected (replaced before release — see the
+  entry of 2026-10-10 below).
+
+### Removed
+
+- **2.0 starts from an empty data directory.** A 1.x `/data` is not upgraded:
+  its database is refused at start and left untouched, and a 1.x backup is not
+  restored; a domain is carried over with its export file. Gone with it, as
+  built: the 1.x migration chain, every pre-2.0 panel path (listed next), the
+  help drawer (Help is a page of topics), the default DMARC report address —
+  the panel-wide one of 1.x (`dmarc_report_email`, "Same as Settings") and the
+  per-user one with a domain following a user that earlier entries of this
+  release describe (`users.dmarc_default_*`, `domains.dmarc_rua_user_id`) —
+  together with the DMARC box on Account, the old stylesheet `legacy.css`, the
+  old layout `layout_legacy.html`, and the unused `rate_limits.allowed_ips`
+  column.
+- Old panel paths, GET and POST alike, without redirects: `/status`,
+  `/status/fragment`, `/status/recheck`, `/reload`, `/domains` and everything
+  under it (`/domains/import`, `/domains/{id}`, `…/dns-recheck`, `…/delete`,
+  `…/ratelimit`, `…/ratelimit/recalc`, `…/dmarc`, `…/export`), `/inbound` and
+  `/inbound/{id}/…`, `/dmarc`, `/dmarc/reports/{id}`, `/dmarc/domains/{id}`,
+  `/deliveries`, `/deliveries/rows`, `/deliveries/{id}`, `/mail-queue`,
+  `/mail-queue/body`, `/system-log`, `/system-log/body`, `/backup`, `/users`
+  and everything under it, `/settings`, and the `/account` → `/settings`
+  redirect; `POST /domains/{id}/applications` and `/applications/{aid}/mode`,
+  `/authips`, `/ratelimit`, `/ratelimit/recalc`, `/password`, `/delete` — the
+  three separate saves of an application are one form now.
+- The instance setting `dmarc_report_email` (a mirror of the global user's
+  profile field) and the unused `rate_limits.allowed_ips` column.
+
 ## [1.9.5] - 2026-10-09
 
 CI-only cut: the release workflow no longer breaks the multi-arch image it

NOTICE

@@ -21,6 +21,22 @@ htmx 2.0.4 (internal/web/view/static/htmx.min.js)
   Licence: Zero-Clause BSD (0BSD)
   https://github.com/bigskysoftware/htmx
 
+Bulma 1.0.4 (internal/web/view/static/bulma.min.css)
+  Copyright (c) 2023 Jeremy Thomas
+  Licence: MIT
+  https://github.com/jgthms/bulma
+  Distributed unmodified.
+
+Tabler Icons 3.49.0
+  Copyright (c) 2020-2026 Paweł Kuna
+  Licence: MIT
+  https://github.com/tabler/tabler-icons
+  Distributed as two files:
+    internal/web/view/static/tabler-icons.css
+    internal/web/view/static/tabler-icons.woff2
+  Webfont subset to the 57 icons the panel uses, made with fontTools
+  pyftsubset.
+
 IBM Plex Sans / IBM Plex Mono
   Copyright © 2017 IBM Corp., with Reserved Font Name "Plex"
   Licence: SIL Open Font License 1.1

README.md

@@ -26,9 +26,9 @@ send log and DNS checks in the panel, encrypted backups.
 - Outbound SMTP (465/smtps; optional 587 submission) with per-domain DKIM signing
 - Optional inbound relay on port 25 (backup-MX / forwarder; off by default)
 - Optional DMARC aggregate report ingest on port 25 (off by default)
-- In-panel Help drawer and `/help` page for Status and domain controls
+- In-panel Help: a page of topics, opened from the `?` in the head of a box
 - Per-application client IP allow-list for SMTP AUTH (optional)
-- Web panel — domains, applications, deliveries, mail queue, system log, backup
+- Web panel grouped by mail direction — Overview, Outbound (domains, log, queue, DMARC reports), Inbound, Server (health, system log, backup, users, settings)
 - Multi-domain relay — each SASL application is bound to one sending domain
 - DNS status checks (PTR, SPF, DKIM, DMARC) with in-panel re-check
 - Two-level rate limiting — IP backstop (Postfix), per-domain ceilings, and trusted-IP app overrides

cmd/panel/antispam_test.go

@@ -0,0 +1,34 @@
+package main
+
+import "testing"
+
+// The panel reads the inbound filter's two variables with the semantics of
+// build/postfix-config.sh: the action is accept unless it says tempfail, and a
+// value the script would refuse is not guessed at.
+func TestAntispamActionMirrorsTheBuildScript(t *testing.T) {
+	for raw, want := range map[string]string{
+		"": "accept", "accept": "accept", "tempfail": "tempfail",
+		"reject": "", "Accept": "", "TEMPFAIL": "", " accept": "",
+	} {
+		if got := antispamAction(raw); got != want {
+			t.Errorf("antispamAction(%q) = %q, want %q", raw, got, want)
+		}
+	}
+}
+
+func TestLoadConfigReadsTheInboundFilter(t *testing.T) {
+	t.Setenv("INBOUND_RELAY_ENABLE", "true")
+	t.Setenv("INBOUND_ANTISPAM_MILTER", "inet:antispam:11332")
+	t.Setenv("INBOUND_ANTISPAM_MILTER_ACTION", "tempfail")
+	cfg := loadConfig()
+	if !cfg.inboundEnabled || cfg.inboundAntispamMilter != "inet:antispam:11332" || cfg.inboundAntispamAction != "tempfail" {
+		t.Errorf("config = %+v", cfg)
+	}
+
+	t.Setenv("INBOUND_ANTISPAM_MILTER", "")
+	t.Setenv("INBOUND_ANTISPAM_MILTER_ACTION", "")
+	cfg = loadConfig()
+	if cfg.inboundAntispamMilter != "" || cfg.inboundAntispamAction != "accept" {
+		t.Errorf("unset filter: milter %q, action %q", cfg.inboundAntispamMilter, cfg.inboundAntispamAction)
+	}
+}

cmd/panel/envdoc_test.go

@@ -89,6 +89,8 @@ var loadConfigKeys = []string{
 	"POSTFIX_DIR",
 	"SELFPOST_DEPLOY_ROOT",
 	"INBOUND_RELAY_ENABLE",
+	"INBOUND_ANTISPAM_MILTER",
+	"INBOUND_ANTISPAM_MILTER_ACTION",
 	"DMARC_REPORTS_ENABLE",
 }
 

cmd/panel/httpserver.go

@@ -110,6 +110,8 @@ func newPanel(cfg config, st *store.Store) (*web.Server, error) {
 		RateLimitWindowSeconds:     cfg.rateLimitWindowSeconds,
 		RetryPolicy:                retryPolicy,
 		InboundEnabled:             cfg.inboundEnabled,
+		InboundAntispamMilter:      cfg.inboundAntispamMilter,
+		InboundAntispamAction:      cfg.inboundAntispamAction,
 		DMARCEnabled:               cfg.dmarcEnabled,
 		SendLogRetentionEnvDefault: cfg.retentionDays,
 	}, cfg.setupTokenPath)

cmd/panel/main.go

@@ -91,6 +91,11 @@ type config struct {
 	deployRoot string
 
 	inboundEnabled bool
+	// The optional milter on the inbound listener (INBOUND_ANTISPAM_MILTER) and
+	// what Postfix does when it is down. Read-only: build/postfix-config.sh is
+	// what attaches it; the panel only says so. See antispamAction.
+	inboundAntispamMilter string
+	inboundAntispamAction string
 	dmarcEnabled          bool
 }
 
@@ -155,11 +160,27 @@ func loadConfig() config {
 		deployRoot: envDefault("SELFPOST_DEPLOY_ROOT", "/selfpost-deploy"),
 		// Optional inbound relay (backup-MX / forwarder). Off unless exactly "true".
 		inboundEnabled:        os.Getenv("INBOUND_RELAY_ENABLE") == "true",
+		inboundAntispamMilter: os.Getenv("INBOUND_ANTISPAM_MILTER"),
+		inboundAntispamAction: antispamAction(os.Getenv("INBOUND_ANTISPAM_MILTER_ACTION")),
 		// Optional DMARC aggregate ingest on port 25. Off unless exactly "true".
 		dmarcEnabled: os.Getenv("DMARC_REPORTS_ENABLE") == "true",
 	}
 }
 
+// antispamAction reads INBOUND_ANTISPAM_MILTER_ACTION the way
+// build/postfix-config.sh does: empty means accept, and accept and tempfail are
+// the only other values it lets the container start with. Anything else is
+// returned as "" — the panel says nothing about the action rather than guess.
+func antispamAction(raw string) string {
+	switch raw {
+	case "", "accept":
+		return "accept"
+	case "tempfail":
+		return "tempfail"
+	}
+	return ""
+}
+
 // saslRealm chooses the realm new SASL accounts live under. It mirrors the
 // hostname Postfix's SASL layer uses so a client authenticating with a bare
 // login resolves to the right account.

cmd/panel/restore_test.go

@@ -74,7 +74,7 @@ func restoreFromOwnBackup(t *testing.T, password string) restored {
 func TestPanelBootsOnADataDirectoryRestoredFromItsOwnBackup(t *testing.T) {
 	r := restoreFromOwnBackup(t, "")
 
-	body := getPage(t, r.panel, "/deliveries", signIn(t, r.panel))
+	body := getPage(t, r.panel, "/outbound/log", signIn(t, r.panel))
 	for _, want := range []string{restoreDomain, restoreSubject} {
 		if !strings.Contains(body, want) {
 			t.Errorf("the restored panel's send log does not show %q:\n%s", want, body)
@@ -128,7 +128,7 @@ func TestARestoreDoesNotReopenTheSetupLink(t *testing.T) {
 func TestARestoredPanelHonoursSessionsFromTheArchive(t *testing.T) {
 	r := restoreFromOwnBackup(t, "")
 
-	rec := request(t, r.panel, http.MethodGet, "/deliveries", nil, r.session)
+	rec := request(t, r.panel, http.MethodGet, "/outbound/log", nil, r.session)
 	if rec.Code != http.StatusOK {
 		t.Errorf("a session from before the backup = %d on the restored panel, want 200", rec.Code)
 	}
@@ -141,7 +141,7 @@ func TestARestoredPanelHonoursSessionsFromTheArchive(t *testing.T) {
 func TestAnEncryptedBackupRestoresTheSameWay(t *testing.T) {
 	r := restoreFromOwnBackup(t, "a-long-enough-password")
 
-	body := getPage(t, r.panel, "/deliveries", signIn(t, r.panel))
+	body := getPage(t, r.panel, "/outbound/log", signIn(t, r.panel))
 	if !strings.Contains(body, restoreSubject) {
 		t.Errorf("the panel restored from an encrypted backup lost the send log:\n%s", body)
 	}
@@ -384,7 +384,7 @@ func downloadBackup(t *testing.T, h http.Handler, session *http.Cookie, password
 		form.Set("password", password)
 		form.Set("password_confirm", password)
 	}
-	rec := request(t, h, http.MethodPost, "/backup", strings.NewReader(form.Encode()), session)
+	rec := request(t, h, http.MethodPost, "/server/backup", strings.NewReader(form.Encode()), session)
 	if rec.Code != http.StatusOK {
 		t.Fatalf("download a backup = %d, want 200:\n%s", rec.Code, rec.Body.String())
 	}

docs/architecture.md

@@ -114,10 +114,10 @@ One process, four roles:
    parameters (`queue_run_delay`, `minimal_backoff_time`,
    `maximal_backoff_time`, `maximal_queue_lifetime`, `bounce_queue_lifetime`,
    `delay_warning_time`) and caches the snapshot on the handlers config. The
-   Mail queue card and a delivery's `deferred` / `bounced` history print those
+   Outbound queue box and a delivery's `deferred` / `bounced` history print those
    numbers; they never call `postconf` per request. If `postconf` is missing,
    the panel logs a warning and uses Postfix 3.x compiled-in defaults
-   (`300s` / `4000s` / `5d` / `0`) with a muted note on the card.
+   (`300s` / `4000s` / `5d` / `0`) with a muted note on the box.
 2. **journal-milter** — unix socket `JOURNAL_MILTER_SOCKET`; records From/To/
    Subject/SASL user at DATA; enforces level-2 rate limits; **fail-open**
    (`default_action=accept`) so milter failure does not stop mail. Domain
@@ -133,8 +133,8 @@ One process, four roles:
 3. **log-tailer** — follows `MAIL_LOG`, updates send-log delivery status by
    queue-id. Send-log `queued → sent` transitions depend on this goroutine alone
    (`UpdateStatus` is only called from [internal/logtail](../internal/logtail/logtail.go)).
-4. **rate-limit recalc** — every six hours (and on demand from the domain
-   page), recomputes level-2 **Auto** rate limits from send-log statistics.
+4. **rate-limit recalc** — every six hours (and on demand from Domain settings and
+   the application form), recomputes level-2 **Auto** rate limits from send-log statistics.
 
 Milter chain in Postfix: OpenDKIM (tempfail) then journal (accept on failure).
 
@@ -159,7 +159,7 @@ panel user cannot read). `follow()` drains the old inode once more before
 switching descriptors; the panel treats a missing log file as an empty tail, not
 an error.
 
-**Read offset is persisted** (`logtail_state` table, migration `0003`): the
+**Read offset is persisted** (`logtail_state` table, in the baseline schema): the
 tailer stores its position plus a fingerprint of the log's first 512 bytes, and
 on start resumes from it, parsing the tail written while the panel was down. If
 the fingerprint no longer matches (rotated or recreated in the meantime) it reads
@@ -185,8 +185,8 @@ rotated past fourteen files while the panel was down, or deleted.
 
 **Two one-shot reads** sit beside the follow loop and are unrelated to it, both
 serving panel pages on request: `TailLines` (the last *n* lines, for
-`/system-log`) and `QueueLines` (the lines carrying one queue-id, for
-`/deliveries/{id}`). `QueueLines` scans a bounded tail of the current file —
+`/server/log`) and `QueueLines` (the lines carrying one queue-id, for
+`/outbound/log/{id}`). `QueueLines` scans a bounded tail of the current file —
 finding a message's lines means reading rather than seeking — and matches the id
 anchored on the character before it, since queue ids are hexadecimal runs and a
 shorter one is regularly the tail of a longer one. Send-log rows outlive the log
@@ -197,61 +197,227 @@ state for an older message and the page reports it as such, not as a failure.
 
 ## Panel HTTP surface
 
-Canonical routes: [internal/web/web.go](../internal/web/web.go). Authenticated
-unless noted. Routes marked **global** return **404** for domain administrators
-(`requireGlobal()` in
-[internal/web/handlers/authz.go](../internal/web/handlers/authz.go)). The table
-below is a summary — HTMX fragment endpoints
-(`/status/fragment`, `/deliveries/rows`, `/mail-queue/body`,
-`/system-log/body`, …) and every POST variant live in `web.go`.
+Canonical routes: [internal/web/web.go](../internal/web/web.go). The router is
+two flat `http.ServeMux`es built by `muxes()` — one pattern per route, method
+included (`GET /outbound/log/{id}`), nothing mounted as a sub-router, and
+building them only takes method values, so the route guard test can run it on
+a bare `Server` and ask which pattern answers a path:
 
-| Route | Purpose |
+- **public** — `/healthz` (liveness), `/license` (the embedded `LICENSE`),
+  `/static/`, `/setup/`, `/login`, `/logout`;
+- **authenticated** — everything else, behind `RequireAuth`: a request without
+  a live session is redirected to `/login`.
+
+Both sit inside `secure()`, which sets the security headers and runs the origin
+check on every state-changing request (see below).
+
+### Routes
+
+A path reads like the menu: `/<group>/<page>`, an entity under its list, an
+action under the thing it changes. Every state change is a `POST`; a `GET`
+only reads (the delete confirmation at `GET …/delete` renders a form).
+
+| Group | Routes |
 |---|---|
-| `/healthz` | Liveness (no auth) |
-| `/license` | Embedded `LICENSE` text (no auth) |
-| `/setup/*` | One-time admin bootstrap |
-| `/login`, `/logout` | Session auth |
-| `/account` | 308 redirect to `/settings` (pre-1.2.3 route, kept as a compat shim) |
-| `/status`, `/status/*` | **Global.** Process, cert, socket, PTR checks; machine CPU/memory/network |
-| `/domains` | Domain list; `POST /domains` (add domain) is **global** |
-| `/domains/{id}`, `/domains/{id}/*` | Assigned-domain detail for domain-admins; delete domain is **global** |
-| `/domains/import` | **Global.** Domain import (`POST`; form on the Backup page) |
-| `/deliveries`, `/deliveries/{id}` | Send log with filters; scoped to assigned domains for domain-admins |
-| `/mail-queue`, `/mail-queue/*` | **Global.** Postfix queue view; retry-policy card on the page (not the HTMX fragment) |
-| `/system-log`, `/system-log/*` | **Global.** `mail.log` tail |
-| `/reload` | **Global.** `POST` — reload OpenDKIM tables, Postfix sender map, and inbound relay maps when enabled (not DMARC maps — see § Persistence restore) |
-| `/backup`, `/backup/*` | **Global.** Full backup download (page also hosts the import form) |
-| `/help` | In-panel operator help (any authenticated user) |
-| `/settings` | Username/password for any user; DMARC report default is **global** only |
-| `/users`, `/users/*` | **Global.** Panel user CRUD |
-| `/inbound`, `/inbound/{id}`, `/inbound/{id}/*` | **Global.** Inbound relay domains. Registered only when `INBOUND_RELAY_ENABLE=true`; otherwise 404. |
-| `/dmarc`, `/dmarc/reports/{id}`, `/dmarc/domains/{id}` | **Global** list and report detail; domain roll-up scoped like deliveries. Registered only when `DMARC_REPORTS_ENABLE=true`; otherwise 404. |
+| Home | `GET /` → `/overview`, or for a user with the *domain* role to the first list they reach (`/outbound/domains`, or `/inbound/domains` when that is all) |
+| Overview | `GET /overview`, `GET /overview/fragment` |
+| Outbound › Domains | `GET, POST /outbound/domains` · `/outbound/domains/{id}` · `POST …/dns-recheck` · `GET, POST …/delete` · `GET …/settings` · `POST …/settings/reports`, `…/ratelimit`, `…/ratelimit/recalc`, `…/export` |
+| Outbound › Applications | `GET, POST /outbound/domains/{id}/applications/new` · `GET, POST …/applications/{aid}` · `POST …/applications/{aid}/password`, `…/{aid}/ratelimit/recalc`, `…/{aid}/delete` |
+| Outbound › Log, Queue | `GET /outbound/log` · `/outbound/log/fragment` · `/outbound/log/{id}` · `GET /outbound/queue` · `/outbound/queue/fragment` |
+| Outbound › DMARC reports | `GET /outbound/dmarc` · `…/dmarc/domains/{id}` · `…/dmarc/reports/{id}` — registered only with `DMARC_REPORTS_ENABLE=true` |
+| Inbound › Domains | `GET, POST /inbound/domains` · `/inbound/domains/{id}` · `POST …/dns-recheck`, `…/upstream`, `…/recipients` · `GET, POST …/delete` — registered only with `INBOUND_RELAY_ENABLE=true` |
+| Server | `GET /server/health` (+ `/fragment`) · `POST /server/health/recheck`, `/server/health/reload` · `GET /server/log` (+ `/fragment`) · `GET, POST /server/backup` · `POST /server/backup/import` · `/server/users`, `…/new`, `…/{uid}`, `…/{uid}/delete` · `GET, POST /server/settings` · `GET /server/components` |
+| Account | `GET /account` · `POST /account/profile`, `/account/password` |
+| User menu | `GET /help` · `POST /logout` (public mux) |
 
-HTMX polling refreshes monitoring fragments (5 s while the operator is active on
-the page, 30 s when the tab is visible but idle, none when hidden — scheduled in
-`panel.js` via `data-poll`, not `hx-trigger="every …"`); polling does not extend
-session idle timeout (only non-`HX-Request` GET and mutating requests count as
-activity). The Mail queue retry-policy card is outside that fragment: it is the
-start-up `postconf -h` snapshot (see [Panel binary](#panel-binary-cmdpanel)),
-not a live re-read.
+An application is addressed under its domain, and an application id that does
+not belong to the domain in the path is a 404. The application form is one
+`POST`: sender, client IPs and rate limit are validated and saved together or
+not at all, also at creation. The page that shows a new password is the
+response to the `POST` that created or regenerated it; it has no `GET` path and
+carries `Cache-Control: no-store`.
+
+The pre-2.0 paths are not served and not redirected (`/status`, `/domains/…`,
+`/inbound/{id}/…`, `/deliveries`, `/mail-queue`, `/system-log`, `/backup`,
+`/users/…`, `/settings`, `/reload`, `/dmarc/…`, and `/account` as a redirect):
+each answers 404 once signed in. `TestRoutesFollowNavigation`
+([internal/web/guard_routes_test.go](../internal/web/guard_routes_test.go))
+holds the table: every path is registered with its methods, every menu entry
+points at a registered path, every old path answers 404, and no template
+contains an old path.
+
+### Who may open what
+
+Authorization is by tree where the tree is the boundary, and by object where it
+is not.
+
+- **`/server/` is guarded once.** Routes under it are registered through
+  `server()` in `web.go`, which wraps the handler in `globalOnly` (404 for
+  anyone but the global role — the answer a missing page gets, so the panel does
+  not confirm the page exists) and panics at start-up for a pattern outside
+  `/server/`. The handlers also call `requireGlobal()` themselves.
+- **Overview and the Outbound queue** are global-only but not under `/server/`,
+  so their handlers call `requireGlobal()`.
+- **Outbound is checked per domain.** `lookupDomain` resolves `{id}` and answers
+  404 for a missing domain and for one the principal may not reach alike
+  ([handlers/handlers_domains.go](../internal/web/handlers/handlers_domains.go));
+  application routes go on to check the application belongs to that domain.
+  Lists and the log are filtered by assignment in the query
+  (`ListDomainsForUser`), not in the template. Adding and deleting a domain is
+  `requireGlobal()`.
+- **Inbound is checked per inbound domain**, separately from outbound
+  ([handlers/handlers_inbound.go](../internal/web/handlers/handlers_inbound.go)):
+  `requireInbound` (the list), `requireInboundDomain` (one domain — page,
+  upstream, recipients, DNS re-check) and `requireInboundGlobal` (add, delete).
+  All three answer 404 alike.
+- **The DMARC hub** is open to anyone with outbound reach for the reports of
+  their own domains; the *Ingest* box (server-wide statistics) is rendered for
+  the global role only.
+- **Account and Help** are open to every signed-in user.
+- The principal ([web/auth/principal.go](../internal/web/auth/principal.go))
+  carries the role, the assigned outbound and inbound domain ids and the two
+  *All* flags; `CanAccessDomain` and `CanAccessInboundDomain` are the only
+  predicates. The reach, not the role, decides which menu groups exist.
+
+Routes marked global are tested per path for a user with the *domain* role,
+including another tenant's domain id
+([handlers/handlers_delegation_test.go](../internal/web/handlers/handlers_delegation_test.go),
+[authz_test.go](../internal/web/handlers/authz_test.go)).
+
+### Polled fragments
+
+A polled page answers its refresh at `<page>/fragment` (`/overview/fragment`,
+`/outbound/log/fragment`, `/server/health/fragment`, …). The fragment is the
+same `{{define}}` block that renders the page's own box, so the first paint and
+a refresh cannot differ. HTMX refreshes them every 5 s while the operator is
+active on the page, every 30 s when the tab is visible but idle, and not at all
+when it is hidden — scheduled in `panel.js` via `data-poll`, not
+`hx-trigger="every …"`, because a trigger filter is evaluated with `new
+Function`, which the CSP forbids. Polling does not extend the session idle
+timeout (only non-`HX-Request` `GET`s and mutating requests count as
+activity). The Outbound queue's retry-policy box is outside the polled region:
+it is the start-up `postconf -h` snapshot (see [Panel
+binary](#panel-binary-cmdpanel)), not a live re-read.
+
+### View engine and component kit
+
+Pages are rendered by [internal/web/view](../internal/web/view/view.go). There
+is one layout and one way to render.
+
+- **One layout.** Every page is parsed with `layout.html` (the shell: brick
+  navbar with the wordmark, the perforated edge, the strip of sibling pages,
+  user menu, footer) and `components.html` (the partials), then its own file.
+  `layout_signed_out` is the same document without navigation, used for sign-in
+  and setup; `Engine.Render` picks it when the page data names no user. The
+  page's file defines `content`; `pageFiles` in `view.go` lists the files of
+  each page, and fragments are listed in `fragmentFiles` and rendered by
+  `RenderFragment` with no layout.
+- **Typed page data.** A page's data is a struct that embeds `Meta` (title,
+  user, the viewer's reach, the menu group and page it sits in) and carries
+  the page's boxes and rows as fields, built by a constructor in the `view`
+  package (`NewOutDomain`, `NewHelp`, …) that the handler fills. The shell is
+  derived from `Meta` and the feature flags (`SetInboundEnabled`,
+  `SetDMARCEnabled`) in one place, `Engine.shell`, so which entries the menu
+  has is decided once. No template reads a `map[string]any`; the one map left
+  in the handlers is the health sampler's, which is turned into a typed
+  `Health` before rendering.
+- **The component kit.** [components.html](../internal/web/view/templates/components.html)
+  holds one `{{define}}` per partial (page head, postmark, box and its head and
+  foot, flash, health card, DNS record, facts, side menu, timeline, log pane,
+  empty state, confirm list, help topic, form rows) and is the only file that
+  writes their `sp-` markup. [components.go](../internal/web/view/components.go)
+  is the typed input of each (`Head`, `Box`, `Record`, `Fact`, `SideMenu`, …),
+  so a page passes a struct, never a `dict`. Template functions: `status_tag`
+  (a status → Bulma's tag classes, once), `wbr_at` (a break after the `@` in a
+  table cell). A page that needs a component the kit lacks is a design change
+  made in the mockups first
+  ([plans/panel-redesign.md](plans/panel-redesign.md) § The contract).
+- **Help.** [help.go](../internal/web/view/help.go) is the Help page's data:
+  topics grouped by section of the panel. A box's head links to its topic with
+  `Box.Help` (`/help#<topic>`), and the page lists only the
+  sections the viewer's menu shows.
+- **Assets.** [static/](../internal/web/view/static) is embedded
+  (`//go:embed`): vendored `bulma.min.css` and a Tabler icon subset (checksummed),
+  `panel.css` (the mockups' stylesheet, rule for rule), `htmx.min.js`, `panel.js`,
+  the IBM Plex subset and the logo files. Served with a content-derived `ETag`,
+  and `/static/` does not list its files. The kit page
+  `GET /server/components` renders every partial in every state from fixtures
+  (global role only).
+
+**Guard tests** hold the design in place; they run in `go test ./...` and CI.
+They read their rules from the accepted mockups
+([docs/assets/panel-redesign/panel/](assets/panel-redesign/index.html)) rather
+than keep a copy: `TestPanelClassVocabulary` (only the Bulma subset and the
+`sp-` classes of `panel.css`; every `sp-` class defined, used and shown on the
+components page), `TestPanelCSSIsTheMockupStylesheet`, `TestPanelCSSContract`
+(no `!important`, no id or page selector, type floor, widths),
+`TestTemplatesUseComponents` (no hand-written component markup in a page),
+`TestPanelOutlinesMatchMockups` and `TestPanelPageStructure` (each rendered page
+has the component skeleton of its mockup), `TestRedesignedPagesLoadOnlyTheKit`,
+`TestVendoredAssetsArePinned`, `TestStaticHoldsOnlyTheKnownAssets`,
+`TestRoutesFollowNavigation`, `TestNoTemplateUsesInlineScriptOrStyle`. The
+ratchet list `internal/web/view/legacy_pages.txt` is empty and can only shrink;
+the CI step
+[design-first](../.github/scripts/design-first.sh) rejects a commit that
+changes a guard together with the code it judges, and a template that is a
+byte-for-byte return of one from history. The design contract and the process
+are in [plans/panel-redesign.md](plans/panel-redesign.md) § Enforcement.
+
+### Security headers, CSP and scripts
+
+`secure()` ([internal/web/security.go](../internal/web/security.go)) puts these
+on every response: `Content-Security-Policy: default-src 'self'; object-src
+'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'`,
+`X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`,
+`Referrer-Policy: no-referrer`, and `Strict-Transport-Security` when the cookie
+is `Secure`. Because the policy has no exemptions, no template carries an
+inline `<script>`, an event-handler attribute or `style="…"` — the page's
+behaviour is `htmx.min.js` plus `panel.js` (copy and *fill* buttons, the
+`data-confirm` prompt on destructive forms, conditional field visibility,
+adaptive polling), both optional: every form works as a native HTML `POST`
+with scripts off. htmx is told not to inject its indicator stylesheet
+(`htmx-config` meta), which the CSP would otherwise have to allow.
+
+State-changing requests (every non-`GET`/`HEAD`/`OPTIONS`) pass `originAllowed`
+first: `Sec-Fetch-Site` must say `same-origin`, or `Origin` must name the
+panel's host; a request with neither header is let through (an accepted risk).
+There are no CSRF tokens — see [security.md](security.md).
+
+### Errors shown to users
+
+A validation refusal is shown as the text the validator wrote (on the form,
+next to the field, or in a notice above the first box). Anything else — a
+database error, `saslpasswd2`, a Postfix reload — is logged
+and the page gets a fixed sentence saying so; the error text never reaches the
+browser. A template error renders a bare `500` rather than a half-written page
+(`Engine.Render` buffers).
 
 ### Sessions
 
-Stored in SQLite (`sessions` table, migration `0002`): cookie holds a random
-token; the database stores **SHA-256 of the token**, not the token itself — a
-stolen DB or backup archive does not alone grant login, but a browser that still
-holds the cookie works after process restart, redeploy, or full backup restore.
+Stored in SQLite (`sessions` table of the baseline, `0001_init.sql`): the cookie
+holds a random token; the database stores **SHA-256 of the token**, not the
+token itself — a stolen DB or backup archive does not alone grant login, but a
+browser that still holds the cookie works after process restart, redeploy, or
+full backup restore.
 
+- **A session belongs to a user by id** (`sessions.user_id`, `ON DELETE
+  CASCADE`). Deleting a user ends their sessions; renaming one keeps them;
+  `RequireAuth` loads the user on every request, so a session whose user is
+  gone is a redirect to `/login`.
 - **Idle timeout** — sliding window, `PANEL_SESSION_IDLE_DAYS` (default 7); no
   absolute cap (regular use keeps the session alive indefinitely).
-- **Renewal** — DB `last_seen` and cookie `Max-Age` update at most once per hour
-  (`renewThreshold` in [internal/web/auth/session.go](../internal/web/auth/session.go)).
-- **Password change on `/settings`** — changing your own password deletes
-  every other session for that user; the current session stays active
+- **Renewal** — the DB `expires_at` and the cookie `Max-Age` update at most once per
+  hour (`renewThreshold` in
+  [internal/web/auth/session.go](../internal/web/auth/session.go)).
+- **Password change on Account** — deletes every other session of that user;
+  the current one stays active
   ([internal/store/sessions.go](../internal/store/sessions.go),
-  [handlers_settings.go](../internal/web/handlers/handlers_settings.go)).
-  A global administrator resetting another user's password on `/users` updates
-  the hash but does not delete that user's existing sessions.
+  [handlers_account.go](../internal/web/handlers/handlers_account.go)).
+- **A password set by a global user on the user form** deletes all of that
+  user's sessions (`DestroyUserSessions`); set for oneself, it keeps the
+  current one
+  ([handlers_users.go](../internal/web/handlers/handlers_users.go),
+  `endSessionsAfterPasswordSet`).
 
 Restoring an **older** backup also restores session rows: a session removed
 after that backup was taken can become valid again if the browser still holds
@@ -264,7 +430,7 @@ the cookie and the restored row's `expires_at` has not passed.
 Multi-store writes that must land in more than one place (SQLite row,
 `sasldb2` entry, Postfix map, OpenDKIM table) go through a service, which is
 also where the rollback of a partial failure lives. Handlers may call
-`store` directly for single-table reads and simple writes (sessions, admin,
+`store` directly for single-table reads and simple writes (sessions, users,
 send-log queries); the first-run setup-token file is read and written in
 `web` itself. The adapters below the services are the only code that knows
 about Postfix, OpenDKIM, DNS or the log file, which is what makes them
@@ -295,7 +461,7 @@ flowchart TB
     dmarcSvc["internal/dmarc"]
   end
   subgraph persistence ["Persistence"]
-    store["internal/store — SQLite, embedded migrations"]
+    store["internal/store — SQLite, embedded schema"]
   end
   subgraph adapters ["Adapters — the only infrastructure-aware code"]
     postfix["internal/postfix"]
@@ -344,7 +510,7 @@ single-connection trade-off that follows from it.
 
 | Path | Contents |
 |---|---|
-| `selfpost.db` | SQLite panel state (domains, apps, users, sessions, send log, L2 limits, log-tailer offset, inbound relay, DMARC reports) — see [schema-migrations.md](schema-migrations.md) |
+| `selfpost.db` | SQLite panel state (users, sessions, domains, apps, send log, L2 limits, log-tailer offset, inbound relay, DMARC reports) — see [Database](#database) and [schema-migrations.md](schema-migrations.md) |
 | `setup-token` | First-run setup token file |
 | `opendkim/` | DKIM keys + tables |
 | `sasl/sasldb2` | Application SASL credentials |
@@ -363,6 +529,49 @@ single-connection trade-off that follows from it.
 Not in `/data`: TLS certificates for the panel (reverse-proxy mount) — though
 full backups also archive the operator's `./certs` PEM files when present.
 
+### Database
+
+The schema is one embedded baseline, `internal/store/migrations/0001_init.sql`,
+applied by `store.Open` into an empty file; `PRAGMA user_version` is `1` and
+`PRAGMA application_id` is `0x53503230` ("SP20"). There is no 1.x migration
+chain. **2.0 starts from an empty data directory:** a database with a schema
+version but without the 2.x `application_id` — what every 1.x file looks like —
+is refused at start with `ErrForeignSchema` and left untouched, as is one whose
+version is newer than the build knows. A restored 1.x backup fails the same
+way. Domains are carried across with a domain export, whose format is not the
+database. Later schema changes are new files (`0002_*.sql`, …); once `2.0.0` is
+released the baseline is never edited. History and the per-table list:
+[schema-migrations.md](schema-migrations.md).
+
+The tables that carry the panel's model:
+
+- **`users`** — `role` is `global` or `domain` (a reach, not a rank); `email` is
+  the user's own address, edited on Account and set by the global role on the
+  user form; `all_domains` / `all_inbound_domains` widen a *domain* user to
+  every domain of that direction, including ones added later (with a flag set
+  the assignment rows are ignored).
+- **`user_domains`** and **`user_inbound_domains`** — the outbound and inbound
+  domains assigned to a *domain* user. Separate tables: the same name on both
+  is two assignments, and a sending domain gives no inbound access or the other
+  way round.
+- **`sessions`** — `token_hash`, `user_id` (`ON DELETE CASCADE`), `expires_at`.
+  Keyed by user id, not by name.
+- **`domains`** — `dmarc_rua` is the whole of a domain's report-address choice:
+  `''` is no reports (a new domain), the address SelfPost derives for the
+  domain and the server's hostname is the hosted choice, anything else is an
+  address typed for the domain. Nothing refers to a user, and deleting one
+  changes no domain.
+- **`settings`** — key/value, what holds for the instance whoever is signed in
+  (send-log retention). Nothing that belongs to a user.
+- `applications` (with `auth_ip_restrict` / `auth_allowed_ips`),
+  `application_addresses`, `rate_limits` (no `allowed_ips` column), `send_log`,
+  `logtail_state`, `inbound_domains`, `inbound_transports`,
+  `inbound_recipients`, `dmarc_reports`, `dmarc_report_records`.
+
+The panel is the only writer; SQLite runs in WAL mode on one connection (see
+[Panel binary](#panel-binary-cmdpanel)), which is why a full backup snapshots
+with `VACUUM INTO` instead of copying the file.
+
 **Rotation:** send-log retention `SEND_LOG_RETENTION_DAYS` (default 90);
 `mail.log` via logrotate (14 rotated files, check every 6h, rename +
 `postfix reload` in `postrotate` — see § Log tailer above).
@@ -377,7 +586,8 @@ tables, Postfix's sender map, inbound relay maps (when
 `INBOUND_RELAY_ENABLE=true`), and DMARC maps (when `DMARC_REPORTS_ENABLE=true`)
 are re-derived from SQLite and both daemons are reloaded, so drift between the
 extracted archive and the database is healed before mail flows. Manual
-`POST /reload` on the Status page resyncs OpenDKIM, the sender map, and
+`POST /server/health/reload` (the *Reload configuration* button on Server ›
+Health) resyncs OpenDKIM, the sender map, and
 inbound maps only — not DMARC maps. Stopped-container
 `tar` of `./data` alone remains possible for state-only copies (see guide).
 
@@ -386,9 +596,12 @@ inbound maps only — not DMARC maps. Stopped-container
 scrypt → AES-256-GCM over 64 KiB chunks, each authenticated with the header,
 its counter and an end-of-stream flag (so truncation and reordering fail to
 open). Full backup `.tar.gz` → `.spbk` (SelfPost backup), domain export
-`.json` → `.spde` (SelfPost domain export); the plain forms remain the
-default. Domain import detects the envelope by magic bytes; an encrypted full
-backup is converted back with `selfpost-backup -decrypt` before restore.
+`.json` → `.spde` (SelfPost domain export). In the panel the *Encrypt with a
+password* box is ticked by default on both downloads and the plain form is
+what an unticked box gives; the `selfpost-backup` CLI stays plain unless it is
+given a password. Domain import detects the envelope by magic bytes; an
+encrypted full backup is converted back with `selfpost-backup -decrypt` before
+restore.
 
 ---
 

docs/assets/panel-redesign/index.html

@@ -13,7 +13,7 @@
   <h1>The accepted direction, every screen</h1>
   <p class="lead">Direction <strong>C</strong> (Bulma) was picked as the base: the important things in view, details one
   or two clicks away. It takes the postal signature of <strong>A</strong> — the postmark verdict, numbered mono section
-  heads, the stamp's perforated paper edge under a brick bar that carries the wordmark — and the icons of <strong>B</strong>. Thirty-three screens and a components page live in
+  heads, the stamp's perforated paper edge under a brick bar that carries the wordmark — and the icons of <strong>B</strong>. Thirty-four screens and a components page live in
   <a href="panel/overview.html">panel/</a>. Serve this folder from the repository root: the pages load the panel's own
   fonts and mark by relative path.</p>
 
@@ -21,7 +21,7 @@
   <div class="scroll">
   <table>
     <tbody>
-      <tr><th>Signed out</th><td><a href="panel/login.html">Sign in</a> · <a href="panel/setup.html">Create administrator</a></td></tr>
+      <tr><th>Signed out</th><td><a href="panel/login.html">Sign in</a> · <a href="panel/login-no-admin.html">sign in before an administrator exists</a> · <a href="panel/setup.html">Create administrator</a></td></tr>
       <tr><th>Overview</th><td><a href="panel/overview.html">Overview</a> — postmark verdict, six health cards, both domain lists</td></tr>
       <tr><th>Outbound</th><td><a href="panel/out-domains.html">Domains</a> · <a href="panel/out-domain.html">domain</a> ·
         <a href="panel/out-domain-settings.html">domain settings</a> · <a href="panel/out-app.html">application form</a> ·

docs/assets/panel-redesign/panel/account.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -69,24 +69,26 @@
       <div class="sp-grow">
         <p class="sp-kicker">Signed in as admin · global</p>
         <h1 class="title is-3">Account</h1>
-        <p class="sp-lead">Who you are to this panel, what it should tell you about, and where reports about your domains go. Applications keep their own logins and passwords and are not affected.</p>
+        <p class="sp-lead">Who you are to this panel. Applications keep their own logins and passwords and are not affected.</p>
       </div>
     </div>
 
     <div class="columns">
-      <div class="column is-5">
+      <div class="column is-6">
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>Profile</h2></div>
           <div class="sp-box-body">
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="username">Username</label><div class="control has-icons-left"><input class="input" id="username" name="username" value="admin" autocomplete="username" spellcheck="false" required><span class="icon is-left"><i class="ti ti-user"></i></span></div></div>
               <div class="field"><label class="label" for="email">E-mail</label><div class="control has-icons-left"><input class="input" id="email" name="email" type="email" value="mix@example.org" autocomplete="email"><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
-                <p class="help">Where the panel writes to you: the notifications on the right and a password-reset link. It can also receive DMARC reports — your choice, under <a href="#dmarc">DMARC reports</a>.</p></div>
+                <p class="help">Your own address. A domain's report address can be filled with it from Domain settings.</p></div>
               <button type="submit" class="button is-primary">Save profile</button>
             </form>
           </div>
         </div>
+      </div>
 
+      <div class="column is-6">
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Password</h2></div>
           <div class="sp-box-body">
@@ -102,55 +104,6 @@
           </div>
         </div>
       </div>
-
-      <div class="column is-7">
-        <div class="box">
-          <div class="sp-box-head"><span class="sp-no">03</span><h2>Notifications</h2><div class="sp-end">Sent to mix@example.org</div></div>
-          <div class="sp-box-body">
-            <form class="sp-form" method="post" action="#">
-              <p class="sp-kicker mb-2">Your domains</p>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev" checked> A DNS record stops matching — DKIM, SPF, DMARC or an inbound MX</label></div>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev" checked> A domain or an application reaches its rate limit and mail is being refused</label></div>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev" checked> An inbound domain's upstream cannot be reached and mail is piling up</label></div>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev"> DMARC reports start showing failures for a domain</label></div>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev"> Mail is held in quarantine</label></div>
-              <p class="sp-kicker mt-4 mb-2">The server · global role</p>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev" checked> The TLS certificate is within 14 days of expiry</label></div>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev" checked> A process or a milter socket stops answering</label></div>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev"> Messages sit in a queue for more than a day</label></div>
-              <p class="help mb-3">One message when a problem starts and one when it clears — never a stream. A domain administrator is told only about the domains assigned to them.</p>
-              <button type="submit" class="button is-primary">Save notifications</button>
-            </form>
-          </div>
-        </div>
-
-        <div class="box" id="dmarc">
-          <div class="sp-box-head"><span class="sp-no">04</span><h2>DMARC reports</h2><div class="sp-end"><span class="tag is-success is-light">authorized</span></div><a class="sp-help" href="help.html#dmarc" title="What the reports are and where they go"><i class="ti ti-help-circle"></i></a></div>
-          <div class="sp-record">
-            <form class="sp-form" method="post" action="#">
-              <div class="field"><label class="label" for="rua">My default report address</label>
-                <div class="control"><div class="select is-fullwidth"><select id="rua" name="dmarc_default">
-                  <option>SelfPost hosted — read them under DMARC reports</option>
-                  <option selected>My account e-mail — mix@example.org</option>
-                  <option>Another address…</option>
-                  <option>No reports</option>
-                </select></div></div>
-                <p class="help">Used by every outbound domain whose report address is set to <em>admin's default</em> — 2 of your 3 now. Changing it changes the DMARC record those domains must publish. The hosted address is parsed by SelfPost; any other just receives the raw XML.</p></div>
-              <button type="submit" class="button is-primary">Save report address</button>
-            </form>
-          </div>
-          <div class="sp-record">
-            <div class="sp-record-head"><h3>Report authorization</h3><span class="tag is-success is-light">published</span><small>Needed because the address is on another domain than the senders</small></div>
-            <div class="sp-row">
-              <div class="field"><label class="label">Host / name</label>
-                <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="*._report._dmarc.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-              <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
-            </div>
-            <div class="field"><label class="label">Value to publish</label>
-              <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=DMARC1"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-          </div>
-        </div>
-      </div>
     </div>
 
     <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>

docs/assets/panel-redesign/panel/backup.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -76,7 +76,7 @@
     <div class="columns">
       <div class="column is-6">
         <div class="box">
-          <div class="sp-box-head"><span class="sp-no">01</span><h2>Full backup</h2></div>
+          <div class="sp-box-head"><span class="sp-no">01</span><h2>Full backup</h2><a class="sp-help" href="help.html#backup" title="Backups, encryption and restore"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <p class="mb-3"><code>data/</code> (database, DKIM keys, credentials, the queue), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code> in one archive. Restore into an empty project directory and start the <strong>same SelfPost version</strong>. The reverse-proxy vhost is not included.</p>
             <form class="sp-form" method="post" action="#">
@@ -94,7 +94,7 @@
 
       <div class="column is-6">
         <div class="box" id="import">
-          <div class="sp-box-head"><span class="sp-no">02</span><h2>Import a domain</h2></div>
+          <div class="sp-box-head"><span class="sp-no">02</span><h2>Import a domain</h2><a class="sp-help" href="help.html#backup" title="Moving a domain to another instance"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <p class="mb-3">A domain export from another instance — plain <code>.json</code> or encrypted <code>.spde</code>. Its DKIM key and application passwords come across, so the published DNS needs no change. The export itself is made on the <a href="out-domain-settings.html#export">domain's settings</a>.</p>
             <form class="sp-form" method="post" action="out-domain.html" enctype="multipart/form-data">

docs/assets/panel-redesign/panel/build.py

@@ -81,7 +81,9 @@ def navbar(section, page):
             '            <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>',
             '            <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>',
             '            <hr class="navbar-divider">',
-            '            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>',
+            # Signing out changes state, so it is a POST: a form with a button, not a link.
+            '            <form method="post" action="login.html"><button type="submit" class="navbar-item">'
+            '<i class="ti ti-logout"></i>Sign out</button></form>',
             '          </div>', '        </div>', '      </div>', '    </div>', '  </div>', '</nav>',
             '<div class="sp-perf" aria-hidden="true"></div>']
     return "\n".join(out)

docs/assets/panel-redesign/panel/check.py

@@ -27,7 +27,7 @@ box button buttons checkbox column columns control field file file-cta file-inpu
 file-name has-addons has-icons-left has-name has-text-danger help icon input label menu menu-label
 menu-list notification progress select table table-container tag textarea title
 is-3 is-4 is-5 is-6 is-7 is-9 is-active is-danger is-expanded is-fullwidth is-gapless is-half
-is-hoverable is-left is-light is-primary is-small is-success is-text is-warning
+is-hidden is-hoverable is-left is-light is-primary is-small is-success is-text is-warning
 mb-1 mb-2 mb-3 mb-4 ml-2 mt-4 mt-5
 """.split())
 # Classes the shell (build.py, later layout.html) owns; screens never write them.

docs/assets/panel-redesign/panel/components.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -172,7 +172,7 @@
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
             <thead><tr><th>Time, UTC</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
             <tbody>
-              <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td><a href="#"><strong>the row's link</strong></a></td><td class="sp-clip">A long subject is clipped with an ellipsis instead of wrapping the row</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="#">Details</a><a class="has-text-danger" href="#">Delete</a></td></tr>
+              <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td><a href="#"><strong>the row's link</strong></a></td><td class="sp-clip">A long subject is clipped with an ellipsis instead of wrapping the row</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="#">Details</a><form method="post" action="#"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
             </tbody>
           </table></div>
           <div class="sp-box-foot"><span>Page 1 of 9</span><a href="#">Older →</a></div>

docs/assets/panel-redesign/panel/dmarc-domain.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -78,7 +78,7 @@
     <div class="columns">
       <div class="column is-5">
         <div class="box">
-          <div class="sp-box-head"><span class="sp-no">01</span><h2>Sources · 7 days</h2></div>
+          <div class="sp-box-head"><span class="sp-no">01</span><h2>Sources · 7 days</h2><a class="sp-help" href="help.html#dmarc" title="How to read pass, fail and sources"><i class="ti ti-help-circle"></i></a></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Source</th><th>Pass</th><th>Fail</th><th>Disposition</th></tr></thead>
             <tbody>

docs/assets/panel-redesign/panel/dmarc-report.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -76,7 +76,7 @@
     <div class="columns">
       <div class="column is-6">
         <div class="box">
-          <div class="sp-box-head"><span class="sp-no">01</span><h2>Report</h2></div>
+          <div class="sp-box-head"><span class="sp-no">01</span><h2>Report</h2><a class="sp-help" href="help.html#dmarc" title="What an aggregate report is"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
               <div><dt>Reporter</dt><dd>Outlook.com</dd></div>

docs/assets/panel-redesign/panel/dmarc.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -74,12 +74,12 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Ingest</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Ingest</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#dmarc" title="What the reports are and where they go"><i class="ti ti-help-circle"></i></a></div>
       <div class="sp-box-body">
         <dl class="sp-facts">
           <div><dt>Last report</dt><dd>2026-09-21 06:12 UTC</dd></div>
           <div><dt>This week</dt><dd>14 kept · 0 parse failures</dd></div>
-          <div><dt>Hosted address</dt><dd class="sp-mono">dmarc@mail.example.org</dd></div>
+          <div><dt>Hosted addresses</dt><dd class="sp-mono">dmarc-reports+&lt;domain&gt;@mail.example.org</dd></div>
           <div><dt>Retention</dt><dd>500 reports or 90 days</dd></div>
         </dl>
       </div>

docs/assets/panel-redesign/panel/health.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -77,7 +77,7 @@
     <div class="columns">
       <div class="column is-6">
         <div class="box" id="machine">
-          <div class="sp-box-head"><span class="sp-no">01</span><h2>Machine</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div></div>
+          <div class="sp-box-head"><span class="sp-no">01</span><h2>Machine</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#checks" title="What these readings mean"><i class="ti ti-help-circle"></i></a></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Resource</th><th>Usage</th><th>Detail</th></tr></thead>
             <tbody>
@@ -108,7 +108,7 @@
     <div class="columns">
       <div class="column is-4">
         <div class="box" id="certificate">
-          <div class="sp-box-head"><span class="sp-no">03</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-warning is-light">warn</span></div></div>
+          <div class="sp-box-head"><span class="sp-no">03</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-warning is-light">warn</span></div><a class="sp-help" href="help.html#certificate" title="When it warns and what to do"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
               <div><dt>Expires</dt><dd class="sp-mono">2026-10-03 09:14 UTC</dd></div>
@@ -134,7 +134,7 @@
       </div>
       <div class="column is-4">
         <div class="box" id="hostname">
-          <div class="sp-box-head"><span class="sp-no">05</span><h2>Hostname and reverse DNS</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div></div>
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>Hostname and reverse DNS</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#rdns" title="Forward and reverse DNS"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
               <div><dt>Hostname</dt><dd class="sp-mono">mail.example.org</dd></div>

docs/assets/panel-redesign/panel/help.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -69,7 +69,7 @@
       <div class="sp-grow">
         <p class="sp-kicker">Reference</p>
         <h1 class="title is-3">Help</h1>
-        <p class="sp-lead">What each screen checks and what to do when it is not green. Every numbered section on a page links to its topic here.</p>
+        <p class="sp-lead">What each screen checks or does, and what to do when it is not green. The ? in a box's head opens its topic here.</p>
       </div>
     </div>
 
@@ -87,27 +87,61 @@
             <li><a href="#dns"><i class="ti ti-world-check"></i>DNS records</a></li>
             <li><a href="#apps"><i class="ti ti-apps"></i>Applications</a></li>
             <li><a href="#limits"><i class="ti ti-gauge"></i>Rate limits</a></li>
+            <li><a href="#log"><i class="ti ti-list-details"></i>Outbound log</a></li>
             <li><a href="#queue"><i class="ti ti-stack-2"></i>Queue and retries</a></li>
             <li><a href="#dmarc"><i class="ti ti-report-analytics"></i>DMARC reports</a></li>
           </ul>
           <p class="menu-label">Inbound</p>
           <ul class="menu-list">
             <li><a href="#inbound"><i class="ti ti-inbox"></i>Backup-MX and forwarding</a></li>
+            <li><a href="#upstream"><i class="ti ti-arrow-forward-up"></i>Upstream</a></li>
+            <li><a href="#recipients"><i class="ti ti-address-book"></i>Valid recipients</a></li>
+            <li><a href="#filter"><i class="ti ti-shield-check"></i>Spam filter</a></li>
+          </ul>
+          <p class="menu-label">Server</p>
+          <ul class="menu-list">
+            <li><a href="#backup"><i class="ti ti-archive"></i>Backup and moving a domain</a></li>
+            <li><a href="#users"><i class="ti ti-users"></i>Users and roles</a></li>
+            <li><a href="#settings"><i class="ti ti-settings"></i>Settings</a></li>
+          </ul>
+          <p class="menu-label">Account</p>
+          <ul class="menu-list">
+            <li><a href="#account"><i class="ti ti-user-circle"></i>Your account</a></li>
           </ul>
         </aside>
       </div>
       <div class="column is-9">
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>Overview</h2></div>
-          <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now.</p></div>
-          <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. It warns 14 days before expiry and fails once expired — clients that verify certificates then refuse to connect.</p></div>
-          <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone.</p></div>
+          <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, and the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now. <a href="health.html">Health</a> shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total.</p></div>
+          <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. It warns 14 days before expiry and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect.</p></div>
+          <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname (<code>SELFPOST_HOSTNAME</code>) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Outbound</h2></div>
-          <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one.</p></div>
-          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login. It may send as any address of its domain or only as listed addresses. The password is shown once at creation or regeneration and is not stored in readable form.</p></div>
-          <div class="sp-help-topic" id="limits"><h3>Rate limits</h3><p>Level 1 is a per-IP ceiling set in <code>.env</code>. Level 2 is optional, per domain and per application, manual or computed from 30-day statistics, and can never exceed level 1.</p></div>
+          <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
+          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once at creation or regeneration and is not stored in readable form.</p></div>
+          <div class="sp-help-topic" id="limits"><h3>Rate limits</h3><p>Level 1 is a per-IP ceiling set in <code>.env</code>. Level 2 is optional, per domain and per application, entered by hand or computed from the last 30 days of sending, and can never exceed level 1. An application's own limit replaces its domain's.</p></div>
+          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient, with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out) and rejected (refused before queueing under a level-2 rate limit, so it never reached Postfix). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id; that file is rotated daily and about two weeks are kept, so an old message may show none. Rows are deleted after the retention set in Server › Settings, 90 days by default. A domain administrator sees only the rows of their own domains.</p></div>
+          <div class="sp-help-topic" id="queue"><h3>Queue and retries</h3><p>The page lists, as <code>postqueue -p</code> prints it, the messages Postfix has accepted and not yet delivered: mail being sent right now and mail deferred for a later attempt. Only the global role can open it, and it only shows; nothing here deletes or forces a message. A deferred message is tried again after the first retry delay, then at gaps that double up to a cap, until the receiving server takes it or the queue lifetime runs out and it bounces; there is no attempt counter, and the box on the page shows this server's values. A queue that keeps growing means a receiver is refusing or not answering: open the message from the Outbound log to read the reason Postfix logged.</p></div>
+          <div class="sp-help-topic" id="dmarc"><h3>DMARC reports</h3><p>An aggregate report is the summary a receiving provider sends, usually daily, to the <code>rua=</code> address of your DMARC record: which servers sent mail as your domain and whether SPF or DKIM passed for it. A domain's report address is one of three choices, set in its Domain settings: no reports (the default for a new domain), the SelfPost hosted address (an address on this server whose reports are parsed and shown under DMARC reports; offered only while hosted reports are enabled on the server), or an address typed for the domain (an ordinary mailbox that receives the raw XML; a button fills in your own profile e-mail). When the typed address is on another domain than the one sending, that domain must publish a report-authorization record, or providers will not send; the domain's page shows it with the other DNS records and checks it. In the tables pass means SPF or DKIM passed and aligned, fail means neither did, and your own server shows as <em>this relay</em>. A fail from any other source is someone else sending as your domain — a forwarder, an application you forgot, or abuse — so do not tighten <code>p=</code> until that sender is fixed or removed. A domain administrator reads the reports of their own domains.</p></div>
+        </div>
+        <div class="box">
+          <div class="sp-box-head"><span class="sp-no">03</span><h2>Inbound</h2></div>
+          <div class="sp-help-topic" id="inbound"><h3>Backup-MX and forwarding</h3><p>An optional backup-MX or forwarder, switched on in the server's <code>.env</code>; the Inbound menu exists only then. Postfix accepts mail on port 25 for the listed domains only and hands each message on to that domain's upstream; there are no mailboxes. For each domain publish the MX record its page shows, and keep a primary MX the domain already has if this is a backup. The MX tag is green when at least one MX of the domain points at this server, and a domain accepts no mail until an upstream is saved on its page. Adding and deleting domains is for the global role.</p></div>
+          <div class="sp-help-topic" id="upstream"><h3>Upstream</h3><p>The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear, Required holds the mail until a TLS session is possible, Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.</p></div>
+          <div class="sp-help-topic" id="recipients"><h3>Valid recipients</h3><p>Choose whom this domain accepts. Listed addresses only: the relay accepts exactly the addresses you list, one per line or comma-separated, and refuses any other while the sender is still connected, so it never has to send a bounce for them. Any recipient: everything at the domain is accepted and passed on, and an address the upstream then rejects comes back as a bounce from this server to a sender who is often forged — backscatter. Prefer a list, and keep it in step with the mailboxes upstream.</p></div>
+          <div class="sp-help-topic" id="filter"><h3>Spam filter</h3><p>The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's <code>.env</code>, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or deferred, so the sending server tries again later, as the server's setting says; the box states which.</p></div>
+        </div>
+        <div class="box">
+          <div class="sp-box-head"><span class="sp-no">04</span><h2>Server</h2></div>
+          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys, application credentials and the queue), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
+          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out of their other sessions.</p></div>
+          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it.</p></div>
+        </div>
+        <div class="box">
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>Account</h2></div>
+          <div class="sp-help-topic" id="account"><h3>Your account</h3><p>Account is your own, whatever your role: your username and e-mail, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected.</p></div>
         </div>
       </div>
     </div>

docs/assets/panel-redesign/panel/in-domain-delete.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/in-domain.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -116,7 +116,7 @@
         <div class="columns">
           <div class="column is-6">
             <div class="box" id="upstream">
-              <div class="sp-box-head"><span class="sp-no">02</span><h2>Upstream</h2><div class="sp-end">Not a mailbox</div></div>
+              <div class="sp-box-head"><span class="sp-no">02</span><h2>Upstream</h2><div class="sp-end">Not a mailbox</div><a class="sp-help" href="help.html#upstream" title="Host, port and TLS"><i class="ti ti-help-circle"></i></a></div>
               <div class="sp-box-body">
                 <form class="sp-form" method="post" action="#">
                   <div class="sp-row">
@@ -132,7 +132,7 @@
           </div>
           <div class="column is-6">
             <div class="box" id="recipients">
-              <div class="sp-box-head"><span class="sp-no">03</span><h2>Valid recipients</h2></div>
+              <div class="sp-box-head"><span class="sp-no">03</span><h2>Valid recipients</h2><a class="sp-help" href="help.html#recipients" title="Listed addresses or any address"><i class="ti ti-help-circle"></i></a></div>
               <div class="sp-box-body">
                 <form class="sp-form" method="post" action="#">
                   <div class="field"><label class="label" for="rmode">Who to accept</label>
@@ -151,7 +151,7 @@ security@lists.example.org</textarea></div>
         </div>
 
         <div class="box" id="filter">
-          <div class="sp-box-head"><span class="sp-no">04</span><h2>Spam filter</h2><div class="sp-end"><span class="tag is-success is-light">on</span></div></div>
+          <div class="sp-box-head"><span class="sp-no">04</span><h2>Spam filter</h2><div class="sp-end"><span class="tag is-success is-light">on</span></div><a class="sp-help" href="help.html#filter" title="A server setting"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
               <div><dt>Engine</dt><dd>rspamd, for every inbound domain of this server</dd></div>

docs/assets/panel-redesign/panel/in-domains.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -87,7 +87,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">02</span><h2>Domains</h2><div class="sp-end">Spam filter <span class="tag is-success is-light">on</span> · 2 domains</div></div>
+      <div class="sp-box-head"><span class="sp-no">02</span><h2>Domains</h2><div class="sp-end">Spam filter <span class="tag is-success is-light">on</span> · 2 domains</div><a class="sp-help" href="help.html#inbound" title="Backup-MX and forwarding"><i class="ti ti-help-circle"></i></a></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
         <thead><tr><th>Domain</th><th>DNS</th><th>Upstream</th><th>Recipients</th><th>TLS to upstream</th><th></th></tr></thead>
         <tbody>

docs/assets/panel-redesign/panel/in-filter-lists.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/in-log.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/in-quarantine-message.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/in-quarantine.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/in-queue.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/login-no-admin.html

@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="light">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Sign in · SelfPost</title>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
+<link rel="stylesheet" href="../shared/brand.css">
+<link rel="stylesheet" href="theme.css">
+</head>
+<body>
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <div class="sp-form">
+      <p class="sp-kicker">mail.example.org</p>
+      <h1 class="title is-3">No administrator yet</h1>
+      <p class="sp-muted">Open the one-time setup link printed in the container log to create one.</p>
+    </div>
+    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>
+
+</body>
+</html>

docs/assets/panel-redesign/panel/out-app-created.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/out-app.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -97,7 +97,7 @@
 
         <div class="column is-4">
           <div class="box">
-            <div class="sp-box-head"><span class="sp-no">02</span><h2>Client IP allow-list</h2><div class="sp-end"><span class="tag is-light">off</span></div></div>
+            <div class="sp-box-head"><span class="sp-no">02</span><h2>Client IP allow-list</h2><div class="sp-end"><span class="tag is-light">off</span></div><a class="sp-help" href="help.html#apps" title="What an application is"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <div class="field"><label class="checkbox"><input type="checkbox" name="auth_ip_restrict"> Restrict to listed IPs</label></div>
               <div class="field"><label class="label" for="ips">Allowed client IPs</label>
@@ -109,7 +109,7 @@
 
         <div class="column is-4">
           <div class="box">
-            <div class="sp-box-head"><span class="sp-no">03</span><h2>Rate limit</h2><div class="sp-end"><span class="tag is-success is-light">active</span></div></div>
+            <div class="sp-box-head"><span class="sp-no">03</span><h2>Rate limit</h2><div class="sp-end"><span class="tag is-success is-light">active</span></div><a class="sp-help" href="help.html#limits" title="Levels 1 and 2"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <div class="field"><label class="label" for="rmode">Limit mode</label>
                 <div class="control"><div class="select is-fullwidth"><select id="rmode" name="rl_mode"><option>Use the domain limit</option><option selected>Manual</option><option>Auto (from statistics)</option></select></div></div></div>

docs/assets/panel-redesign/panel/out-domain-delete.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/out-domain-settings.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -76,25 +76,25 @@
     <div class="columns">
       <div class="column is-6">
         <div class="box" id="reports">
-          <div class="sp-box-head"><span class="sp-no">01</span><h2>DMARC report address</h2></div>
+          <div class="sp-box-head"><span class="sp-no">01</span><h2>DMARC report address</h2><a class="sp-help" href="help.html#dmarc" title="Where DMARC reports go"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="rua">Aggregate reports (rua=)</label>
                 <div class="control"><div class="select is-fullwidth"><select id="rua" name="dmarc_rua_mode">
-                  <option selected>admin's default — mix@example.org</option>
-                  <option>SelfPost hosted (example.org@dmarc.mail.example.org)</option>
-                  <option>My default instead — (you are admin)</option>
-                  <option>No aggregate reports</option>
-                  <option>Custom address</option>
+                  <option>No reports</option>
+                  <option>SelfPost hosted — example.org@dmarc.mail.example.org</option>
+                  <option selected>A specific address</option>
                 </select></div></div>
-                <p class="help">A default belongs to a user and is set under their <a href="account.html#dmarc">Account</a>; a domain follows one named user, so two people sharing a domain never pull it two ways. Changing this changes the DMARC record to publish.</p></div>
+                <p class="help">No reports leaves <code>rua=</code> out of the DMARC record. SelfPost hosted sends them to an address on this server, which parses them for DMARC reports. A specific address is any mailbox, and it receives the raw XML. Changing this changes the DMARC record to publish.</p></div>
+              <div class="field"><label class="label" for="rua_email">Report address</label>
+                <div class="field has-addons"><div class="control is-expanded"><input class="input" id="rua_email" name="dmarc_rua_email" type="email" value="reports@acme.io" placeholder="reports@your-mail-domain.com" autocomplete="off" spellcheck="false"></div><div class="control"><button type="button" class="button" data-fill="rua_email" data-fill-value="mix@example.org"><i class="ti ti-mail"></i>Use my e-mail</button></div></div></div>
               <button type="submit" class="button is-primary">Save report address</button>
             </form>
           </div>
         </div>
 
         <div class="box" id="export">
-          <div class="sp-box-head"><span class="sp-no">03</span><h2>Export domain</h2></div>
+          <div class="sp-box-head"><span class="sp-no">03</span><h2>Export domain</h2><a class="sp-help" href="help.html#backup" title="Moving a domain to another instance"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <p class="mb-3">One file with the DKIM key and every application's password hash — import it on another SelfPost and the published DNS needs no change. <strong>The file is a secret.</strong></p>
             <form class="sp-form" method="post" action="#">

docs/assets/panel-redesign/panel/out-domain.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -132,14 +132,14 @@
           </div>
 
           <div class="sp-record">
-            <div class="sp-record-head"><h3>DMARC</h3><span class="tag is-success is-light">published</span><small>Report address: <a href="out-domain-settings.html#reports">admin's default</a></small></div>
+            <div class="sp-record-head"><h3>DMARC</h3><span class="tag is-success is-light">published</span><small>Report address: <a href="out-domain-settings.html#reports">example.org@dmarc.mail.example.org</a></small></div>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="_dmarc.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
               <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
             </div>
             <div class="field"><label class="label">Value to publish</label>
-              <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=DMARC1; p=none; rua=mailto:dmarc@mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div>
+              <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=DMARC1; p=none; rua=mailto:example.org@dmarc.mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div>
               <p class="help"><code>p=none</code> does not affect delivery. Tighten to <code>quarantine</code>, then <code>reject</code>, once the <a href="dmarc-domain.html">reports</a> look clean.</p></div>
           </div>
         </div>
@@ -149,10 +149,10 @@
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
             <thead><tr><th>Login</th><th>May send as</th><th>30 days</th><th>Limits</th><th></th></tr></thead>
             <tbody>
-              <tr><td class="sp-mono"><strong>prod-server</strong></td><td>*@example.org</td><td class="sp-muted">1 102 msg · peak 96/h</td><td><span class="tag is-success is-light">200 / h</span></td>
-                <td class="sp-actions"><a href="out-app.html">Edit</a><a href="out-app-created.html">New password</a><a class="has-text-danger" href="#">Delete</a></td></tr>
-              <tr><td class="sp-mono"><strong>alerts</strong></td><td>alerts@example.org, noc@example.org</td><td class="sp-muted">182 msg · peak 14/h</td><td><span class="tag is-light">domain</span> <span class="tag is-success is-light">2 IPs</span></td>
-                <td class="sp-actions"><a href="out-app.html">Edit</a><a href="out-app-created.html">New password</a><a class="has-text-danger" href="#">Delete</a></td></tr>
+              <tr><td class="sp-mono sp-nowrap"><strong>prod-server</strong></td><td>*@example.org</td><td class="sp-muted">1 102 msg · peak 96/h</td><td><span class="tag is-success is-light">200 / h</span></td>
+                <td class="sp-actions"><a href="out-app.html">Edit</a><form method="post" action="out-app-created.html"><button type="submit">New password</button></form><form method="post" action="out-domain.html"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
+              <tr><td class="sp-mono sp-nowrap"><strong>alerts</strong></td><td>alerts@example.org, noc@example.org</td><td class="sp-muted">182 msg · peak 14/h</td><td><span class="tag is-light">domain</span> <span class="tag is-success is-light">2 IPs</span></td>
+                <td class="sp-actions"><a href="out-app.html">Edit</a><form method="post" action="out-app-created.html"><button type="submit">New password</button></form><form method="post" action="out-domain.html"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
             </tbody>
           </table></div>
           <div class="sp-box-foot">New password and Delete ask for confirmation; the old password stops working at once.</div>

docs/assets/panel-redesign/panel/out-domains.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/out-log.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -82,6 +82,7 @@
           <div class="select"><select name="status"><option>Any status</option><option>sent</option><option>deferred</option><option>bounced</option><option>rate-limited</option></select></div>
           <button type="submit" class="button"><i class="ti ti-filter"></i>Filter</button>
         </form>
+        <a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
         <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>

docs/assets/panel-redesign/panel/out-message.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -91,7 +91,7 @@
       </div>
       <div class="column is-5">
         <div class="box">
-          <div class="sp-box-head"><span class="sp-no">02</span><h2>History</h2></div>
+          <div class="sp-box-head"><span class="sp-no">02</span><h2>History</h2><a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
               <li><time>13:58:07 UTC</time><strong>Accepted</strong> from <span class="sp-mono">alerts</span> at 198.51.100.7</li>

docs/assets/panel-redesign/panel/out-queue.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -74,7 +74,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">1 message · 3.1 kB</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">1 message · 3.1 kB</div><a class="sp-help" href="help.html#queue" title="What waits here and how Postfix retries"><i class="ti ti-help-circle"></i></a></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
         <thead><tr><th>Queue id</th><th>Arrived, UTC</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
         <tbody>

docs/assets/panel-redesign/panel/outlines.json

@@ -4,15 +4,13 @@
   {
    "columns": [
     {
-     "is-5": [
-      "box[Profile]:body",
-      "box[Password]:body"
+     "is-6": [
+      "box[Profile]:body"
      ]
     },
     {
-     "is-7": [
-      "box[Notifications]:body",
-      "box[DMARC reports]:record×2"
+     "is-6": [
+      "box[Password]:body"
      ]
     }
    ]
@@ -124,7 +122,10 @@
     {
      "is-9": [
       "box[Overview]:help×3",
-      "box[Outbound]:help×3"
+      "box[Outbound]:help×6",
+      "box[Inbound]:help×4",
+      "box[Server]:help×3",
+      "box[Account]:help"
      ]
     }
    ]
@@ -405,8 +406,7 @@
      "columns": [
       {
        "is-6": [
-        "box[Log retention]:body",
-        "box[Notifications]:body"
+        "box[Log retention]:body"
        ]
       },
       {

docs/assets/panel-redesign/panel/overview.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/preflight.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/settings.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -69,7 +69,7 @@
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">Settings</h1>
-        <p class="sp-lead">What holds for the whole instance, whoever is signed in. Your own name, e-mail, notifications and DMARC report address are under <a href="account.html">Account</a>.</p>
+        <p class="sp-lead">What holds for the whole instance, whoever is signed in. Your own name, e-mail and password are under <a href="account.html">Account</a>.</p>
       </div>
     </div>
 
@@ -77,26 +77,18 @@
       <div class="columns">
         <div class="column is-6">
           <div class="box">
-            <div class="sp-box-head"><span class="sp-no">01</span><h2>Log retention</h2></div>
+            <div class="sp-box-head"><span class="sp-no">01</span><h2>Log retention</h2><a class="sp-help" href="help.html#settings" title="How long rows are kept"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <div class="field"><label class="label" for="ret">Keep outbound log rows, days</label>
                 <div class="control"><input class="input" id="ret" name="send_log_retention_days" type="number" min="7" max="365" value="30" required></div>
                 <p class="help">The main driver of <code>/data</code> growth. Does not affect <code>mail.log</code> rotation (fourteen daily files).</p></div>
             </div>
           </div>
-
-          <div class="box">
-            <div class="sp-box-head"><span class="sp-no">02</span><h2>Notifications</h2></div>
-            <div class="sp-box-body">
-              <div class="field"><label class="checkbox"><input type="checkbox" name="notify" checked> Send notification e-mails</label></div>
-              <p class="help">Sent through this relay from <span class="sp-mono">postmaster@mail.example.org</span>. Each user picks the events under <a href="account.html">Account</a>; a user without an e-mail gets none.</p>
-            </div>
-          </div>
         </div>
 
         <div class="column is-6">
           <div class="box" id="rate-limits">
-            <div class="sp-box-head"><span class="sp-no">03</span><h2>Sending rate limits</h2><div class="sp-end">Read-only</div></div>
+            <div class="sp-box-head"><span class="sp-no">02</span><h2>Sending rate limits</h2><div class="sp-end">Read-only</div><a class="sp-help" href="help.html#limits" title="Levels 1 and 2"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <dl class="sp-facts">
                 <div><dt>Level 1 · per client IP</dt><dd class="sp-big">600 / h</dd><dd class="sp-muted">Set in <code>.env</code>; restart to change. Nothing below may exceed it.</dd></div>

docs/assets/panel-redesign/panel/src/account.html

@@ -3,24 +3,26 @@
       <div class="sp-grow">
         <p class="sp-kicker">Signed in as admin · global</p>
         <h1 class="title is-3">Account</h1>
-        <p class="sp-lead">Who you are to this panel, what it should tell you about, and where reports about your domains go. Applications keep their own logins and passwords and are not affected.</p>
+        <p class="sp-lead">Who you are to this panel. Applications keep their own logins and passwords and are not affected.</p>
       </div>
     </div>
 
     <div class="columns">
-      <div class="column is-5">
+      <div class="column is-6">
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>Profile</h2></div>
           <div class="sp-box-body">
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="username">Username</label><div class="control has-icons-left"><input class="input" id="username" name="username" value="admin" autocomplete="username" spellcheck="false" required><span class="icon is-left"><i class="ti ti-user"></i></span></div></div>
               <div class="field"><label class="label" for="email">E-mail</label><div class="control has-icons-left"><input class="input" id="email" name="email" type="email" value="mix@example.org" autocomplete="email"><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
-                <p class="help">Where the panel writes to you: the notifications on the right and a password-reset link. It can also receive DMARC reports — your choice, under <a href="#dmarc">DMARC reports</a>.</p></div>
+                <p class="help">Your own address. A domain's report address can be filled with it from Domain settings.</p></div>
               <button type="submit" class="button is-primary">Save profile</button>
             </form>
           </div>
         </div>
+      </div>
 
+      <div class="column is-6">
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Password</h2></div>
           <div class="sp-box-body">
@@ -36,53 +38,4 @@
           </div>
         </div>
       </div>
-
-      <div class="column is-7">
-        <div class="box">
-          <div class="sp-box-head"><span class="sp-no">03</span><h2>Notifications</h2><div class="sp-end">Sent to mix@example.org</div></div>
-          <div class="sp-box-body">
-            <form class="sp-form" method="post" action="#">
-              <p class="sp-kicker mb-2">Your domains</p>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev" checked> A DNS record stops matching — DKIM, SPF, DMARC or an inbound MX</label></div>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev" checked> A domain or an application reaches its rate limit and mail is being refused</label></div>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev" checked> An inbound domain's upstream cannot be reached and mail is piling up</label></div>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev"> DMARC reports start showing failures for a domain</label></div>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev"> Mail is held in quarantine</label></div>
-              <p class="sp-kicker mt-4 mb-2">The server · global role</p>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev" checked> The TLS certificate is within 14 days of expiry</label></div>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev" checked> A process or a milter socket stops answering</label></div>
-              <div class="field"><label class="checkbox"><input type="checkbox" name="ev"> Messages sit in a queue for more than a day</label></div>
-              <p class="help mb-3">One message when a problem starts and one when it clears — never a stream. A domain administrator is told only about the domains assigned to them.</p>
-              <button type="submit" class="button is-primary">Save notifications</button>
-            </form>
-          </div>
-        </div>
-
-        <div class="box" id="dmarc">
-          <div class="sp-box-head"><span class="sp-no">04</span><h2>DMARC reports</h2><div class="sp-end"><span class="tag is-success is-light">authorized</span></div><a class="sp-help" href="help.html#dmarc" title="What the reports are and where they go"><i class="ti ti-help-circle"></i></a></div>
-          <div class="sp-record">
-            <form class="sp-form" method="post" action="#">
-              <div class="field"><label class="label" for="rua">My default report address</label>
-                <div class="control"><div class="select is-fullwidth"><select id="rua" name="dmarc_default">
-                  <option>SelfPost hosted — read them under DMARC reports</option>
-                  <option selected>My account e-mail — mix@example.org</option>
-                  <option>Another address…</option>
-                  <option>No reports</option>
-                </select></div></div>
-                <p class="help">Used by every outbound domain whose report address is set to <em>admin's default</em> — 2 of your 3 now. Changing it changes the DMARC record those domains must publish. The hosted address is parsed by SelfPost; any other just receives the raw XML.</p></div>
-              <button type="submit" class="button is-primary">Save report address</button>
-            </form>
-          </div>
-          <div class="sp-record">
-            <div class="sp-record-head"><h3>Report authorization</h3><span class="tag is-success is-light">published</span><small>Needed because the address is on another domain than the senders</small></div>
-            <div class="sp-row">
-              <div class="field"><label class="label">Host / name</label>
-                <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="*._report._dmarc.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-              <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
-            </div>
-            <div class="field"><label class="label">Value to publish</label>
-              <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=DMARC1"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-          </div>
-        </div>
-      </div>
     </div>

docs/assets/panel-redesign/panel/src/backup.html

@@ -10,7 +10,7 @@
     <div class="columns">
       <div class="column is-6">
         <div class="box">
-          <div class="sp-box-head"><span class="sp-no">01</span><h2>Full backup</h2></div>
+          <div class="sp-box-head"><span class="sp-no">01</span><h2>Full backup</h2><a class="sp-help" href="help.html#backup" title="Backups, encryption and restore"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <p class="mb-3"><code>data/</code> (database, DKIM keys, credentials, the queue), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code> in one archive. Restore into an empty project directory and start the <strong>same SelfPost version</strong>. The reverse-proxy vhost is not included.</p>
             <form class="sp-form" method="post" action="#">
@@ -28,7 +28,7 @@
 
       <div class="column is-6">
         <div class="box" id="import">
-          <div class="sp-box-head"><span class="sp-no">02</span><h2>Import a domain</h2></div>
+          <div class="sp-box-head"><span class="sp-no">02</span><h2>Import a domain</h2><a class="sp-help" href="help.html#backup" title="Moving a domain to another instance"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <p class="mb-3">A domain export from another instance — plain <code>.json</code> or encrypted <code>.spde</code>. Its DKIM key and application passwords come across, so the published DNS needs no change. The export itself is made on the <a href="out-domain-settings.html#export">domain's settings</a>.</p>
             <form class="sp-form" method="post" action="out-domain.html" enctype="multipart/form-data">

docs/assets/panel-redesign/panel/src/components.html

@@ -106,7 +106,7 @@
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
             <thead><tr><th>Time, UTC</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
             <tbody>
-              <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td><a href="#"><strong>the row's link</strong></a></td><td class="sp-clip">A long subject is clipped with an ellipsis instead of wrapping the row</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="#">Details</a><a class="has-text-danger" href="#">Delete</a></td></tr>
+              <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td><a href="#"><strong>the row's link</strong></a></td><td class="sp-clip">A long subject is clipped with an ellipsis instead of wrapping the row</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="#">Details</a><form method="post" action="#"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
             </tbody>
           </table></div>
           <div class="sp-box-foot"><span>Page 1 of 9</span><a href="#">Older →</a></div>

docs/assets/panel-redesign/panel/src/dmarc-domain.html

@@ -12,7 +12,7 @@
     <div class="columns">
       <div class="column is-5">
         <div class="box">
-          <div class="sp-box-head"><span class="sp-no">01</span><h2>Sources · 7 days</h2></div>
+          <div class="sp-box-head"><span class="sp-no">01</span><h2>Sources · 7 days</h2><a class="sp-help" href="help.html#dmarc" title="How to read pass, fail and sources"><i class="ti ti-help-circle"></i></a></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Source</th><th>Pass</th><th>Fail</th><th>Disposition</th></tr></thead>
             <tbody>

docs/assets/panel-redesign/panel/src/dmarc-report.html

@@ -10,7 +10,7 @@
     <div class="columns">
       <div class="column is-6">
         <div class="box">
-          <div class="sp-box-head"><span class="sp-no">01</span><h2>Report</h2></div>
+          <div class="sp-box-head"><span class="sp-no">01</span><h2>Report</h2><a class="sp-help" href="help.html#dmarc" title="What an aggregate report is"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
               <div><dt>Reporter</dt><dd>Outlook.com</dd></div>

docs/assets/panel-redesign/panel/src/dmarc.html

@@ -8,12 +8,12 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Ingest</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Ingest</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#dmarc" title="What the reports are and where they go"><i class="ti ti-help-circle"></i></a></div>
       <div class="sp-box-body">
         <dl class="sp-facts">
           <div><dt>Last report</dt><dd>2026-09-21 06:12 UTC</dd></div>
           <div><dt>This week</dt><dd>14 kept · 0 parse failures</dd></div>
-          <div><dt>Hosted address</dt><dd class="sp-mono">dmarc@mail.example.org</dd></div>
+          <div><dt>Hosted addresses</dt><dd class="sp-mono">dmarc-reports+&lt;domain&gt;@mail.example.org</dd></div>
           <div><dt>Retention</dt><dd>500 reports or 90 days</dd></div>
         </dl>
       </div>

docs/assets/panel-redesign/panel/src/health.html

@@ -11,7 +11,7 @@
     <div class="columns">
       <div class="column is-6">
         <div class="box" id="machine">
-          <div class="sp-box-head"><span class="sp-no">01</span><h2>Machine</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div></div>
+          <div class="sp-box-head"><span class="sp-no">01</span><h2>Machine</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#checks" title="What these readings mean"><i class="ti ti-help-circle"></i></a></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Resource</th><th>Usage</th><th>Detail</th></tr></thead>
             <tbody>
@@ -42,7 +42,7 @@
     <div class="columns">
       <div class="column is-4">
         <div class="box" id="certificate">
-          <div class="sp-box-head"><span class="sp-no">03</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-warning is-light">warn</span></div></div>
+          <div class="sp-box-head"><span class="sp-no">03</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-warning is-light">warn</span></div><a class="sp-help" href="help.html#certificate" title="When it warns and what to do"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
               <div><dt>Expires</dt><dd class="sp-mono">2026-10-03 09:14 UTC</dd></div>
@@ -68,7 +68,7 @@
       </div>
       <div class="column is-4">
         <div class="box" id="hostname">
-          <div class="sp-box-head"><span class="sp-no">05</span><h2>Hostname and reverse DNS</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div></div>
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>Hostname and reverse DNS</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#rdns" title="Forward and reverse DNS"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
               <div><dt>Hostname</dt><dd class="sp-mono">mail.example.org</dd></div>

docs/assets/panel-redesign/panel/src/help.html

@@ -3,7 +3,7 @@
       <div class="sp-grow">
         <p class="sp-kicker">Reference</p>
         <h1 class="title is-3">Help</h1>
-        <p class="sp-lead">What each screen checks and what to do when it is not green. Every numbered section on a page links to its topic here.</p>
+        <p class="sp-lead">What each screen checks or does, and what to do when it is not green. The ? in a box's head opens its topic here.</p>
       </div>
     </div>
 
@@ -21,27 +21,61 @@
             <li><a href="#dns"><i class="ti ti-world-check"></i>DNS records</a></li>
             <li><a href="#apps"><i class="ti ti-apps"></i>Applications</a></li>
             <li><a href="#limits"><i class="ti ti-gauge"></i>Rate limits</a></li>
+            <li><a href="#log"><i class="ti ti-list-details"></i>Outbound log</a></li>
             <li><a href="#queue"><i class="ti ti-stack-2"></i>Queue and retries</a></li>
             <li><a href="#dmarc"><i class="ti ti-report-analytics"></i>DMARC reports</a></li>
           </ul>
           <p class="menu-label">Inbound</p>
           <ul class="menu-list">
             <li><a href="#inbound"><i class="ti ti-inbox"></i>Backup-MX and forwarding</a></li>
+            <li><a href="#upstream"><i class="ti ti-arrow-forward-up"></i>Upstream</a></li>
+            <li><a href="#recipients"><i class="ti ti-address-book"></i>Valid recipients</a></li>
+            <li><a href="#filter"><i class="ti ti-shield-check"></i>Spam filter</a></li>
+          </ul>
+          <p class="menu-label">Server</p>
+          <ul class="menu-list">
+            <li><a href="#backup"><i class="ti ti-archive"></i>Backup and moving a domain</a></li>
+            <li><a href="#users"><i class="ti ti-users"></i>Users and roles</a></li>
+            <li><a href="#settings"><i class="ti ti-settings"></i>Settings</a></li>
+          </ul>
+          <p class="menu-label">Account</p>
+          <ul class="menu-list">
+            <li><a href="#account"><i class="ti ti-user-circle"></i>Your account</a></li>
           </ul>
         </aside>
       </div>
       <div class="column is-9">
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>Overview</h2></div>
-          <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now.</p></div>
-          <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. It warns 14 days before expiry and fails once expired — clients that verify certificates then refuse to connect.</p></div>
-          <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone.</p></div>
+          <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, and the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now. <a href="health.html">Health</a> shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total.</p></div>
+          <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. It warns 14 days before expiry and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect.</p></div>
+          <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname (<code>SELFPOST_HOSTNAME</code>) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Outbound</h2></div>
-          <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one.</p></div>
-          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login. It may send as any address of its domain or only as listed addresses. The password is shown once at creation or regeneration and is not stored in readable form.</p></div>
-          <div class="sp-help-topic" id="limits"><h3>Rate limits</h3><p>Level 1 is a per-IP ceiling set in <code>.env</code>. Level 2 is optional, per domain and per application, manual or computed from 30-day statistics, and can never exceed level 1.</p></div>
+          <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
+          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once at creation or regeneration and is not stored in readable form.</p></div>
+          <div class="sp-help-topic" id="limits"><h3>Rate limits</h3><p>Level 1 is a per-IP ceiling set in <code>.env</code>. Level 2 is optional, per domain and per application, entered by hand or computed from the last 30 days of sending, and can never exceed level 1. An application's own limit replaces its domain's.</p></div>
+          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient, with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out) and rejected (refused before queueing under a level-2 rate limit, so it never reached Postfix). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id; that file is rotated daily and about two weeks are kept, so an old message may show none. Rows are deleted after the retention set in Server › Settings, 90 days by default. A domain administrator sees only the rows of their own domains.</p></div>
+          <div class="sp-help-topic" id="queue"><h3>Queue and retries</h3><p>The page lists, as <code>postqueue -p</code> prints it, the messages Postfix has accepted and not yet delivered: mail being sent right now and mail deferred for a later attempt. Only the global role can open it, and it only shows; nothing here deletes or forces a message. A deferred message is tried again after the first retry delay, then at gaps that double up to a cap, until the receiving server takes it or the queue lifetime runs out and it bounces; there is no attempt counter, and the box on the page shows this server's values. A queue that keeps growing means a receiver is refusing or not answering: open the message from the Outbound log to read the reason Postfix logged.</p></div>
+          <div class="sp-help-topic" id="dmarc"><h3>DMARC reports</h3><p>An aggregate report is the summary a receiving provider sends, usually daily, to the <code>rua=</code> address of your DMARC record: which servers sent mail as your domain and whether SPF or DKIM passed for it. A domain's report address is one of three choices, set in its Domain settings: no reports (the default for a new domain), the SelfPost hosted address (an address on this server whose reports are parsed and shown under DMARC reports; offered only while hosted reports are enabled on the server), or an address typed for the domain (an ordinary mailbox that receives the raw XML; a button fills in your own profile e-mail). When the typed address is on another domain than the one sending, that domain must publish a report-authorization record, or providers will not send; the domain's page shows it with the other DNS records and checks it. In the tables pass means SPF or DKIM passed and aligned, fail means neither did, and your own server shows as <em>this relay</em>. A fail from any other source is someone else sending as your domain — a forwarder, an application you forgot, or abuse — so do not tighten <code>p=</code> until that sender is fixed or removed. A domain administrator reads the reports of their own domains.</p></div>
+        </div>
+        <div class="box">
+          <div class="sp-box-head"><span class="sp-no">03</span><h2>Inbound</h2></div>
+          <div class="sp-help-topic" id="inbound"><h3>Backup-MX and forwarding</h3><p>An optional backup-MX or forwarder, switched on in the server's <code>.env</code>; the Inbound menu exists only then. Postfix accepts mail on port 25 for the listed domains only and hands each message on to that domain's upstream; there are no mailboxes. For each domain publish the MX record its page shows, and keep a primary MX the domain already has if this is a backup. The MX tag is green when at least one MX of the domain points at this server, and a domain accepts no mail until an upstream is saved on its page. Adding and deleting domains is for the global role.</p></div>
+          <div class="sp-help-topic" id="upstream"><h3>Upstream</h3><p>The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear, Required holds the mail until a TLS session is possible, Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.</p></div>
+          <div class="sp-help-topic" id="recipients"><h3>Valid recipients</h3><p>Choose whom this domain accepts. Listed addresses only: the relay accepts exactly the addresses you list, one per line or comma-separated, and refuses any other while the sender is still connected, so it never has to send a bounce for them. Any recipient: everything at the domain is accepted and passed on, and an address the upstream then rejects comes back as a bounce from this server to a sender who is often forged — backscatter. Prefer a list, and keep it in step with the mailboxes upstream.</p></div>
+          <div class="sp-help-topic" id="filter"><h3>Spam filter</h3><p>The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's <code>.env</code>, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or deferred, so the sending server tries again later, as the server's setting says; the box states which.</p></div>
+        </div>
+        <div class="box">
+          <div class="sp-box-head"><span class="sp-no">04</span><h2>Server</h2></div>
+          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys, application credentials and the queue), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
+          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out of their other sessions.</p></div>
+          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it.</p></div>
+        </div>
+        <div class="box">
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>Account</h2></div>
+          <div class="sp-help-topic" id="account"><h3>Your account</h3><p>Account is your own, whatever your role: your username and e-mail, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected.</p></div>
         </div>
       </div>
     </div>

docs/assets/panel-redesign/panel/src/in-domain.html

@@ -50,7 +50,7 @@
         <div class="columns">
           <div class="column is-6">
             <div class="box" id="upstream">
-              <div class="sp-box-head"><span class="sp-no">02</span><h2>Upstream</h2><div class="sp-end">Not a mailbox</div></div>
+              <div class="sp-box-head"><span class="sp-no">02</span><h2>Upstream</h2><div class="sp-end">Not a mailbox</div><a class="sp-help" href="help.html#upstream" title="Host, port and TLS"><i class="ti ti-help-circle"></i></a></div>
               <div class="sp-box-body">
                 <form class="sp-form" method="post" action="#">
                   <div class="sp-row">
@@ -66,7 +66,7 @@
           </div>
           <div class="column is-6">
             <div class="box" id="recipients">
-              <div class="sp-box-head"><span class="sp-no">03</span><h2>Valid recipients</h2></div>
+              <div class="sp-box-head"><span class="sp-no">03</span><h2>Valid recipients</h2><a class="sp-help" href="help.html#recipients" title="Listed addresses or any address"><i class="ti ti-help-circle"></i></a></div>
               <div class="sp-box-body">
                 <form class="sp-form" method="post" action="#">
                   <div class="field"><label class="label" for="rmode">Who to accept</label>
@@ -85,7 +85,7 @@ security@lists.example.org</textarea></div>
         </div>
 
         <div class="box" id="filter">
-          <div class="sp-box-head"><span class="sp-no">04</span><h2>Spam filter</h2><div class="sp-end"><span class="tag is-success is-light">on</span></div></div>
+          <div class="sp-box-head"><span class="sp-no">04</span><h2>Spam filter</h2><div class="sp-end"><span class="tag is-success is-light">on</span></div><a class="sp-help" href="help.html#filter" title="A server setting"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
               <div><dt>Engine</dt><dd>rspamd, for every inbound domain of this server</dd></div>

docs/assets/panel-redesign/panel/src/in-domains.html

@@ -21,7 +21,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">02</span><h2>Domains</h2><div class="sp-end">Spam filter <span class="tag is-success is-light">on</span> · 2 domains</div></div>
+      <div class="sp-box-head"><span class="sp-no">02</span><h2>Domains</h2><div class="sp-end">Spam filter <span class="tag is-success is-light">on</span> · 2 domains</div><a class="sp-help" href="help.html#inbound" title="Backup-MX and forwarding"><i class="ti ti-help-circle"></i></a></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
         <thead><tr><th>Domain</th><th>DNS</th><th>Upstream</th><th>Recipients</th><th>TLS to upstream</th><th></th></tr></thead>
         <tbody>

docs/assets/panel-redesign/panel/src/login-no-admin.html

@@ -0,0 +1,17 @@
+<!-- title: Sign in | shell: bare -->
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <div class="sp-form">
+      <p class="sp-kicker">mail.example.org</p>
+      <h1 class="title is-3">No administrator yet</h1>
+      <p class="sp-muted">Open the one-time setup link printed in the container log to create one.</p>
+    </div>
+    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>

docs/assets/panel-redesign/panel/src/out-app.html

@@ -31,7 +31,7 @@
 
         <div class="column is-4">
           <div class="box">
-            <div class="sp-box-head"><span class="sp-no">02</span><h2>Client IP allow-list</h2><div class="sp-end"><span class="tag is-light">off</span></div></div>
+            <div class="sp-box-head"><span class="sp-no">02</span><h2>Client IP allow-list</h2><div class="sp-end"><span class="tag is-light">off</span></div><a class="sp-help" href="help.html#apps" title="What an application is"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <div class="field"><label class="checkbox"><input type="checkbox" name="auth_ip_restrict"> Restrict to listed IPs</label></div>
               <div class="field"><label class="label" for="ips">Allowed client IPs</label>
@@ -43,7 +43,7 @@
 
         <div class="column is-4">
           <div class="box">
-            <div class="sp-box-head"><span class="sp-no">03</span><h2>Rate limit</h2><div class="sp-end"><span class="tag is-success is-light">active</span></div></div>
+            <div class="sp-box-head"><span class="sp-no">03</span><h2>Rate limit</h2><div class="sp-end"><span class="tag is-success is-light">active</span></div><a class="sp-help" href="help.html#limits" title="Levels 1 and 2"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <div class="field"><label class="label" for="rmode">Limit mode</label>
                 <div class="control"><div class="select is-fullwidth"><select id="rmode" name="rl_mode"><option>Use the domain limit</option><option selected>Manual</option><option>Auto (from statistics)</option></select></div></div></div>

docs/assets/panel-redesign/panel/src/out-domain-settings.html

@@ -10,25 +10,25 @@
     <div class="columns">
       <div class="column is-6">
         <div class="box" id="reports">
-          <div class="sp-box-head"><span class="sp-no">01</span><h2>DMARC report address</h2></div>
+          <div class="sp-box-head"><span class="sp-no">01</span><h2>DMARC report address</h2><a class="sp-help" href="help.html#dmarc" title="Where DMARC reports go"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="rua">Aggregate reports (rua=)</label>
                 <div class="control"><div class="select is-fullwidth"><select id="rua" name="dmarc_rua_mode">
-                  <option selected>admin's default — mix@example.org</option>
-                  <option>SelfPost hosted (example.org@dmarc.mail.example.org)</option>
-                  <option>My default instead — (you are admin)</option>
-                  <option>No aggregate reports</option>
-                  <option>Custom address</option>
+                  <option>No reports</option>
+                  <option>SelfPost hosted — example.org@dmarc.mail.example.org</option>
+                  <option selected>A specific address</option>
                 </select></div></div>
-                <p class="help">A default belongs to a user and is set under their <a href="account.html#dmarc">Account</a>; a domain follows one named user, so two people sharing a domain never pull it two ways. Changing this changes the DMARC record to publish.</p></div>
+                <p class="help">No reports leaves <code>rua=</code> out of the DMARC record. SelfPost hosted sends them to an address on this server, which parses them for DMARC reports. A specific address is any mailbox, and it receives the raw XML. Changing this changes the DMARC record to publish.</p></div>
+              <div class="field"><label class="label" for="rua_email">Report address</label>
+                <div class="field has-addons"><div class="control is-expanded"><input class="input" id="rua_email" name="dmarc_rua_email" type="email" value="reports@acme.io" placeholder="reports@your-mail-domain.com" autocomplete="off" spellcheck="false"></div><div class="control"><button type="button" class="button" data-fill="rua_email" data-fill-value="mix@example.org"><i class="ti ti-mail"></i>Use my e-mail</button></div></div></div>
               <button type="submit" class="button is-primary">Save report address</button>
             </form>
           </div>
         </div>
 
         <div class="box" id="export">
-          <div class="sp-box-head"><span class="sp-no">03</span><h2>Export domain</h2></div>
+          <div class="sp-box-head"><span class="sp-no">03</span><h2>Export domain</h2><a class="sp-help" href="help.html#backup" title="Moving a domain to another instance"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <p class="mb-3">One file with the DKIM key and every application's password hash — import it on another SelfPost and the published DNS needs no change. <strong>The file is a secret.</strong></p>
             <form class="sp-form" method="post" action="#">

docs/assets/panel-redesign/panel/src/out-domain.html

@@ -66,14 +66,14 @@
           </div>
 
           <div class="sp-record">
-            <div class="sp-record-head"><h3>DMARC</h3><span class="tag is-success is-light">published</span><small>Report address: <a href="out-domain-settings.html#reports">admin's default</a></small></div>
+            <div class="sp-record-head"><h3>DMARC</h3><span class="tag is-success is-light">published</span><small>Report address: <a href="out-domain-settings.html#reports">example.org@dmarc.mail.example.org</a></small></div>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="_dmarc.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
               <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
             </div>
             <div class="field"><label class="label">Value to publish</label>
-              <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=DMARC1; p=none; rua=mailto:dmarc@mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div>
+              <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=DMARC1; p=none; rua=mailto:example.org@dmarc.mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div>
               <p class="help"><code>p=none</code> does not affect delivery. Tighten to <code>quarantine</code>, then <code>reject</code>, once the <a href="dmarc-domain.html">reports</a> look clean.</p></div>
           </div>
         </div>
@@ -83,10 +83,10 @@
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
             <thead><tr><th>Login</th><th>May send as</th><th>30 days</th><th>Limits</th><th></th></tr></thead>
             <tbody>
-              <tr><td class="sp-mono"><strong>prod-server</strong></td><td>*@example.org</td><td class="sp-muted">1 102 msg · peak 96/h</td><td><span class="tag is-success is-light">200 / h</span></td>
-                <td class="sp-actions"><a href="out-app.html">Edit</a><a href="out-app-created.html">New password</a><a class="has-text-danger" href="#">Delete</a></td></tr>
-              <tr><td class="sp-mono"><strong>alerts</strong></td><td>alerts@example.org, noc@example.org</td><td class="sp-muted">182 msg · peak 14/h</td><td><span class="tag is-light">domain</span> <span class="tag is-success is-light">2 IPs</span></td>
-                <td class="sp-actions"><a href="out-app.html">Edit</a><a href="out-app-created.html">New password</a><a class="has-text-danger" href="#">Delete</a></td></tr>
+              <tr><td class="sp-mono sp-nowrap"><strong>prod-server</strong></td><td>*@example.org</td><td class="sp-muted">1 102 msg · peak 96/h</td><td><span class="tag is-success is-light">200 / h</span></td>
+                <td class="sp-actions"><a href="out-app.html">Edit</a><form method="post" action="out-app-created.html"><button type="submit">New password</button></form><form method="post" action="out-domain.html"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
+              <tr><td class="sp-mono sp-nowrap"><strong>alerts</strong></td><td>alerts@example.org, noc@example.org</td><td class="sp-muted">182 msg · peak 14/h</td><td><span class="tag is-light">domain</span> <span class="tag is-success is-light">2 IPs</span></td>
+                <td class="sp-actions"><a href="out-app.html">Edit</a><form method="post" action="out-app-created.html"><button type="submit">New password</button></form><form method="post" action="out-domain.html"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
             </tbody>
           </table></div>
           <div class="sp-box-foot">New password and Delete ask for confirmation; the old password stops working at once.</div>

docs/assets/panel-redesign/panel/src/out-log.html

@@ -16,6 +16,7 @@
           <div class="select"><select name="status"><option>Any status</option><option>sent</option><option>deferred</option><option>bounced</option><option>rate-limited</option></select></div>
           <button type="submit" class="button"><i class="ti ti-filter"></i>Filter</button>
         </form>
+        <a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
         <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>

docs/assets/panel-redesign/panel/src/out-message.html

@@ -25,7 +25,7 @@
       </div>
       <div class="column is-5">
         <div class="box">
-          <div class="sp-box-head"><span class="sp-no">02</span><h2>History</h2></div>
+          <div class="sp-box-head"><span class="sp-no">02</span><h2>History</h2><a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
               <li><time>13:58:07 UTC</time><strong>Accepted</strong> from <span class="sp-mono">alerts</span> at 198.51.100.7</li>

docs/assets/panel-redesign/panel/src/out-queue.html

@@ -8,7 +8,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">1 message · 3.1 kB</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">1 message · 3.1 kB</div><a class="sp-help" href="help.html#queue" title="What waits here and how Postfix retries"><i class="ti ti-help-circle"></i></a></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
         <thead><tr><th>Queue id</th><th>Arrived, UTC</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
         <tbody>

docs/assets/panel-redesign/panel/src/settings.html

@@ -3,7 +3,7 @@
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">Settings</h1>
-        <p class="sp-lead">What holds for the whole instance, whoever is signed in. Your own name, e-mail, notifications and DMARC report address are under <a href="account.html">Account</a>.</p>
+        <p class="sp-lead">What holds for the whole instance, whoever is signed in. Your own name, e-mail and password are under <a href="account.html">Account</a>.</p>
       </div>
     </div>
 
@@ -11,26 +11,18 @@
       <div class="columns">
         <div class="column is-6">
           <div class="box">
-            <div class="sp-box-head"><span class="sp-no">01</span><h2>Log retention</h2></div>
+            <div class="sp-box-head"><span class="sp-no">01</span><h2>Log retention</h2><a class="sp-help" href="help.html#settings" title="How long rows are kept"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <div class="field"><label class="label" for="ret">Keep outbound log rows, days</label>
                 <div class="control"><input class="input" id="ret" name="send_log_retention_days" type="number" min="7" max="365" value="30" required></div>
                 <p class="help">The main driver of <code>/data</code> growth. Does not affect <code>mail.log</code> rotation (fourteen daily files).</p></div>
             </div>
           </div>
-
-          <div class="box">
-            <div class="sp-box-head"><span class="sp-no">02</span><h2>Notifications</h2></div>
-            <div class="sp-box-body">
-              <div class="field"><label class="checkbox"><input type="checkbox" name="notify" checked> Send notification e-mails</label></div>
-              <p class="help">Sent through this relay from <span class="sp-mono">postmaster@mail.example.org</span>. Each user picks the events under <a href="account.html">Account</a>; a user without an e-mail gets none.</p>
-            </div>
-          </div>
         </div>
 
         <div class="column is-6">
           <div class="box" id="rate-limits">
-            <div class="sp-box-head"><span class="sp-no">03</span><h2>Sending rate limits</h2><div class="sp-end">Read-only</div></div>
+            <div class="sp-box-head"><span class="sp-no">02</span><h2>Sending rate limits</h2><div class="sp-end">Read-only</div><a class="sp-help" href="help.html#limits" title="Levels 1 and 2"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <dl class="sp-facts">
                 <div><dt>Level 1 · per client IP</dt><dd class="sp-big">600 / h</dd><dd class="sp-muted">Set in <code>.env</code>; restart to change. Nothing below may exceed it.</dd></div>

docs/assets/panel-redesign/panel/src/user.html

@@ -12,7 +12,7 @@
       <div class="columns">
         <div class="column is-6">
           <div class="box">
-            <div class="sp-box-head"><span class="sp-no">01</span><h2>Account</h2></div>
+            <div class="sp-box-head"><span class="sp-no">01</span><h2>Account</h2><a class="sp-help" href="help.html#users" title="Roles and domain assignments"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <div class="field"><label class="label" for="username">Username</label><div class="control"><input class="input" id="username" name="username" value="acme-ops" autocomplete="username" spellcheck="false" required></div></div>
               <div class="field"><label class="label" for="email">E-mail</label><div class="control"><input class="input" id="email" name="email" type="email" value="ops@acme.io" autocomplete="off"></div>

docs/assets/panel-redesign/panel/src/users.html

@@ -11,7 +11,7 @@
     <div class="notification is-success is-light"><i class="ti ti-circle-check"></i>User <strong>acme-ops</strong> created.</div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Panel users</h2><div class="sp-end">3 users</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Panel users</h2><div class="sp-end">3 users</div><a class="sp-help" href="help.html#users" title="Roles are a reach, not a rank"><i class="ti ti-help-circle"></i></a></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
         <thead><tr><th>Username</th><th>E-mail</th><th>Role</th><th>Outbound domains</th><th>Inbound domains</th><th></th></tr></thead>
         <tbody>

docs/assets/panel-redesign/panel/system-log.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/theme.css

@@ -64,6 +64,14 @@ code { background: var(--sp-well); color: var(--sp-ink); border-radius: 3px; pad
 .navbar.is-primary .navbar-dropdown .navbar-item .ti { margin-right: .6rem; color: var(--sp-muted); }
 .navbar.is-primary .navbar-dropdown .navbar-item.is-active { color: var(--sp-brick); font-weight: 600; background: var(--sp-brick-tint); }
 .navbar.is-primary .navbar-dropdown .navbar-item.is-active .ti { color: var(--sp-brick); }
+/* Sign out is a POST, so it is a form with a button rather than a link. Bulma
+   tints only a.navbar-item; the button is handed the same variables, and the
+   form stretches it across the menu, so it answers the pointer, the keyboard
+   and a press exactly like the entries above it. */
+.navbar-dropdown form { display: flex; }
+.navbar-dropdown button.navbar-item { flex: 1; cursor: pointer; }
+.navbar-dropdown button.navbar-item:hover, .navbar-dropdown button.navbar-item:focus { --bulma-navbar-item-background-l-delta: var(--bulma-navbar-item-hover-background-l-delta); }
+.navbar-dropdown button.navbar-item:active { --bulma-navbar-item-background-l-delta: var(--bulma-navbar-item-active-background-l-delta); }
 .navbar.is-primary .sp-current > .navbar-link, .navbar.is-primary a.navbar-item.sp-current { background: rgb(0 0 0 / .18); }
 /* The header is built like the mark: a brick field, then the stamp's paper
    margin, and the perforation runs along the outer edge of that margin — round
@@ -153,7 +161,14 @@ code { background: var(--sp-well); color: var(--sp-ink); border-radius: 3px; pad
 .box > .table-container td:first-child, .box > .table-container th:first-child { padding-left: 1.25rem; }
 .box > .table-container td:last-child, .box > .table-container th:last-child { padding-right: 1.25rem; }
 .table td.sp-actions { text-align: right; white-space: nowrap; }
-.table td.sp-actions a { margin-left: .9rem; }
+/* An action that changes state (New password, Delete) is a POST, so it is a form
+   with a button, not a link. The form sits inline like the links beside it and
+   the button is handed the link's colour and type; Bulma already resets the
+   button and shares the pointer and the focus ring between a and button, and a
+   link here has no hover colour of its own. */
+.table td.sp-actions a, .table td.sp-actions form { margin-left: .9rem; }
+.table td.sp-actions form { display: inline; }
+.table td.sp-actions button { color: var(--bulma-link-text); font: inherit; }
 .table td.sp-clip { max-width: 13rem; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .tag { font-family: var(--sp-mono); font-weight: 600; letter-spacing: .04em; }
 .sp-empty { padding: 2.2rem 1.25rem; text-align: center; color: var(--sp-muted); }
@@ -241,7 +256,7 @@ code { background: var(--sp-well); color: var(--sp-ink); border-radius: 3px; pad
 .sp-signin-brand img { width: 20rem; max-width: 100%; height: auto; }
 .sp-signin-brand p { font-family: var(--sp-mono); letter-spacing: .18em; font-size: var(--sp-fs-xs); color: var(--sp-on-brick); margin-top: 1.6rem; }
 .sp-signin-form { display: flex; flex-direction: column; justify-content: center; padding: 3rem; }
-.sp-signin-form form { width: 22rem; max-width: 100%; margin-inline: auto; }
+.sp-signin-form .sp-form { width: 22rem; max-width: 100%; margin-inline: auto; }
 .sp-foot { color: var(--sp-muted); font-size: var(--sp-fs-s); padding-block: 1.5rem 0; }
 .sp-foot a { color: inherit; text-decoration: underline; }
 .sp-signin-form .sp-foot { text-align: center; margin-top: 2.5rem; }

docs/assets/panel-redesign/panel/user-delete.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/user.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -78,7 +78,7 @@
       <div class="columns">
         <div class="column is-6">
           <div class="box">
-            <div class="sp-box-head"><span class="sp-no">01</span><h2>Account</h2></div>
+            <div class="sp-box-head"><span class="sp-no">01</span><h2>Account</h2><a class="sp-help" href="help.html#users" title="Roles and domain assignments"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <div class="field"><label class="label" for="username">Username</label><div class="control"><input class="input" id="username" name="username" value="acme-ops" autocomplete="username" spellcheck="false" required></div></div>
               <div class="field"><label class="label" for="email">E-mail</label><div class="control"><input class="input" id="email" name="email" type="email" value="ops@acme.io" autocomplete="off"></div>

docs/assets/panel-redesign/panel/users.html

@@ -54,7 +54,7 @@
             <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
             <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
             <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html"><i class="ti ti-logout"></i>Sign out</a>
+            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
           </div>
         </div>
       </div>
@@ -77,7 +77,7 @@
     <div class="notification is-success is-light"><i class="ti ti-circle-check"></i>User <strong>acme-ops</strong> created.</div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Panel users</h2><div class="sp-end">3 users</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Panel users</h2><div class="sp-end">3 users</div><a class="sp-help" href="help.html#users" title="Roles are a reach, not a rank"><i class="ti ti-help-circle"></i></a></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
         <thead><tr><th>Username</th><th>E-mail</th><th>Role</th><th>Outbound domains</th><th>Inbound domains</th><th></th></tr></thead>
         <tbody>

docs/development.md

@@ -180,6 +180,9 @@ the tree are AGPL-3.0-compatible.
 |---|---|---|---|
 | `internal/web/view/static/htmx.min.js` | 2.0.4 | <https://github.com/bigskysoftware/htmx> | 0BSD |
 | `internal/web/view/static/ibm-plex-*.woff2` | latin subset | <https://github.com/IBM/plex> | SIL OFL 1.1 (`OFL.txt` beside the files) |
+| `internal/web/view/static/bulma.min.css` | 1.0.4 | <https://github.com/jgthms/bulma> | MIT |
+| `internal/web/view/static/tabler-icons.css` | 3.49.0 (57-icon subset) | <https://github.com/tabler/tabler-icons> | MIT |
+| `internal/web/view/static/tabler-icons.woff2` | 3.49.0 (57-icon subset) | <https://github.com/tabler/tabler-icons> | MIT |
 
 ### E2e module (`test/e2e/go.mod`)
 
@@ -349,6 +352,30 @@ go test ./...
 — every new `loadConfig` key must appear in the env lists in [guide.md](guide.md)
 ([cmd/panel/envdoc_test.go](../cmd/panel/envdoc_test.go)).
 
+### Panel pages: the component kit and its guards
+
+Every panel page is built from the component kit in
+[internal/web/view](../internal/web/view): partials in
+`templates/components.html`, their typed input in `components.go`, one stylesheet
+`static/panel.css`, one layout `layout.html`. A page template calls partials with
+a struct from a `view.New…` constructor and writes no component markup of its
+own ([architecture.md § Panel HTTP surface](architecture.md#panel-http-surface)).
+The guard tests (`internal/web/guard_*_test.go`, `internal/web/view/guard_*_test.go`)
+run in `go test ./...` and read their rules from the accepted mockups under
+[docs/assets/panel-redesign/panel/](assets/panel-redesign/index.html): which
+classes and icons exist, what `panel.css` may contain, what component skeleton
+each page has, which routes exist. A failing guard means the page is wrong, not
+the guard.
+
+Changing the design is mockup first: edit the fragment under `panel/src/`, run
+`build.py` and `check.py --write`, commit as `design: …`, get it accepted, and
+only then touch `internal/web`. CI enforces the order with `design-first`
+([.github/scripts/design-first.sh](../.github/scripts/design-first.sh)): a commit
+that changes the mockups, a guard or the script touches nothing else under
+`internal/web/`, and a template that returns from git history is refused.
+[plans/panel-redesign.md](plans/panel-redesign.md) § The contract and
+§ Enforcement have the full rules.
+
 ### End-to-end (container suite)
 
 Separate Go module `test/e2e/`; **not** included in the main module's
@@ -388,7 +415,9 @@ Workflows in [.github/workflows/](../.github/workflows/). What each job runs —
 
 ### `test.yml` — every push and PR to `main`
 
-`gofmt -l` → `go vet ./...` → `go test ./...` (main module, no e2e).
+`design-first` (needs the full history) → `gofmt -l` → `go vet ./...` →
+`go test ./...` (main module, no e2e; includes the panel guard tests, see
+[§ Panel pages](#panel-pages-the-component-kit-and-its-guards)).
 
 ### `release.yml` — published GitHub Release, or `workflow_dispatch` with SemVer
 

docs/guide.md

@@ -6,9 +6,15 @@ overview and quick start, see [README.md](../README.md).
 This guide has three parts: **[Installation](#installation)** (getting a
 container running with a working reverse proxy and TLS), **[Instance
 administration](#instance-administration)** (running and maintaining the
-SelfPost server itself — status, backups, users, upgrades), and **[Domain
-administration](#domain-administration)** (day-to-day work on the sending
-domains hosted on that instance — DNS, deliveries, rate limits, applications).
+SelfPost server itself — the panel's layout, health, backups, users,
+upgrades), and **[Domain administration](#domain-administration)** (day-to-day
+work on the sending domains hosted on that instance — DNS, the outbound log,
+rate limits, applications).
+
+SelfPost 2.0 starts from an empty data directory: a `/data` written by 1.x is
+refused at start, not upgraded. A domain moves over with its
+[export file](#exporting-and-importing-a-single-domain), and every panel path
+changed (see the CHANGELOG, *Removed*).
 
 ## Table of contents
 
@@ -21,8 +27,11 @@ domains hosted on that instance — DNS, deliveries, rate limits, applications).
   - [Environment variables](#environment-variables)
   - [Reverse proxy (mandatory)](#reverse-proxy-mandatory)
 - [Instance administration](#instance-administration)
-  - [Status](#status)
-  - [Mail queue and System log](#mail-queue-and-system-log)
+  - [The panel](#the-panel)
+  - [Help](#help)
+  - [Overview and Health](#overview-and-health)
+  - [Queue and System log](#queue-and-system-log)
+  - [Account](#account)
   - [Settings](#settings)
   - [Users](#users)
   - [Sessions](#sessions)
@@ -37,11 +46,11 @@ domains hosted on that instance — DNS, deliveries, rate limits, applications).
   - [Inbound relay](#inbound-relay)
   - [DMARC reports](#dmarc-reports)
 - [Domain administration](#domain-administration)
-  - [Domains page](#domains-page)
+  - [Outbound domains](#outbound-domains)
   - [Domain-level DNS (SPF, DKIM, DMARC)](#domain-level-dns-spf-dkim-dmarc)
   - [IP warmup](#ip-warmup)
   - [Rate limiting — level 2 (domain and application)](#rate-limiting--level-2-domain-and-application)
-  - [Deliveries](#deliveries)
+  - [Outbound log](#outbound-log)
   - [Exporting and importing a single domain](#exporting-and-importing-a-single-domain)
 
 ## Installation
@@ -61,8 +70,8 @@ ports in external scans.
 
 The [README quick start](../README.md#quick-start) runs a single container
 with `PANEL_COOKIE_SECURE=false` and port 8080 published on localhost. No
-reverse proxy, no `./certs` bind mount — Postfix still starts, but the Status
-page will report missing TLS material until you mount PEM files at
+reverse proxy, no `./certs` bind mount — Postfix still starts, but Overview
+and Health will report missing TLS material until you mount PEM files at
 `/etc/postfix/tls/fullchain.pem` and `privkey.pem`.
 
 The one-time setup link is always printed as
@@ -71,8 +80,8 @@ The one-time setup link is always printed as
 scheme to `http://127.0.0.1:8080/setup/<token>` — the path token is what
 matters; the hostname in the printed URL is not reachable as written.
 
-**What works:** the full panel — setup, domains, applications, deliveries view,
-mail queue, system log. **What does not:** reliable outbound delivery to the
+**What works:** the full panel — setup, domains, applications, outbound log,
+queue, system log. **What does not:** reliable outbound delivery to the
 public internet (no PTR, no real DNS for your domains, port 25 may be blocked
 on your network, HELO does not match anything receivers trust).
 
@@ -98,8 +107,9 @@ On first start the one-time setup URL is printed in the container log
 container — `./data/setup-token` on the host, mode `0600` — then deleted when
 setup completes. The link is `https://<SELFPOST_HOSTNAME>/setup/<token>` (path
 token, not a query string), valid for ten minutes. Open it to choose the
-administrator username and password — until then the panel has no login. If
-this host ships container logs to a central aggregator, prefer reading the
+administrator username and password — until then the panel has no login, and
+its sign-in page says there is no administrator yet and points at the setup
+link. If this host ships container logs to a central aggregator, prefer reading the
 file:
 
 ```sh
@@ -164,8 +174,8 @@ cat ./data/setup-token
 
 **4. DNS and sending.** Before sending real mail:
 
-1. Confirm PTR/rDNS for the server IP points at `SELFPOST_HOSTNAME` (Status
-   page → *Re-check*) — see [Server-level DNS](#server-level-dns-ptrrdns).
+1. Confirm PTR/rDNS for the server IP points at `SELFPOST_HOSTNAME` (Server ›
+   Health → *Re-check DNS*) — see [Server-level DNS](#server-level-dns-ptrrdns).
 2. For each domain you add in the panel, publish SPF, DKIM, and DMARC at the
    same time ([Domain-level DNS](#domain-level-dns-spf-dkim-dmarc)).
 3. Warm up a new IP gradually ([IP warmup](#ip-warmup)).
@@ -193,18 +203,18 @@ expected to set; defaults match the code exactly.
 |---|---|---|---|
 | `SELFPOST_HOSTNAME` | Mail-server identity: Postfix HELO/EHLO, SASL realm, certificate CN/SAN, and the hostname the PTR check expects. Bare FQDN only — no scheme or port. | *(required)* | `.env` |
 | `SUBMISSION_ENABLE` | When `true`, also listen on port 587 with STARTTLS (RFC 6409 submission) alongside the primary 465/smtps listener. | `false` | `.env` |
-| `INBOUND_RELAY_ENABLE` | When `true`, accept mail on port 25 for domains configured under *Inbound* in the panel and forward them to the upstream you set. Off by default — the outbound path is unchanged. See [Inbound relay](#inbound-relay). | `false` | `.env` |
-| `DMARC_REPORTS_ENABLE` | When `true`, accept DMARC aggregate reports on port 25 only for report addresses configured in the panel, parse gzip/XML, and show summaries under *DMARC*. Off by default. See [DMARC reports](#dmarc-reports). | `false` | `.env` |
+| `INBOUND_RELAY_ENABLE` | When `true`, accept mail on port 25 for domains configured under *Inbound › Domains* in the panel and forward them to the upstream you set. Off by default — the outbound path is unchanged. See [Inbound relay](#inbound-relay). | `false` | `.env` |
+| `DMARC_REPORTS_ENABLE` | When `true`, accept DMARC aggregate reports on port 25 only for report addresses configured in the panel, parse gzip/XML, and show summaries under *Outbound › DMARC reports*. Off by default. See [DMARC reports](#dmarc-reports). | `false` | `.env` |
 | `DMARC_RATE_LIMIT_MESSAGES_PER_IP` | Per-client-IP cap on port 25 when DMARC ingest is on. When inbound relay is also enabled, **`INBOUND_RATE_LIMIT_MESSAGES_PER_IP`** applies to the shared listener instead. | `20` | `.env` |
 | `DMARC_MESSAGE_SIZE_LIMIT` | Maximum report message size in bytes when DMARC ingest is on. | `5242880` (5 MiB) | `.env` |
-| `INBOUND_ANTISPAM_MILTER` | Optional milter on the inbound relay listener only (requires `INBOUND_RELAY_ENABLE=true`; not 465/587 or DMARC-only port 25). Empty = off. Format `inet:host:port` or `unix:/path`. Example with [deploy/antispam/docker-compose.antispam.yml](../deploy/antispam/docker-compose.antispam.yml): `inet:antispam:11332`. | *(empty)* | `.env` |
-| `INBOUND_ANTISPAM_MILTER_ACTION` | What Postfix does if that milter is down: `accept` (fail-open) or `tempfail` (defer). | `accept` | `.env` |
+| `INBOUND_ANTISPAM_MILTER` | Optional milter on the inbound relay listener only (requires `INBOUND_RELAY_ENABLE=true`; not 465/587 or DMARC-only port 25). Empty = off. Format `inet:host:port` or `unix:/path`. Example with [deploy/antispam/docker-compose.antispam.yml](../deploy/antispam/docker-compose.antispam.yml): `inet:antispam:11332`. The panel reads it to report on the *Spam filter* box of the inbound pages and to check that the filter answers (Server › Health). | *(empty)* | `.env` |
+| `INBOUND_ANTISPAM_MILTER_ACTION` | What Postfix does if that milter is down: `accept` (fail-open) or `tempfail` (defer). The *Spam filter* box states which. | `accept` | `.env` |
 | `INBOUND_RATE_LIMIT_MESSAGES_PER_IP` | Coarse per-client-IP cap on inbound smtpd (`smtpd_client_message_rate_limit`). Uses the same window as `RATE_LIMIT_WINDOW_SECONDS`. | `20` | `.env` |
 | `INBOUND_MESSAGE_SIZE_LIMIT` | Maximum message size in bytes on inbound smtpd (`message_size_limit`). When both inbound relay and DMARC ingest are on, the shared listener uses the **greater** of this and `DMARC_MESSAGE_SIZE_LIMIT`. | `26214400` (25 MiB) | `.env` |
 | `RATE_LIMIT_MESSAGES_PER_IP` | Level-1 backstop: maximum messages one client IP may submit per window (Postfix `smtpd_client_message_rate_limit`). See [Rate limiting — level 1](#rate-limiting--level-1-ip-backstop). | `100` | `.env` |
 | `RATE_LIMIT_WINDOW_SECONDS` | Level-1 window length in seconds (Postfix `anvil_rate_time_unit`). | `3600` | `.env` |
-| `SEND_LOG_RETENTION_DAYS` | Initial default for how many days of send-log history are kept before the background sweep deletes rows — the main driver of `/data` growth over time. After the first panel start, change retention on **Settings** (global administrator); the env value is only used to seed SQLite when the setting has never been saved. | `90` | `.env` |
-| `PANEL_SESSION_IDLE_DAYS` | Sliding idle timeout for the panel login session, in days. There is no absolute cap: an admin who keeps coming back stays signed in indefinitely. | `7` | `.env` |
+| `SEND_LOG_RETENTION_DAYS` | Initial default for how many days of send-log history are kept before the background sweep deletes rows — the main driver of `/data` growth over time. After the first panel start, change retention under **Server › Settings** (global role); the env value is only used to seed SQLite when the setting has never been saved. | `90` | `.env` |
+| `PANEL_SESSION_IDLE_DAYS` | Sliding idle timeout for the panel login session, in days. There is no absolute cap: a user who keeps coming back stays signed in indefinitely. | `7` | `.env` |
 | `SELFPOST_DNS_RESOLVERS` | Comma-separated recursive resolvers the panel's PTR/SPF/DKIM/DMARC checks query directly (so they report what the internet sees, not what this host's stub resolver synthesises). | `1.1.1.1:53`, `8.8.8.8:53`, `9.9.9.9:53` when unset | `.env` |
 | `TRUSTED_PROXY_CIDR` | Comma-separated CIDRs (bare IPs allowed) of reverse proxies allowed to supply `X-Forwarded-For` for login, setup, and account-change rate-limiting. **Leave unset unless you know the exact address of your reverse proxy.** A wrong value lets a client spoof its rate-limit key by sending a forged `X-Forwarded-For` header — the panel trusts the last hop only when the TCP peer matches one of these CIDRs. Behind the default Apache host-network setup this is typically the Docker bridge gateway, e.g. `172.18.0.1`. | *(empty — XFF ignored)* | `.env` |
 
@@ -311,97 +321,171 @@ Schedule `extract-cert.sh` (cron or a timer) alongside Traefik's renewals.
 
 ## Instance administration
 
-After sign-in the panel opens on **Status** — the place to answer "is the
-service healthy and will mail be accepted?"
+After sign-in the global role opens on **Overview** — the place to answer "is
+the service healthy and will mail be accepted?" A user with the *domain* role
+opens on the first list they reach: Outbound › Domains, or Inbound › Domains
+when that is all they are assigned.
 
-### In-panel help
+### The panel
 
-The panel carries short operator notes so day-to-day work does not require
-opening this guide. **Help** in the navigation opens an index; each Status or
-domain card's «?» opens the same text in a side drawer (CSS only, no extra
-script). That content explains what a check or control *means* — kernel
-counters, TLS on port 465, forward-confirmed PTR, DNS publish hints, rate
-limits, and similar. It is not a second copy of this document: installation,
+The menu is grouped by mail direction, and a path reads like the menu:
+`/<group>/<page>`, an entity under its list, an action under the thing it
+changes.
+
+| Menu | Pages | Path |
+|---|---|---|
+| Overview | Overview | `/overview` |
+| Outbound | Domains · Log · Queue · DMARC reports | `/outbound/domains`, `/outbound/log`, `/outbound/queue`, `/outbound/dmarc` |
+| Inbound | Domains | `/inbound/domains` |
+| Server | Health · System log · Backup · Users · Settings | `/server/health`, `/server/log`, `/server/backup`, `/server/users`, `/server/settings` |
+| User menu (your name) | Account · Help · Sign out | `/account`, `/help`, `POST /logout` |
+
+A page a user cannot reach, or a feature that is off, leaves no gap in the
+menu: a group with nothing in it is absent. *Inbound* appears only with
+`INBOUND_RELAY_ENABLE=true` and *DMARC reports* only with
+`DMARC_REPORTS_ENABLE=true`. Everything under `/server/`, and Overview and the
+queue, answer 404 to a user with the *domain* role — the same answer a missing
+page gets.
+
+Pages that used to be one are now several. The old Status page is **Overview**
+(one verdict per check) and **Server › Health** (the tables behind them). The
+old Settings page is **Account** (your own name, e-mail and password) and
+**Server › Settings** (the instance). A domain has its own page, **Domain
+settings** under it, and an **application** form of its own under the domain.
+
+### Help
+
+**Help** (user menu) is a page of topics, one box per section of the panel —
+Overview, Outbound, Inbound, Server, Account — and a user is shown the sections
+their menu shows. The **?** in the head of a box opens the topic about that box
+on the Help page, scrolled to it. The topics explain what a check
+or control *means* — kernel counters, TLS on port 465, forward-confirmed PTR,
+DNS publish hints, rate limits, DMARC report addresses, the spam filter, and
+similar. They are not a second copy of this document: installation,
 reverse-proxy setup, backup/restore, environment variables, and security
-assumptions stay here in `docs/guide.md` (linked from the drawer and Help
-page).
+assumptions stay here in `docs/guide.md`.
 
-### Status
+### Overview and Health
 
-`/status` shows supervised processes (Postfix, OpenDKIM, panel), TLS
-certificate validity and expiry, milter socket presence, and a short Postfix
-queue summary. The **Machine** card adds the resource usage of the host
-underneath — processor (core and thread counts), memory and swap, and
-per-interface network throughput and totals — read from the kernel's
+**Overview** (`/overview`, global role) shows the stamp — the worst of its
+checks — and one card per check: machine (processor and memory), supervised
+processes (Postfix, OpenDKIM, panel), TLS certificate, queue, milter sockets
+and reverse DNS. A check the panel could not run shows as a warning, never as
+fine. Below the cards are the outbound domain list and, with the inbound relay
+on, the inbound one. Each card leads to its table on **Server › Health**
+(`/server/health`) — the queue card to the Outbound queue — and Health has the
+readings:
+
+- **Machine** — processor (core and thread counts), memory and swap, and
+  per-interface network throughput and totals, read from the kernel's
   counters; CPU and throughput are measured between refreshes, so they appear
   one refresh after the page opens. A fully busy processor or a machine out of
-memory is a warning here, because both delay or kill the mail path;
-throughput is only reported. The hostname block compares `SELFPOST_HOSTNAME`
-against the PTR record the internet publishes for this server's IP
-(forward-confirmed reverse DNS) — see
-[Server-level DNS](#server-level-dns-ptrrdns); use *Re-check* after changing
-DNS. The **Reload configuration** button re-applies OpenDKIM tables and the
-Postfix sender map from the database (and inbound relay maps when
-`INBOUND_RELAY_ENABLE=true`) — use it if daemons drifted from what the panel
-shows after manual edits under `/data`. It does **not** rebuild DMARC Postfix
-maps; a full restore Resync does (see [Restore](#restore)).
+  memory is a warning, because both delay or kill the mail path; throughput is
+  only reported.
+- **Processes**, **TLS certificate** (validity and expiry) and **Milter
+  sockets** (OpenDKIM and the journal-milter).
+- **Hostname and reverse DNS** — compares `SELFPOST_HOSTNAME` against the PTR
+  record the internet publishes for this server's IP (forward-confirmed
+  reverse DNS), see [Server-level DNS](#server-level-dns-ptrrdns); use
+  *Re-check DNS* after changing DNS.
+- **Configuration** — the **Reload configuration** button re-applies OpenDKIM
+  tables and the Postfix sender map from the database (and inbound relay maps
+  when `INBOUND_RELAY_ENABLE=true`) — use it if daemons drifted from what the
+  panel shows after manual edits under `/data`. It does **not** rebuild DMARC
+  Postfix maps; a full restore Resync does (see [Restore](#restore)).
 
-### Mail queue and System log
+### Queue and System log
 
-- **Mail queue** (`/mail-queue`) — live view of messages Postfix is still
-  trying to deliver or deferring. A card at the top states this instance's
-  retry policy — first retry delay, later backoff cap, how long a message
-  stays in the queue — from `postconf -h`, read once when the panel starts.
-  A `postconf -e` override inside the container is visible after the next
-  panel (or container) restart. There is no maximum attempt count: Postfix
-  retries until the message is delivered or the queue lifetime runs out.
-- **System log** (`/system-log`) — tail of `/data/log/mail.log` (Postfix and
-  related daemon lines). The log rotates daily (14 files kept) with a
-  `postfix reload` after each rotation; a background loop checks every six
-  hours. It lives in the data volume, so it survives a container recreate along
-  with the rest of the state — `./data/log/` on the host — but it is *not*
-  included in backups: it is diagnostics, not state.
+- **Outbound › Queue** (`/outbound/queue`, global role) — live view of
+  messages Postfix is still trying to deliver or deferring, as `postqueue -p`
+  lists them. It only shows: nothing there deletes or forces a message. A box
+  states this instance's retry policy — first retry delay, later backoff cap,
+  how long a message stays in the queue — from `postconf -h`, read once when
+  the panel starts. A `postconf -e` override inside the container is visible
+  after the next panel (or container) restart. There is no maximum attempt
+  count: Postfix retries until the message is delivered or the queue lifetime
+  runs out.
+- **Server › System log** (`/server/log`) — tail of `/data/log/mail.log`
+  (Postfix and related daemon lines). The log rotates daily (14 files kept)
+  with a `postfix reload` after each rotation; a background loop checks every
+  six hours. It lives in the data volume, so it survives a container recreate
+  along with the rest of the state — `./data/log/` on the host — but it is
+  *not* included in backups: it is diagnostics, not state.
+
+### Account
+
+**Account** (`/account`, every role) is the signed-in user's own: **Profile**
+(username and e-mail) and **Password**. Saving the profile does not ask for the
+password; changing the password asks for the current one and is rate-limited
+like a sign-in. The e-mail is the user's own address. Nothing is sent to it
+yet; it is what a domain's *Use my e-mail* button fills in (see [Domain-level
+DNS](#domain-level-dns-spf-dkim-dmarc)). Application SASL logins are separate
+and are not changed here.
 
 ### Settings
 
-`/settings` changes the signed-in user's username and/or password. **Global
-administrators** also set the panel-wide default DMARC report address (`rua=`)
-offered when a domain doesn't set its own — see
-[Domain-level DNS](#domain-level-dns-spf-dkim-dmarc) — and how many days
-**Deliveries** rows are kept before the background sweep deletes them (7–365
-days; takes effect on the next six-hour prune cycle without a container
-restart). Application SASL logins are separate and are not changed here.
+**Server › Settings** (`/server/settings`, global role) holds what is true for
+the whole instance: how many days the **Outbound log** keeps its rows before the
+background sweep deletes them (7–365 days; takes effect on the next six-hour
+prune cycle without a container restart), and, read-only, the level-1 rate
+limit that comes from `.env` ([Rate limiting — level 1](#rate-limiting--level-1-ip-backstop)).
+There is no panel-wide DMARC report address: each domain has its own.
 
 ### Users
 
-`/users` (global administrator only) creates, edits, and deletes panel users.
-There are two roles:
+**Server › Users** (`/server/users`, global role only) creates, edits, and
+deletes panel users. Everyone in the panel is an administrator, so the two
+roles name a *reach*, not a rank, and are called `global` and `domain` in the
+list, the role select and the page headers:
 
-- **Global administrator** — full access to every page and every domain,
-  including Users, Backup, Status, Mail queue, System log, Help, Inbound (when
-  the inbound relay flag is on), and DMARC (when `DMARC_REPORTS_ENABLE=true`).
-- **Domain-admin** — scoped to one or more domains assigned by a global
-  administrator. Sees only those domains' pages, applications, and
-  Deliveries rows; cannot add or delete domains. `/users`, `/backup`,
-  `/status`, `/mail-queue`, `/system-log`, `/inbound`, and `POST /reload` are
-  not reachable (404). A domain-admin can *export* the
-  domains assigned to them — see
-  [Exporting and importing a single domain](#exporting-and-importing-a-single-domain).
+- **global** — every page and every domain: Overview, Server (Health, System
+  log, Backup, Users, Settings), the Outbound queue, and every outbound and
+  inbound domain. The only role that adds or deletes a domain and that manages
+  users.
+- **domain** — only the domains assigned to the user, outbound and inbound
+  **separately**: the user form has one list for each, and the same name on
+  both lists is two assignments. Each list has **All**, which includes domains
+  added later; with it ticked the rows below are ignored. A *domain* user needs
+  at least one domain, or *All*, on either list. A group with nothing assigned
+  is absent from that user's menu.
 
-The panel refuses to remove or demote the **last** global administrator, so
-it can never end up with none.
+What the *domain* role reaches inside what is assigned:
+
+| | `global` | `domain` |
+|---|---|---|
+| Overview, Server, the Outbound queue | yes | no (404) |
+| Outbound: domain page, applications, Domain settings, log | every domain | assigned domains |
+| Outbound › DMARC reports | every report, with the ingest statistics | reports of assigned domains, without the ingest box |
+| Inbound: domain page, upstream, recipients | every domain | assigned inbound domains |
+| Add or delete a domain, either direction | yes | no |
+| Export a domain (Domain settings) | yes | assigned domains |
+| Import a domain (Server › Backup) | yes | no |
+| Account, Help | yes | yes |
+
+A domain that is not assigned, one that does not exist, and a user with no
+reach in that direction all get the same 404.
+
+The panel refuses to remove or demote the **last** global user, so it can never
+end up with none. A user cannot delete the account they are signed in with.
+The user form also sets the user's e-mail, which the users list shows.
 
 ### Sessions
 
 A login survives a container restart: sessions live in SQLite, not in
-memory. Expiry is a sliding idle window (`PANEL_SESSION_IDLE_DAYS`, default
-seven days) with no absolute lifetime cap — an admin who keeps using the panel
-stays signed in indefinitely. HTMX polling on the monitoring screens
-(Deliveries, Mail queue, System log, and the Status health fragment) does
-**not** count as activity, so an auto-refreshing tab left open will not keep a
-session alive forever. Changing **your own** password on `/settings` signs out
-every other session for that user but leaves the current browser signed in.
-Signing out (`POST /logout`) ends only the current session — other browsers or
+memory. A session belongs to the user it was created for, by id: deleting the
+user ends their sessions, and renaming them keeps theirs. Expiry is a sliding
+idle window (`PANEL_SESSION_IDLE_DAYS`, default seven days) with no absolute
+lifetime cap — a user who keeps using the panel stays signed in indefinitely.
+HTMX polling on the monitoring screens (Overview, Health, Outbound log and
+queue, System log) does **not** count as activity, so an auto-refreshing tab
+left open will not keep a session alive forever.
+
+- Changing **your own** password on **Account** signs out every other session
+  of yours but leaves the current browser signed in.
+- A password that a global user sets for **another** user on the user form
+  ends all of that user's sessions; set for oneself, it behaves like the
+  previous item.
+- Signing out (`POST /logout`) ends only the current session — other browsers or
   tabs for the same user keep working until their session rows expire.
 
 ### Upgrading
@@ -418,7 +502,8 @@ The image declares a Docker `HEALTHCHECK` that probes `GET /healthz` on port
 Postfix are all `RUNNING` under supervisord; otherwise `503 unhealthy`. This
 catches a dead mail path that would still leave the HTTP server up, but it
 does **not** verify TLS certificates, DNS records, or end-to-end delivery —
-use the authenticated [Status](#status) page for that. External monitoring
+use the authenticated [Overview and Health](#overview-and-health) pages for
+that. External monitoring
 can use the same endpoint through the reverse proxy if you expose it, or poll
 `docker inspect` health state on the host.
 
@@ -429,9 +514,10 @@ its mail hostname. Most receiving mail servers weigh this heavily; get it
 from whoever assigns the IP (hosting provider's panel/support), not from
 your own DNS zone.
 
-The [Status](#status) page verifies the server's hostname against this
-record (forward-confirmed reverse DNS). Results are cached for about one
-minute; use *Re-check* right after publishing a record.
+**Server › Health** verifies the server's hostname against this record
+(forward-confirmed reverse DNS), and Overview shows the verdict. Results are
+cached for about one minute; use *Re-check DNS* right after publishing a
+record.
 
 Per-domain DNS (SPF, DKIM, DMARC) is a separate scope — see
 [Domain-level DNS](#domain-level-dns-spf-dkim-dmarc).
@@ -468,9 +554,9 @@ deploy files — without that mount, *Full backup* refuses with an error.
 There are four ways to capture a full backup. They differ in whether the
 instance keeps running, what goes into the archive, and what happens on restore.
 
-**1. Panel — while the container is running (no downtime).** *Backup* → *Full
-backup* (optionally tick *Encrypt with a password*). Same archive as the CLI
-below.
+**1. Panel — while the container is running (no downtime).** *Server › Backup*
+→ *Full backup*. *Encrypt with a password* is ticked; untick it for a plain
+archive. Same archive as the CLI below.
 
 **2. `selfpost-backup` CLI — while the container is running (no downtime).**
 The panel button and this command call the same code path: a consistent SQLite
@@ -552,8 +638,8 @@ blocked. On that same first boot the panel also runs one **Resync** — OpenDKIM
 tables and Postfix's sender map are re-derived from SQLite (inbound relay maps
 when `INBOUND_RELAY_ENABLE=true`; DMARC maps when `DMARC_REPORTS_ENABLE=true`)
 and both daemons are reloaded, healing any drift between the extracted files and
-the database. The Status page's *Reload configuration* button resyncs OpenDKIM,
-the sender map, and inbound maps only — not DMARC maps. This is why the
+the database. The *Reload configuration* button on Server › Health resyncs
+OpenDKIM, the sender map, and inbound maps only — not DMARC maps. This is why the
 compose file pins a fixed tag rather than `:latest`: without a known version,
 there'd be no way to tell which image restoring a given backup actually requires
 (see [Fixed image tag](#fixed-image-tag)).
@@ -619,34 +705,35 @@ the resulting `.tar.gz` — see [Encrypting a backup or
 export](#encrypting-a-backup-or-export) for the decrypt command's password
 options.
 
-**Archives from older SelfPost versions** (flat layout: `manifest.json` and
-`selfpost.db` at the archive root, no `data/` prefix, no deploy files) restore
-with the previous procedure: `tar xzf backup.tar.gz -C ./data` into a project
-that already has `docker-compose.yml` and `.env`.
+**Archives and data directories from 1.x cannot be restored into 2.0.** The
+database is refused at start and left untouched — 2.0 starts from an empty data
+directory. Carry each domain over with its
+[export file](#exporting-and-importing-a-single-domain) instead.
 
 Restoring an archive taken **before** a session row was removed can bring
 that session back: session rows travel with the backup, and a browser that
 still holds the matching cookie is signed in again on the next request if the
 restored row's idle expiry has not passed. `POST /logout` removes only the
-current session; there is no "logout everywhere". Changing your own password
-on `/settings` deletes your other sessions, but a global administrator
-resetting another user's password on `/users` does not invalidate that user's
-existing sessions.
+current session; there is no "logout everywhere" — see
+[Sessions](#sessions) for what ends a user's sessions.
 
 See also [Exporting and importing a single
 domain](#exporting-and-importing-a-single-domain) — a different, domain-scoped
-operation that also lives on the *Backup* page (`/backup`).
+operation: *Export domain* is on the domain's settings page, *Import a domain*
+on *Server › Backup* (`/server/backup`).
 
 Both a full backup and a domain export are **secrets** — they contain the
-admin password hash (full backup), TLS private keys and `.env` (full backup),
-or working application credentials (domain export) in the clear or in
-directly reversible form. Treat them like any other credential material: restrict who can read them, don't email them
-around — and encrypt them, which SelfPost can do for you.
+password hashes of the panel's users (full backup), TLS private keys and `.env`
+(full backup), or working application credentials (domain export) in the clear
+or in directly reversible form. Treat them like any other credential material:
+restrict who can read them, don't email them around — and encrypt them, which
+SelfPost does unless you untick the box.
 
 #### Encrypting a backup or export
 
-Both download forms carry an **Encrypt with a password** checkbox. Ticked, the
-file that comes down is an encrypted envelope instead of the plain archive:
+Both download forms carry an **Encrypt with a password** checkbox, ticked by
+default. Ticked, the file that comes down is an encrypted envelope instead of
+the plain archive; unticked, it is the plain archive:
 
 | Artefact | Plain | Encrypted |
 |----------|-------|-----------|
@@ -686,27 +773,33 @@ With no password set, the CLI keeps writing the plain `.tar.gz` it always has.
 ### Inbound relay
 
 Optional backup-MX / forwarder: Postfix accepts mail on port **25** for
-domains you list under *Inbound* and hands each message to the upstream host
-you configure. It is **not** mailboxes, IMAP, or webmail — SelfPost never
-stores the message locally.
+domains you list under *Inbound › Domains* and hands each message to the
+upstream host you configure. It is **not** mailboxes, IMAP, or webmail —
+SelfPost never stores the message locally.
 
 **Off by default.** Set `INBOUND_RELAY_ENABLE=true` in `.env` and recreate the
 container. Until then there is no inbound-relay `smtp inet` listener, no
-*Inbound* item in the nav, and `/inbound` is 404. (Port 25 can still listen
-when only `DMARC_REPORTS_ENABLE=true` — see [DMARC reports](#dmarc-reports).)
-Outbound 465/587 is unchanged.
+*Inbound* group in the menu, and `/inbound/…` is 404. (Port 25 can still
+listen when only `DMARC_REPORTS_ENABLE=true` — see [DMARC
+reports](#dmarc-reports).) Outbound 465/587 is unchanged.
 
-**Panel** (`/inbound`, global administrator only): add a domain, set the
-upstream host/port and TLS to that hop (opportunistic / required / off), and
-choose recipients — an allow-list, or any address at that domain. A domain
-with an empty upstream is kept in the database but is **not** published into
-Postfix maps, so mail is never accepted with nowhere to send it.
+**Panel** (`/inbound/domains`): the global role adds and deletes domains. On a
+domain's page, set the upstream host/port and TLS to that hop (opportunistic /
+required / off), and choose recipients — an allow-list, or any address at that
+domain. Inbound domains are assigned to a user with the *domain* role
+separately from outbound ones (see [Users](#users)); such a user sees and
+changes the upstream and recipients of the inbound domains assigned to them,
+and cannot add or delete one. The upstream may be any host and port, including
+loopback and private addresses — see the accepted risks in
+[security.md](security.md). A domain with an empty upstream is kept in the
+database but is **not** published into Postfix maps, so mail is never accepted
+with nowhere to send it.
 
 **DNS.** Unlike sending domains, an inbound domain needs an **MX** record that
 points at `SELFPOST_HOSTNAME`. The domain page shows the value to publish
 (`10 <hostname>.`) and a check that succeeds when *any* MX host matches this
 server — other MX targets (a primary mail server) are fine; this is how
-backup-MX is meant to work. Use *Re-check* after publishing.
+backup-MX is meant to work. Use *Re-check DNS* after publishing.
 
 **Not an open relay.** The inbound smtpd offers no SASL. It accepts only
 domains in `relay_domains` and only listed recipients (`relay_recipient_maps`);
@@ -729,10 +822,23 @@ only sees SelfPost. Default action is fail-open (`accept`) so a down sidecar
 does not block backup-MX; set `INBOUND_ANTISPAM_MILTER_ACTION=tempfail` to
 defer instead.
 
-**Inbound mail is not in Deliveries.** Port 25 runs its own milter chain: the
-optional anti-spam milter, and nothing else. OpenDKIM does not sign relayed
+The panel only reports this setting; it does not change it. Every inbound
+domain page has a **Spam filter** box — on or off, what happens to mail while
+the filter is down, and that the filter belongs to the server, not to the
+domain — and the domain list says in its head whether the filter is on. The
+filter's address (`INBOUND_ANTISPAM_MILTER`) is shown to the global role only,
+so a user with the *domain* role sees the state without the server's internals.
+For the global role the filter is also one of the milter sockets on **Server ›
+Health** and in the Overview card: the panel connects to the address (one
+second at most, nothing is sent) and, if there is no answer, says whether
+inbound mail is being deferred (`tempfail`) or going through unfiltered
+(`accept`).
+
+**Inbound mail is not in the Outbound log.** Port 25 runs its own milter chain:
+the optional anti-spam milter, and nothing else. OpenDKIM does not sign relayed
 mail (and a signing outage therefore cannot defer it), and the journal-milter
-does not file it — [Deliveries](#deliveries) stays a record of what *you* sent.
+does not file it — the [Outbound log](#outbound-log) stays a record of what
+*you* sent.
 This also keeps a forged `From:` on inbound mail from counting against a
 sending domain's [level-2 rate limit](#rate-limiting--level-2-domain-and-application).
 
@@ -749,26 +855,43 @@ are not stored. This is separate from [Inbound relay](#inbound-relay) — no
 backup-MX, no forwarding upstream.
 
 **Off by default.** Set `DMARC_REPORTS_ENABLE=true` in `.env` and recreate the
-container. Until then there is no report ingest, no *DMARC* item in the nav,
-and `/dmarc` is 404. Outbound 465/587 is unchanged.
+container. Until then there is no report ingest, no *DMARC reports* entry in
+the Outbound menu, and `/outbound/dmarc` is 404. Outbound 465/587 is unchanged.
 
-**Addresses.** In *Settings* (global administrator), set the default
-`rua=` mailbox to an address on `SELFPOST_HOSTNAME`, e.g.
-`dmarc-reports@mail.example.com`. Per domain you can choose **SelfPost hosted**
-(`dmarc-reports+<domain>@<hostname>`) under *Domain settings → DMARC reports*.
-Only those allow-listed addresses are accepted on port 25.
+**Addresses.** A domain's report address (`rua=`) is one of three choices, set
+in that domain's **Domain settings** (Outbound › Domains › the domain › Domain
+settings) and nowhere else:
+
+- **No reports** — the state of a new domain; `rua=` is left out of the DMARC
+  record.
+- **SelfPost hosted** — `dmarc-reports+<domain>@<hostname>`, an address on this
+  server whose reports are parsed and shown under *DMARC reports*. Offered only
+  while `DMARC_REPORTS_ENABLE=true`.
+- **A specific address** — any mailbox, typed for this domain; it receives the
+  raw XML. Beside the field, *Use my e-mail* fills it with the e-mail of your
+  profile (Account); it only fills the field, and saving is the form's own
+  button. The button is absent when your profile has no e-mail.
+
+Changing the choice changes the DMARC record to publish; the domain page shows
+the new value. There is no panel-wide or per-user default. Only addresses on
+`SELFPOST_HOSTNAME` that a domain has chosen are accepted on port 25 - the
+hosted address `dmarc-reports+<domain>@<hostname>` of a domain set to
+*SelfPost hosted*, or a typed address that happens to be on this host. There
+is no mailbox for the server as a whole.
 
 **DNS.** Publish the usual `_dmarc` TXT on each sending domain with
-`rua=mailto:…` pointing at your hosted address. Receivers deliver to the
+`rua=mailto:…` pointing at the address the domain shows. Receivers deliver to the
 address domain — publish **MX** for `SELFPOST_HOSTNAME` (or the report
 address domain if different) so reports reach this server. If a hub domain
 authorises external destinations, publish `_report._dmarc` there too; the panel
 checks it on the domain page.
 
-**Panel.** *DMARC* (global administrator) lists recent reports and ingest
-health. Open a domain's roll-up from the list or from *View DMARC reports* on
-the domain page. Domain administrators see reports only for domains assigned to
-them. Summaries are pruned (500 kept, 90 days max).
+**Panel.** *Outbound › DMARC reports* lists recent reports. The global role also
+sees the *Ingest* box — whether ingest works, the last report received, reports
+kept this week and parse failures. Open a domain's roll-up from the list or
+from *DMARC reports* in the domain page's menu. A user with the *domain* role
+sees the reports of the domains assigned to them, without the *Ingest* box.
+Summaries are pruned (500 kept, 90 days max).
 
 **Not an open relay.** The inbound smtpd offers no SASL. With DMARC ingest
 alone, `check_recipient_access` permits only configured report addresses;
@@ -780,7 +903,7 @@ predictable, so the report XML is treated as untrusted input: a report is
 accepted only when the domain it claims in `policy_published` is a sending
 domain configured here, and — when it arrived at a per-domain hosted address —
 only when that domain matches the address's `+tag`. Anything else is refused
-and counted in *parse failures* on the DMARC page, so a stranger cannot file
+and counted in *parse failures* on the DMARC reports page, so a stranger cannot file
 reports under your domain or push genuine ones out through the retention cap.
 Reports are accepted as gzip, zip, or plain XML.
 
@@ -789,17 +912,32 @@ Parsed report data lives in SQLite and is included in a
 
 ## Domain administration
 
-### Domains page
+### Outbound domains
 
-`/domains` lists sending domains and hosts the add-domain form (**global
-administrator only**). Domain administrators see only domains assigned to
-them. Each row shows its DKIM TXT value, SPF/DMARC checks, and SASL
-applications. Per-domain rate limits (level 2), per-application limits, and
-optional client IP allow-lists are configured here — see [Rate limiting —
-level 2](#rate-limiting--level-2-domain-and-application). *Export domain*
-writes a single-domain archive; *Import a domain* on the Backup page reads
-one back in (**global administrator only**) — see [Exporting and importing a single
-domain](#exporting-and-importing-a-single-domain).
+**Outbound › Domains** (`/outbound/domains`) lists sending domains with the
+verdict of each DNS check, the DKIM selector, the number of applications and
+recent mail, and hosts the add-domain form (**global role only**). A user with
+the *domain* role sees only the domains assigned to them. Three pages belong
+to a domain:
+
+- **The domain page** (`/outbound/domains/{id}`) — the *DNS records* to
+  publish and what is in DNS now, the *Applications* (SASL logins) with *New
+  password* and *Delete* in their rows, and the *Connection* settings. *Re-check
+  DNS* and *Add application* are in its head; its menu leads to the domain's
+  log and DMARC reports.
+- **The application form** (`…/applications/new`, `…/applications/{aid}`) —
+  who the application may send as, its client IP allow-list and its rate limit
+  are validated and saved together, or not at all, also when the application
+  is created. A password is shown once, on the page that answers the creation
+  or *New password*, and is never shown again.
+- **Domain settings** (`…/settings`) — the *DMARC report address* (see [DMARC
+  reports](#dmarc-reports)), the domain's *Rate limit* (see [Rate limiting —
+  level 2](#rate-limiting--level-2-domain-and-application)), *Export domain*
+  and, for the global role, *Delete domain*, which asks once more.
+
+*Export domain* writes a single-domain file; *Import a domain* on *Server ›
+Backup* reads one back in (**global role only**) — see [Exporting and importing
+a single domain](#exporting-and-importing-a-single-domain).
 
 ### Domain-level DNS (SPF, DKIM, DMARC)
 
@@ -810,12 +948,14 @@ records; see [Inbound relay](#inbound-relay).
 - **SPF** — a TXT record on the domain authorizing this server to send on its
   behalf (e.g. `v=spf1 a mx ip4:<server IP> -all`, adjusted to your setup).
 - **DKIM** — a TXT record with the exact value the panel shows on that
-  domain's page (`domain page → DKIM TXT record`), one selector per domain.
+  domain's page (*DNS records* box), one selector per domain.
 - **DMARC** — a `_dmarc` TXT record. The panel suggests `p=none` (monitoring
-  only, safe to publish immediately). Set `rua=` to receive aggregate reports:
-  with [DMARC reports](#dmarc-reports) enabled, use a SelfPost-hosted address
-  from *Settings* or per-domain *Domain settings*; otherwise point `rua=` at a
-  mailbox elsewhere that receives inbound mail. If `rua=` points at another
+  only, safe to publish immediately). Set `rua=` to receive aggregate reports
+  by choosing the domain's report address in *Domain settings*: with [DMARC
+  reports](#dmarc-reports) enabled, the SelfPost-hosted address; otherwise an
+  address typed for the domain — a mailbox elsewhere that receives mail (*Use
+  my e-mail* fills in your profile's) — or no reports, which leaves `rua=` out.
+  The record the page shows follows that choice. If `rua=` points at another
   domain, publish `_report._dmarc` on that hub domain too; the panel checks
   it. Public mail hosts (Gmail, Outlook, …) cannot be used as external
   report destinations.
@@ -825,10 +965,10 @@ lands in spam even though SelfPost delivered it correctly — DKIM passing
 doesn't help if SPF/DMARC are absent. **Whenever you add a new domain in the
 panel, add its DNS records at the same time**, not later.
 
-Each domain's page shows a *DNS status* card comparing the published DKIM
+Each domain's page has a *DNS records* box comparing the published DKIM
 record against the key this server signs with, plus the domain's SPF,
 DMARC, and (when configured) DMARC report-authorisation records. Results are
-cached for a few minutes; use *Re-check* right after publishing a record.
+cached for a few minutes; use *Re-check DNS* right after publishing a record.
 The SPF check is deliberately shallow — it looks for a mechanism that
 literally covers this server's address and does not follow `include:` or
 `redirect=`, so a record that authorizes the server through an include is
@@ -848,12 +988,13 @@ public internet, not something SelfPost's configuration can shortcut.
 
 ### Rate limiting — level 2 (domain and application)
 
-Level 2 is optional, configured on each domain's page, and layers on top of
+Level 2 is optional, configured in each domain's settings (the domain) and
+on each application's form (the application), and layers on top of
 the always-on [level-1 IP backstop](#rate-limiting--level-1-ip-backstop).
 Level-2 ceilings cannot exceed level 1 (the panel shows the level-1 values
 and rejects higher numbers). When a level-2 ceiling is exceeded, Postfix
-returns a 4xx and the refusal is recorded in [Deliveries](#deliveries) as
-`rejected`.
+returns a 4xx and the refusal is recorded in the [Outbound log](#outbound-log)
+as `rejected`.
 
 **Level 2 — domain** — a message ceiling and window for **every** client IP
 sending as that domain. When unset, only level 1 applies for non-privileged
@@ -896,43 +1037,45 @@ accept rather than defer when it cannot reach it. Level 1 is the backstop
 that keeps working even when level 2 cannot run, and it is the only one of
 the two that does not depend on the panel process.
 
-### Deliveries
+### Outbound log
 
-`/deliveries` is a searchable send log with server-side filters by domain
-and application. A row identifies its message and nothing more — time,
+**Outbound › Log** (`/outbound/log`) is a searchable send log with server-side
+filters by domain and application; a user with the *domain* role sees only the
+rows of their domains. It refreshes its rows without resetting a filter being
+chosen. A row identifies its message and nothing more — time,
 sender, recipient, subject and status `queued` (accepted, not yet
 delivered), `sent` (handed off successfully), `deferred` (Postfix is
 retrying), `bounced` (final failure), or `rejected` (refused — for example
 by a [level-2 rate limit](#rate-limiting--level-2-domain-and-application));
-*Details* opens that row's own page (`/deliveries/{id}`). That page carries
+*Details* opens that row's own page (`/outbound/log/{id}`). That page carries
 the sending domain, the application it was submitted under, the Postfix
 queue id and the journal id, beside the message's history — when it was
 accepted and what Postfix later reported for the recipient. A `deferred`
 or `bounced` row includes this Postfix's retry intervals (first delay,
-backoff cap, queue lifetime), the same numbers Mail queue shows; domain
-administrators see them here because they cannot open Mail queue. Under
+backoff cap, queue lifetime), the same numbers the Outbound queue shows; users
+with the *domain* role see them here because they cannot open the queue. Under
 both sit the `mail.log` lines for its queue id: the connection to the
 receiving server, the server's reply, and the status that reply was filed
 as. Rows outlive `mail.log`, so an older message's lines may have rotated
-away; the page says so. Retention is set on **Settings** (global
-administrator); `SEND_LOG_RETENTION_DAYS` in `.env` is only the initial
-default until it is changed there.
+away; the page says so. Retention is set under **Server › Settings** (global
+role); `SEND_LOG_RETENTION_DAYS` in `.env` is only the initial default until it
+is changed there.
 
 ### Exporting and importing a single domain
 
-Domain page → *Export domain* to write the file, *Backup* → *Import a
-domain* to read it back in. This moves one domain — its DKIM key, its
+Domain settings → *Export domain* to write the file, *Server › Backup* →
+*Import a domain* to read it back in. This moves one domain — its DKIM key, its
 applications' **working** SASL passwords, and configured **rate limits**
 (mode, ceilings, multipliers) and client IP allow-lists — to a different SelfPost
 instance without regenerating anything, so DNS (the DKIM TXT record)
 doesn't need to change. Unlike a full restore (see [Full backup and
 restore](#full-backup-and-restore)), this works across different
-hostnames/instances. *Import* is global-administrator only; *export* is
-available to any user who can access the domain, **including a domain-admin**
-for a domain assigned to them — so a domain-admin can walk away with that
-domain's working SASL passwords in the clear. Weigh that when deciding which
-domains to assign to a domain-admin account.
+hostnames/instances. *Import* is for the global role only; *export* is
+available to any user who can access the domain, **including a user with the
+*domain* role** for a domain assigned to them — so that user can walk away with
+the domain's working SASL passwords, in the clear if they untick the encryption
+box. Weigh that when deciding which domains to assign to a *domain* user.
 
-A domain export is a secret in the same way a full backup is, and can be
-encrypted the same way — see [Encrypting a backup or
-export](#encrypting-a-backup-or-export).
+A domain export is a secret in the same way a full backup is. The *Encrypt with
+a password* box is ticked by default, and the export is sealed the same way —
+see [Encrypting a backup or export](#encrypting-a-backup-or-export).