docs: machine requirements from load, every option, 768 MB with the spam filter

Owner, 2026-10-19: "Мы рассмотрели все комбинации опций поставки? Почему со
спамом нужна машина с 1 ГБ ОЗУ? 768 МБ не хватит? 512 МБ не хватит?" The
first version measured one configuration at rest and set the host column by
estimate. Now:

- The options and how they combine: 587 (no cost at rest), port 25 (one
  listener for the relay and DMARC), the rspamd sidecar (needs port 25; an
  external rspamd costs nothing here), the proxy (host program or a
  deploy/ container).
- Measured under load on the test server (dev/server/loadmem.sh, nothing
  delivered): SelfPost 60 MB at rest, 123 MB with 20 SMTP sessions to port
  25 held open; rspamd 118 MB at rest, 153 MB scanning ten 100 KB messages
  at once, 232 MB one 25 MiB message, 424 MB three at once, 139 MB after.
  Caddy 10 MB, nginx 3 MB, Traefik 21 MB at rest (images 92/280/231 MB).
- The host column: SelfPost's peak, rspamd's for the case, and a stated
  300 MB allowance for the system and Docker (not measured on a fresh
  host). With the spam filter 768 MB when port-25 messages are small or
  rarely large, 1 GB for several 25 MiB at once; 512 MB is not enough
  (about 480 MB at rest with the allowance, +100 MB a large message).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/scripts/base-packages.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+# base-packages.sh: compare the Debian packages the mail path runs on with
+# what debian:trixie-slim would install today (security audit 2026-10-17,
+# I5). The image installs without pinning, and published tags are never
+# rebuilt, so a security update of postfix, Cyrus SASL, OpenSSL or Berkeley
+# DB reaches operators only with the next release. This fails when one of
+# them has moved past the version the last release was built with - the
+# table between the base-package-versions markers in docs/development.md -
+# as the nudge to cut a patch release (and then to update the table).
+#
+# Run by .github/workflows/base-packages.yml every week; needs docker.
+set -eu
+doc=docs/development.md
+table=$(sed -n '/<!-- base-package-versions -->/,/<!-- \/base-package-versions -->/p' "$doc" |
+	sed -n 's/^| `\([^`]*\)` | `\([^`]*\)` |$/\1 \2/p')
+[ -n "$table" ] || { echo "no base-package-versions table in $doc" >&2; exit 2; }
+names=$(echo "$table" | cut -d' ' -f1 | tr '\n' ' ')
+# apt-cache policy's "Candidate:" is what an install would take now.
+now=$(docker run --rm debian:trixie-slim sh -c "apt-get update -qq >/dev/null && for p in $names; do printf '%s %s\n' \"\$p\" \"\$(apt-cache policy \"\$p\" | sed -n 's/^ *Candidate: //p')\"; done")
+moved=0
+echo "$table" | while read -r name built; do
+	cand=$(echo "$now" | awk -v n="$name" '$1 == n { print $2 }')
+	if [ "$cand" != "$built" ]; then
+		echo "::warning::$name: the last release was built with $built, trixie now installs ${cand:-nothing}" >&2
+		echo moved
+	fi
+done | grep -q moved && moved=1
+if [ "$moved" = 1 ]; then
+	echo "A package the mail path runs on has moved: cut a patch release, then update the table in $doc." >&2
+	exit 1
+fi
+echo "Every watched package is as the last release was built."

.github/workflows/base-packages.yml

@@ -0,0 +1,20 @@
+name: base packages
+
+# Every Monday: has a Debian package the mail path runs on moved since the
+# last release was built? A red run is the nudge to cut a patch release
+# (security audit 2026-10-17, I5; .github/scripts/base-packages.sh).
+on:
+  schedule:
+    - cron: "17 5 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  watch:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - name: Compare with trixie
+        run: sh .github/scripts/base-packages.sh

.github/workflows/release.yml

@@ -66,14 +66,14 @@ jobs:
             arch: arm64
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: v${{ needs.prepare.outputs.version }}
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Build image (native, loaded locally for the e2e gate)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           file: build/Dockerfile
@@ -83,7 +83,7 @@ jobs:
             VERSION=${{ needs.prepare.outputs.version }}
           tags: selfpost:e2e
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: "1.26"
           cache-dependency-path: test/e2e/go.sum
@@ -110,8 +110,22 @@ jobs:
             fi
           done
 
+      # The binaries about to be pushed, as built in the image - with the Go
+      # of golang:1.26-trixie, which may lag the runner's: a standard-library
+      # advisory fixed in a later patch fails the release until the base tag
+      # moves, which is the point (security audit 2026-10-17, I4).
+      - name: Vulnerabilities in the image's binaries
+        run: |
+          set -euo pipefail
+          id=$(docker create selfpost:e2e)
+          trap 'docker rm -f "$id" >/dev/null' EXIT
+          for bin in panel selfpost-backup; do
+            docker cp "$id:/usr/local/bin/$bin" "/tmp/$bin"
+            go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 -mode=binary "/tmp/$bin"
+          done
+
       - name: Log in to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -152,14 +166,14 @@ jobs:
     needs: [prepare, build]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: v${{ needs.prepare.outputs.version }}
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Log in to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/test.yml

@@ -5,11 +5,16 @@ on:
     branches: [main]
   pull_request:
 
+# The job reads the repository and nothing else (security audit 2026-10-17,
+# review of stages 2-6).
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           # design-first.sh reads each commit's parent and the template history.
           fetch-depth: 0
@@ -20,7 +25,7 @@ jobs:
           HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
         run: bash .github/scripts/design-first.sh "$BASE" "$HEAD"
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: "1.26"
           cache: true
@@ -51,6 +56,13 @@ jobs:
       - name: Test
         run: go test ./...
 
+      # Known vulnerabilities in the module's dependencies and in the
+      # standard library of this Go, reached from SelfPost's code (security
+      # audit 2026-10-17, I4: twelve stdlib advisories went unnoticed until
+      # the base image's tag happened to move). Pinned like staticcheck.
+      - name: Vulnerabilities
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...
+
       # The e2e module runs only in release.yml, after a release is published;
       # a type error there would first show up then. Compile it here without
       # running it: `go test -run` would still run TestMain, which brings up

CHANGELOG.md

@@ -5,16 +5,526 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Documentation
+
+- **Machine requirements by what is switched on** (guide § Installation,
+  README § Requirements), measured on the test installation instead of the
+  old unmeasured "1 vCPU, 512 MB-1 GB, 8-10 GB": 512 MB of host memory for
+  outbound mail with or without port 25; with the spam filter 768 MB when
+  port-25 messages are kept small and 1 GB for several 25 MiB messages at
+  once (rspamd measured at 118 MB at rest, 232 MB on one 25 MiB message,
+  424 MB on three); the proxy containers' own; one vCPU. Building the image needs 1.5 GB of memory - a build held to 1 GB was
+  killed in the Go compiler - and about 3 GB of free disk. The send log
+  grows about 2-3 KB a message for its retention.
+
+## [2.16.0] - 2026-10-18
+
+The queues as the 2.0 mockups drew them: Outbound › Queue a table, Inbound ›
+Queue built. No migration; schema 14.
+
+### Added
+
+- **Inbound › Queue** (`/inbound/queue`, global role, with the inbound relay
+  on): mail accepted on port 25 that its upstream has not yet taken, a row
+  per recipient with the upstream's last reply - the screen `in-queue`, drawn
+  for 2.0 and not built until now. Help has its topic.
+
+### Changed
+
+- **Outbound › Queue is the table the mockup draws** instead of
+  `postqueue -p`'s text: a row per recipient, oldest first - queue id, when
+  it arrived, sender, recipient, and the last reply of the receiving server
+  or why no connection was made - with *Details* to the message in the
+  Outbound log when it has a row there. The box head counts the messages and
+  their size; past 200 recipients the oldest 200 are listed and a line says
+  how many wait. Read from `postqueue -j` (Postfix 3.10.13,
+  `src/postqueue/showq_json.c`: `message_size`, and a recipient's
+  `delay_reason` when it has one). A recipient of an inbound domain is on
+  Inbound › Queue instead.
+- **Overview's queue card** is *Queues*, "Both empty", "outbound and inbound"
+  while the inbound relay is on, as the mockup has it: Postfix keeps one queue
+  for both.
+- `TestUnbuiltScreensAreOnTheRoadmap`: a screen the guards let pass unbuilt
+  must be named in `docs/roadmap.md`. The two queues had been deferred on
+  2026-10-09 with no roadmap row and were forgotten; development.md says so.
+
+### Fixed
+
+Two gaps a comparison of every mockup with the panel found (the rest
+matches):
+
+- **Server › Users, the user form:** with *All outbound domains* (or *All
+  inbound domains*) ticked, that list's single domains are disabled, as the
+  mockup draws them - the server ignored them already, which the help line
+  says. panel.js does it; without scripts they stay clickable.
+- **Server › Backup, Import a domain:** "the domain's settings" links to
+  Outbound › Domains, where each domain's settings are, as the mockup's link
+  does.
+
+## [2.15.0] - 2026-10-18
+
+The two proposals the security audit left as product choices. Migration
+0014; schema 14.
+
+### Added
+
+- **Verified TLS to an inbound domain's upstream** (upstream-tls-verify; the
+  security audit's M7): a fourth choice beside Opportunistic, Required and
+  Off - Postfix's `secure` level, which also checks that the upstream's
+  certificate was issued by a trusted authority for its name. The upstream
+  is then given by name. Postfix's SMTP client now trusts Debian's
+  `ca-certificates`; mail to the recipients' MX is unchanged. Migration
+  0014 widens the stored TLS mode; schema 14.
+- **A DMARC record for the server's own name** (server-dmarc-hint; the
+  security audit's S3): Server › Settings › Notification mail gives
+  `v=DMARC1; p=reject` at `_dmarc.<hostname>` beside the DKIM and SPF
+  records, checks it, and Health's card shows it. Without one a receiver
+  does not refuse mail forged in the server's name, a false password-reset
+  message among it; `p=none` is shown as weak.
+
+## [2.14.5] - 2026-10-18
+
+A line less in the mail log. No migration; schema 13.
+
+### Fixed
+
+- **ETRN is discarded from the EHLO reply silently**: since `2.14.4` Postfix
+  logged "discarding EHLO keywords: ETRN" for every connection on every port
+  (seen on the test server after the rollout); `silent-discard` keeps the
+  discard and drops the line.
+
+## [2.14.4] - 2026-10-17
+
+The follow-ups of the security audit of 2026-10-17
+([docs/security-audit-2026-10-17.md](docs/security-audit-2026-10-17.md)),
+stages 0-6: its one high (A2), its seven mediums and the lows. No migration;
+schema 13. Read *Upgrading* below: the TLS key's group, and copy
+`antispam/` again where the sidecar runs.
+
+### Upgrading
+
+- **Give the TLS private key to group 10997** (audit I1): `chgrp 10997
+  certs/privkey.pem` - or certbot's `archive/<name>/privkey*.pem` - and the
+  same in whatever renews it. Group 10998, which the guide named until now,
+  has Postfix in it; the backup keeps working with either, but only 10997
+  keeps the key from Postfix's daemons.
+- **With the antispam sidecar, copy `antispam/` again** (audit S4): rspamd
+  4.2.2, and a third file, `antispam/rspamd/worker-proxy.inc`, that the
+  fragment now mounts; `docker compose ... up -d` recreates the sidecar.
+- **Behind Apache on the host, set `TRUSTED_PROXY_CIDR`** if it is not set
+  (audit A1): the guide's install step prints the gateway to put there; the
+  panel's log says so after the first requests when it is missing.
+
+### Security
+
+- **A stolen `global` session no longer takes a full backup** (security
+  audit 2026-10-17, A2, high): the user form set the signed-in user's own
+  password without the current one, which then passed the backup's password
+  check. Adding a user, setting a password, changing an e-mail or a role on
+  the user form, and deleting a user now ask for your own account password,
+  as a backup does, under the same limit on wrong guesses - which now
+  counts wrong passwords only.
+- **One stranger behind a shared proxy no longer locks everyone out of
+  signing in** (audit A1, A8, A9): sign-in counts failures per address and
+  username (a hundred per address alone), a right password no longer
+  counts, a link's page is limited per link, a reset request per address
+  and name, and an IPv6 client is one per /64. With every request coming
+  from one private address with `X-Forwarded-For` and `TRUSTED_PROXY_CIDR`
+  empty, the log says what to set. Refused sign-ins are logged.
+- **Reset links pause for a day after five** (audit A3): anyone who knew a
+  username could keep a live reset link arriving in that mailbox five times
+  an hour. After five in a day the owner is told once that further requests
+  are ignored for 24 hours.
+- **`/healthz` is not answered through the reverse proxy** (audit I6):
+  only a request with no `X-Forwarded-For` from loopback or a private
+  address gets the liveness answer - the container's own check, the host,
+  a monitor next to it; the internet gets `404`.
+- **Every container has a process ceiling** (audit I3): `pids_limit` 1024
+  for SelfPost, 256 for the proxies and rspamd, 64 for certbot.
+- **A save that changes no map no longer reloads Postfix, and DNS
+  re-checks are limited** (audit W6/M9): every application, upstream,
+  recipient or report-address save reloaded Postfix, and *Re-check DNS*
+  bypassed the cache without limit. Now only a changed file is written and
+  reloaded (Health's *Reload configuration* always re-reads), and a user
+  re-checks twenty times in 15 minutes.
+- **A domain import is bounded** (audit W4, W5, W8): a DKIM key over 4096
+  bits, more than 500 applications, and a domain named as the server
+  itself - whose key signs the panel's own mail - are refused.
+- **The build is pinned and checked** (audit I4, I5): GitHub Actions by
+  commit, certbot and Caddy by release; govulncheck on the source in CI and
+  on the image's binaries before a release is pushed; a weekly check says
+  when a Debian package the mail path runs on has moved, so that a patch
+  release follows.
+- **The signature covers `Content-Type`, `MIME-Version` and `Message-ID`**
+  when the message has them (audit M6), and a header line too long to be
+  delivered unbroken is named in the log as a body line is (M8).
+- **A session made under a longer `PANEL_SESSION_IDLE_DAYS` is cut to the
+  current window** at its next request (audit A10), not kept until its old
+  expiry.
+- **The antispam sidecar runs rspamd 4.2.2, hardened** (audit S4): from
+  3.11.1 (December 2024; the line between fixed a heap overflow, a
+  use-after-free on reload and parser crashes), with no Linux capability,
+  `no-new-privileges`, and only the milter on the compose network - the
+  scanner and the controller, whose default password is public, stay on the
+  sidecar's loopback. A third file, `antispam/rspamd/worker-proxy.inc`, is
+  mounted; copy it with the fragment.
+- **The TLS private key no longer has to be readable by Postfix** (audit
+  I1): the guide gave it to group 10998 for the panel's backup, and
+  `postfix` is in that group, so every Postfix daemon - an smtpd talking to
+  the internet included - could read it. A new group, `backupkey` (10997),
+  holds the panel alone; the guide, Help and the backup's refusal name it.
+
+- **A domain's rate limit is taken only by its own applications** (audit
+  M1): the level-2 domain limit was read from `MAIL FROM`, which reaches the
+  milter before Postfix holds it to the login, so a client that never
+  signed in, or another tenant's application, could use up a domain's
+  limit. It is now the signed-in application's domain.
+- **One accepted message is one Inbound › Log row per recipient** (audit
+  M3): a recipient repeated in RCPT TO, up to Postfix's thousand, was a row
+  each, and the journal milter's rows did not count toward the 10 000-row
+  cut between the six-hourly prunes. Repeats are one row, a message's rows
+  are written in one transaction, and both writers count toward the cut.
+- **A domain's custom DMARC report address may not be on the server's own
+  name** (audit W1): it opened a mailbox the whole internet could file
+  reports into, under any domain, or another domain's hosted one. Only the
+  hosted address of a domain that chose it is a mailbox now, and a report
+  must arrive at the address tagged with its domain.
+- **A domain's DMARC reports are deleted with it** (audit A5/W2): reports
+  belong to a domain by name, and a domain deleted and added again showed
+  its old reports to whoever it was assigned to then.
+- **The sender map is rebuilt one change at a time** (audit W3): two
+  application changes at once could leave the map without the newer one
+  until the next change.
+- **A stranger's recipient no longer writes an Inbound › Log row** (audit
+  M2): Postfix quotes a refused recipient in its reply with the quotes
+  removed, so `RCPT TO:<"; from=<x> to=<y> …"@domain>` spelled a second
+  sender and recipient there, and the parser took the first. It now takes
+  Postfix's own tail at the end of the line.
+- **The sender check keeps two `From:` and two `Sender:` lines** (audit M5),
+  not every one an application sends: the judgement needs no more, and a
+  hundred long lines were megabytes held per connection.
+- **A link's token stays out of the duplicate-cookie log line** (audit A4),
+  as it already did out of the origin check's.
+- **ETRN is refused and no longer offered** (audit S6): Postfix's default
+  let anyone on port 25 flush the queue toward an inbound domain's upstream.
+- **SECURITY.md names the 2.x line as the supported one** (audit X1); its
+  table still said 1.x.
+- **The entrypoint follows no link at the DMARC maps** (audit I2): the
+  three `dmarc_*` maps root creates at the start were missing from the list
+  of paths where a symbolic link is removed first.
+
+### Documentation
+
+- security.md says what the code does where it said more (audit A6, A7,
+  W7): a wrong method answers `405` before the role is looked at; the setup
+  token is made anew at the first request after it expired; two GETs make
+  the server's own DKIM key on first view. The README's local trial says
+  that the compose file is the hardened deployment.
+
+- **The upstream's "Required" TLS checks no certificate**, and the guide and
+  Help now say so (audit M7): it guards against a listener, not against one
+  who answers in the upstream's place.
+
+
+## [2.14.3] - 2026-10-17
+
+A tag beside a label. No migration; schema 13.
+
+### Fixed
+
+- **A tag beside a label no longer squeezes the field under it**: the
+  e-mail's "not confirmed" on Account made its label taller and left less
+  room above the field than Username has (the owner's phone).
+
+## [2.14.2] - 2026-10-17
+
+The last small items of the day. No migration; schema 13.
+
+### Added
+
+- **Health dials the inbound journal's socket** with the inbound relay on:
+  the milter that writes Inbound › Log was the one the panel did not check.
+  The send log's socket is named as the mockup names it, `journal-milter`.
+
+### Changed
+
+- **A DMARC report says which day it is**: its day stays the reporter's, in
+  UTC (owner, 2026-10-17: accepted as it is), and the report's page now says
+  so under its window; Settings and Help name it as the one exception to
+  the panel's zone. A daily report from midnight to midnight is one day, not
+  two.
+
+### Documentation
+
+- The guide's gaps from the docs audit: `/license` and `/server/components`,
+  DMARC pages' paths, `selfpost-backup -o`, `-i` and `-version`, the
+  Inbound log's retention field, `PANEL_COOKIE_SECURE`.
+
+## [2.14.1] - 2026-10-17
+
+Overview's head in the mockup's words. No migration; schema 13.
+
+### Changed
+
+- **Overview's head says it as the mockup does** (overview-head): "Mail is
+  flowing. One thing needs attention." - or "Nothing needs attention", or
+  "Mail may not be flowing" when a check fails - and under it each check
+  that is not fine with its value ("TLS certificate: expires in 12 days.").
+
+## [2.14.0] - 2026-10-17
+
+Password reset by e-mail, to a confirmed address. Migration 0013; schema 13.
+
+### Added
+
+- **Password reset by e-mail** (password-reset): *Forgot your password?* on
+  the sign-in page sends a one-time link, for 30 minutes, to the account's
+  e-mail - once that address has been confirmed by a link sent to it. A new
+  address is sent its confirmation link when it is saved (Account, or the
+  user form); Account shows whether it is confirmed and can send the link
+  again. Notifications go to the address confirmed or not. Setting a new
+  password from a link signs every session of the account out. Migration
+  0013; schema 13.
+
+### Changed
+
+- **Changing your e-mail on Account asks for your password**, as changing
+  the password does: the address is where a reset link goes.
+
+## [2.13.1] - 2026-10-17
+
+The documents and the panel's words checked against the code. No migration;
+schema 12.
+
+### Fixed
+
+- **A panel password's twelve characters are characters**: the minimum
+  counted bytes, so six letters of a non-Latin alphabet passed for twelve.
+  It counts characters now, as the backup password always did. Passwords
+  already set are not affected.
+
+### Changed
+
+- **The panel and its mockups say the same** (docs-audit): an inbound
+  domain's MX box says when it was checked and its side menu links the
+  domain's Inbound log; a deferred message's history ends with the wait in
+  the queue; Overview says it refreshes on its own; DMARC's hint for an
+  unaligned third party reads as the mockup. Help says what the code does:
+  an application's password is kept by the server so an export can carry
+  it, every password check of a backup counts, a password set for another
+  user signs them out everywhere, the limit mail is daily per sending
+  domain, and a domain administrator is no longer shown the Filter lists
+  topic (their page is the global role's).
+
+### Documentation
+
+- The documents checked against the code (docs-audit, 2026-10-17): the
+  guide, architecture, schema-migrations, security, development, README and
+  product say what the code does.
+
+## [2.13.0] - 2026-10-17
+
+The panel in the container's time zone. No migration; schema 12.
+
+### Added
+
+- **The panel in your time zone** (local-time): set `TZ` in `.env` (an IANA
+  name, e.g. `Europe/Moscow`) and every time the panel shows, every day it
+  counts - today on Health, the statistics' days, the days of the log
+  filters - and the stamps of `mail.log` are that zone's. The screens no
+  longer write "UTC" beside a time; **Server › Settings** names the zone in
+  a new read-only box. Unset, it is UTC as before. Changing it is a
+  restart; days counted before stay the old zone's.
+
+## [2.12.0] - 2026-10-17
+
+A test message from Server › Health. No migration; schema 12.
+
+### Added
+
+- **A test message from Server › Health** (test-email): one message to an
+  address you type, from `postmaster@` the hostname, the way notifications
+  go. The page that opens is its row in the Outbound log, which follows it
+  to the receiving server. It tests the server's own path, not a domain's.
+  Global role, ten an hour.
+
+## [2.11.0] - 2026-10-16
+
+Health checks the certificate's name, Postfix's greeting and the reverse
+proxy. No migration; schema 12.
+
+### Added
+
+- **Server › Health checks three things it did not** (health-setup-checks):
+  whether the TLS certificate is for the server's own name - a tag beside
+  its names, and a failure when it is not, since a client that checks the
+  name refuses it however valid it is; Postfix's greeting, the `220` line,
+  which must name the hostname; and the address the panel sees your browser
+  at, warning when a reverse proxy it does not trust stands in front - every
+  visitor then shares one sign-in limit - and naming what to put in
+  `TRUSTED_PROXY_CIDR`.
+
+## [2.10.4] - 2026-10-16
+
+The origin check is strict. No migration; schema 12.
+
+### Security
+
+- **A change with no word of where it came from is refused**
+  (origin-strict): a `POST` that carries neither `Sec-Fetch-Site` nor
+  `Origin` is answered 403, as a cross-origin one is. It was let through
+  before, as an accepted risk, which left a browser that sends neither open
+  to a request forged by any site. Every current browser sends `Origin` with
+  a form; a browser too old to (Firefox before 70) can no longer save
+  anything in the panel.
+
+## [2.10.3] - 2026-10-16
+
+The backup asks for your password. No migration; schema 12.
+
+### Changed
+
+- **A backup and a domain's export ask for your password** (backup-reauth):
+  both downloads take the signed-in user's account password, checked like a
+  password change and under its limit, so a stolen session or a panel left
+  open no longer hands over the server's every secret.
+
+### Fixed
+
+- **The file field of a domain's import is drawn as designed**: Bulma's
+  file button and the name of the file chosen, not the browser's own
+  "Browse…".
+
+## [2.10.2] - 2026-10-16
+
+The panel on a phone. No migration; schema 12.
+
+### Changed
+
+- **A narrow screen gets a Menu** (phone-desktop-mode): below 1024 px - a
+  phone, a phone in "desktop site" mode, a tablet, a narrow window - the
+  navigation was a sheet of every section and page, always open, filling
+  the first screen. It is now *Menu* at the right of the header, which opens
+  the sections as folds, the current one open, the account's entries last;
+  no script. The page no longer meets the screen's edge. From 1024 px
+  nothing changes.
+
+## [2.10.1] - 2026-10-16
+
+Postfix's queue ids no longer repeat. No migration; schema 12.
+
+### Fixed
+
+- **Queue ids no longer repeat**: Postfix makes long, non-repeating queue ids
+  (`enable_long_queue_ids=yes`). A short id - the microsecond of arrival and
+  the queue file's inode - came round once the inode did, and a later message
+  could then rewrite an older row of the Outbound log with the same id and
+  recipient, put its lines on that row's page, or reach the Inbound log's
+  row of an earlier message. New ids read like `3Pt2mN2VXxznjll`; mail
+  already in the queue keeps its short id; Outbound › Queue's Queue ID
+  column is wider.
+
+## [2.10.0] - 2026-10-16
+
+Inbound › Log says what became of accepted mail: the upstream's answer,
+its last reply and the host that gave it. Migration `0012`; schema 12.
+Nothing for an operator to do.
+
+### Added
+
+- **Inbound › Log shows what the upstream answered** (inbound-upstream-result,
+  the plan, since removed): an *Upstream* column
+  beside the decision - *queued*, *held*, *sent*, *deferred* (a greylisting, an
+  upstream that cannot be reached), *bounced* (refused, or expired in the
+  queue) - opening the last reply, the host that gave it and when. Read from
+  the delivery lines of `mail.log`, one update of the row per attempt; the
+  lines of port-25 mail are still not stored. Rows logged before have no
+  result. Migration `0012`, schema 12.
+
+## [2.9.1] - 2026-10-16
+
+Log panes read on a phone. No migration; schema 11.
+
+### Fixed
+
+- **Log panes wrap their lines instead of scrolling sideways**: a phone drew
+  two scroll bars over the Delivery log of a message, and the end of a
+  delivery line - `status=` and the reply - was out of sight. A long line
+  wraps, the rest indented under its start; copied text keeps one line per
+  line. The Delivery log, System log and the queue's listing.
+
+## [2.9.0] - 2026-10-16
+
+The panel's DNS records read faster: a record DNS already holds as shown
+is one line, its values on request. Server › Settings puts its Save button
+under its own fields and can re-check the records of the server's own
+name. `/data/opendkim`, which 2.8.x kept for a rollback to 2.7.x, is
+removed at the first start; an installation still on 2.7.x goes through
+2.8.x first (guide, § Upgrading). No migration; schema 11.
+
+### Changed
+
+- **A DNS record DNS already holds as shown is folded** (dns-record-collapse):
+  on an outbound domain's page, an inbound domain's and in Server ›
+  Settings › Notification mail, a *published* record is one line - its
+  name, its tag and *Show values*, which opens the host, type and value to
+  copy them again. A record that is missing, weak, wrong or not checked
+  stays open as before, with *In DNS now* where it differs. A `<details>`
+  block, no script; *Re-check DNS* draws the page again, so a record that
+  has just turned right comes back folded.
+- **Server › Settings: *Save settings* sits under the fields it saves**
+  (settings-save-row): the form is the left column - Log retention,
+  Notifications, the button - and the right column holds what is not a
+  field, Notification mail and the read-only Sending rate limits. Before,
+  the button stood under both columns, after a long gap whenever the
+  records of the server's own name were open.
+
+### Added
+
+- **Re-check DNS on Server › Settings** (notification-mail-recheck): the
+  records of the server's own name can be checked again where they are
+  shown, as a domain's can on its page; the Notification mail box says when
+  they were checked. Before, the only way was Re-check DNS on Server ›
+  Health, which nothing on Settings pointed to. `POST
+  /server/settings/dns-recheck`, global role.
+
+### Removed
+
+- **`/data/opendkim`, the key tree of 2.7.x** (panel-dkim-signing, as
+  planned for the release after 2.8.0): 2.8.x copied its keys to
+  `/data/dkim` and kept it for a rollback to 2.7.x; the first start of
+  this image removes it once `/data/dkim` holds a key, and says so. A
+  `/data` whose keys are under the old tree only - one that never ran
+  2.8.x - stops the start rather than give the server's own name a new
+  key: start 2.8.x once first (guide, § Upgrading). The copy and the
+  backup's exclusion of the tree went with it. A rollback from here goes
+  to 2.8.x; to 2.7.x only through a 2.7.x backup.
+
+## [2.8.0] - 2026-10-16
+
+The panel signs outgoing mail with DKIM itself, and OpenDKIM - a 2018 beta
+with open 2026 CVEs - has left the image. Keys, selectors and DNS records do
+not change; the first start copies the keys to `/data/dkim`. The sender
+check holds a `Sender:` line too. Nothing for an operator to do; a rollback
+to 2.7.x needs one command first (guide, § Upgrading). No migration;
+schema 11.
+
 ### Added
 
 - **The panel signs outgoing mail with DKIM itself** (panel-dkim-signing,
-  [the plan](docs/plans/panel-dkim-signing.md)): a milter of the panel's on
+  the plan, since removed): a milter of the panel's on
   two sockets, one for applications' mail - signed with the key of the
   domain the login belongs to - and one for the panel's own, signed with the
   server's name. `relaxed/simple`, RFC 6376 § 5.4.1's headers and `From`
   once more, as OpenDKIM signed; strict. Before OpenDKIM left, both signed
   every message on the e2e stand and agreed on `h=` and `bh=`; dkimpy - an
   independent implementation - verifies the panel's signature on every run.
+  Beyond what OpenDKIM signed: `Sender` and `List-Unsubscribe-Post` (RFC 8058
+  wants it signed for one-click unsubscribe), and the shown headers a message
+  has - Subject, Date, To, Cc, Reply-To, Sender - named once more, so that
+  one added on the way breaks the signature. A header section over 1 MiB is
+  refused (`552 5.3.4`); a body line over 998 bytes, which Postfix breaks on
+  delivery, is logged with its domain.
 
 ### Removed
 
@@ -26,14 +536,22 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 ### Changed
 
 - **The DKIM keys moved to `/data/dkim`** and are the panel's alone (0600):
-  the first start copies them from `/data/opendkim`, which is left as it was
+  the first start copies them from `/data/opendkim`, which is kept, the
-  for a rollback to 2.7.x. Keys, selectors and DNS records do not change.
+  panel's alone as well, for a rollback to 2.7.x, and left out of backups.
-  The KeyTable and SigningTable are gone; a selector table the signer reads
+  Keys, selectors and DNS records do not change. The KeyTable and
-  takes their place. `OPENDKIM_DIR` and `OPENDKIM_SOCKET` are gone.
+  SigningTable are gone; a selector table the signer reads takes their
+  place, rewritten from the database at every start. `OPENDKIM_DIR` and
+  `OPENDKIM_SOCKET` are gone.
 - **The sender check reads `From:` as a mail program does** and no longer as
   OpenDKIM did: the line must be one address at a domain the application
   may send as, and the 256-byte limit of OpenDKIM's buffer goes. The key is
   the login's, so no `From:` line can choose another tenant's.
+- **A `Sender:` line is held to the same rule as `From:`** when a message
+  has one - the address a mail program shows as "on behalf of". A message
+  with another domain's address there, or with two `Sender:` lines, is
+  refused with `550 5.7.1 Sender: …`, tagged `wrong Sender` in the
+  Outbound log. A system writing for people outside your domains puts its
+  own address in `From:` and theirs in `Reply-To:`.
 
 ### Fixed
 
@@ -41,6 +559,22 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   it as quoted-printable for a server that does not announce 8BITMIME, after
   it was signed; `disable_mime_output_conversion=yes` now delivers it as
   signed. OpenDKIM's signatures were exposed to this too.
+- **A message of nothing but headers was held whole by every milter.** The
+  milter library (go-milter v0.4.1) kept each header of a message in a map
+  of its own that no milter of the panel read - up to the message size
+  limit, on port 25 from strangers too. The panel builds it patched not to
+  (`third_party/go-milter`).
+- **A rotation of `mail.log` due at the container's start logged an error.**
+  It runs before Postfix does, and its `postfix reload` failed ("the Postfix
+  mail system is not running"); nothing was lost - the Postfix starting
+  next opens the new file - but logrotate reported a failure. It reloads
+  only a running Postfix now.
+- **A start on a queue of an earlier image could stop at `postfix check`.**
+  The numbers the image's package accounts get depend on what else it
+  installs, and the queue under `/data` kept the old ones; `postsuper`, which
+  the check runs as the mail owner, could not read it. The entrypoint hands
+  the queue to Postfix's users by name before the check now. The first
+  rollout of this version to the test server met it and was rolled back.
 
 ## [2.7.0] - 2026-10-15
 
@@ -165,7 +699,7 @@ No migration; schema 11.
   The listener now sets `normalize` - the setting Postfix recommends and 3.9
   made the default: DATA ends only at the standard `<CR><LF>.<CR><LF>`, a
   bare newline elsewhere is read as a line end. Found while reading for
-  [own-mta-builds](docs/own-mta-builds-2026-10-15.md) (§ 5); `test/e2e`
+  own-mta-builds (§ 5, since removed); `test/e2e`
   sends the sequence and finds one message at the upstream with all of it
   inside. Only installations with `INBOUND_RELAY_ENABLE=true` or
   `DMARC_REPORTS_ENABLE=true` have the listener.
@@ -881,7 +1415,7 @@ Documentation only; no product code changes.
   held to - any address of the application's domain, or the addresses of its
   list, with or without a `+extension` - and refuses anything else with
   `550 5.7.1`, a domain this server does not sign for included
-  ([plans/from-header-binding.md](docs/plans/from-header-binding.md)).
+  (plans/from-header-binding.md, since removed).
 - **The check is strict.** It is the first milter of the chain, on a socket
   of its own (`SENDER_CHECK_SOCKET`), attached with
   `default_action=tempfail`: while the panel does not answer, Postfix defers
@@ -935,7 +1469,7 @@ Documentation only; no product code changes.
   a user's own switch, `users.notify`, on for everyone; `notify_state`, what
   the panel has already written to its users about. The instance switch is a
   settings key, on unless turned off
-  ([plans/panel-notifications.md](docs/plans/panel-notifications.md)).
+  (plans/panel-notifications.md, since removed).
 - **The panel writes to its users when something needs them.** Four things,
   each said once: a sending domain's DKIM, SPF or DMARC record stops matching
   (after two hourly checks in a row, and once more when it matches again); a
@@ -985,7 +1519,7 @@ Documentation only; no product code changes.
   The table that will hold what Postfix wrote about a message for as long as
   its send-log row lives, with the store methods to write a line, to write it
   once, to read the lines of a row and to prune
-  ([plans/delivery-log-storage.md](docs/plans/delivery-log-storage.md)).
+  (plans/delivery-log-storage.md, since removed).
 - **The log tailer keeps what Postfix writes about queued messages.** A
   `mail.log` line headed by a queue id is stored with the line's own time, one
   transaction per pass over the log; after an unclean stop a line read twice
@@ -1585,7 +2119,7 @@ screens. Nothing in `internal/web` changes; the design stays `candidate`
   scrolling at 1280px and up. Documented on the components page and in the
   plan (§ Type and tables).
 - Panel redesign, header comparison sheet
-  ([docs/assets/panel-redesign/header/](docs/assets/panel-redesign/header/index.html)):
+  (`docs/assets/panel-redesign/header/`, since removed):
   at nav size the stamp dissolves into the brick bar and the perforated edge
   was drawn inverted (round bumps instead of round holes). Three replacements
   beside the current header — **A** wordmark with the stamp's real hole-to-tooth
@@ -1659,7 +2193,7 @@ screens. Nothing in `internal/web` changes; the design stays `candidate`
   grammar (`measure` / `fill` plus Web Awesome layout CSS), no JS component
   library, new mockups rather than `docs/assets/panel-ui/`. Status: candidate.
 - Roadmap item and plan for `/preflight` installation check page
-  ([docs/plans/preflight.md](docs/plans/preflight.md)) — instance-level
+  (`docs/plans/preflight.md`, since removed) — instance-level
   infrastructure verification (rDNS, TLS, ports, HELO banner, proxy headers,
   DKIM socket, test email). Status: candidate.
 
@@ -1833,7 +2367,7 @@ antispam and quarantine. Upgrading from 1.9.0 is a tag bump; no migration.
 
 ### Added
 
-- [docs/plans/inbound-antispam-panel.md](docs/plans/inbound-antispam-panel.md) —
+- `docs/plans/inbound-antispam-panel.md` (since removed) —
   agreed plan for inbound antispam journal (inbound-journal milter + mail.log
   rejects) and instance-wide allow/deny lists synced to rspamd maps; target
   `1.10.0`; Composer → Opus → Fable workflow.
@@ -2033,7 +2567,7 @@ tag bump; no schema migration.
   self-contained backups and persistent queue.
 
 - docs: HTML mockups for a full panel UI refresh
-  ([docs/assets/panel-ui/](docs/assets/panel-ui/index.html)) — current screens,
+  (`docs/assets/panel-ui/`, since removed) — current screens,
   agreed and candidate roadmap surfaces (queue-retries, inbound-relay,
   dmarc-reports, panel-docs), a hybrid width (ops pages use the window, forms
   keep a reading measure), and a 390px emergency layout. The stamp and brick

README.md

@@ -6,9 +6,9 @@
 
 Self-hosted SMTP relay with a web panel — one Docker image, no provider.
 
-Postfix, OpenDKIM, and a small Go panel run together under `supervisord`; you
+Postfix and a small Go panel, which also signs outgoing mail with DKIM, run
-configure domains, DKIM keys, and SASL applications once, then point your apps
+together under `supervisord`; you configure domains, DKIM keys, and SASL
-at the SMTP endpoint.
+applications once, then point your apps at the SMTP endpoint.
 
 SelfPost sends mail straight to the internet from **your own IP**, with
 per-domain DKIM signing. No mailboxes or webmail. An optional inbound relay
@@ -27,11 +27,11 @@ send log and DNS checks in the panel, encrypted backups.
 - Optional inbound relay on port 25 (backup-MX / forwarder; off by default)
 - Optional DMARC aggregate report ingest on port 25 (off by default)
 - In-panel Help: a page of topics, opened from the `?` in the head of a box
-- Per-application client IP allow-list for SMTP AUTH (optional)
+- Per-application client IP allow-list for submitting mail (optional; refused at MAIL FROM, not an authentication boundary)
 - Web panel grouped by mail direction — Overview, Outbound (domains, log, queue, DMARC reports), Inbound, Server (health, system log, backup, users, settings)
 - Multi-domain relay — each SASL application is bound to one sending domain
 - DNS status checks (PTR, SPF, DKIM, DMARC) with in-panel re-check
-- Two-level rate limiting — IP backstop (Postfix), per-domain ceilings, and trusted-IP app overrides
+- Two-level rate limiting — IP backstop (Postfix), per-domain ceilings, and per-application overrides
 - Full-server backup and single-domain export/import (optional password encryption)
 - Single Docker image; production data in a `./data` bind mount (the quick start below uses a named Docker volume instead)
 
@@ -44,7 +44,7 @@ send log and DNS checks in the panel, encrypted backups.
 | [Architecture](docs/architecture.md) | As-built technical design |
 | [Security design](docs/security.md) | Mandatory requirements, accepted risks, the CSRF ADR |
 | [Development](docs/development.md) | Building, testing, docs rules, model routing, commits |
-| [Roadmap](docs/roadmap.md) | Open work (1.x+) — direction, not commitments |
+| [Roadmap](docs/roadmap.md) | Open work — direction, not commitments |
 | [CHANGELOG](CHANGELOG.md) | Release history |
 
 Found a vulnerability? Do not open an issue — [SECURITY.md](SECURITY.md) has
@@ -62,9 +62,23 @@ missing PTR record for you. Details: [Operator guide](docs/guide.md).
 
 - Docker + Compose v2 on the host
 - A reverse proxy in front of the panel (SelfPost never terminates HTTPS itself)
-- Rough sizing: **1 vCPU**, **512 MB–1 GB RAM**, **8–10 GB disk** (send log and
+- Machine, by what is switched on (measured; details and disk growth in the
-  rotated `mail.log` are the main growth drivers; both sit in the `./data`
+  guide's [Machine requirements](docs/guide.md#machine-requirements)):
-  volume, and both are capped — 90 days and 14 files by default)
+
+  | Switched on | Host memory, at least | Images on disk |
+  |---|---|---|
+  | Outbound only (465/587), with or without port 25 (inbound relay, DMARC reports) | 512 MB | 315 MB |
+  | With the spam filter (rspamd sidecar), port-25 messages kept small | 768 MB | 626 MB |
+  | With the spam filter and 25 MiB messages, several at once | 1 GB | 626 MB |
+
+  rspamd takes about 100 MB more for each large message it scans; a reverse
+  proxy in a container adds its own few megabytes.
+
+  One vCPU is enough. **Building the image needs 1.5 GB of memory and about
+  3 GB of free disk** (the Go compiler: a 1 GB build was killed) - on a
+  smaller machine, build elsewhere and `docker load` the image. The send log
+  is what grows: about 2-3 KB a message for the retention (90 days by
+  default) - 10 000 messages a day keep about 2.5 GB.
 
 ### Network and IP
 
@@ -112,8 +126,8 @@ outbound mail will not reach the real internet without DNS, PTR, and port 25.
 > local image and pulls nothing:
 >
 > ```sh
-> docker build -f build/Dockerfile --build-arg VERSION=2.7.0 \
+> docker build -f build/Dockerfile --build-arg VERSION=2.16.0 \
->   -t ghcr.io/mixeme/selfpost:2.7.0 .
+>   -t ghcr.io/mixeme/selfpost:2.16.0 .
 > ```
 
 ```sh
@@ -122,9 +136,14 @@ docker run --rm -d --name selfpost-try \
   -e SELFPOST_HOSTNAME=mail.local.test \
   -e PANEL_COOKIE_SECURE=false \
   -v selfpost-try-data:/data \
-  ghcr.io/mixeme/selfpost:2.7.0
+  ghcr.io/mixeme/selfpost:2.16.0
 ```
 
+This trial runs with Docker's default capabilities and no
+`no-new-privileges`; the compose file of a real deployment
+(`deploy/docker-compose.yml`) drops every capability but the few it names,
+sets `no-new-privileges` and a process ceiling.
+
 **Get the setup URL** (pick one):
 
 ```sh

SECURITY.md

@@ -3,15 +3,22 @@
 ## Supported versions
 
 SelfPost follows SemVer. Fixes are issued for the **latest minor release of the
-1.x line** only; there is no backporting to earlier minors. Upgrade before
+2.x line** only; there is no backporting to earlier minors or to 1.x. Upgrade before
 reporting if you are behind — the image tag is `ghcr.io/mixeme/selfpost:X.Y.Z`.
 
 | Version | Supported |
 |---|---|
-| latest 1.x | yes |
+| latest 2.x | yes |
-| earlier 1.x | no — upgrade first |
+| earlier 2.x | no — upgrade first |
+| 1.x | no — upgrade to 2.x (guide § Upgrading) |
 | 0.x | no (pre-release) |
 
+A security update of a Debian package the image runs - Postfix, Cyrus SASL,
+OpenSSL, Berkeley DB - arrives with the next patch release built after it:
+published image tags are never rebuilt. A weekly check
+(`.github/workflows/base-packages.yml`) says when one has moved, and a patch
+release follows.
+
 ## Reporting a vulnerability
 
 **Do not open a public issue.** Use GitHub's private vulnerability reporting:
@@ -70,7 +77,8 @@ These are the operator's responsibility or accepted trade-offs, documented in
 - Deliverability outcomes: mail rejected or filtered by a receiving provider is
   a policy decision of that provider, not a defect
 - Denial of service through sheer volume against a single-tenant relay
-- Vulnerabilities in upstream Postfix, OpenDKIM, or the base image — report
+- Vulnerabilities in upstream Postfix, the Go libraries SelfPost builds on,
+  or the base image — report
   those upstream; if SelfPost's configuration makes an upstream issue
   exploitable when it otherwise would not be, that *is* in scope
 

build/Dockerfile

@@ -13,8 +13,11 @@ WORKDIR /src
 # Version stamped into both binaries; MUST match the image tag.
 ARG VERSION=dev
 
-# Module metadata first for layer caching.
+# Module metadata first for layer caching. third_party/go-milter is a module
+# go.mod replaces go-milter with (third_party/go-milter/PATCHES.md): the
+# download needs it.
 COPY go.mod go.sum ./
+COPY third_party ./third_party
 RUN go mod download
 
 COPY cmd ./cmd
@@ -54,13 +57,17 @@ ENV DEBIAN_FRONTEND=noninteractive
 # test say whether it does.
 # No DKIM package is installed: the panel signs itself (internal/milter,
 # sign.go) and makes the keys in Go (internal/domain/dkim.go); OpenDKIM left
-# the image in 2.8.0 (docs/plans/panel-dkim-signing.md).
+# the image in 2.8.0 (docs/architecture.md § DKIM signing).
 # systemd-standalone-sysusers is named so that cron-daemon-common, which
 # logrotate brings (logrotate 3.22.0-1, debian/control: "Depends: cron |
 # anacron | cron-daemon | systemd-sysv"), creates its group with it rather
 # than with the whole of systemd, the first alternative of its "Depends:
 # systemd | systemd-standalone-sysusers | systemd-sysusers" (dpkg -s in the
 # image, 2026-10-15). Nothing here runs systemd.
+# tzdata is named for TZ (local-time): the zone of every time the panel shows
+# and of the stamps Postfix writes in mail.log. supervisor's python3.13 brings
+# it today (apt-cache rdepends --installed tzdata in the image, 2026-10-17);
+# a TZ the image did not have would leave both in UTC without a word.
 RUN echo "postfix postfix/mailname string localhost" | debconf-set-selections \
  && echo "postfix postfix/main_mailer_type string Internet Site" | debconf-set-selections \
  && apt-get update \
@@ -75,6 +82,7 @@ RUN echo "postfix postfix/mailname string localhost" | debconf-set-selections \
       openssl \
       curl \
       systemd-standalone-sysusers \
+      tzdata \
  && rm -rf /var/lib/apt/lists/*
 
 # Debian's postfix runs its chroot sync on every "postfix check" and "postfix
@@ -101,9 +109,10 @@ RUN groupadd --system --gid 10999 panel  && useradd --system --uid 10999 --gid p
 # (set up in entrypoint.sh) - lets Postfix read the sasldb2/sender map and
 # connect to the panel's milters. The DKIM keys are the panel's alone. (The
 # supervisor control socket has a group of its own, `supervisor`, below.)
-# The id is fixed, because the host sees it: an operator gives the TLS
+# The id is fixed, because the host saw it: until 2.14.4 an operator gave the
-# private key on the host to this group by number, so that the panel can put
+# TLS private key on the host to this group by number - now to backupkey,
-# it into a full backup (guide § Taking a full backup). It lies outside the
+# below, which Postfix is not in - and a key given then still names it. It
+# lies outside the
 # range the distribution hands out to system groups, 100-999 (adduser 3.152,
 # /etc/adduser.conf: "Default: FIRST_SYSTEM_GID=100, LAST_SYSTEM_GID=999";
 # passwd 1:4.17.4-2, /etc/login.defs: SYS_GID_MIN 101, SYS_GID_MAX 999 - both
@@ -119,6 +128,16 @@ RUN groupadd --system --gid 10998 selfpost \
  && usermod -aG selfpost panel \
  && usermod -aG selfpost postfix
 
+# The host's TLS private key is given to this group, not to selfpost, so that
+# the panel can put it into a full backup (guide § Taking a full backup) and
+# no Postfix daemon can read it: postfix is in selfpost, and a memory-safety
+# bug in an smtpd reached from the internet would otherwise yield the key of
+# the mail and of the panel (security audit 2026-10-17, I1). Postfix itself
+# serves a root-only copy (postfix-config.sh). The panel is the one member.
+# Fixed for the same reason as selfpost's, next to it.
+RUN groupadd --system --gid 10997 backupkey \
+ && usermod -aG backupkey panel
+
 # The panel reads the mail queue with `postqueue -p` (and the status page's
 # queue card). postqueue is setgid postdrop, which normally gives it the group
 # needed to reach Postfix's showq socket - but the documented deployment runs

build/entrypoint.sh

@@ -87,48 +87,50 @@ drop_links() {
 	done
 }
 drop_links /data/dkim /data/dkim.new /data/opendkim /data/sasl /data/postfix /data/antispam /data/log \
-	/data/dkim/keys /data/dkim/selectors /data/opendkim/keys \
+	/data/dkim/keys /data/dkim/selectors \
 	/data/sasl/sasldb2 /data/postfix/queue \
 	/data/postfix/sender_login_maps /data/postfix/relay_domains \
 	/data/postfix/transport /data/postfix/relay_recipients /data/postfix/tls_policy \
+	/data/postfix/dmarc_recipients /data/postfix/dmarc_transport /data/postfix/dmarc_relay_domains \
 	/data/log/mail.log
 # Restored backups or previously-created state may contain panel-owned files
 # under /data; make sure they stay writable without disturbing anything that a
 # later phase deliberately hands to another service. /data/log is exempt: it is
 # deliberately owned by postfix (postlogd writes the delivery log there) and is
-# normalised on its own below, as are the trees shared through group selfpost
+# normalised on its own below, as are the trees shared through group selfpost.
-# and the one OpenDKIM read until 2.8.0, which is left as it was (below).
 # A file's owner is a number: an entry whose user or group is not the panel's
 # by that number - unpacked by root, or written under another image whose
 # image gave the panel other ids (999:999 until 2.7.0, 10999:10999 since) - is
 # handed over whole.
-find /data -mindepth 1 -maxdepth 1 ! -name log ! -name postfix ! -name opendkim ! -name sasl ! -name antispam \
+find /data -mindepth 1 -maxdepth 1 ! -name log ! -name postfix ! -name sasl ! -name antispam \
 	\( ! -user panel -o ! -group panel \) -exec chown -R panel:panel {} +
 
 # DKIM keys and the selector table, /data/dkim: the panel's alone - it makes
 # the keys, writes the table and signs (internal/domain, Keys; internal/milter,
-# sign.go). Until 2.8.0 the keys were under /data/opendkim, shared with
+# sign.go). The selector table is written by the panel before its signer
-# OpenDKIM through group selfpost. The first start without /data/dkim copies
+# serves (cmd/panel/signer.go). Until 2.8.0 the keys were under
-# them over and leaves the old tree as it was, for an image of 2.7.x rolled
+# /data/opendkim, shared with OpenDKIM; 2.8.x copied them to /data/dkim at its
-# back to (docs/plans/panel-dkim-signing.md, Q2). The copy is made as the
+# first start and kept the old tree for a rollback to 2.7.x until the next
-# panel user, which can read nothing there the panel could not, into a
+# release, this one (CHANGELOG [2.9.0]). It is removed
-# directory beside, renamed into place when it is whole: a start that stops
+# once /data/dkim holds a key. A /data that never ran 2.8.x - keys under the
-# midway copies again. A copy that fails stops the start (set -e) - the
+# old tree only - stops the start instead: the panel would make the server's
-# panel would otherwise make the server's own name a new key, and its
+# own name a new key, and its published record would no longer match; 2.8.x
-# published record would no longer match. The selector table is written by
+# copies them (guide § Upgrading). rm -rf removes a link, not what it points
-# the panel before its signer serves (cmd/panel/signer.go).
+# to, and follows none inside (GNU coreutils rm(1)); a link at the path is
-# (util-linux 2.41, setpriv(1): --reuid, --regid, --clear-groups; cp(1)
+# gone already (drop_links). (e2e TestStartsOnA28Data, TestRefusesA27Data.)
-# -P: never follow a symbolic link in the source.)
+has_keys() { [ -d "$1" ] && [ -n "$(find "$1" -type f -name '*.private' | head -n 1)" ]; }
-rm -rf /data/dkim.new
+if [ -d /data/opendkim ]; then
-if [ ! -e /data/dkim ] && [ -d /data/opendkim/keys ]; then
+	if ! has_keys /data/dkim/keys && has_keys /data/opendkim/keys; then
-	setpriv --reuid=panel --regid=panel --clear-groups -- \
+		echo "entrypoint: the DKIM keys are only under /data/opendkim, as 2.7.x kept them; start 2.8.x once first - it copies them to /data/dkim - then this image (guide, § Upgrading)" >&2
-		sh -c 'mkdir /data/dkim.new && cp -RP /data/opendkim/keys /data/dkim.new/keys'
+		exit 1
-	mv /data/dkim.new /data/dkim
+	fi
-	echo "entrypoint: the DKIM keys were copied from /data/opendkim to /data/dkim; /data/opendkim is left for a rollback" >&2
+	rm -rf /data/opendkim
+	echo "entrypoint: removed /data/opendkim, the key tree of 2.7.x; the keys are under /data/dkim" >&2
 fi
+rm -rf /data/dkim.new
 mkdir -p /data/dkim/keys
 chown -R panel:panel /data/dkim
-find /data/dkim -type d -exec chmod 0700 {} +
+find /data/dkim -type d -exec chmod 0700 {} + -exec chmod g-s {} +
 find /data/dkim -type f -exec chmod 0600 {} +
 
 # Application SASL accounts. The panel (user `panel`) writes the
@@ -148,11 +150,11 @@ rm -f /data/sasl/sasldb2.new
 # Postfix state under /data (architecture.md § Persistence). The panel writes
 # sender_login_maps; Postfix owns the on-disk queue tree under queue/.
 mkdir -p /data/postfix/queue
-[ -e /data/postfix/sender_login_maps ] || : > /data/postfix/sender_login_maps
+[ -e /data/postfix/sender_login_maps ] || [ -L /data/postfix/sender_login_maps ] || : > /data/postfix/sender_login_maps
 # Inbound relay maps (written by the panel when INBOUND_RELAY_ENABLE=true).
 # Empty files keep postfix check happy if the flag is on before any domain exists.
 for f in relay_domains transport relay_recipients tls_policy; do
-	[ -e "/data/postfix/$f" ] || : > "/data/postfix/$f"
+	[ -e "/data/postfix/$f" ] || [ -L "/data/postfix/$f" ] || : > "/data/postfix/$f"
 done
 # Every map here is the panel's to write and Postfix's to read - the sender
 # map, the inbound and the DMARC maps alike - so each file beside queue/ is
@@ -194,7 +196,7 @@ chmod 0755 /data/antispam
 # because parent directory has insecure permissions" when the directory's
 # group is not root and has write permission.
 mkdir -p /data/log
-[ -e /data/log/mail.log ] || : > /data/log/mail.log
+[ -e /data/log/mail.log ] || [ -L /data/log/mail.log ] || : > /data/log/mail.log
 chown -R postfix:selfpost /data/log
 chmod 2750 /data/log
 find /data/log -type f -exec chmod 0640 {} +
@@ -219,34 +221,53 @@ chmod 2750 /run/selfpost
 # (test(1), -S: true for any socket file, whether or not anything listens.)
 rm -f /run/selfpost/*.sock /run/selfpost/*.alive
 
+# The queue tree belongs to Postfix's users by name. Their numbers are what
+# the package's install hands out and depend on what else the image installs:
+# without opendkim (2.8.0) postfix went from uid 101 to 100 and postdrop from
+# gid 103 to 102, and a queue of an earlier image kept the old numbers. So an
+# existing tree is handed over before postfix-config.sh runs "postfix check",
+# whose postsuper drops to the mail owner before it reads the queue and
+# otherwise stops the start ("scan_dir_push: open directory defer: Permission
+# denied", the test server, 2026-10-16; Postfix 3.10.13,
+# src/postsuper/postsuper.c:1442, set_ugid(var_owner_uid, var_owner_gid);
+# conf/postfix-script:342). After the check it is done again for a tree the
+# check has just built.
+own_queue() {
+	[ -d /data/postfix/queue/active ] || return 0
+	chown -R postfix:postfix /data/postfix/queue
+	# The recursive chown would leave public/ and maildrop/ in group postfix.
+	# Postfix keeps those two in its setgid group: postqueue and postdrop are
+	# setgid postdrop and reach the showq socket and the maildrop directory
+	# through that group alone. With the wrong group `postqueue -p` run by the
+	# panel answers "Connect to the Postfix showq service: Permission denied"
+	# and the panel cannot read the queue (the Queue card and the Outbound
+	# queue page).
+	chgrp postdrop /data/postfix/queue/public /data/postfix/queue/maildrop
+	# It would also leave the queue directory itself and pid/ owned by
+	# postfix. Postfix keeps those two owned by root (master, which runs as
+	# root, is the only writer) and logs "warning: not owned by root" for each
+	# at every start. (Postfix 3.10.13, conf/postfix-files:51-68:
+	# $queue_directory root 755, maildrop $setgid_group 730, public
+	# $setgid_group 710, pid root 755, the other queue directories
+	# $mail_owner 700; conf/postfix-script:354-356, "check-warn": "not owned
+	# by root".)
+	chown root /data/postfix/queue /data/postfix/queue/pid
+}
+own_queue
+
 # Generate the outbound-relay Postfix configuration from the environment (spec
 # 5). Kept out of the image build so cert paths, rate limits, hostname and the
 # optional 587 service are all driven by env at run time, and re-derived on every
 # start the same way the /data normalisation above is.
 /usr/local/bin/postfix-config.sh
 
-# The queue tree, on a first start or after a restore, is already built here:
+# The queue tree, on a first start or after a restore, is built here:
 # postfix-config.sh ends with "postfix check", whose check-fatal runs
 # "post-install create-missing" (Postfix 3.10.13, conf/postfix-script:314;
 # conf/postfix-files:55, "$queue_directory/active:d:$mail_owner:-:700:ucr").
 # A "postfix set-permissions" for a missing active/ stood here and never ran
 # (assumptions C-P34).
-chown -R postfix:postfix /data/postfix/queue
+own_queue
-# The recursive chown above would leave public/ and maildrop/ in group postfix.
-# Postfix keeps those two in its setgid group: postqueue and postdrop are setgid
-# postdrop and reach the showq socket and the maildrop directory through that
-# group alone. With the wrong group `postqueue -p` run by the panel answers
-# "Connect to the Postfix showq service: Permission denied" and the panel cannot
-# read the queue (the Queue card and the Outbound queue page).
-chgrp postdrop /data/postfix/queue/public /data/postfix/queue/maildrop
-# It would also leave the queue directory itself and pid/ owned by postfix.
-# Postfix keeps those two owned by root (master, which runs as root, is the only
-# writer) and logs "warning: not owned by root" for each at every start.
-# (Postfix 3.10.13, conf/postfix-files:51-68: $queue_directory root 755, maildrop
-# $setgid_group 730, public $setgid_group 710, pid root 755, the other queue
-# directories $mail_owner 700; conf/postfix-script:354-356, "check-warn": "not
-# owned by root".)
-chown root /data/postfix/queue /data/postfix/queue/pid
 
 # [program:postfix]'s startsecs (build/supervisord.conf): longer than the
 # wrapper's wait for the milter sockets, so its exit at the end of the wait is

build/logrotate-mail.conf

@@ -15,7 +15,15 @@
 	compress
 	delaycompress
 	create 0640 postfix selfpost
+	# A rotation due when the container starts runs before Postfix does
+	# (logrotate-loop.sh runs at once, the wrapper waits for the milter
+	# sockets): no postlogd holds the old file then, the one Postfix starts
+	# opens the new, and a reload would only fail - "fatal: the Postfix mail
+	# system is not running", seen at the test server's rollout of
+	# 2026-10-16. "postfix status" exits 1 while no master runs (Postfix
+	# 3.10.13, conf/postfix-script:297-307), reload then nothing.
 	postrotate
+		/usr/sbin/postfix status >/dev/null 2>&1 || exit 0
 		/usr/sbin/postfix reload
 	endscript
 }

build/postfix-cert-reload.sh

@@ -43,7 +43,8 @@ reload() {
 # same_pair says whether a certificate file and a private key file belong
 # together, by comparing the public key each one prints. openssl-x509(1) and
 # openssl-pkey(1) do not say the two print it byte for byte alike; measured
-# in the image, 2026-10-15, OpenSSL 3.0.22: identical for RSA-2048, P-256 and
+# in the image, 2026-10-15, OpenSSL 3.0.x of bookworm, before trixie's 3.5
+# (re-read on 3.5.7 is due with the next look at this script): identical for RSA-2048, P-256 and
 # P-384 keys, and for a P-256 key written in SEC1 form ("EC PRIVATE KEY") -
 # certbot 2.0 and later issue ECDSA keys by default (assumptions C-X1).
 same_pair() {

build/postfix-config.sh

@@ -94,7 +94,7 @@ HOSTNAME_VALUE="${SELFPOST_HOSTNAME:-$(hostname -f 2>/dev/null || hostname)}"
 # other user; Postfix does not enforce it (smtpd loads the key as root in
 # pre_jail_init(), Postfix 3.10.13 src/smtpd/smtpd.c), but the mount cannot
 # give that mode - it is :ro and owned by the host's user, often readable by
-# group 10998 for the panel's backup. So the pair is copied into a directory of
+# group 10997 (the panel's alone) for the panel's backup. So the pair is copied into a directory of
 # Postfix's own, the key root:root 0600, before postconf and `postfix check`
 # (assumptions D-arch:154).
 TLS_CERT_SRC="${TLS_CERT_FILE:-/etc/postfix/tls/fullchain.pem}"
@@ -297,9 +297,19 @@ postconf -e \
 	"local_transport=error:local mail delivery is disabled"
 
 # Outbound delivery: straight to the recipient MX, opportunistic TLS.
+# The client trusts the authorities Debian's ca-certificates ships, for an
+# inbound domain's upstream with Verified TLS (the "secure" level in the TLS
+# policy map, upstream-tls-verify): Postfix trusts none by default - the
+# *_tls_CAfile defaults are empty and tls_append_default_CA is "no" (Postfix
+# 3.10.13, src/global/mail_params.h, DEF_SMTP_TLS_CA_FILE,
+# DEF_TLS_APPEND_DEF_CA). The levels may and encrypt check nothing and only
+# log the verdict; mail to the recipients' MX is unchanged. The file is the
+# bundle update-ca-certificates writes (ca-certificates, installed in the
+# image), read by smtp(8) unchrooted (chroot is off below).
 postconf -e \
 	"smtp_tls_security_level=may" \
-	"smtp_tls_note_starttls_offer=yes"
+	"smtp_tls_note_starttls_offer=yes" \
+	"smtp_tls_CAfile=/etc/ssl/certs/ca-certificates.crt"
 
 # TLS server material shared by every inbound service. auth_only guarantees
 # credentials are never accepted before TLS is up on any port. Postfix 3.10.13,
@@ -323,11 +333,21 @@ postconf -e \
 # and the banner names no distribution (Debian's adds "(Debian)": postfix
 # 3.10.13-0+deb13u1, debian/main.cf.in:15 "(@DEB_VENDOR@)", filled in by
 # debian/rules:118; the upstream default is "$myhostname ESMTP $mail_name").
+# ETRN is refused to everyone and not offered: Postfix's default lets any
+# client flush the queue toward an inbound domain's upstream
+# (fast_flush_domains = $relay_domains), and nothing here needs it (security
+# audit 2026-10-17, S6; Postfix 3.10.13, src/smtpd/smtpd.c, etrn_cmd() asks
+# smtpd_check_etrn(), whose "reject" answers reject_code, 554). The discard is
+# silent: without the pseudo keyword smtpd logs "discarding EHLO keywords:
+# ETRN" for every connection (src/smtpd/smtpd.c:2016, EHLO_MASK_SILENT;
+# src/global/ehlo_mask.c:88; seen on the test server after 2.14.4).
 postconf -e \
 	"smtpd_tls_protocols=>=TLSv1.2" \
 	"smtpd_tls_mandatory_protocols=>=TLSv1.2" \
 	"smtp_tls_mandatory_protocols=>=TLSv1.2" \
 	"disable_vrfy_command=yes" \
+	"smtpd_etrn_restrictions=reject" \
+	"smtpd_discard_ehlo_keywords=silent-discard,etrn" \
 	'smtpd_banner=$myhostname ESMTP'
 
 # SASL: Cyrus with the local sasldb2 the panel maintains. The realm is left
@@ -406,7 +426,7 @@ postconf -e \
 # deferred (docs/security.md).
 #
 # The panel's DKIM signer follows, strict too: unreachable, it defers rather
-# than send unsigned (docs/plans/panel-dkim-signing.md). It signs with the
+# than send unsigned (docs/architecture.md § DKIM signing). It signs with the
 # key of the login's domain. The journal-milter is monitoring only and is
 # fail-open (default_action=accept): its failure must never block the relay.
 # Per-milter settings use Postfix 3.0+ brace syntax.
@@ -440,6 +460,19 @@ postconf -e \
 # panel's, were exposed to it as well.
 postconf -e "disable_mime_output_conversion=yes"
 
+# Long, non-repeating queue ids (owner, 2026-10-16). The panel finds a
+# message's rows, its stored lines and the inbound journal's upstream result
+# by the queue id of mail.log; a short id is the microsecond of arrival and
+# the queue file's inode in hex and repeats once the inode comes round, so a
+# later message could meet an earlier one's rows. A long id adds the time in
+# seconds and does not repeat. Postfix 3.10.13, src/global/mail_params.h:1010,
+# DEF_LONG_QUEUE_IDS 0; src/global/mail_queue.h, MQID_SH_* and MQID_LG_*;
+# proto/postconf.proto, enable_long_queue_ids: "Enable long, non-repeating,
+# queue IDs", existing queue files keep their names, postqueue -p gets a
+# wider Queue ID column. Every pattern of the panel takes both shapes
+# (internal/logtail, internal/postfix/queue.go).
+postconf -e "enable_long_queue_ids=yes"
+
 # What Postfix tells a milter with MAIL FROM: its defaults plus the client's
 # address. The panel's milters judge every message by that address (an
 # application's client-address list) and record it (the inbound journal), and
@@ -521,8 +554,12 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 	TRANSPORT_SETTING=""
 	RECIPIENT_RESTRICTIONS="reject"
 	if [ "${INBOUND_RELAY_ENABLE}" = "true" ]; then
+		# [ -e ] is false for a dangling link and the redirect would follow
+		# it: the entrypoint's drop_links removes links at these paths, and
+		# this refuses to create through one all the same (audit 2026-10-17,
+		# I2).
 		for f in "$RELAY_DOMAINS_MAP" "$TRANSPORT_MAP" "$RELAY_RECIPIENTS_MAP" "$TLS_POLICY_MAP"; do
-			[ -e "$f" ] || : > "$f"
+			[ -e "$f" ] || [ -L "$f" ] || : > "$f"
 		done
 		RELAY_DOMAINS_SETTING="texthash:${RELAY_DOMAINS_MAP}"
 		TRANSPORT_SETTING="texthash:${TRANSPORT_MAP}"
@@ -530,7 +567,7 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 	fi
 	if [ "${DMARC_REPORTS_ENABLE}" = "true" ]; then
 		for f in "$DMARC_RECIPIENTS_MAP" "$DMARC_TRANSPORT_MAP" "$DMARC_RELAY_DOMAINS_MAP"; do
-			[ -e "$f" ] || : > "$f"
+			[ -e "$f" ] || [ -L "$f" ] || : > "$f"
 		done
 		ln -sf /usr/local/bin/panel /usr/local/bin/dmarc-ingest
 		# flags=, user= and argv= are arguments of pipe(8), not -o parameters:
@@ -719,7 +756,7 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 	# only here (above), so no client is spared. The submission ports take
 	# the default, normalize as well since this Postfix: an application whose
 	# SMTP library ends DATA with a bare <LF>.<LF> is no longer read to its
-	# end there (own-mta-builds, § 5: their smuggled transaction would still
+	# end there (docs/security.md § Mail path: their smuggled transaction would still
 	# be the authenticated session's, so they were left to the default).
 	postconf -P \
 		"smtp/inet/smtpd_forbid_bare_newline=normalize" \

cmd/panel/envdoc_test.go

@@ -14,15 +14,17 @@ import (
 // are compared as they are, not as lists kept by hand beside them (audit
 // 2026-10-12, stage 5 - the three lists this file held were compared with each
 // other and with nothing else). Read: what the panel's code asks of the
-// environment (cmd/panel and internal, tests aside) and what the start-up
+// environment (cmd/panel, cmd/selfpost-backup and internal, tests aside) and what the start-up
 // scripts take with a default (build/*.sh, "${VAR:-…}"). Documented: the
 // operator's table in guide.md § Environment variables, with the paragraph
 // under it, and the internal list in architecture.md § Configuration.
 
 var (
-	goEnvRead     = regexp.MustCompile(`(?:envDefault|envInt|envBool|envSeconds|envDuration|os\.Getenv|os\.LookupEnv)\("([A-Z][A-Z0-9_]+)"`)
+	goEnvRead = regexp.MustCompile(`(?:envDefault|envInt|envBool|envSeconds|envDuration|os\.Getenv|os\.LookupEnv)\("([A-Z][A-Z0-9_]+)"`)
+	// A name kept in a constant, as the backup CLI keeps its password's.
+	goEnvConst    = regexp.MustCompile(`\w+Env\s*=\s*"([A-Z][A-Z0-9_]+)"`)
 	scriptEnvRead = regexp.MustCompile(`\$\{([A-Z][A-Z0-9_]+):[-?=]`)
-	docEnvName    = regexp.MustCompile("`([A-Z][A-Z0-9_]{2,})`")
+	docEnvName    = regexp.MustCompile("`([A-Z][A-Z0-9_]+)`")
 )
 
 func readFile(t *testing.T, path string) string {
@@ -38,12 +40,16 @@ func readFile(t *testing.T, path string) string {
 func envRead(t *testing.T) map[string]bool {
 	t.Helper()
 	keys := map[string]bool{}
-	for _, root := range []string{".", filepath.Join("..", "..", "internal")} {
+	for _, root := range []string{".", filepath.Join("..", "selfpost-backup"), filepath.Join("..", "..", "internal")} {
 		err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
 			if err != nil || d.IsDir() || !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
 				return err
 			}
-			for _, m := range goEnvRead.FindAllStringSubmatch(readFile(t, path), -1) {
+			text := readFile(t, path)
+			for _, m := range goEnvRead.FindAllStringSubmatch(text, -1) {
+				keys[m[1]] = true
+			}
+			for _, m := range goEnvConst.FindAllStringSubmatch(text, -1) {
 				keys[m[1]] = true
 			}
 			return nil

cmd/panel/httpserver.go

@@ -112,10 +112,13 @@ func newPanel(cfg config, st *store.Store) (*web.Server, error) {
 		TrustedProxyCIDRs:          cfg.trustedProxies,
 		TLSCertFile:                cfg.tlsCertFile,
 		TLSServedCertFile:          cfg.tlsServedCertFile,
+		SMTPBanner:                 cfg.smtpBanner,
+		TimeZone:                   cfg.timeZone,
 		TLSReloadInterval:          cfg.tlsReloadInterval,
 		SignSocket:                 cfg.signSocket,
 		SignLocalSocket:            cfg.signLocalSocket,
 		JournalSocket:              cfg.journalSocket,
+		InboundJournalSocket:       cfg.inboundJournalSocket,
 		SenderSocket:               cfg.senderSocket,
 		SessionIdleDays:            cfg.sessionIdleDays,
 		DNSResolvers:               cfg.dnsResolvers,
@@ -167,7 +170,9 @@ func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
 	srv := newHTTPServer(cfg.httpAddr, srvApp.Handler())
 
 	// Shut the server down cleanly when the process is asked to stop.
+	shutDown := make(chan struct{})
 	go func() {
+		defer close(shutDown)
 		<-ctx.Done()
 		shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 		defer cancel()
@@ -178,5 +183,13 @@ func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
 	if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
 		return err
 	}
+	// ListenAndServe returns at the stop, before its requests have
+	// (net/http, Server.Shutdown); Shutdown returns once they have. The links
+	// they mail after their answers go on after that, and end before the
+	// database closes.
+	<-shutDown
+	drainCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	srvApp.Drain(drainCtx)
 	return nil
 }

cmd/panel/main.go

@@ -97,6 +97,12 @@ type config struct {
 	// how often build/postfix-cert-reload.sh looks for a renewal.
 	tlsServedCertFile string
 	tlsReloadInterval time.Duration
+	// smtpBanner is Postfix's smtpd_banner, expanded, read from postconf at
+	// the start: Health shows the greeting it makes.
+	smtpBanner string
+	// timeZone is TZ as the container was started with ("" for none): the
+	// zone of every time and day the panel shows, which Settings names.
+	timeZone string
 
 	dkimDir         string
 	dkimSelectorDef string
@@ -147,6 +153,7 @@ func loadConfig() config {
 		manifestPath:   filepath.Join(dataDir, backup.ManifestName),
 		setupTokenPath: envDefault("SELFPOST_SETUP_TOKEN_FILE", filepath.Join(dataDir, "setup-token")),
 		hostname:       os.Getenv("SELFPOST_HOSTNAME"),
+		timeZone:       os.Getenv("TZ"),
 		// Secure cookies by default (security.md); PANEL_COOKIE_SECURE=false is a
 		// development-only escape hatch for testing over plain HTTP.
 		cookieSecure: envDefault("PANEL_COOKIE_SECURE", "true") != "false",
@@ -311,6 +318,13 @@ func openData(cfg config, resync func(*store.Store) error) (st *store.Store, res
 	}
 	if restored {
 		log.Printf("restore manifest accepted; regenerating mail-path maps from SQLite")
+		// A link taken after the backup was made would work again from it
+		// (security review, 2026-10-17); a link sent before a restore is
+		// asked for again.
+		if err := st.DeleteAllUserLinks(); err != nil {
+			_ = st.Close()
+			return nil, false, err
+		}
 		if err := resync(st); err != nil {
 			_ = st.Close()
 			return nil, false, err
@@ -323,8 +337,8 @@ func openData(cfg config, resync func(*store.Store) error) (st *store.Store, res
 	return st, restored, nil
 }
 
-// run starts the panel's three roles and blocks until a shutdown signal or the
+// run starts the panel's roles (the list below) and blocks until a shutdown
-// first fatal error from any role. A signal triggers a clean stop of all
+// signal or the first fatal error from any role. A signal triggers a clean stop of all
 // roles; a role error cancels the others and is returned so the process exits
 // non-zero (letting supervisord/Docker see the failure — architecture.md §
 // Image and processes).
@@ -333,6 +347,7 @@ func run() error {
 	// postfix-config.sh has written main.cf before supervisord started the
 	// panel (build/entrypoint.sh), and nothing rewrites it after.
 	cfg.tlsServedCertFile = health.ServedCertPath()
+	cfg.smtpBanner = health.SMTPBanner()
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()

cmd/panel/restore_test.go

@@ -360,10 +360,11 @@ func signIn(t *testing.T, h http.Handler) *http.Cookie {
 
 // downloadBackup takes a backup through the panel's own /backup route, the way
 // the operator does. An empty password downloads the plain archive; otherwise
-// the response is a .spbk envelope, which is decrypted here.
+// the response is a .spbk envelope, which is decrypted here. The account
+// password goes with it, as the form asks for it (backup-reauth).
 func downloadBackup(t *testing.T, h http.Handler, session *http.Cookie, password string) []byte {
 	t.Helper()
-	form := url.Values{}
+	form := url.Values{"account_password": {restorePassword}}
 	if password != "" {
 		form.Set("encrypt", "1")
 		form.Set("password", password)

cmd/panel/sendercheck.go

@@ -24,7 +24,7 @@ const aliveEvery = 2 * time.Second
 // try again later"), so while this role is not serving, mail is deferred:
 // what that costs is counted here and
 // by the log tailer, and shown on Server > Health
-// (docs/plans/from-header-binding.md § Statistics).
+// (docs/architecture.md § Sender check).
 func serveSenderCheck(ctx context.Context, cfg config, st *store.Store) error {
 	ln, err := listenMilter(cfg.senderSocket)
 	if err != nil {
@@ -104,19 +104,21 @@ func senderCheckDowntime(markAt, now time.Time, ask func() postfixState) (down t
 	return 0, false
 }
 
-// dayPart is the part of a stretch of downtime that fell on one UTC day.
+// dayPart is the part of a stretch of downtime that fell on one day of the
+// container's zone.
 type dayPart struct {
 	day  time.Time
 	down time.Duration
 }
 
-// byDay cuts the time from 'from' to 'to' at the UTC midnights between them,
+// byDay cuts the time from 'from' to 'to' at the midnights of the container's
-// so that a night's outage is not all booked on the morning it ended.
+// zone between them, so that a night's outage is not all booked on the morning
+// it ended.
 func byDay(from, to time.Time) []dayPart {
-	from, to = from.UTC(), to.UTC()
+	from, to = from.Local(), to.Local()
 	var parts []dayPart
 	for from.Before(to) {
-		next := time.Date(from.Year(), from.Month(), from.Day(), 0, 0, 0, 0, time.UTC).AddDate(0, 0, 1)
+		next := time.Date(from.Year(), from.Month(), from.Day(), 0, 0, 0, 0, time.Local).AddDate(0, 0, 1)
 		if next.After(to) {
 			next = to
 		}

cmd/panel/sendercheck_test.go

@@ -62,3 +62,15 @@ func TestByDay(t *testing.T) {
 		t.Errorf("no time: %+v", none)
 	}
 }
+
+// In a container with TZ=Europe/Moscow a day is Moscow's: an outage from
+// 20:50 to 21:10 UTC crosses its midnight (21:00 UTC).
+func TestByDayInTheContainersZone(t *testing.T) {
+	inZone(t, "Europe/Moscow")
+	from := time.Date(2026, 10, 12, 20, 50, 0, 0, time.UTC)
+	got := byDay(from, from.Add(20*time.Minute))
+	if len(got) != 2 || got[0].down != 10*time.Minute || got[1].down != 10*time.Minute ||
+		got[1].day.Format("2006-01-02 15:04") != "2026-10-13 00:00" {
+		t.Errorf("parts = %+v, want ten minutes on the 12th and ten from Moscow's midnight", got)
+	}
+}

cmd/panel/signer.go

@@ -5,12 +5,17 @@ import (
 	"log"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/mixeme/selfpost/internal/milter"
 	"github.com/mixeme/selfpost/internal/postfix"
 	"github.com/mixeme/selfpost/internal/store"
 )
 
+// rewriteRetry is how often the signer tries again to write the selector
+// table when the write at its start failed.
+const rewriteRetry = 10 * time.Second
+
 // serveSigner runs the DKIM signer (internal/milter/sign.go) on its two
 // sockets: signSocket for what applications send on 465/587, signed with the
 // key of the domain the login belongs to - the sender_login_maps Postfix and
@@ -20,16 +25,33 @@ import (
 // build/postfix-config.sh), so while this role is not serving, mail waits.
 //
 // The keys and selectors come from the key tree and the selector table under
-// dkimDir (internal/domain, Keys). Before it serves, the table is made to
+// dkimDir (internal/domain, Keys). Before it serves, the table is rewritten
-// hold the server's own name - and written at all on the first start of
+// from the registry (WriteSelectors): Postfix waits for these sockets
-// 2.8.0, whose table replaced OpenDKIM's: Postfix waits for these sockets
+// (build/postfix-wrapper.sh), so no message meets a table from before. A
-// (build/postfix-wrapper.sh), so no message meets the table before it.
+// rewrite that fails is tried again every rewriteRetry until it succeeds;
+// meanwhile what the signer finds no key for it defers, and the panel's
+// pages - Reload configuration among them - stay up.
 func serveSigner(ctx context.Context, cfg config, st *store.Store) error {
-	if rebuilt, err := newMailStack(cfg, st).Domains.EnsureServerSigned(); err != nil {
+	domains := newMailStack(cfg, st).Domains
-		// Mail waits: what the signer cannot find a key for it defers.
+	if err := domains.WriteSelectors(); err != nil {
-		log.Printf("dkim-signer: the selector table: %v", err)
+		log.Printf("dkim-signer: the selector table: %v - trying again every %s", err, rewriteRetry)
-	} else if rebuilt {
+		go func() {
-		log.Printf("dkim-signer: the selector table was rewritten from the registry")
+			tick := time.NewTicker(rewriteRetry)
+			defer tick.Stop()
+			for {
+				select {
+				case <-ctx.Done():
+					return
+				case <-tick.C:
+					if err := domains.WriteSelectors(); err != nil {
+						log.Printf("dkim-signer: the selector table: %v", err)
+						continue
+					}
+					log.Printf("dkim-signer: the selector table is written")
+					return
+				}
+			}
+		}()
 	}
 	keys := milter.NewSignKeys(filepath.Join(cfg.dkimDir, "selectors"), filepath.Join(cfg.dkimDir, "keys"))
 	bind := milter.NewBindings(postfix.New(cfg.postfixDir).SenderLoginMapsPath())

cmd/panel/zone_main_test.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"os"
+	"testing"
+	"time"
+)
+
+// TestMain runs the tests in UTC, whatever the zone of the machine they run
+// on: the panel shows times and counts days in time.Local, the container's
+// zone (TZ), and the fixtures are written in UTC. The tests of another zone
+// set it themselves (inZone).
+func TestMain(m *testing.M) {
+	time.Local = time.UTC
+	os.Exit(m.Run())
+}
+
+// inZone runs the rest of the test in the zone name, as a container started
+// with TZ=name; the test must not be parallel.
+func inZone(t *testing.T, name string) {
+	t.Helper()
+	loc, err := time.LoadLocation(name)
+	if err != nil {
+		t.Skipf("no zone %s here: %v", name, err)
+	}
+	time.Local = loc
+	t.Cleanup(func() { time.Local = time.UTC })
+}

deploy/.env.example

@@ -60,6 +60,12 @@ PANEL_SESSION_IDLE_DAYS=7
 # your own recursor, e.g. SELFPOST_DNS_RESOLVERS=10.0.0.2:53
 # SELFPOST_DNS_RESOLVERS=
 
+# Time zone of the container, an IANA name: every time the panel shows, the
+# days it counts (today on Health, the days of the statistics, the log
+# filters) and the stamps Postfix writes in mail.log. Leave unset for UTC;
+# changing it is a restart. Server > Settings shows the zone in use.
+# TZ=Europe/Moscow
+
 # Comma-separated CIDRs (bare IPs allowed) of reverse proxies allowed to
 # supply X-Forwarded-For for login/setup rate-limiting. Leave unset unless
 # you know the exact address of your reverse proxy — trusting the wrong

deploy/antispam/docker-compose.antispam.yml

@@ -9,10 +9,11 @@
 # Requires INBOUND_RELAY_ENABLE=true in .env. The milter sees the real client
 # IP, HELO and PTR — unlike the upstream, which only sees SelfPost's address.
 #
-# The rspamd image is pinned to one build, 3.11.1-3 - "3.11" and "3.11.1"
+# The rspamd image is pinned to one build, 4.2.2-0 - "4.2", "4" and "latest"
-# move with each rebuild (Docker Hub rspamd/rspamd tags 3.11.1-0 ... -3) -
+# are rebuilt every night - and it is the build the comments in
-# and it is the build the comments in antispam/rspamd/ were read against;
+# antispam/rspamd/ were read against (rspamd 4.2.2, rspamd-docker v4.2.2+0;
-# bump it deliberately, and read them again. Default milter action is fail-open (accept) so a down sidecar
+# 3.11.1-3 until 2.14.4, security audit 2026-10-17, S4); bump it
+# deliberately, and read them again. Default milter action is fail-open (accept) so a down sidecar
 # does not block backup-MX. Set INBOUND_ANTISPAM_MILTER_ACTION=tempfail to
 # defer instead.
 
@@ -26,12 +27,23 @@ services:
       - antispam
 
   antispam:
-    # The milter: rspamd 3.11.1, conf/worker-proxy.inc, "milter = yes" for the
+    # The milter: rspamd 4.2.2, conf/worker-proxy.inc, "milter = yes" for the
-    # rspamd_proxy worker, which the image binds to *:11332 (rspamd-docker
+    # rspamd_proxy worker, bound to *:11332 by antispam/rspamd/worker-proxy.inc
-    # v3.11.1+3, patches/rspamd-docker-config.diff), and runs as uid 11333
+    # while every other worker stays on loopback (RSPAMD_LOCAL_ADDR below);
-    # (its Dockerfile, USER 11333:11333).
+    # it runs as uid 11333 (rspamd-docker v4.2.2+0, Dockerfile, USER
-    image: rspamd/rspamd:3.11.1-3
+    # 11333:11333) and needs no capability: it starts unprivileged, binds
+    # ports above 1024 and runs nothing setuid (src/rspamd.c, detect_priv()).
+    image: rspamd/rspamd:4.2.2-0
     restart: unless-stopped
+    environment:
+      # Workers on loopback; the proxy alone is put back on every address.
+      RSPAMD_LOCAL_ADDR: localhost
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    # A ceiling on processes and threads (security audit 2026-10-17, I3).
+    pids_limit: 256
     # No host ports: only SelfPost talks to the milter on the compose network.
     volumes:
       # The verdict headers SelfPost's inbound journal reads.
@@ -39,4 +51,6 @@ services:
       # The allow and deny lists kept in the panel: the rules, and the files
       # SelfPost writes them to.
       - ./antispam/rspamd/multimap.conf:/etc/rspamd/local.d/multimap.conf:ro
+      # The proxy (the milter) on the compose network, nothing else.
+      - ./antispam/rspamd/worker-proxy.inc:/etc/rspamd/local.d/worker-proxy.inc:ro
       - ./data/antispam:/etc/rspamd/selfpost:ro

deploy/antispam/rspamd/milter_headers.conf

@@ -8,7 +8,7 @@
 # rspamd removes headers of these names that a sender wrote himself before it
 # adds its own - for every client, because of the two lines below. Without
 # them it would do neither for a client it counts as local or one that
-# authenticated: rspamd 3.11.1, src/plugins/lua/milter_headers.lua,
+# authenticated: rspamd 4.2.2 (as 3.11.1), src/plugins/lua/milter_headers.lua,
 # skip_wanted() - skip_local and skip_authenticated are on by default, and
 # "local" is loopback, a unix socket, or an address in local_addrs, the
 # private ranges (src/lua/lua_ip.c, lua_ip_is_local(); conf/options.inc). The
@@ -20,7 +20,9 @@
 # message carrying its own X-Spamd-Result and X-Rspamd-Action): without the
 # two lines, from 10.0.0.5 or as an authenticated user, the milter reply
 # removed neither header, added neither, and added the signature; with
-# them, both removed and rspamd's own added, as from a public address.
+# them, both removed and rspamd's own added, as from a public address. The
+# same again on 2026-10-17 in rspamd/rspamd:4.2.2-0 (from 10.0.0.5), and the
+# signature equal to HMAC-SHA256 of the queue id computed with openssl.
 #
 # Without this file the journal still lists accepted mail, with no verdict
 # next to it.
@@ -34,7 +36,7 @@
 # signature travels on with the mail and is of no use to whoever sees it: it
 # fits that one queue id.
 #
-# rspamd 3.11.1, src/plugins/lua/milter_headers.lua: a custom routine is called
+# rspamd 4.2.2 (as 3.11.1), src/plugins/lua/milter_headers.lua: a custom routine is called
 # as function(task, common_meta) and returns error, headers to add, headers to
 # remove, metadata; a remove value of 0 removes every header of that name
 # (docs.rspamd.com/modules/milter_headers, "Custom routines").

deploy/antispam/rspamd/multimap.conf

@@ -3,7 +3,7 @@
 # The allow and deny lists kept in the panel (Inbound > Filter lists). SelfPost
 # writes them as six files under data/antispam/, which the fragment mounts at
 # /etc/rspamd/selfpost; rspamd rereads a file when it changes, no restart.
-# (rspamd 3.11.1, src/libserver/maps/map.c: a file map is watched with libev's
+# (rspamd 4.2.2 (as 3.11.1), src/libserver/maps/map.c: a file map is watched with libev's
 # ev_stat - inotify where the kernel has it, else a stat poll every
 # map_watch_interval x map_file_watch_multiplier, 5min x 0.1, conf/options.inc;
 # docs.rspamd.com/configuration/maps asks for an atomic rename, which
@@ -14,7 +14,7 @@
 # allowed one is not accepted outright - rspamd would then let whichever of
 # the two rules ran first decide - but given a weight no spam score
 # outweighs, which a refusal by the deny list still overrides. (rspamd
-# 3.11.1, src/plugins/lua/multimap.lua: every rule is registered as a
+# 4.2.2 (as 3.11.1), src/plugins/lua/multimap.lua: every rule is registered as a
 # "normal" symbol, one with an action with the "passthrough" augmentation;
 # no "prefilter" setting is read. Measured with this file in a throwaway
 # rspamd/rspamd:3.11.1-3, 2026-10-15: every mix of an allow and a deny entry
@@ -29,7 +29,7 @@
 # bounce whose From: domain is on the deny list was refused by default and
 # is not with this setting; a sender on the list is refused either way.
 #
-# A domain entry is that domain, not its subdomains. (rspamd 3.11.1,
+# A domain entry is that domain, not its subdomains. (rspamd 4.2.2 (as 3.11.1),
 # src/libserver/maps/map_helpers.c: a hash map is looked up by the whole key,
 # case-insensitively - rspamd_icase_hash, rspamd_lc_cmp; "email:domain" gives
 # the address's domain part, src/plugins/lua/multimap.lua, apply_addr_filter().)

deploy/antispam/rspamd/worker-proxy.inc

@@ -0,0 +1,18 @@
+# Mounted into the sidecar as /etc/rspamd/local.d/worker-proxy.inc.
+#
+# The milter - the proxy worker - is the one listener SelfPost needs on the
+# compose network. The fragment sets RSPAMD_LOCAL_ADDR=localhost, which keeps
+# every worker on the container's loopback: the normal worker (11333), whose
+# scan accepts a client-named file or shared-memory input, and the controller
+# (11334), whose default password is the well-known "q1" (rspamd 4.2.2,
+# conf/rspamd.conf: each worker's bind_socket is the env variable LOCAL_ADDR,
+# localhost by default, and its port; conf/worker-controller.inc: password =
+# "q1"; the rspamd-docker v4.2.2+0 Dockerfile sets RSPAMD_LOCAL_ADDR=* for all
+# three). This line puts the proxy alone back on every address: a local.d
+# scalar at priority 1 replaces the default one (contrib/libucl/ucl_parser.c,
+# UCL_DUPLICATE_MERGE). The proxy still reaches the normal worker on
+# localhost, as before (security audit 2026-10-17, S4).
+#
+# rspamd expands its template syntax in these files, comments included:
+# quote none of it here.
+bind_socket = "*:11332";

deploy/apache/selfpost-vhost.conf

@@ -1,6 +1,6 @@
 # Example host Apache vhost for the SelfPost panel (default scenario). Install
 # on the host running Apache — NOT inside the SelfPost container. Requires
-# mod_ssl and mod_proxy/mod_proxy_http enabled (`a2enmod ssl proxy proxy_http`).
+# mod_ssl, mod_proxy/mod_proxy_http and mod_rewrite enabled (`a2enmod ssl proxy proxy_http rewrite`).
 #
 # Certificates: obtain with the Apache certbot plugin against THIS vhost
 # (`certbot --apache -d mail.example.com`). Certbot edits this file in place to

deploy/caddy/docker-compose.caddy.yml

@@ -16,7 +16,8 @@
 # the CA URL's host and path, "acme-v02.api.letsencrypt.org-directory" for Let's
 # Encrypt). caddy/modules/caddytls/automation.go, DefaultIssuers(): ZeroSSL is a
 # second issuer only when an email is configured, and the Caddyfile below sets
-# none. Read at the projects' master of 2026-10-14: `caddy:2` is a moving tag.
+# none. Read at the projects' master of 2026-10-14, when the image was the
+# moving `caddy:2`; it is pinned below now, and a bump re-reads these.
 #
 # Merge with the base file — run this from the deploy/ directory (Compose
 # resolves every relative path in both files against the directory of the
@@ -46,8 +47,12 @@ services:
       - ./caddy/caddy-data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/<hostname>:/etc/postfix/tls:ro
 
   caddy:
-    image: caddy:2
+    # Pinned to a release: "2" moves under a running server (security audit
+    # 2026-10-17, I4). Bump it deliberately.
+    image: caddy:2.11.7
     restart: unless-stopped
+    # A ceiling on processes and threads (security audit 2026-10-17, I3).
+    pids_limit: 256
     depends_on:
       - selfpost
     ports:

deploy/docker-compose.yml

@@ -23,7 +23,7 @@
 
 services:
   selfpost:
-    image: ghcr.io/mixeme/selfpost:2.7.0
+    image: ghcr.io/mixeme/selfpost:2.16.0
     restart: unless-stopped
     environment:
       SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}"
@@ -56,6 +56,9 @@ services:
       # report what the internet sees rather than what this host's own stub
       # resolver synthesises. Empty uses public defaults.
       SELFPOST_DNS_RESOLVERS: "${SELFPOST_DNS_RESOLVERS:-}"
+      # The zone of every time the panel shows and of mail.log's stamps, e.g.
+      # Europe/Moscow. Empty is UTC.
+      TZ: "${TZ:-}"
       # Reverse-proxy CIDRs allowed to supply X-Forwarded-For for login/setup
       # rate-limiting. See docs/guide.md "Environment variables" — wrong value lets a
       # client spoof its rate-limit key.
@@ -96,10 +99,12 @@ services:
       # when the variable is true.
       - "25:25"
       - "127.0.0.1:8080:8080"
-    # Hardening. SelfPost's entrypoint still needs to run as
+    # Hardening. SelfPost's entrypoint runs as root to fix /data ownership
-    # root very briefly to fix /data ownership and normalise permissions
+    # and normalise permissions under the shared `selfpost` group (see
-    # under the shared `selfpost` group (see build/entrypoint.sh) before
+    # build/entrypoint.sh) before supervisord drops the panel to an
-    # supervisord drops the panel to an unprivileged user — so this cannot be
+    # unprivileged user; supervisord, Postfix's master, cert-reload and
+    # logrotate stay root for the container's life, which is inherent to
+    # them (security audit 2026-10-17, I3) — so this cannot be
     # `user: panel` or a fully read-only rootfs without breaking that startup
     # self-healing. What IS applied: no privilege escalation past what the
     # image already grants, and every Linux capability dropped except the
@@ -148,3 +153,9 @@ services:
       - SETGID
       - DAC_OVERRIDE
       - KILL
+    # A ceiling on processes and threads, so that a runaway or compromised
+    # program cannot use up the host's (security audit 2026-10-17, I3).
+    # Postfix starts up to 100 processes per service by default
+    # (default_process_limit), and a busy server runs three smtpd services,
+    # cleanup and smtp at once; 1024 leaves them room.
+    pids_limit: 1024

deploy/nginx/docker-compose.nginx.yml

@@ -47,6 +47,8 @@ services:
   nginx:
     image: nginx:1.27
     restart: unless-stopped
+    # A ceiling on processes and threads (security audit 2026-10-17, I3).
+    pids_limit: 256
     depends_on:
       - selfpost
     ports:
@@ -58,7 +60,10 @@ services:
       - ./nginx/certbot-www:/var/www/certbot:ro
 
   certbot:
-    image: certbot/certbot:latest
+    # Pinned like every image here: "latest" moves under a running server
+    # (security audit 2026-10-17, I4). Bump it deliberately.
+    image: certbot/certbot:v5.8.0
+    pids_limit: 64
     volumes:
       - ./nginx/certbot-etc:/etc/letsencrypt
       - ./nginx/certbot-www:/var/www/certbot

deploy/traefik/docker-compose.traefik.yml

@@ -40,6 +40,8 @@ services:
   traefik:
     image: traefik:v3.1
     restart: unless-stopped
+    # A ceiling on processes and threads (security audit 2026-10-17, I3).
+    pids_limit: 256
     depends_on:
       - selfpost
     command:

deploy/traefik/extract-cert.sh

@@ -59,7 +59,7 @@ grep -q -- '-----BEGIN CERTIFICATE-----' "$tmp_cert" || die "the certificate of
 grep -q -- '-----BEGIN .*PRIVATE KEY-----' "$tmp_key" || die "the key of $DOMAIN is not PEM"
 
 chmod 0640 "$tmp_cert" "$tmp_key"
-# The group the files had stays theirs: the guide gives the key to group 10998
+# The group the files had stays theirs: the guide gives the key to group 10997
 # so the panel can read it for a full backup, and a run from root's cron would
 # otherwise hand it to root's group (review of audit stage 5).
 for f in fullchain privkey; do

docs/architecture.md

@@ -26,15 +26,17 @@ Managed programs ([build/supervisord.conf](../build/supervisord.conf)):
 
 | Program | User | Priority | Role |
 |---|---|---|---|
-| `syslog-relay` | panel | 50 | The container's `/dev/log`: passes what OpenDKIM logs through syslog(3) to the container's log (`panel -syslog-relay`) |
+| `panel` | panel | 200 | HTTP UI + sender check + DKIM signer + journal-milter + log-tailer + rate-limit recalc + notifier; with the inbound relay on also the inbound journal milter |
-| `opendkim` | root → `opendkim` (`UserID` in opendkim.conf) | 100 | DKIM signing milter |
+| `postfix` | root (wrapper) | 300 | MTA — started only after the milter sockets exist (the sender check's, the DKIM signer's two, the journal milter's and, with the inbound relay on, the inbound journal milter's) |
-| `panel` | panel | 200 | HTTP UI + sender check + DKIM signer + journal-milter + log-tailer + rate-limit recalc; with the inbound relay on also the inbound journal milter |
-| `postfix` | root (wrapper) | 300 | MTA — started only after the milter sockets exist (OpenDKIM's, the sender check's, the DKIM signer's two, the journal milter's and, with the inbound relay on, the inbound journal milter's) |
 | `postfix-reload` | root | — | On-demand `postfix reload` (autostart off) |
 | `cert-reload` | root | 400 | Daily: re-copies a renewed TLS certificate for Postfix and reloads it |
 | `logrotate` | root | 400 | Periodic `mail.log` rotation |
 
-Start order: syslog-relay → OpenDKIM → panel (opens the sender check's, the DKIM signer's and the journal-milter's sockets) → Postfix wrapper
+Until `2.8.0` two more programs ran before the panel: `opendkim`, the DKIM
+signing milter, and `syslog-relay`, the container's `/dev/log` for what
+OpenDKIM logged; the panel signs now (§ DKIM signing).
+
+Start order: panel (opens the sender check's, the DKIM signer's two and the journal-milter's sockets) → Postfix wrapper
 polls unix sockets (timeout `MILTER_WAIT_TIMEOUT`, default 30s) then runs
 `postfix start-fg` and stays its parent: on TERM it runs `postfix stop`, so a
 stop of the program or of the container stops Postfix as Postfix means it to
@@ -55,14 +57,15 @@ new one: the entrypoint clears what the last run left in `/run` (the milter
 sockets, the sender check's alive mark). Besides a stop, supervisord itself
 dying, or the entrypoint refusing a setting, nothing else exits the
 container. `logrotate`'s FATAL (a config logrotate would ignore),
-`postfix-reload`'s (reported to the page that asked), `cert-reload`'s and
+`postfix-reload`'s (reported to the page that asked) and `cert-reload`'s
-`syslog-relay`'s stay on Server › Health instead.
+stay on Server › Health instead.
 The panel runs `postfix-reload` through supervisord's XML-RPC interface and
 waits for its exit status (`internal/supervisor`, `RunOnce`); the program
 rests EXITED after a run.
 
-**Liveness:** `GET /healthz` (unauthenticated) returns 200 when opendkim,
+**Liveness:** `GET /healthz` (unauthenticated; answered only to a request with no `X-Forwarded-For` from loopback or a private address, else 404) returns 200 when panel - whose
-panel, and postfix are RUNNING; Docker `HEALTHCHECK` uses the same probe (its
+roles include the DKIM signer - and postfix are RUNNING
+(`internal/health`, `Liveness`); Docker `HEALTHCHECK` uses the same probe (its
 90-second start period covers postfix's STARTING).
 
 ---
@@ -73,7 +76,7 @@ panel, and postfix are RUNNING; Docker `HEALTHCHECK` uses the same probe (its
 Client ──TLS+SASL──► Postfix (465 smtps, optional 587 submission)
                          │
                          ├─► sender check (From: against the login, tempfail on failure)
-                         ├─► OpenDKIM milter (sign, tempfail on failure)
+                         ├─► DKIM signer (the login's domain, tempfail on failure)
                          ├─► journal-milter (send log + L2 rate limits, fail-open)
                          └─► outbound MX delivery (port 25 client)
 
@@ -96,11 +99,14 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
 - **587/submission** — only when `SUBMISSION_ENABLE=true`; STARTTLS with
   `smtpd_tls_security_level=encrypt`.
 - **25/smtp inet** — when `INBOUND_RELAY_ENABLE=true` and/or
-  `DMARC_REPORTS_ENABLE=true`. No SASL, no OpenDKIM, no journal-milter —
+  `DMARC_REPORTS_ENABLE=true`. No SASL, no sender check, no signing, no journal-milter —
   `smtpd_milters` is always overridden on this service, because main.cf's
   submission chain would otherwise let a signing outage defer relayed mail and
   would file inbound mail into the outbound send log under the sender's
-  domain. With the inbound relay on the chain is the optional antispam milter,
+  domain. `ETRN` is refused on every listener and not offered in the EHLO
+  reply (`smtpd_etrn_restrictions=reject`, `smtpd_discard_ehlo_keywords=silent-discard,etrn`):
+  Postfix's default lets any client flush the queue toward an inbound
+  domain's upstream. With the inbound relay on the chain is the optional antispam milter,
   then the panel's **inbound journal milter** (unix socket
   `INBOUND_JOURNAL_MILTER_SOCKET`, default
   `/run/selfpost/inbound-journal.sock`, `default_action=accept`); with DMARC
@@ -110,7 +116,12 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   verdict headers (`X-Rspamd-Action`, `X-Spamd-Result`) off it. It writes one
   `inbound_spam_log` row per recipient at an inbound domain - a DMARC report
   address is not one - and never refuses anything
-  ([internal/milter/inbound.go](../internal/milter/inbound.go)). The headers
+  ([internal/milter/inbound.go](../internal/milter/inbound.go)). The row
+  keeps the message's queue id (`{i}` at end-of-message) and starts
+  `queued` - `held` when the filter had Postfix hold it - and the recipient
+  as Postfix logs it (`recipientAsLogged`); the log tailer puts the
+  upstream's answer on it (§ Log tailer, *The upstream's answer*). Older
+  rows of a queue id Postfix uses again are detached first. The headers
   are read only while a filter is attached, and only next to the filter's
   signature: a third header, `X-SelfPost-Filter`, the HMAC-SHA256 of the
   message's queue id under the key in `/data/antispam/filter.key`
@@ -119,7 +130,7 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   rspamd removes a sender's own copies of the three headers and writes and
   signs its own for every message it lets through: `skip_local` and
   `skip_authenticated` are off in that file, so this holds whatever the
-  sender's address (rspamd 3.11.1, `src/plugins/lua/milter_headers.lua`,
+  sender's address (rspamd 4.2.2 (as 3.11.1), `src/plugins/lua/milter_headers.lua`,
   `skip_wanted()`).
   With the filter down - it is attached fail-open - a sender's own verdict
   headers carry no signature and the row is that of mail nobody judged.
@@ -127,9 +138,10 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   Refusals come from `mail.log`: this listener logs as `postfix/inbound`
   (`syslog_name`), and the log tailer turns a `reject:` line of
   `postfix/inbound/smtpd` (Postfix's own policy) and a `milter-reject` /
-  `milter-hold` / `milter-discard` line of `cleanup` (the filter's verdict,
+  `milter-discard` line of `cleanup` (the filter's verdict, counted only for
-  counted only for a queue id that listener opened) into a row, dated by the
+  a queue id that listener opened) into a row, dated by the line, when the
-  line, when the recipient is at an inbound domain
+  recipient is at an inbound domain; a message the filter holds goes on to
+  the inbound journal milter, which writes its row as `held`
   ([internal/logtail/inbound.go](../internal/logtail/inbound.go)). A line
   names one recipient (the last), so a message refused at end-of-message is
   one row whatever its recipient count. The tailer saves its place every five seconds,
@@ -137,7 +149,8 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   start are written only if the same row is not there already. The
   journal is pruned every six hours: rows
   older than the `inbound_spam_log_retention_days` setting, then down to
-  10 000.
+  10 000 - and down to 10 000 every 500 rows either writer adds in between
+  (the store counts them, `countInboundWrites`).
   **Filter lists** (`inbound_spam_list`): allow and deny entries for the
   external filter - sender address, sender domain, client address or network -
   validated and normalised by `internal/inbound` (`lists.go`) and written as
@@ -158,15 +171,21 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   allowed IP with a denied address were all `reject` (assumptions
   D-arch:121). A sender entry is matched against
   the envelope sender only (`extract_from = "smtp"`; by default rspamd takes
-  a bounce's `From:` header instead - rspamd 3.11.1,
+  a bounce's `From:` header instead - rspamd 4.2.2 (as 3.11.1),
   `src/plugins/lua/multimap.lua`, the `from` callback).
   How often an entry decided a message is not stored: `Lists.Usage` reads it
   off the journal on each view of Filter lists - the rows a list decided (the
   deny rule's reply, the allow rule's symbol, which the journal milter keeps
   ahead of its six-symbol cap) matched against the entries as rspamd matches
-  them. When that stops being good enough is written in
+  them. So a count reaches back as far as the journal does, a row counts for
-  [plans/inbound-antispam-panel.md](plans/inbound-antispam-panel.md) § Filter
+  every fitting entry of the deciding list, and a count is of messages,
-  list usage.
+  roughly. A counter kept with each entry (hits and last hit on
+  `inbound_spam_list`, a migration) is worth it when any one of these holds
+  (owner, 2026-10-12): the journal is cut by its 10 000-row cap rather than by
+  age (the tailer's prune keeps removing rows while the oldest row of
+  Inbound › Log is younger than the retention); the retention is set short,
+  towards its 7 days; counts are wanted that outlive the journal; or the page
+  is slow - past a few hundred entries, measure it.
   **Inbound relay** (`INBOUND_RELAY_ENABLE=true`): accepts only
   `relay_domains` + `relay_recipient_maps` (`reject_unauth_destination`,
   `reject_unlisted_recipient`). Maps under `/data/postfix/` (`relay_domains`,
@@ -175,8 +194,9 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   an empty upstream host are omitted from the maps. Optional
   `INBOUND_ANTISPAM_MILTER` only when inbound relay is enabled (not on
   DMARC-only port 25); it is attached with its own `default_action`,
-  `INBOUND_ANTISPAM_MILTER_ACTION`, which is `accept` (fail-open) unless set
+  `INBOUND_ANTISPAM_MILTER_ACTION`, `accept` (fail-open, the default) or
-  to `tempfail` (main.cf's `milter_default_action` is `tempfail`).
+  `tempfail`, any other value stopping the start (main.cf's
+  `milter_default_action` is `tempfail`).
   **DMARC ingest** (`DMARC_REPORTS_ENABLE=true`): allow-listed
   report addresses via `check_recipient_access` on `postfix/dmarc_recipients`;
   messages pipe to `dmarc-ingest` (symlink to `panel`). When both flags are
@@ -209,31 +229,113 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   and to smtpd's `client=` line in mail.log.
 - **Chroot disabled** for all services (DNS/TLS inside container).
 - **TLS certs** — read-only mount at `TLS_CERT_FILE` / `TLS_KEY_FILE`, copied
-  at start into `/etc/postfix/tls-internal`, owned by root and `0600` as
+  at start into `/etc/postfix/tls-internal`, owned by root, the key `0600`
-  Postfix's TLS_README advises (Postfix itself reads the key as root and does
+  (the certificate `0644`) as Postfix's TLS_README advises (Postfix itself reads the key as root and does
   not check its mode), which the mount cannot give; Postfix reads the copy.
   `cert-reload` compares the mount with the copy daily; when they differ and
   the certificate and key belong together it renews the copy (each file
   renamed into place) and reloads Postfix.
 
-### OpenDKIM
+### DKIM signing
 
-Per-domain keys under `/data/opendkim/keys`; `KeyTable` / `SigningTable` maintained
+The panel signs outgoing mail itself, in a role of its own, `dkim-signer`
-by the panel. Socket `/run/opendkim/opendkim.sock`.
+([cmd/panel/signer.go](../cmd/panel/signer.go),
+[internal/milter/sign.go](../internal/milter/sign.go)), since `2.8.0`; until
+then OpenDKIM did, in a program of its own (CHANGELOG `[2.8.0]`).
 
-The server's own name (`SELFPOST_HOSTNAME`) has a key and a line in both
+- **Keys** — `/data/dkim/keys/<name>/<selector>.private`, PKCS#1 PEM, one
-tables too, without being a row of the registry
+  for each sending domain and one for the server's own name
-(`domain.Service.SetServerName`): the panel's notifications are sent as
+  (`internal/domain`, `Keys`; `DKIM_DIR`, default `/data/dkim`). A key is
-`postmaster@` that name and signed with it. No application can use it as an
+  made when a domain is added and an existing one is reused, never
-envelope sender - the sender map is built from the registry - and since
+  overwritten: that would invalidate the record already published
-`2.4.0` none can have a message signed as the server by writing it into
+  (`EnsureKey`). A domain export carries the key and an import writes it,
-`From:` either: the sender check holds the header against the login (§ Sender
+  over whatever key the name had (`ImportKey`: the import is the domain
-check). A sending domain of the same name shares its key and selector with
+  with exactly that key). A
-the server; deleting that domain leaves the server signed under the default
+  deleted domain's key directory is removed once the selector table no
-selector, which is the same key only if that was the domain's. At its start
+  longer names it; one a deletion had to leave, Reload configuration removes
-the notifier makes sure the tables have the line and name the selector the
+  (`Service.Resync`).
-panel shows (`EnsureServerSigned`): tables are otherwise rebuilt only when a
+- **The selector table** — `/data/dkim/selectors`, a line `<name> <selector>`
-domain is added or deleted.
+  for every name the server signs, sorted, written whole from the database
+  and renamed into place (`Keys.Rebuild`). It is rewritten when a domain is
+  added, deleted or imported, by Server › Health › Reload configuration,
+  after a restore, and at every start of the signer before it serves
+  (`WriteSelectors`): Postfix waits for the signer's sockets, so no message
+  meets a table from before - one a rewrite cut short left, the first start
+  of `2.8.0` without one, or one naming the old selector after a changed
+  `DKIM_SELECTOR_DEFAULT`. A rewrite at start that fails is tried again every
+  10 seconds; meanwhile the signer defers what it finds no key for, and the
+  pages stay up. Each role builds a domain service of its own, so the
+  writers are serialised by a mutex (`tableMu`): a writer that read the
+  registry before another's domain was added cannot write after it.
+- **The signer reads files, not the database.** The panel's one SQLite
+  connection is shared with the pages, and a long query would hold up mail.
+  It reads the table for every message (a few lines; a stamp of time and
+  size would miss a rewrite of the same size within one tick of the file
+  system's clock) and a key again when its file's time or size changes; a key
+  the table no longer names is forgotten. Nothing is reloaded.
+- **The panel's alone.** All of `/data/dkim` is `panel:panel`, directories
+  `0700`, files `0600`, set by the entrypoint at every start: no group, no
+  other program reads it.
+- **Two sockets, both strict** (`default_action=tempfail`, so while the role
+  does not answer mail waits, never goes unsigned):
+  `DKIM_SIGN_SOCKET` (`/run/selfpost/sign.sock`) for what applications send
+  on 465/587, signed with the key of the domain the SASL login belongs to -
+  `{auth_authen}`, then `Bindings.DomainOf`, the `sender_login_maps` file
+  Postfix and the sender check read; `DKIM_SIGN_LOCAL_SOCKET`
+  (`/run/selfpost/sign-local.sock`) for what the panel itself submits with
+  `sendmail(1)` (`non_smtpd_milters`), signed with the key of the server's
+  name. The socket a message comes through, not the absence of a login,
+  decides that the server's key may sign it.
+- **The server's own name** (`SELFPOST_HOSTNAME`) has a key and a line in the
+  table without being a row of the registry (`domain.Service.SetServerName`):
+  the panel's notifications are sent as `postmaster@` that name and signed
+  with it. The name is kept in lower case for DKIM, as the signer finds keys
+  by the name in lower case; the SASL realm, which defaults to the hostname,
+  stays as written. No application can use it as an envelope sender - the
+  sender map is built from the registry - and since `2.4.0` none can have a
+  message signed as the server by writing it into `From:` either: the sender
+  check holds the header against the login (§ Sender check). A sending
+  domain of the same name shares its key and selector with the server;
+  deleting that domain leaves the server signed under the default selector,
+  which is the same key only if that was the domain's.
+- **What is signed** — `relaxed/simple`, `rsa-sha256`, with
+  `github.com/emersion/go-msgauth` v0.7.0 (`dkim`). `h=`: every header of
+  the message whose name is in RFC 6376 § 5.4.1's list as OpenDKIM's
+  `dkim_should_signhdrs[]` held it, and `Sender`, `List-Unsubscribe-Post`,
+  `Content-Type`, `MIME-Version` and `Message-ID` besides (`signHeaders`;
+  `Message-ID` is not over-signed: cleanup adds one a message lacks after the
+  milters), each occurrence, in message order; then, once
+  more, each of `Subject`, `Date`, `To`, `Cc`, `Reply-To` and `Sender` the
+  message has (`overSign` - only those present: Postfix's cleanup adds a
+  missing `Date:` after the milters, out of their sight, and a name in `h=`
+  the message lacked would break the signature over the one added); then `From` once more, last (`signLines`). Each header is hashed as
+  Postfix will deliver it: the value with its leading space (the signer asks
+  for `SMFIP_HDR_LEADSPC`), the lines of a folded one joined with CRLF. The
+  signature is inserted at the top, above Postfix's own `Received:`, as
+  `DKIM-Signature: ...`. `disable_mime_output_conversion=yes`
+  ([build/postfix-config.sh](../build/postfix-config.sh)): an 8-bit message
+  is delivered as it was signed, not converted to 7-bit for a server that
+  does not announce 8BITMIME.
+- **Limits.** What cannot be signed - no line in the table, no key file, a
+  login with no domain, a read error - is deferred. A header section over
+  1 MiB is refused, `552 5.3.4`: the signer holds it whole until the body
+  starts. A body line over 998 bytes is logged (`dkim-signer: <domain> ...`)
+  and the message goes on: Postfix's SMTP client breaks such a line on
+  delivery (`smtp_line_length_limit`), and the signature will not verify. A
+  message has an hour from the end of its headers to its end - go-milter
+  v0.4.1 tells a session nothing of a dropped connection - after which it is
+  deferred, never signed over part of its body.
+- **Logs** go to the panel's stderr, the container's log, as
+  `panel: … dkim-signer:` lines; nothing is written to `mail.log` (nor did OpenDKIM write there).
+- **The old tree,** `/data/opendkim` - the keys, `KeyTable` and
+  `SigningTable` until `2.8.0`, shared with OpenDKIM through group
+  `selfpost`. `2.8.x` copied its keys to `/data/dkim/keys` at its first
+  start and kept it for a rollback to a 2.7.x image; since `2.9.0` the
+  entrypoint removes it once `/data/dkim` holds a key, and a `/data` with
+  keys under the old tree only - one that never ran 2.8.x - stops the start
+  (the server's name would otherwise get a new key and its published record
+  would no longer match). Under 2.8.x it was the panel's alone, like the
+  new one, and left out of backups.
 
 ### Panel binary ([cmd/panel](../cmd/panel))
 
@@ -256,14 +358,13 @@ milter, § Postfix above, port 25):
    (`300s` / `4000s` / `5d` / `0`) with a muted note on the box.
 2. **sender check** — unix socket `SENDER_CHECK_SOCKET`, first in the chain
    and **strict** (`default_action=tempfail`): § Sender check below.
-3. **DKIM signer** (`2.8.0`, [plans/panel-dkim-signing.md](plans/panel-dkim-signing.md))
+3. **DKIM signer** (`2.8.0`, § DKIM signing)
    — unix sockets `DKIM_SIGN_SOCKET` (applications' mail on 465/587, signed
    with the key of the domain the SASL login belongs to) and
    `DKIM_SIGN_LOCAL_SOCKET` (the panel's own mail, `non_smtpd_milters`,
    signed with the key of the server's name); after the sender check and
-   **strict**. `relaxed/simple`, RFC 6376 § 5.4.1's headers and `From` once
+   **strict**. Keys and the selector table from `/data/dkim`, no database:
-   more, go-msgauth/dkim; keys and selectors from OpenDKIM's KeyTable while
+   § DKIM signing above.
-   both sign (`internal/milter/sign.go`).
 4. **journal-milter** — unix socket `JOURNAL_MILTER_SOCKET`; records From/To/
    Subject/SASL user at DATA; enforces level-2 rate limits; **fail-open**
    (`default_action=accept`) so milter failure does not stop mail. Domain
@@ -287,12 +388,13 @@ milter, § Postfix above, port 25):
 7. **notifier** — writes to the panel's users when something needs them
    (§ Notifications below).
 
-Milter chain in Postfix: the sender check (tempfail), the panel's DKIM
+Milter chain in Postfix ([build/postfix-config.sh](../build/postfix-config.sh),
-signer (tempfail), OpenDKIM (tempfail), then the journal (accept on
+`smtpd_milters`): the sender check (tempfail), the DKIM signer (tempfail),
-failure); until OpenDKIM leaves the image both sign every message
+then the journal (accept on failure) - the check first, since the signature
-(docs/plans/panel-dkim-signing.md, stage 1). Mail submitted locally with
+is held to the `From:` domain and a message the check could not judge must
-`sendmail(1)` — the notifier's — passes the signer's own socket and OpenDKIM
+not be signed. Until `2.8.0` OpenDKIM signed in the signer's place. Mail
-(`non_smtpd_milters`): it is signed, it is the panel's own and so needs no
+submitted locally with `sendmail(1)` — the notifier's — passes the signer's
+own socket alone (`non_smtpd_milters`, tempfail): it is signed, it is the panel's own and so needs no
 check of whose it is, and it is not an application's mail to be journalled
 or limited. Bounces Postfix
 generates pass no milter.
@@ -300,12 +402,15 @@ generates pass no milter.
 ### Sender check
 
 [internal/milter/sender.go](../internal/milter/sender.go) holds a message's
-`From:` header against the application that sends it
+`From:` header against the application that sends it (since `2.4.0`;
-([plans/from-header-binding.md](plans/from-header-binding.md)). Postfix holds
+`Sender:` too since `2.8.0`). Postfix holds
-the envelope sender against the SASL login, and OpenDKIM chooses the signing
+the envelope sender against the SASL login, and the signer signs with the key
-key by the header; until `2.4.0` nothing connected the two, and an
+of the login's domain (§ DKIM signing): the signature's `d=` is that domain,
-application could have mail signed as another domain of the server or as the
+and a receiver holds it to the domain of `From:` (DMARC, RFC 7489 § 3.1.1).
-server itself.
+Without the check an application could send under the server's signature as
+another domain of the server or as the server itself. The check came in
+`2.4.0`, when OpenDKIM still signed and chose its key by the header itself;
+the hole it closed was the same.
 
 - **The rule is the envelope's.** The check reads the file Postfix reads for
   `smtpd_sender_login_maps` and makes the same lookup: the address itself is
@@ -324,20 +429,24 @@ server itself.
   `src/global/mail_addr_find.c`, `mail_addr_find_opt()`). A key written
   twice makes Postfix refuse the whole table, and the check defers then too.
 - **How the header is read.** Exactly one `From:` field (none, or more than
-  one, is refused), read with OpenDKIM's own parser: libopendkim's
+  one, is refused). The line, its folds joined, must be one address in RFC
-  `dkim_mail_parse()`, ported line for line from Debian's opendkim
+  5322's grammar as Go's `net/mail` reads it - a mail program's reading, the
-  2.11.0~beta2 (`internal/milter/mailparse.go`) and tested against the C on
+  address it shows; a display name may say anything (an encoded one in a
-  two hundred thousand lines. The check asks Postfix for header values with
+  charset Go does not convert is passed through unread). A line a lenient
-  their leading space, as OpenDKIM does (`SMFIP_HDR_LEADSPC`), so both read the
+  program could show as another address - `ceo@bank.com <me@mine.com>`,
-  same bytes. The address it returns is the one judged - the one OpenDKIM
+  `<b@evil.com, a@mine.com>` - is refused. That address, its local part
-  signs for - whatever a display name, a comment or a quoted local part
+  unquoted as Postfix holds the envelope's, is what the bindings are asked
-  holds; a parse failure, no address, or a second one after it is refused,
+  about, folded to lower case in ASCII only: a Unicode fold would make the
-  and so is an address over 256 bytes, which OpenDKIM would match its
+  Kelvin sign a `k` and let a look-alike pass. Since `2.8.0` a `Sender:`
-  `SigningTable` against cut short (`dkimf_apply_signtable()`,
+  line - the sending agent's, shown beside `From:` as "on behalf of" - is
-  `MAXADDRESS`). Encoded words are not decoded, by either. The line must also
+  held to the same rule when the message has one (at most one; the owner's
-  be one address in RFC 5322's grammar (`net/mail`), at the domain OpenDKIM
+  decision, 2026-10-16): the reply says `Sender:` instead of `From:` and the
-  signs for, so that a mail program shows the address that is signed; that
+  row's reason is `sender`. `From:` is judged first. The check asks Postfix for
-  address, its local part unquoted, is what the bindings are asked about.
+  header values with their leading space (`SMFIP_HDR_LEADSPC`), as the
+  signer does, so both read the same bytes. Until `2.8.0` the line was also
+  read with a port of OpenDKIM's own parser, so that the address judged was
+  the one OpenDKIM signed for, and an address over 256 bytes was refused;
+  both went with OpenDKIM.
 - **The verdict** comes at the end of the headers: `550 5.7.1`, permanent,
   naming the line, as a reply code of the milter's own. What the client wrote
   is reduced to printable ASCII and cut before it is said back, logged or
@@ -381,10 +490,10 @@ server itself.
   cleanup process serves message after message, so each such warning is
   counted as a message. The two are counted apart (the owner, 2026-10-14):
   connections turned away in `deferred`, messages deferred mid-message in
-  `messages` of `sender_check_days`, a row per UTC day kept a year, and
+  `messages` of `sender_check_days`, a row per day of the container's zone (`TZ`) kept a year, and
   Server › Health shows today, 30 days and 12 months in a column each. The
   counts also see a panel that is running and not answering, which the mark
-  does not. Downtime is cut at the UTC midnights it crossed. A log read again
+  does not. Downtime is cut at the midnights of that zone it crossed. A log read again
   after an unclean stop does not count again: the count and the place in the
   log it reached (the file's fingerprint and the offset past the line) are
   saved in one transaction, and while the tailer catches up a warning at or
@@ -400,10 +509,15 @@ server itself.
 [internal/notify](../internal/notify/notify.go) reports four things to the
 users of the panel: a sending domain's DNS record that stopped matching, a
 level-2 rate limit that refused mail, the TLS certificate about to expire, a
-message more than three days in the queue. The rules of when a message goes
+message more than three days in the queue. The operator's view is guide
-out are the owner's and are written in
+§ Notifications. When a message goes out is the owner's rule (2026-10-12):
-[plans/panel-notifications.md](plans/panel-notifications.md) § When a message
+
-is sent; the operator's view is guide § Notifications.
+| Subject | Sent | "Cleared" message |
+|---|---|---|
+| DNS mismatch | when it has held for an hour (two checks, below); a resolver that did not answer is not a mismatch | the same way back |
+| Certificate | 14 days before expiry, and 3 days before if it is still the same certificate | none |
+| Level-2 limit refused mail | at the first refusal for a sending domain, then at most once a day for it | none |
+| Queue older than three days | when such a message appears | one, when none is left |
 
 - **Readings.** Once an hour, starting three minutes after the process does:
   every sending domain's records through a DNS checker of the notifier's own,
@@ -480,9 +594,12 @@ and `MAIL_LOG` in [cmd/panel/main.go](../cmd/panel/main.go). Backups exclude
 Rotation uses rename + `postfix reload`
 ([build/logrotate-mail.conf](../build/logrotate-mail.conf)), not `copytruncate` —
 the latter can drop `status=sent` lines and leave send-log rows stuck at
-`queued`. After rename, logrotate runs `create 0640 postfix selfpost` (postlogd
+`queued`. After rename, logrotate runs `create 0640 postfix selfpost`, so the
-recreates the file on its first line after the reload, as root and mode
+file is there, readable by the panel through group `selfpost`, before postlogd
-`0600`, which the unprivileged panel user cannot read). `follow()` drains the
+writes its first line after the reload; a file postlogd makes itself (one
+removed while the container runs) is `0640` too, through
+`maillog_file_permissions=0640` - Postfix's default is `0600`, which the
+unprivileged panel user could not read. `follow()` drains the
 old inode once more before switching descriptors, and keeps it open and reads
 it for a minute after: postlogd keeps writing to the renamed file until the
 reload makes it exit, seconds later (Postfix 3.10.13, src/postlogd/postlogd.c;
@@ -496,10 +613,44 @@ inbound journal's. The tail of a line is the far end's words (a reply, a HELO
 name), and a pattern that could start there let a stranger's HELO name file a
 delivery (audit 2026-10-12, M12).
 
+**The test message** (test-email, `2.12.0`) is the one row the panel writes
+itself: Server › Health hands it to `sendmail(1)`, which tells nothing of the
+queue id, and the journal-milter does not see local mail. The row is written
+first, queued and with no queue id, and its Message-ID is awaited
+(`logtail.AwaitMessageID`, in memory, ten minutes); cleanup's line
+`<id>: message-id=<…>` (Postfix 3.10.13, `src/cleanup/cleanup_message.c:639`)
+gives the row its queue id, and from then on its delivery lines update it as
+any row's. A restart in the second between leaves it without one, and the
+reconcile sweep closes it once the id is no longer awaited
+(`CloseUnmatchedTestMessages`); an id awaited longer than that is not taken
+any more. sendmail out of time keeps the row and the id - postdrop may have
+queued the message all the same.
+
+**The upstream's answer** on the inbound journal (inbound-upstream-result,
+`2.10.0`). Mail accepted on port 25 is handed to its upstream by the same
+`smtp` client as outbound mail, and its delivery lines look alike; what tells
+them apart is the row. A delivery line no send-log row takes (`UpdateStatus`
+changed nothing) is offered to the journal: the rows of its queue id and
+recipient take the status, the host (`relay=`, `""` for `none` - a line
+written without a session, Postfix 3.10.13, `src/smtp/smtp_trouble.c:273,
+421`), the reply - the `(%s)` after the first `status=`, made printable and
+cut to 255 bytes - and the line's time (`store.UpdateInboundUpstream`). Only
+a `queued`, `held` or `deferred` row moves: `sent` and `bounced` are final, so
+a line read twice after a restart changes nothing. The addresses are read by
+Postfix's quoting (`loggedAddress`), so a quoted local part cannot end one
+early. cleanup's `removed (canceled)` - a queue file never queued - detaches
+the rows the milter had written for it. qmgr's expiry line, which names no
+recipient, makes the rows of its queue id `bounced`, keeping the last reply
+after "expired in the queue" (`ExpireInboundUpstream`). It is an update per
+attempt, never a row: the journal's caps stand, and port-25 mail's lines are
+still not stored (delivery-log-storage). A bounce Postfix sends to a stranger
+is mail of its own queue id and matches no row.
+
 **Read offset is persisted** (`logtail_state` table, in the baseline schema): the
 tailer stores its position plus a fingerprint of the log - the hash of its first
-512 bytes and the file's device and inode, so two logs that begin alike are two
+512 bytes and the file's inode (not the device, which can change across a
-files and a renamed file keeps its fingerprint - and on start resumes from it,
+host's reboot), so two logs that begin alike are two files and a renamed file
+keeps its fingerprint - and on start resumes from it,
 parsing the tail written while the panel was down. If the fingerprint no longer
 matches, the log was rotated in the meantime: the tailer first opens
 `mail.log.1` (left plain by `delaycompress`), and if that is the file the saved
@@ -508,7 +659,7 @@ start - what Postfix wrote between the stop and the rotation is not lost. A
 `mail.log.1` that is another file (rotated twice) is logged with the time from
 which nothing was read. Re-parsing lines is harmless because `UpdateStatus`
 writes the same status onto the same row. Only a first-ever start, with nothing
-stored, begins at end-of-file, so installing the panel does not replay a
+stored (or a stored place that cannot be read), begins at end-of-file, so installing the panel does not replay a
 pre-existing log.
 
 **A refusal's line, and a refusal the panel did not write.** A message refused
@@ -573,7 +724,11 @@ folding case). A delivery line names it in `orig_to=` when Postfix rewrote
 the address, in `to=` otherwise (`log_adhoc.c` writes `orig_to=` only then),
 and is matched without regard to case. It updates only the newest row of its
 queue id and recipient: Postfix reuses a short queue id once the message has
-left the queue, and an old row must not be rewritten. `UpdateStatus`'s transaction
+left the queue, and an old row must not be rewritten. Since `2.10.1` the
+image makes long, non-repeating queue ids (`enable_long_queue_ids=yes`,
+[build/postfix-config.sh](../build/postfix-config.sh)): the time in seconds,
+then the microseconds, `z` and the inode; a queue file from before keeps its
+short name, and every pattern of the panel takes both. `UpdateStatus`'s transaction
 starts with a write, so a commit by the `dmarc-ingest` process in between
 cannot fail it with `database is locked`.
 Now that the log survives the container, reaching this path should mean the
@@ -581,7 +736,7 @@ lines are gone for good — rotated past fourteen files while the panel was down
 or deleted — or that the tailer was not reading.
 
 Whether the sweep earns its place is measured, not argued (audit 2026-10-12,
-H3). `delivery_log_days` (migration `0007`) keeps, per UTC day for a year:
+H3). `delivery_log_days` (migration `0007`) keeps, per day of the container's zone for a year:
 `reconcile_closed`, the rows the sweep closed; `reconcile_missed`, those of
 them whose final line - sent, bounced, or the message's expiry - was in
 `mail.log` or `mail.log.1` when the sweep closed them - the tailer did not
@@ -684,7 +839,9 @@ building them only takes method values, so the route guard test can run it on
 a bare `Server` and ask which pattern answers a path:
 
 - **public** — `/healthz` (liveness), `/license` (the embedded `LICENSE`),
-  `/static/`, `/setup/`, `/login`, `/logout`;
+  `/static/`, `/setup/`, `/login`, `/logout`, and the links of
+  password-reset, opened from a mail signed in or not: `/login/reset`,
+  `/login/reset/<token>`, `/confirm/<token>` (`internal/web/auth/links.go`);
 - **authenticated** — everything else, behind `RequireAuth`: a request without
   a live session is redirected to `/login`.
 
@@ -706,9 +863,9 @@ only reads (the delete confirmation at `GET …/delete` renders a form).
 | Outbound › Log, Queue | `GET /outbound/log` · `/outbound/log/fragment` · `/outbound/log/{id}` · `GET /outbound/queue` · `/outbound/queue/fragment` |
 | Outbound › DMARC reports | `GET /outbound/dmarc` · `…/dmarc/domains/{id}` · `…/dmarc/reports/{id}` — registered only with `DMARC_REPORTS_ENABLE=true` |
 | Inbound › Domains | `GET, POST /inbound/domains` · `/inbound/domains/{id}` · `POST …/dns-recheck`, `…/upstream`, `…/recipients` · `GET, POST …/delete` — registered only with `INBOUND_RELAY_ENABLE=true` |
-| Inbound › Log, Filter lists | `GET /inbound/log` · `GET, POST /inbound/filter-lists` · `POST /inbound/filter-lists/{id}/delete` — registered only with `INBOUND_RELAY_ENABLE=true` |
+| Inbound › Log, Queue, Filter lists | `GET /inbound/log` · `GET /inbound/queue` · `/inbound/queue/fragment` · `GET, POST /inbound/filter-lists` · `POST /inbound/filter-lists/{id}/delete` — registered only with `INBOUND_RELAY_ENABLE=true` |
-| Server | `GET /server/health` (+ `/fragment`) · `POST /server/health/recheck`, `/server/health/reload` · `GET /server/log` (+ `/fragment`) · `GET, POST /server/backup` · `POST /server/backup/import` · `/server/users`, `…/new`, `…/{uid}`, `…/{uid}/delete` · `GET, POST /server/settings` · `GET /server/components` |
+| Server | `GET /server/health` (+ `/fragment`) · `POST /server/health/recheck`, `/server/health/reload`, `/server/health/test-message` · `GET /server/log` (+ `/fragment`) · `GET, POST /server/backup` · `POST /server/backup/import` · `/server/users`, `…/new`, `…/{uid}`, `…/{uid}/delete` · `GET, POST /server/settings` · `POST /server/settings/dns-recheck` · `GET /server/components` |
-| Account | `GET /account` · `POST /account/profile`, `/account/password` |
+| Account | `GET /account` · `POST /account/profile`, `/account/password`, `/account/email/confirm` |
 | User menu | `GET /help` · `POST /logout` (public mux) |
 
 An application is addressed under its domain, and an application id that does
@@ -809,9 +966,8 @@ is one layout and one way to render.
   package (`NewOutDomain`, `NewHelp`, …) that the handler fills. The shell is
   derived from `Meta` and the feature flags (`SetInboundEnabled`,
   `SetDMARCEnabled`) in one place, `Engine.shell`, so which entries the menu
-  has is decided once. No template reads a `map[string]any`; the one map left
+  has is decided once. No page's data is a map: the health sampler too
-  in the handlers is the health sampler's, which is turned into a typed
+  returns a typed `health.Machine`.
-  `Health` before rendering.
 - **The component kit.** [components.html](../internal/web/view/templates/components.html)
   holds one `{{define}}` per partial (page head, postmark, box and its head and
   foot, flash, health card, DNS record, facts, side menu, timeline, log pane,
@@ -851,8 +1007,8 @@ has the component skeleton of its mockup), `TestRedesignedPagesLoadOnlyTheKit`,
 ratchet list `internal/web/view/legacy_pages.txt` is empty and can only shrink;
 the CI step
 [design-first](../.github/scripts/design-first.sh) rejects a commit that
-changes a guard together with the code it judges, and a template that is a
+changes a guard together with the code it judges, and a template that is
-byte-for-byte return of one from history. The design contract and the process
+the same as one from history, whitespace aside. The design contract and the process
 are in [plans/panel-redesign.md](plans/panel-redesign.md) § Enforcement.
 
 ### Security headers, CSP and scripts
@@ -876,7 +1032,8 @@ send it (an older one, or a current one over plain HTTP at a name other than
 `localhost`), `Origin` must name the panel's host - which a form of the panel
 carries under its `Referrer-Policy: same-origin`, the page's own origin (under
 `no-referrer` it would be `null` and refused); a request with neither header
-is let through (an accepted risk). A refusal logs the `Sec-Fetch-Site`,
+is refused too (origin-strict, `2.10.4`; it was let through before, as an
+accepted risk). A refusal logs the `Sec-Fetch-Site`,
 `Origin` and `Host` it compared.
 There are no CSRF tokens — see [security.md](security.md).
 
@@ -886,7 +1043,8 @@ A validation refusal is shown as the text the validator wrote (on the form,
 next to the field, or in a notice above the first box). Anything else — a
 database error, `saslpasswd2`, a Postfix reload — is logged
 and the page gets a fixed sentence saying so; the error text never reaches the
-browser. A template error renders a bare `500` rather than a half-written page
+browser - save on the global-only Backup page, where an import's refusal
+names what is wrong with the file (security.md § Output and process). A template error renders a bare `500` rather than a half-written page
 (`Engine.Render` buffers).
 
 ### Sessions
@@ -925,19 +1083,19 @@ the cookie and the restored row's `expires_at` has not passed.
 ## Code layers
 
 Multi-store writes that must land in more than one place (SQLite row,
-`sasldb2` entry, Postfix map, OpenDKIM table) go through a service, which is
+`sasldb2` entry, Postfix map, DKIM key or selector table) go through a service, which is
 also where the rollback of a partial failure lives. Handlers may call
 `store` directly for single-table reads and simple writes (sessions, users,
 send-log queries); the first-run setup-token file is read and written in
 `web` itself. The adapters below the services are the only code that knows
-about Postfix, OpenDKIM, DNS or the log file, which is what makes them
+about Postfix, the milter protocol, DNS or the log file, which is what makes them
 substitutable in tests — `milter.Store`, `app.SenderMaps` and
 `logtail.StatusStore` are the seams the unit tests replace with fakes.
 
 ```mermaid
 flowchart TB
   subgraph cmd ["cmd — composition root"]
-    panel["panel: HTTP + journal-milter + log-tailer"]
+    panel["panel: HTTP + sender check + DKIM signer + journal-milter + log-tailer"]
     backupcli["selfpost-backup CLI"]
   end
   subgraph web ["internal/web — HTTP surface"]
@@ -995,7 +1153,7 @@ flowchart TB
   dmarcSvc --> postfix
 ```
 
-The roles inside the `panel` process (HTTP server, sender check,
+The roles inside the `panel` process (HTTP server, sender check, DKIM signer,
 journal-milter, log-tailer, rate-limit recalc, notifier) share one binary and
 one SQLite handle on purpose — see
 [Panel binary](#panel-binary-cmdpanel) for why, and *Persistence* below for the
@@ -1009,7 +1167,7 @@ single-connection trade-off that follows from it.
 |---|---|
 | `selfpost.db` | SQLite panel state (users, sessions, domains, apps, send log, L2 limits, log-tailer offset, inbound relay, DMARC reports) — see [Database](#database) and [schema-migrations.md](schema-migrations.md) |
 | `setup-token` | First-run setup token file |
-| `opendkim/` | DKIM keys + tables |
+| `dkim/` | DKIM keys (`keys/<name>/<selector>.private`) and the selector table (`selectors`) the signer reads; the panel's alone, `0700` / `0600` — § DKIM signing |
 | `sasl/sasldb2` | Application SASL credentials |
 | `postfix/sender_login_maps` | Login → From binding |
 | `postfix/relay_domains` | Inbound domains accepted on port 25 |
@@ -1019,8 +1177,9 @@ single-connection trade-off that follows from it.
 | `postfix/dmarc_recipients` | Allow-listed DMARC aggregate report addresses |
 | `postfix/dmarc_transport` | Pipe transport for report ingest |
 | `postfix/dmarc_relay_domains` | Domains accepted for DMARC report delivery |
-| `postfix/queue/` | Postfix transit mail (deferred/active); survives container recreate |
+| `postfix/queue/` | Postfix transit mail (deferred/active); survives container recreate; excluded from backups. Handed to `postfix` / `postdrop` by name at every start, before `postfix check` (`own_queue` in `build/entrypoint.sh`): the package accounts' numbers moved in `2.8.0` (postfix 101 → 100, postdrop 103 → 102) |
 | `log/mail.log` | Postfix delivery log + rotated copies (excluded from backups) |
+| `antispam/` | The filter lists (six `.map` files) and the filter's key `filter.key`, which the spam filter's container mounts (`ANTISPAM_DIR`) |
 | `manifest.json` | Backup version stamp; removed by the first start after a restore once its Resync is done |
 | `contents.json` | A backup's last entry: the size and SHA-256 of each file under `data/`, compared by the first start after a restore before it opens the database (renamed `contents.checked.json` once compared, removed with the manifest) |
 
@@ -1030,7 +1189,7 @@ full backups also archive the operator's `./certs` PEM files when present.
 ### Database
 
 The schema is an embedded baseline, `internal/store/migrations/0001_init.sql`,
-and the migrations after it (`0002` to `0011` today; the next is `0012`),
+and the migrations after it (`0002` to `0014` today; the next is `0015`),
 applied by `store.Open` in file order; `PRAGMA user_version` counts the files
 applied and
 `PRAGMA application_id` is `0x53503230` ("SP20"). There is no 1.x migration
@@ -1049,7 +1208,11 @@ The tables that carry the panel's model:
   the user's own address, edited on Account and set by the global role on the
   user form; `all_domains` / `all_inbound_domains` widen a *domain* user to
   every domain of that direction, including ones added later (with a flag set
-  the assignment rows are ignored).
+  the assignment rows are ignored); `email_confirmed_at` is when `email` was
+  confirmed, `''` while it is not (v13).
+- **`user_links`** — the one-time links that confirm an address and reset a
+  password (v13): the token's SHA-256, `purpose`, the address it went to, its
+  expiry; one live link per user and purpose.
 - **`user_domains`** and **`user_inbound_domains`** — the outbound and inbound
   domains assigned to a *domain* user. Separate tables: the same name on both
   is two assignments, and a sending domain gives no inbound access or the other
@@ -1071,7 +1234,7 @@ The tables that carry the panel's model:
   `inbound_spam_list` (the filter lists), `dmarc_reports`,
   `dmarc_report_records`, `notify_state` and `notify_addressees` (what the
   notifier has said and to whom, § Notifications), `sender_check_days` (the
-  sender check's downtime and the mail it deferred, per UTC day) and
+  sender check's downtime and the mail it deferred, per day of the container's zone) and
   `delivery_log_days` (the queue sweep's measurements, § Log tailer).
 
 Two processes write: the panel, on one connection, and `dmarc-ingest`, which
@@ -1089,15 +1252,19 @@ the stored log lines follow;
 `postfix reload` in `postrotate` — see § Log tailer above).
 
 **Restore:** panel button or `selfpost-backup` CLI — self-contained archive:
-`data/` (SQLite snapshot + tree minus `log/`, the setup token and any `tls/`
+`data/` (SQLite snapshot + tree minus `log/`, the Postfix queue
-under `/data`), `docker-compose.yml`, `.env`, and `certs/` when present;
+`postfix/queue`, the copy `sasl/sasldb2.new` a password change is made on, the
+setup token and any `tls/` under `/data`), `docker-compose.yml`, `.env`,
+and `certs/` when present;
 version check on restore. Requires the project directory mounted read-only at
 `SELFPOST_DEPLOY_ROOT` (`/selfpost-deploy` in the default compose file). On the
-first successful boot after restore, the panel runs one **Resync** — OpenDKIM's
+first successful boot after restore, the panel runs one **Resync**
-tables, Postfix's sender map, inbound relay maps and the filter lists (when
+(`mailStack.Resync`, `cmd/panel/httpserver.go`) — the DKIM selector table
-`INBOUND_RELAY_ENABLE=true`), and DMARC maps (when `DMARC_REPORTS_ENABLE=true`)
+(and the keys of deleted domains removed), Postfix's sender map, inbound relay
-are re-derived from SQLite and both daemons are reloaded, so drift between the
+maps and the filter lists (when `INBOUND_RELAY_ENABLE=true`), and DMARC maps
-extracted archive and the database is healed before mail flows. Manual
+(when `DMARC_REPORTS_ENABLE=true`) are re-derived from SQLite and Postfix is
+reloaded, so drift between the extracted archive and the database is healed
+before mail flows; the signer reads the new table without a reload. Manual
 `POST /server/health/reload` (the *Reload configuration* button on Server ›
 Health) writes the same files in the same order (`HandleReload`; before
 `2.5.4` it left out the filter lists and the DMARC maps), and on a failure
@@ -1164,11 +1331,15 @@ unsupported rather than as a missing doc:
   `POSTFIX_DMARC_RECIPIENTS` (`/data/postfix/dmarc_recipients`),
   `POSTFIX_DMARC_TRANSPORT` (`/data/postfix/dmarc_transport`),
   `POSTFIX_DMARC_RELAY_DOMAINS` (`/data/postfix/dmarc_relay_domains`),
-  `POSTFIX_QUEUE_DIR` (`/data/postfix/queue` — set in `build/postfix-config.sh`),
+  `POSTFIX_QUEUE_DIR` (`/data/postfix/queue` — read in `build/postfix-config.sh`
+  for `queue_directory`; `build/entrypoint.sh` hands `/data/postfix/queue` to
+  Postfix by that path, so overriding it desyncs the queue's ownership),
   `SELFPOST_DEPLOY_ROOT` (`/selfpost-deploy` — operator project directory for
   full backups; mount `.:/selfpost-deploy:ro` in compose), `ANTISPAM_DIR`
   (`/data/antispam` — the filter lists and the filter's key, which the spam
-  filter's container mounts).
+  filter's container mounts). `SELFPOST_BACKUP_PASSWORD` is read by the
+  `selfpost-backup` CLI, not the panel: the encryption password, the other
+  way being `-password-file` (guide § Encrypting a backup).
 - **Milter and Postfix startup:** `MILTER_CONNECT_TIMEOUT` (`15s`),
   `MILTER_COMMAND_TIMEOUT` (`15s`), `MILTER_CONTENT_TIMEOUT` (`30s`),
   `MILTER_WAIT_TIMEOUT` (`30` seconds).

docs/assets/panel-redesign/index.html

@@ -36,7 +36,7 @@
         <a href="panel/in-queue.html">Queue</a> (empty state)<br>
         <a href="panel/in-quarantine.html">Quarantine</a> · <a href="panel/in-quarantine-message.html">held message</a> ·
         <a href="panel/in-filter-lists.html">Filter lists</a> — roadmap items, drawn as their target look</td></tr>
-      <tr><th>Server</th><td><a href="panel/health.html">Health</a> · <a href="panel/preflight.html">Preflight</a> (roadmap) · <a href="panel/system-log.html">System log</a> ·
+      <tr><th>Server</th><td><a href="panel/health.html">Health</a> · <a href="panel/system-log.html">System log</a> ·
         <a href="panel/backup.html">Backup</a> · <a href="panel/users.html">Users</a> · <a href="panel/user.html">user form</a> ·
         <a href="panel/user-delete.html">delete user</a> · <a href="panel/settings.html">Settings</a></td></tr>
       <tr><th>User menu</th><td><a href="panel/account.html">Account</a> · <a href="panel/help.html">Help</a></td></tr>

docs/assets/panel-redesign/panel/account.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group" open><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -80,12 +79,18 @@
           <div class="sp-box-body">
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="username">Username</label><div class="control has-icons-left"><input class="input" id="username" name="username" value="admin" autocomplete="username" spellcheck="false" required><span class="icon is-left"><i class="ti ti-user"></i></span></div></div>
-              <div class="field"><label class="label" for="email">E-mail</label><div class="control has-icons-left"><input class="input" id="email" name="email" type="email" value="mix@example.org" autocomplete="email"><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
+              <div class="field"><label class="label" for="email">E-mail <span class="tag is-warning is-light">not confirmed</span></label><div class="control has-icons-left"><input class="input" id="email" name="email" type="email" value="mix@example.org" autocomplete="email"><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
-                <p class="help">Your own address. A domain's report address can be filled with it from Domain settings.</p></div>
+                <p class="help">Your own address. Saving a new one sends it a link to confirm it; once confirmed it is where a link to reset your password can go. A domain's report address can be filled with it from Domain settings.</p></div>
+              <div class="field"><label class="label" for="pcur">Current password</label><div class="control"><input class="input" id="pcur" name="current_password" type="password" autocomplete="current-password"></div>
+                <p class="help">Needed only to change the e-mail.</p></div>
               <div class="field"><label class="checkbox"><input type="checkbox" name="notify" checked> Send me notifications</label>
                 <p class="help">To this address, when something needs you: a DNS record of a domain stops matching, a rate limit refuses mail, the TLS certificate is about to expire, a message has waited in the queue for three days. <a href="help.html#notifications">What is sent and when</a></p></div>
               <button type="submit" class="button is-primary">Save profile</button>
             </form>
+            <form class="sp-form mt-4" method="post" action="#">
+              <p class="help mb-3">A link was sent to <span class="sp-mono">mix@example.org</span> at 14:02; it works once, for 24 hours.</p>
+              <button type="submit" class="button">Send the link again</button>
+            </form>
           </div>
         </div>
       </div>
@@ -108,7 +113,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/backup.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group" open><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html" aria-current="page"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item is-active" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -62,7 +61,7 @@
   </div>
 </nav>
 <div class="sp-perf" aria-hidden="true"></div>
-<div class="sp-subnav"><div class="container"><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html" aria-current="page"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></div></div>
+<div class="sp-subnav"><div class="container"><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html" aria-current="page"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></div></div>
 <main>
   <div class="container sp-page">
 <div class="sp-head">
@@ -86,6 +85,8 @@
                 <div class="field"><label class="label" for="pw2">Repeat password</label><div class="control"><input class="input" id="pw2" type="password"></div></div>
               </div>
               <p class="help mb-3">Keep this password: SelfPost does not store it, and the file cannot be opened without it.</p>
+              <div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password" required></div>
+                <p class="help">The one you sign in with, asked at every download: the archive holds every secret of the server, and a session left open must not be enough to take it.</p></div>
               <button type="submit" class="button is-primary"><i class="ti ti-download"></i>Download full backup</button>
             </form>
           </div>
@@ -109,7 +110,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/build.py

@@ -31,7 +31,6 @@ NAV = [
     ]),
     ("server", "Server", "health.html", "ti-server-2", [
         ("health", "Health", "health.html", "ti-heartbeat"),
-        ("preflight", "Preflight", "preflight.html", "ti-checklist"),
         ("system-log", "System log", "system-log.html", "ti-file-text"),
         ("backup", "Backup", "backup.html", "ti-archive"),
         ("users", "Users", "users.html", "ti-users"),
@@ -52,15 +51,39 @@ HEAD = """<!DOCTYPE html>
 </head>
 """
 
-FOOT = ('<footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a>'
+FOOT = ('<footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a>'
         ' · <a href="#">Source</a> · No warranty</footer>')
 
 
+def touchnav(section, page):
+    """The navigation below 1024 px: a Menu that opens over the page, its
+    sections folded but the current one - details elements, no script."""
+    out = ['<details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel">']
+    for key, label, href, _icon, pages in NAV:
+        if not pages:
+            cur = ' aria-current="page"' if key == section else ""
+            out.append(f'<a href="{href}"{cur}>{label}</a>')
+            continue
+        opened = " open" if key == section else ""
+        out.append(f'<details class="sp-touchnav-group"{opened}><summary>{label}</summary>')
+        for pkey, plabel, phref, picon in pages:
+            cur = ' aria-current="page"' if key == section and pkey == page else ""
+            out.append(f'<a href="{phref}"{cur}><i class="ti {picon}"></i>{plabel}</a>')
+        out.append('</details>')
+    opened = " open" if section == "user" else ""
+    out += [f'<details class="sp-touchnav-group"{opened}><summary><i class="ti ti-user-circle"></i>admin</summary>',
+            '<a href="account.html"><i class="ti ti-key"></i>Account</a>',
+            '<a href="help.html"><i class="ti ti-help"></i>Help</a>',
+            '<form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form>',
+            '</details>', '</div></details>']
+    return "".join(out)
+
+
 def navbar(section, page):
     out = ['<nav class="navbar is-primary" aria-label="main navigation">', '  <div class="container">',
            '    <div class="navbar-brand"><a class="navbar-item" href="overview.html">'
-           '<img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>',
+           '<img src="../../selfpost-wordmark.svg" alt="SelfPost"></a>' + touchnav(section, page) + '</div>',
-           '    <div class="navbar-menu is-active">', '      <div class="navbar-start">']
+           '    <div class="navbar-menu">', '      <div class="navbar-start">']
     for key, label, href, _icon, pages in NAV:
         cur = " sp-current" if key == section else ""
         if not pages:

docs/assets/panel-redesign/panel/components.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -150,9 +149,9 @@
     <div class="columns">
       <div class="column is-7">
         <div class="box">
-          <div class="sp-box-head"><span class="sp-no">05</span><h2>dns_record · copy_field</h2><div class="sp-end">One block per record</div></div>
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>dns_record · copy_field</h2><div class="sp-end">One block per record · folded when DNS holds it as shown</div></div>
-          <div class="sp-record">
+          <details class="sp-record">
-            <div class="sp-record-head"><h3>Record</h3><span class="tag is-success is-light">published</span><small>A one-line note</small></div>
+            <summary class="sp-record-head"><h3>Record</h3><span class="tag is-success is-light">published</span><small>A one-line note</small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="copy_field — single line"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -160,7 +159,7 @@
             </div>
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><textarea class="textarea" rows="2" readonly>copy_field — multi-line, for a DKIM key</textarea></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-          </div>
+          </details>
           <div class="sp-record">
             <div class="sp-record-head"><h3>Record</h3><span class="tag is-danger is-light">mismatch</span><small>"In DNS now" appears only when it differs</small></div>
             <div class="field"><label class="label">In DNS now</label>
@@ -172,7 +171,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">07</span><h2>Table conventions</h2><div class="sp-end">Always inside <code>table-container</code> · an address breaks after its @</div></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Time, UTC</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
+            <thead><tr><th>Time</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td><a href="#"><strong>the row's link</strong></a></td><td class="sp-clip">A long subject is clipped with an ellipsis instead of wrapping the row</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="#">Details</a><form method="post" action="#"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
             </tbody>
@@ -182,9 +181,10 @@
 
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">09</span><h2>log_pane</h2><div class="sp-end">sp-d time · sp-w warning · sp-e error</div></div>
-<pre class="sp-log"><span class="sp-d">13:58:07</span> an ordinary line
+<pre class="sp-log"><span class="sp-ll"><span class="sp-d">13:58:07</span> an ordinary line
-<span class="sp-d">13:58:09</span> <span class="sp-w">a deferred delivery — sp-w</span>
+</span><span class="sp-ll"><span class="sp-d">13:58:09</span> <span class="sp-w">a deferred delivery — sp-w</span>
-<span class="sp-d">13:57:41</span> <span class="sp-e">a reject or a bounce — sp-e</span></pre>
+</span><span class="sp-ll"><span class="sp-d">13:57:41</span> <span class="sp-e">a reject or a bounce — sp-e</span>
+</span></pre>
         </div>
       </div>
 
@@ -195,7 +195,9 @@
             <dl class="sp-facts">
               <div><dt>Label</dt><dd>Value</dd></div>
               <div><dt>Mono value</dt><dd class="sp-mono">4XcB7k2Jm9z1</dd></div>
+              <div><dt>Label with a tag <span class="tag is-success is-light">matches</span></dt><dd>a verdict on the value</dd></div>
               <div><dt>sp-big</dt><dd class="sp-big">5 days</dd><dd class="sp-muted">a supporting line</dd></div>
+              <div class="sp-wide"><dt>sp-wide</dt><dd class="sp-mono">a value that takes the whole row, a line of a server's own</dd></div>
             </dl>
           </div>
         </div>
@@ -204,9 +206,9 @@
           <div class="sp-box-head"><span class="sp-no">08</span><h2>timeline</h2></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Done</strong> — default</li>
+              <li><time>13:58:07</time><strong>Done</strong> — default</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — sp-warn</li>
+              <li class="sp-warn"><time>13:58:09</time><strong>Deferred</strong> — sp-warn</li>
-              <li class="sp-fail"><time>14:40:00 UTC</time><strong>Bounced</strong> — sp-fail</li>
+              <li class="sp-fail"><time>14:40:00</time><strong>Bounced</strong> — sp-fail</li>
               <li class="sp-pending"><time>not yet</time>Expected next — sp-pending</li>
             </ol>
           </div>
@@ -289,7 +291,7 @@
       <div class="sp-box-foot">Bulma's <code>is-small</code> and <code>is-size-7</code> are not used: a control is never small, and <code>sp-small</code> replaces the helper. The postmark's fine print is an imprint, not text.</div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/confirm-email-signin.html

@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="light">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Confirm e-mail · SelfPost</title>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
+<link rel="stylesheet" href="../shared/brand.css">
+<link rel="stylesheet" href="theme.css">
+</head>
+<body>
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <div class="sp-form">
+      <p class="sp-kicker">mail.example.org</p>
+      <h1 class="title is-3">Confirm e-mail</h1>
+      <div class="notification is-danger is-light"><i class="ti ti-alert-circle"></i>Sign in to the account in this browser, then open the link again.</div>
+      <p><a href="login.html">Sign in</a></p>
+    </div>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>
+
+</body>
+</html>

docs/assets/panel-redesign/panel/confirm-email.html

@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="light">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Confirm e-mail · SelfPost</title>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
+<link rel="stylesheet" href="../shared/brand.css">
+<link rel="stylesheet" href="theme.css">
+</head>
+<body>
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="account.html">
+      <p class="sp-kicker">mail.example.org · admin</p>
+      <h1 class="title is-3">Confirm e-mail</h1>
+      <p class="sp-muted mb-4"><span class="sp-mono">mix@example.org</span> becomes the confirmed address of this account: where a link to reset its password can be sent.</p>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Confirm</button></div>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>
+
+</body>
+</html>

docs/assets/panel-redesign/panel/dmarc-domain.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html" aria-current="page"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -92,7 +91,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Reports</h2></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Received, UTC</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+            <thead><tr><th>Received</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 02:15</td><td class="sp-muted">google.com</td><td>20 Sep</td><td>6 410</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
@@ -103,7 +102,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/dmarc-report.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html" aria-current="page"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -68,7 +67,7 @@
 <div class="sp-head">
       <div class="sp-grow">
         <p class="sp-kicker"><a href="dmarc.html">DMARC reports</a> / <a href="dmarc-domain.html">shop.example.org</a> /</p>
-        <h1 class="title is-4">Outlook.com · 20 Sep 2026</h1>
+        <h1 class="title is-4">Outlook.com · 20 Sep</h1>
         <p class="sp-route"><span>shop.example.org</span><span class="tag is-success is-light">1 903 pass</span><span class="tag is-warning is-light">7 fail</span></p>
       </div>
     </div>
@@ -81,8 +80,8 @@
             <dl class="sp-facts">
               <div><dt>Reporter</dt><dd>Outlook.com</dd></div>
               <div><dt>Report id</dt><dd class="sp-mono sp-small">5f1c9a0e7b2d4e61a3</dd></div>
-              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00 UTC</dd></div>
+              <div><dt>Window</dt><dd>20 Sep 03:00 – 21 Sep 03:00</dd><dd class="sp-muted">The reporter's day, 20 Sep: reports count their days in UTC, and the title and the lists name that day. The times are this panel's zone.</dd></div>
-              <div><dt>Received</dt><dd>2026-09-21 04:40 UTC</dd></div>
+              <div><dt>Received</dt><dd>2026-09-21 04:40</dd></div>
             </dl>
           </div>
         </div>
@@ -112,7 +111,7 @@
       </table></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/dmarc.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html" aria-current="page"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -77,7 +76,7 @@
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Ingest</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#dmarc" title="What the reports are and where they go"><i class="ti ti-help-circle"></i></a></div>
       <div class="sp-box-body">
         <dl class="sp-facts">
-          <div><dt>Last report</dt><dd>2026-09-21 06:12 UTC</dd></div>
+          <div><dt>Last report</dt><dd>2026-09-21 06:12</dd></div>
           <div><dt>This week</dt><dd>14 kept · 0 parse failures</dd></div>
           <div><dt>Hosted addresses</dt><dd class="sp-mono sp-small">dmarc-reports+&lt;domain&gt;@mail.example.org</dd></div>
           <div><dt>Retention</dt><dd>500 reports a domain or 90 days</dd></div>
@@ -88,7 +87,7 @@
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">02</span><h2>Recent reports</h2></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Received, UTC</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+        <thead><tr><th>Received</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 06:12</td><td><a href="dmarc-domain.html">example.org</a></td><td class="sp-muted">google.com</td><td>20 Sep</td><td>412</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td><a href="dmarc-domain.html">shop.example.org</a></td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
@@ -98,7 +97,7 @@
       </table></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/health.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group" open><summary>Server</summary><a href="health.html" aria-current="page"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item is-active" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -62,14 +61,14 @@
   </div>
 </nav>
 <div class="sp-perf" aria-hidden="true"></div>
-<div class="sp-subnav"><div class="container"><a href="health.html" aria-current="page"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></div></div>
+<div class="sp-subnav"><div class="container"><a href="health.html" aria-current="page"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></div></div>
 <main>
   <div class="container sp-page">
 <div class="sp-head">
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">Health</h1>
-        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes every 10 s.</p>
+        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes automatically.</p>
       </div>
       <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-refresh"></i>Re-check DNS</button></form>
     </div>
@@ -108,6 +107,7 @@
             <dl class="sp-facts">
               <div><dt>Hostname</dt><dd class="sp-mono">mail.example.org</dd></div>
               <div><dt>Lookup</dt><dd class="sp-mono">→ 203.0.113.25<br>← mail.example.org</dd></div>
+              <div class="sp-wide"><dt>Greeting</dt><dd class="sp-mono">220 mail.example.org ESMTP</dd></div>
             </dl>
           </div>
         </div>
@@ -133,6 +133,7 @@
               <tr><td>dkim-signer <span class="sp-muted">· notifications</span><br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/sign-local.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
               <tr><td>journal-milter<br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/journal.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
               <tr><td>sender-check<br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/sender.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
+              <tr><td>inbound-journal-milter <span class="sp-muted">· Inbound log</span><br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/inbound-journal.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
               <tr><td>rspamd <span class="sp-muted">· inbound spam filter</span><br><span class="sp-muted sp-mono sp-small">inet:antispam:11332</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
             </tbody>
           </table></div>
@@ -141,10 +142,10 @@
           <div class="sp-box-head"><span class="sp-no">04</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#certificate" title="When it warns and what to do"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14 UTC</dd></div>
+              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14</dd></div>
-              <div><dt>Names</dt><dd class="sp-mono">mail.example.org</dd></div>
+              <div><dt>Names <span class="tag is-success is-light">matches</span></dt><dd class="sp-mono">mail.example.org</dd></div>
-              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02 UTC</dd></div>
+              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02</dd></div>
-              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12 UTC</dd></div>
+              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12</dd></div>
             </dl>
             <p class="mt-4 sp-muted">Postfix still serves the certificate above. A renewed one is waiting in the mounted file; Postfix takes it up at its next check for a renewal, at most a day after it was mounted.</p>
           </div>
@@ -156,6 +157,7 @@
             <tbody>
               <tr><td>DKIM<br><span class="sp-muted sp-mono sp-small">sp2026._domainkey.mail.example.org</span></td><td><span class="tag is-success is-light">published</span></td></tr>
               <tr><td>SPF<br><span class="sp-muted sp-mono sp-small">mail.example.org</span></td><td><span class="tag is-warning is-light">missing</span></td></tr>
+              <tr><td>DMARC<br><span class="sp-muted sp-mono sp-small">_dmarc.mail.example.org</span></td><td><span class="tag is-warning is-light">missing</span></td></tr>
             </tbody>
           </table></div>
           <div class="sp-box-body">
@@ -165,14 +167,30 @@
         <div class="box" id="configuration" data-order="8">
           <div class="sp-box-head"><span class="sp-no">08</span><h2>Configuration</h2><div class="sp-end">Safe to run at any time</div></div>
           <div class="sp-box-body">
+            <div class="mb-3"><dl class="sp-facts">
+              <div><dt>Your address</dt><dd class="sp-mono">198.51.100.7</dd><dd class="sp-muted">From X-Forwarded-For, which the trusted proxy 172.18.0.1 set</dd></div>
+            </dl></div>
             <p class="mb-3">Regenerates the Postfix configuration and the spam filter's lists from the database, removes the keys of deleted domains, and reloads Postfix. Use it after editing the files by hand, after restoring a backup, or when the running configuration looks out of step with the domain and application lists. It does not touch the queue or the TLS certificate.</p>
             <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-reload"></i>Reload configuration</button></form>
           </div>
         </div>
+        <div class="box" id="test-message" data-order="9">
+          <div class="sp-box-head"><span class="sp-no">09</span><h2>Test message</h2><div class="sp-end">Shows what the receiving server answers</div><a class="sp-help" href="help.html#test-message" title="What the test proves"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <form class="sp-form" method="post" action="out-message.html">
+              <div class="field"><label class="label" for="rcpt">Recipient</label>
+                <div class="field has-addons">
+                  <div class="control is-expanded has-icons-left"><input class="input" id="rcpt" name="recipient" type="email" placeholder="you@elsewhere.example" required><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
+                  <div class="control"><button type="submit" class="button is-primary"><i class="ti ti-send"></i>Send</button></div>
+                </div>
+                <p class="help">From <span class="sp-mono">postmaster@mail.example.org</span>, signed with the server's own key, through Postfix as its notifications go. It opens in the <a href="out-log.html">Outbound log</a>, where its page follows it to the receiving server. Ten an hour.</p></div>
+            </form>
+          </div>
+        </div>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/help.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group" open><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -80,6 +79,7 @@
           <ul class="menu-list">
             <li><a class="is-active" href="#checks"><i class="ti ti-activity-heartbeat"></i>Health checks</a></li>
             <li><a href="#certificate"><i class="ti ti-certificate"></i>TLS certificate</a></li>
+            <li><a href="#test-message"><i class="ti ti-send"></i>Test message</a></li>
             <li><a href="#rdns"><i class="ti ti-arrows-exchange"></i>Reverse DNS</a></li>
           </ul>
           <p class="menu-label">Outbound</p>
@@ -99,6 +99,7 @@
             <li><a href="#recipients"><i class="ti ti-address-book"></i>Valid recipients</a></li>
             <li><a href="#filter"><i class="ti ti-shield-check"></i>Spam filter</a></li>
             <li><a href="#inbound-log"><i class="ti ti-list-details"></i>Inbound log</a></li>
+            <li><a href="#inbound-queue"><i class="ti ti-stack-2"></i>Inbound queue</a></li>
             <li><a href="#filter-lists"><i class="ti ti-filter"></i>Filter lists</a></li>
           </ul>
           <p class="menu-label">Server</p>
@@ -117,44 +118,46 @@
       <div class="column is-9">
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>Overview</h2></div>
-          <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, and the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now. <a href="health.html">Health</a> shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total.</p></div>
+          <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, and the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now. <a href="health.html">Health</a> shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total. <em>Your address</em>, in the Configuration card, is the address the panel sees your browser at: behind a reverse proxy it must be your own, taken from <code>X-Forwarded-For</code>; when it is the proxy's, every visitor shares one sign-in limit, and Health warns and names the address to put in <code>TRUSTED_PROXY_CIDR</code>.</p></div>
-          <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. Postfix serves its own copy of the mounted file and looks for a renewed one once a day by default; until it takes one up, the card shows it as a renewal waiting, and warns once it has waited longer than that check allows - the container log's cert-reload lines say why. It warns 14 days before expiry unless a renewal is already waiting, and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect.</p></div>
+          <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. Postfix serves its own copy of the mounted file and looks for a renewed one once a day by default; until it takes one up, the card shows it as a renewal waiting, and warns once it has waited longer than that check allows - the container log's cert-reload lines say why. It warns 14 days before expiry unless a renewal is already waiting, and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect. It also fails when none of its names is the hostname (<code>SELFPOST_HOSTNAME</code>) - the tag beside <em>Names</em> says which: a client that verifies the name refuses it however valid it is.</p></div>
-          <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname (<code>SELFPOST_HOSTNAME</code>) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone.</p></div>
+          <div class="sp-help-topic" id="test-message"><h3>Test message</h3><p>A message from <code>postmaster@</code> the server's hostname to one address you type, sent the way notifications are: through Postfix, signed with the DKIM key of the server's own name. It proves the path from this server - TLS, its address's reputation, the SPF and DKIM records of its name - not your domains', which only mail from an application does. The page that opens is its row in the Outbound log: it shows whether the receiving server took it, put it off or refused it, with the lines of <code>mail.log</code>. Whether it then reached the inbox or the spam folder only the mailbox can say. The global role sends it, at most ten an hour.</p></div>
+          <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname (<code>SELFPOST_HOSTNAME</code>) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone. <em>Greeting</em> is the line Postfix opens every connection with, <code>220</code> and its banner; it must name the hostname too - a receiver compares it with the name it looked up - and a container id or <code>localhost</code> there is a warning.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Outbound</h2></div>
-          <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
+          <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. A record DNS already holds as shown is folded to its name and status; Show values opens it to copy them again. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
-          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once at creation or regeneration and is not stored in readable form.</p></div>
+          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once, at creation or regeneration, and the panel does not show it again; the server keeps it, so a domain export can carry it.</p></div>
-          <div class="sp-help-topic" id="sender-check"><h3>Sender check</h3><p>An application sends only as itself, and that holds for both senders a message has. The envelope sender is held against the login by Postfix. The <code>From:</code> line, the one a mail program shows and the one DMARC holds the DKIM signature to, is held against it by the panel, under the same rule: an application set to any address of its domain may write any address of that domain, and one with a list of addresses only those. A message with any other <code>From:</code> - another of your domains, the server's own name, an address somewhere else, or none at all - is refused for good with <code>550 5.7.1</code>. The line must hold one address, read as a mail program reads it: what a display name around it says is not judged, and a line holding more than one address is refused. It is a rejected row of the Outbound log, and its page says which address was refused. This is what keeps one application from sending, under this server's signature, as another domain or another application.<br><br>The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were refused with a temporary error in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message refused in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own.</p></div>
+          <div class="sp-help-topic" id="sender-check"><h3>Sender check</h3><p>An application sends only as itself, and that holds for every sender a message names. The envelope sender is held against the login by Postfix. The <code>From:</code> line, the one a mail program shows and the one DMARC holds the DKIM signature to, is held against it by the panel, under the same rule: an application set to any address of its domain may write any address of that domain, and one with a list of addresses only those. A message with any other <code>From:</code> - another of your domains, the server's own name, an address somewhere else, or none at all - is refused for good with <code>550 5.7.1</code>. The line must hold one address, read as a mail program reads it: what a display name around it says is not judged, and a line holding more than one address is refused. A <code>Sender:</code> line, which a mail program shows beside <code>From:</code> as "on behalf of", is held to the same rule when the message has one. A system that writes for people outside your domains writes its own address in <code>From:</code> with the person's name, and the person's address in <code>Reply-To:</code>: their domain in <code>From:</code> would fail DMARC at the receiver anyway. It is a rejected row of the Outbound log, and its page says which address was refused. This is what keeps one application from sending, under this server's signature, as another domain or another application.<br><br>The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were refused with a temporary error in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message refused in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own.</p></div>
           <div class="sp-help-topic" id="limits"><h3>Rate limits</h3><p>Level 1 is a per-IP ceiling set in <code>.env</code>. Level 2 is optional, per domain and per application, entered by hand or computed from the last 30 days of sending, and can never exceed level 1. An application's own limit replaces its domain's.</p></div>
-          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient, with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
+          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient (a message refused for its From: or Sender: line is one row, however many recipients it had), with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> or <code>Sender:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
-          <div class="sp-help-topic" id="queue"><h3>Queue and retries</h3><p>The page lists, as <code>postqueue -p</code> prints it, the messages Postfix has accepted and not yet delivered: mail being sent right now and mail deferred for a later attempt. Only the global role can open it, and it only shows; nothing here deletes or forces a message. A deferred message is tried again after the first retry delay, then at gaps that double up to a cap, until the receiving server takes it or the queue lifetime runs out and it bounces; there is no attempt counter, and the box on the page shows this server's values. A queue that keeps growing means a receiver is refusing or not answering: open the message from the Outbound log to read the reason Postfix logged.</p></div>
+          <div class="sp-help-topic" id="queue"><h3>Queue and retries</h3><p>The page lists the messages Postfix has accepted and not yet delivered, one row per recipient: mail being sent right now and mail deferred for a later attempt, with the last reply of the receiving server, or why no connection was made. Mail for an inbound domain waits under Inbound › Queue instead. Only the global role can open it, and it only shows; nothing here deletes or forces a message, and Details opens the message in the Outbound log. A deferred message is tried again after the first retry delay, then at gaps that double up to a cap, until the receiving server takes it or the queue lifetime runs out and it bounces; there is no attempt counter, and the box on the page shows this server's values. A queue that keeps growing means a receiver is refusing or not answering; the last reply says which.</p></div>
-          <div class="sp-help-topic" id="dmarc"><h3>DMARC reports</h3><p>An aggregate report is the summary a receiving provider sends, usually daily, to the <code>rua=</code> address of your DMARC record: which servers sent mail as your domain and whether SPF or DKIM passed for it. A domain's report address is one of three choices, set in its Domain settings: no reports (the default for a new domain), the SelfPost hosted address (an address on this server whose reports are parsed and shown under DMARC reports; offered only while hosted reports are enabled on the server), or an address typed for the domain (an ordinary mailbox that receives the raw XML; a button fills in your own profile e-mail). When the typed address is on another domain than the one sending, that domain must publish a report-authorization record, or providers will not send; the domain's page shows it with the other DNS records and checks it. In the tables pass means SPF or DKIM passed and aligned, fail means neither did, and your own server shows as <em>this relay</em>. A fail from any other source is someone else sending as your domain — a forwarder, an application you forgot, or abuse — so do not tighten <code>p=</code> until that sender is fixed or removed. A domain administrator reads the reports of their own domains.</p></div>
+          <div class="sp-help-topic" id="dmarc"><h3>DMARC reports</h3><p>An aggregate report is the summary a receiving provider sends, usually daily, to the <code>rua=</code> address of your DMARC record - its day is the reporter's, counted in UTC, and that is the day the lists and a report's title name, while the report's page gives its window in this panel's zone: which servers sent mail as your domain and whether SPF or DKIM passed for it. A domain's report address is one of three choices, set in its Domain settings: no reports (the default for a new domain), the SelfPost hosted address (an address on this server whose reports are parsed and shown under DMARC reports; offered only while hosted reports are enabled on the server), or an address typed for the domain (an ordinary mailbox that receives the raw XML; a button fills in your own profile e-mail). When the typed address is on another domain than the one sending, that domain must publish a report-authorization record, or providers will not send; the domain's page shows it with the other DNS records and checks it. In the tables pass means SPF or DKIM passed and aligned, fail means neither did, and your own server shows as <em>this relay</em>. A fail from any other source is someone else sending as your domain — a forwarder, an application you forgot, or abuse — so do not tighten <code>p=</code> until that sender is fixed or removed. A domain administrator reads the reports of their own domains.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">03</span><h2>Inbound</h2></div>
           <div class="sp-help-topic" id="inbound"><h3>Backup-MX and forwarding</h3><p>An optional backup-MX or forwarder, switched on in the server's <code>.env</code>; the Inbound menu exists only then. Postfix accepts mail on port 25 for the listed domains only and hands each message on to that domain's upstream; there are no mailboxes. For each domain publish the MX record its page shows, and keep a primary MX the domain already has if this is a backup. The MX tag is green when at least one MX of the domain points at this server, and a domain accepts no mail until an upstream is saved on its page. Adding and deleting domains is for the global role.</p></div>
-          <div class="sp-help-topic" id="upstream"><h3>Upstream</h3><p>The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear; Required sends only over TLS, and the mail waits in the queue while the upstream does not offer it or the TLS handshake fails - an upstream that answers STARTTLS with a permanent error bounces it; Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.</p></div>
+          <div class="sp-help-topic" id="upstream"><h3>Upstream</h3><p>The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear; Required sends only over TLS, and the mail waits in the queue while the upstream does not offer it or the TLS handshake fails - an upstream that answers STARTTLS with a permanent error bounces it. Neither checks the upstream's certificate: TLS here keeps the mail from whoever only listens on the way, not from one who answers in the upstream's place. Verified is Required with that check too: the upstream's certificate has to be issued by a trusted authority for the host given here, so the host is given by name, not by address, and the mail waits in the queue while the check fails - a certificate for another name, or one the upstream signed itself, included. Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.</p></div>
           <div class="sp-help-topic" id="recipients"><h3>Valid recipients</h3><p>Choose whom this domain accepts. Listed addresses only: the relay accepts exactly the addresses you list, one per line or comma-separated, and refuses any other while the sender is still connected, so it never has to send a bounce for them. Any recipient: everything at the domain is accepted and passed on, and an address the upstream then rejects comes back as a bounce from this server to a sender who is often forged — backscatter. Prefer a list, and keep it in step with the mailboxes upstream.</p></div>
           <div class="sp-help-topic" id="filter"><h3>Spam filter</h3><p>The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's <code>.env</code>, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or refused with a temporary error, so the sending server tries again later, as the server's setting says; the box states which.</p></div>
-          <div class="sp-help-topic" id="inbound-log"><h3>Inbound log</h3><p>One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: <span class="tag is-success is-light">accept</span> — handed on to the upstream; <span class="tag is-danger is-light">reject</span> — refused for good; <span class="tag is-warning is-light">tempfail</span> — the sender was asked to come back later; <span class="tag is-primary is-light">quarantine</span> — held by the filter. <em>Why</em> names who decided. <code>rspamd</code> is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; <code>postfix</code> is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; <code>selfpost</code> means nobody judged the message: it was relayed with no filter attached. Accept says what this server did, not what the upstream did with the message afterwards.<br><br>Accepted mail is recorded as it passes; refused mail is read from <code>mail.log</code>, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.</p></div>
+          <div class="sp-help-topic" id="inbound-log"><h3>Inbound log</h3><p>One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: <span class="tag is-success is-light">accept</span> — taken for the upstream; <span class="tag is-danger is-light">reject</span> — refused for good; <span class="tag is-warning is-light">tempfail</span> — the sender was asked to come back later; <span class="tag is-primary is-light">quarantine</span> — held by the filter. <em>Why</em> names who decided. <code>rspamd</code> is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; <code>postfix</code> is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; <code>selfpost</code> means nobody judged the message: it was relayed with no filter attached. <em>Upstream</em> says what became of an accepted message: <span class="tag is-light">queued</span> — not tried yet; <span class="tag is-primary is-light">held</span> — held in the queue by the filter, not tried until it is released; <span class="tag is-success is-light">sent</span> — the upstream took it; <span class="tag is-warning is-light">deferred</span> — the upstream put it off or could not be reached, and Postfix tries again; <span class="tag is-danger is-light">bounced</span> — the upstream refused it, or it waited in the queue too long, and the sender was sent a bounce, if it had a return address. It opens the last reply and the host that gave it. A refused message has no upstream result, and neither has a row logged before 2.10.0.<br><br>Accepted mail is recorded as it passes; refused mail is read from <code>mail.log</code>, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.</p></div>
+          <div class="sp-help-topic" id="inbound-queue"><h3>Inbound queue</h3><p>Mail accepted on port 25 and not yet taken by its upstream, one row per recipient, with the upstream's last reply or why it could not be reached. It is the same Postfix queue as Outbound › Queue, split by the recipient's domain, and retried the same way; an upstream that refuses or does not answer is what makes it grow. Only the global role can open it, and it only shows.</p></div>
           <div class="sp-help-topic" id="filter-lists"><h3>Filter lists</h3><p>Two lists for the whole server that correct the spam filter by hand. An entry is a sender address, a sender domain — that domain, not its subdomains — or a client address or network in CIDR form. A sender on the Deny list is refused outright. A sender on the Allow list is given a weight no spam score outweighs, so the filter lets it through. The sender's address is whatever the sending server says it is - anyone can claim to be a sender you allow - so allow a client address or network where you can, and a sender address only for mail you would rather receive forged than lose. When entries of both lists match one message, <strong>Deny wins</strong>.<br><br>SelfPost does not apply the lists itself: it writes them as files under <code>/data/antispam/</code>, and rspamd rereads a file within seconds of a change. With the spam filter off the lists are kept and can be edited, but nothing reads them. The sender matched is the envelope sender — the one in the log — not the From line a mail program shows. Matched counts the messages in the Inbound log that the entry decided, so it reaches back as far as the log does; never means not once in that time, and such an entry is one to consider removing.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Server</h2></div>
-          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10998 on the host (<code>chgrp 10998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
+          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. Both it and a domain's export ask for your account password - the one you sign in with - at every download, so a session left open is not enough to take them; a wrong one counts against the limit of a password change, ten in 15 minutes. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10997 on the host (<code>chgrp 10997</code>, <code>chmod 640</code>), a group only the panel is in, so Postfix's daemons cannot read it. Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
-          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out of their other sessions.</p></div>
+          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out everywhere; set for yourself, it keeps the session you set it from. Adding a user, changing a user's password, e-mail or role, and deleting a user ask for your own account password, as a backup does, with the same limit on wrong guesses.</p></div>
-          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
+          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. The time zone is the container's, <code>TZ</code> in <code>.env</code> (UTC when it is not set): every time the panel shows and every day it counts is that zone's, as are the stamps Postfix writes in <code>mail.log</code>, so the two always agree; changing it is a restart of the container. The one exception is the day a DMARC report covers, which is the reporter's, counted in UTC. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
-          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same limit. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish, and Server › Health shows whether they are in place. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
+          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same sending domain. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, an SPF record, <code>v=spf1 a -all</code>, and a DMARC record, <code>v=DMARC1; p=reject</code>, which has receivers refuse mail forged in the server's name - a false password-reset message among it; only the panel sends as this name, signed, so reject is safe. Server › Settings gives all three with the values to publish and whether they are in place, and its Re-check DNS checks them again once they are published; Server › Health shows them too. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains depends on none of them.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">05</span><h2>Account</h2></div>
-          <div class="sp-help-topic" id="account"><h3>Your account</h3><p>Account is your own, whatever your role: your username and e-mail, whether the panel sends you notifications, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected.</p></div>
+          <div class="sp-help-topic" id="account"><h3>Your account</h3><p>Account is your own, whatever your role: your username and e-mail, whether the panel sends you notifications, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected. A new e-mail is sent a link that confirms it, which works once, for 24 hours; changing the e-mail asks for your password. Notifications go to the address whether it is confirmed or not, but only a confirmed one can get a link to reset a forgotten password: <em>Forgot your password?</em> on the sign-in page sends it, for 30 minutes and once, and setting the new password signs every session of the account out. Without a confirmed e-mail the global administrator sets a new password under Users, and the only global administrator recovers from the container.</p></div>
         </div>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-domain-delete.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html" aria-current="page"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -94,7 +93,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-domain.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html" aria-current="page"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -70,7 +69,7 @@
       <div class="sp-grow">
         <p class="sp-kicker"><a href="in-domains.html">Inbound domains</a> /</p>
         <h1 class="title is-3">lists.example.org</h1>
-        <p class="sp-lead">Accepted on port 25, handed to <span class="sp-mono">mx.internal:25</span> over required TLS · 4 recipients</p>
+        <p class="sp-lead">Accepted on port 25, handed to <span class="sp-mono">mx.internal:25</span> over verified TLS · 4 recipients</p>
       </div>
       <div class="buttons">
         <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-refresh"></i>Re-check DNS</button></form>
@@ -101,8 +100,8 @@
       <div class="column is-9">
         <div class="box" id="dns">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>MX record</h2><div class="sp-end">Checked 1 min ago</div><a class="sp-help" href="help.html#inbound" title="Backup-MX and forwarding"><i class="ti ti-help-circle"></i></a></div>
-          <div class="sp-record">
+          <details class="sp-record">
-            <div class="sp-record-head"><h3>MX</h3><span class="tag is-success is-light">published</span><small>Keep any existing primary MX if this is a backup-MX</small></div>
+            <summary class="sp-record-head"><h3>MX</h3><span class="tag is-success is-light">published</span><small>Keep any existing primary MX if this is a backup-MX</small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="lists.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -110,7 +109,7 @@
             </div>
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="10 mail.example.org."></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-          </div>
+          </details>
         </div>
 
         <div class="columns">
@@ -124,7 +123,8 @@
                     <div class="field"><label class="label" for="port">Port</label><div class="control"><input class="input sp-mono" id="port" name="port" inputmode="numeric" value="25" required></div></div>
                   </div>
                   <div class="field"><label class="label" for="tls">TLS to upstream</label>
-                    <div class="control"><div class="select is-fullwidth"><select id="tls" name="tls_mode"><option>Opportunistic</option><option selected>Required</option><option>Off</option></select></div></div></div>
+                    <div class="control"><div class="select is-fullwidth"><select id="tls" name="tls_mode"><option>Opportunistic</option><option>Required</option><option selected>Verified</option><option>Off</option></select></div></div>
+                    <p class="help">Required encrypts the hop without checking who answers. Verified also checks the upstream's certificate: issued by a trusted authority for the host above, which is then given by name.</p></div>
                   <button type="submit" class="button is-primary">Save upstream</button>
                 </form>
               </div>
@@ -142,7 +142,7 @@
 dev@lists.example.org
 owner@lists.example.org
 security@lists.example.org</textarea></div>
-                    <p class="help">Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
+                    <p class="help">One per line or comma-separated. Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
                   <button type="submit" class="button is-primary">Save recipients</button>
                 </form>
               </div>
@@ -154,17 +154,16 @@ security@lists.example.org</textarea></div>
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Spam filter</h2><div class="sp-end"><span class="tag is-success is-light">on</span></div><a class="sp-help" href="help.html#filter" title="A server setting"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Engine</dt><dd>rspamd, for every inbound domain of this server</dd></div>
+              <div><dt>Applies to</dt><dd>Every inbound domain of this server</dd></div>
-              <div><dt>Suspicious mail</dt><dd>Held — <a href="in-quarantine.html">1 message in quarantine</a> for this domain</dd></div>
+              <div><dt>Filter</dt><dd class="sp-mono">inet:antispam:11332</dd></div>
-              <div><dt>Spam</dt><dd>Refused at the door; see <em>reject</em> in the <a href="in-log.html">log</a></dd></div>
+              <div><dt>If the filter is down</dt><dd>Mail is accepted unfiltered</dd></div>
-              <div><dt>Allow and deny lists</dt><dd class="sp-muted">Kept by the global administrator, one pair for the whole server</dd></div>
             </dl>
           </div>
         </div>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-domains.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html" aria-current="page"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -91,14 +90,14 @@
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
         <thead><tr><th>Domain</th><th>DNS</th><th>Upstream</th><th>Recipients</th><th>TLS to upstream</th><th></th></tr></thead>
         <tbody>
-          <tr><td><a href="in-domain.html"><strong>lists.example.org</strong></a></td><td><span class="tag is-success is-light">MX</span></td><td class="sp-mono sp-muted">mx.internal:25</td><td>4 addresses</td><td><span class="tag is-success is-light">required</span></td><td class="sp-actions"><a href="in-domain.html">Open</a><a class="has-text-danger" href="in-domain-delete.html">Delete</a></td></tr>
+          <tr><td><a href="in-domain.html"><strong>lists.example.org</strong></a></td><td><span class="tag is-success is-light">MX</span></td><td class="sp-mono sp-muted">mx.internal:25</td><td>4 addresses</td><td><span class="tag is-success is-light">verified</span></td><td class="sp-actions"><a href="in-domain.html">Open</a><a class="has-text-danger" href="in-domain-delete.html">Delete</a></td></tr>
           <tr><td><a href="in-domain.html"><strong>acme.io</strong></a></td><td><span class="tag is-success is-light">MX</span></td><td class="sp-mono sp-muted">10.0.4.12:2525</td><td>any address</td><td><span class="tag is-light">opportunistic</span></td><td class="sp-actions"><a href="in-domain.html">Open</a><a class="has-text-danger" href="in-domain-delete.html">Delete</a></td></tr>
         </tbody>
       </table></div>
       <div class="sp-box-foot">The MX tag is green when at least one MX of the domain points at this server.</div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-filter-lists.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html" aria-current="page"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -132,13 +131,13 @@
         <dl class="sp-facts">
           <div><dt>Applied by</dt><dd>rspamd, from map files it rereads within seconds of a change</dd></div>
           <div><dt>Files</dt><dd><span class="sp-mono">/data/antispam/</span> — six, one for each list and kind of entry</dd></div>
-          <div><dt>Last written</dt><dd>2026-09-11 08:40 UTC</dd></div>
+          <div><dt>Last written</dt><dd>2026-09-11 08:40</dd></div>
           <div><dt>When both lists match</dt><dd>Deny wins, whichever entries they are.</dd></div>
         </dl>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-log.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html" aria-current="page"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -69,7 +68,7 @@
       <div class="sp-grow">
         <p class="sp-kicker">Inbound</p>
         <h1 class="title is-3">Inbound log</h1>
-        <p class="sp-lead">What port 25 decided about each message, one row per recipient. Accepted mail is recorded as it passes, refused mail is read from <code>mail.log</code>; the filter's verdict appears when the spam filter is on. Rows older than 90 days are deleted — change that in <a href="settings.html">Settings</a>.</p>
+        <p class="sp-lead">What port 25 decided about each message and what the upstream answered, one row per recipient. Accepted mail is recorded as it passes, refused mail is read from <code>mail.log</code>; the filter's verdict appears when the spam filter is on. Rows older than 90 days are deleted — change that in <a href="settings.html">Settings</a>.</p>
       </div>
     </div>
 
@@ -86,20 +85,21 @@
         <a class="sp-help" href="help.html#inbound-log" title="What the decisions mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th>Upstream</th><th></th></tr></thead>
         <tbody>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:18</td><td>t.berg@<wbr>uni.example<br><span class="sp-mono sp-muted sp-small">192.0.2.77</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">Re: [dev] patch series v3</td><td><button type="button" class="tag is-success is-light" popovertarget="why-1">accept</button><div class="sp-sheet" id="why-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 0.40 / 15.00</td></tr><tr><th>Subject</th><td>Re: [dev] patch series v3</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:31</td><td>ci@<wbr>builds.example<br><span class="sp-mono sp-muted sp-small">192.0.2.90</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">[ci] nightly build passed</td><td><button type="button" class="tag is-success is-light" popovertarget="why-7">accept</button><div class="sp-sheet" id="why-7" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-7" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 1.10 / 15.00</td></tr><tr><th>Subject</th><td>[ci] nightly build passed</td></tr></tbody></table></div></div></div></div></td><td><span class="tag is-light">queued</span></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example<br><span class="sp-mono sp-muted sp-small">203.0.113.140</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip">Outstanding invoice — action required</td><td><button type="button" class="tag is-success is-light" popovertarget="why-2">accept</button><div class="sp-sheet" id="why-2" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-2" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>add header, score 9.80 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">PHISHING(5.00)<br>FORGED_SENDER(3.00)<br>R_SPF_FAIL(1.00)</td></tr><tr><th>Subject</th><td>Outstanding invoice — action required</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:18</td><td>t.berg@<wbr>uni.example<br><span class="sp-mono sp-muted sp-small">192.0.2.77</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">Re: [dev] patch series v3</td><td><button type="button" class="tag is-success is-light" popovertarget="why-1">accept</button><div class="sp-sheet" id="why-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 0.40 / 15.00</td></tr><tr><th>Subject</th><td>Re: [dev] patch series v3</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-success is-light" popovertarget="up-1">sent</button><div class="sp-sheet" id="up-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">sent</span><h2>Upstream</h2><button type="button" popovertarget="up-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Host</th><td class="sp-mono sp-small">mx.upstream.example[198.51.100.5]:25</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">250 2.0.0 Ok: queued as CE05D10261D</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 14:00:19</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:57:41</td><td>promo@<wbr>bulk.example<br><span class="sp-mono sp-muted sp-small">198.51.100.90</span></td><td>sales@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-3">reject</button><div class="sp-sheet" id="why-3" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-3" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>postfix</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">550 5.1.1 &lt;sales@lists.example.org&gt;: Recipient address rejected: User unknown in relay recipient table</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example<br><span class="sp-mono sp-muted sp-small">203.0.113.140</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip">Outstanding invoice — action required</td><td><button type="button" class="tag is-success is-light" popovertarget="why-2">accept</button><div class="sp-sheet" id="why-2" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-2" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>add header, score 9.80 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">PHISHING(5.00)<br>FORGED_SENDER(3.00)<br>R_SPF_FAIL(1.00)</td></tr><tr><th>Subject</th><td>Outstanding invoice — action required</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-danger is-light" popovertarget="up-2">bounced</button><div class="sp-sheet" id="up-2" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">bounced</span><h2>Upstream</h2><button type="button" popovertarget="up-2" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Host</th><td class="sp-mono sp-small">mx.upstream.example[198.51.100.5]:25</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">550 5.7.1 Message rejected as spam by the upstream filter</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 13:59:04</td></tr><tr><th>Then</th><td>The sender was sent a bounce</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:51:30</td><td>billing@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">198.51.100.12</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-4">reject</button><div class="sp-sheet" id="why-4" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-4" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">5.7.1 Spam message rejected</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:57:41</td><td>promo@<wbr>bulk.example<br><span class="sp-mono sp-muted sp-small">198.51.100.90</span></td><td>sales@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-3">reject</button><div class="sp-sheet" id="why-3" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-3" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>postfix</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">550 5.1.1 &lt;sales@lists.example.org&gt;: Recipient address rejected: User unknown in relay recipient table</td></tr></tbody></table></div></div></div></div></td><td class="sp-muted">—</td><td class="sp-actions"></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:44:02</td><td>hr@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">192.0.2.31</span></td><td>jobs@<wbr>acme.io</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-warning is-light" popovertarget="why-5">tempfail</button><div class="sp-sheet" id="why-5" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-warning is-light">tempfail</span><h2>Why</h2><button type="button" popovertarget="why-5" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">4.7.1 Try again later</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:51:30</td><td>billing@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">198.51.100.12</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-4">reject</button><div class="sp-sheet" id="why-4" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-4" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">5.7.1 Spam message rejected</td></tr></tbody></table></div></div></div></div></td><td class="sp-muted">—</td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:30:55</td><td>noreply@<wbr>github.example<br><span class="sp-mono sp-muted sp-small">192.0.2.200</span></td><td>security@<wbr>lists.example.org</td><td class="sp-clip">[advisory] new report</td><td><button type="button" class="tag is-success is-light" popovertarget="why-6">accept</button><div class="sp-sheet" id="why-6" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-6" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score -98.10 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">SELFPOST_ALLOW_FROM(-100.00)<br>R_DKIM_ALLOW(-0.20)</td></tr><tr><th>Subject</th><td>[advisory] new report</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:44:02</td><td>hr@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">192.0.2.31</span></td><td>jobs@<wbr>acme.io</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-warning is-light" popovertarget="why-5">tempfail</button><div class="sp-sheet" id="why-5" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-warning is-light">tempfail</span><h2>Why</h2><button type="button" popovertarget="why-5" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">4.7.1 Try again later</td></tr></tbody></table></div></div></div></div></td><td class="sp-muted">—</td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:30:55</td><td>noreply@<wbr>github.example<br><span class="sp-mono sp-muted sp-small">192.0.2.200</span></td><td>security@<wbr>lists.example.org</td><td class="sp-clip">[advisory] new report</td><td><button type="button" class="tag is-success is-light" popovertarget="why-6">accept</button><div class="sp-sheet" id="why-6" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-6" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score -98.10 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">SELFPOST_ALLOW_FROM(-100.00)<br>R_DKIM_ALLOW(-0.20)</td></tr><tr><th>Subject</th><td>[advisory] new report</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-warning is-light" popovertarget="up-6">deferred</button><div class="sp-sheet" id="up-6" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-warning is-light">deferred</span><h2>Upstream</h2><button type="button" popovertarget="up-6" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Reply</th><td class="sp-mono sp-small">connect to mx.upstream.example[198.51.100.5]:25: Connection refused</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 13:45:12</td></tr><tr><th>Then</th><td>Postfix tries again; the message is in the queue</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
         </tbody>
       </table></div>
-      <div class="sp-box-foot"><span>Page 1 of 38</span><a href="#">Older →</a><span class="sp-end">A decision opens its reason · Allow / Deny sender opens <a href="in-filter-lists.html">Filter lists</a> with the entry filled in</span></div>
+      <div class="sp-box-foot"><span>Page 1 of 38</span><a href="#">Older →</a><span class="sp-end">A decision opens its reason, an upstream result its last reply · Allow / Deny sender opens <a href="in-filter-lists.html">Filter lists</a> with the entry filled in</span></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-quarantine-message.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html" aria-current="page"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -81,7 +80,7 @@
             <dl class="sp-facts">
               <div><dt>Inbound domain</dt><dd><a href="in-domain.html">lists.example.org</a></dd></div>
               <div><dt>Client</dt><dd class="sp-mono">203.0.113.140</dd></div>
-              <div><dt>Held</dt><dd>2026-09-21 13:59:02 UTC</dd></div>
+              <div><dt>Held</dt><dd>2026-09-21 13:59:02</dd></div>
               <div><dt>Deleted on</dt><dd>2026-10-05 · in 14 days</dd></div>
               <div><dt>Size</dt><dd>48 kB · 1 attachment (<span class="sp-mono">invoice.html</span>)</dd></div>
               <div><dt>Would go to</dt><dd class="sp-mono">mx.internal:25</dd></div>
@@ -106,13 +105,14 @@
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">03</span><h2>Headers</h2><div class="sp-end">The body and attachments are never rendered in the panel</div></div>
-<pre class="sp-log"><span class="sp-d">Received:</span> from mail.partner-billing.example (unknown [203.0.113.140]) by mail.example.org
+<pre class="sp-log"><span class="sp-ll"><span class="sp-d">Received:</span> from mail.partner-billing.example (unknown [203.0.113.140]) by mail.example.org
-<span class="sp-d">From:</span> "Partner Billing" &lt;invoice@partner-billing.example&gt;
+</span><span class="sp-ll"><span class="sp-d">From:</span> "Partner Billing" &lt;invoice@partner-billing.example&gt;
-<span class="sp-d">Reply-To:</span> <span class="sp-w">payments.dept@freemail.example</span>
+</span><span class="sp-ll"><span class="sp-d">Reply-To:</span> <span class="sp-w">payments.dept@freemail.example</span>
-<span class="sp-d">To:</span> owner@lists.example.org
+</span><span class="sp-ll"><span class="sp-d">To:</span> owner@lists.example.org
-<span class="sp-d">Subject:</span> Outstanding invoice — action required
+</span><span class="sp-ll"><span class="sp-d">Subject:</span> Outstanding invoice — action required
-<span class="sp-d">Date:</span> Mon, 21 Sep 2026 13:58:57 +0000
+</span><span class="sp-ll"><span class="sp-d">Date:</span> Mon, 21 Sep 2026 13:58:57 +0000
-<span class="sp-d">Authentication-Results:</span> <span class="sp-e">spf=fail dkim=none dmarc=fail</span></pre>
+</span><span class="sp-ll"><span class="sp-d">Authentication-Results:</span> <span class="sp-e">spf=fail dkim=none dmarc=fail</span>
+</span></pre>
     </div>
 
     <div class="columns">
@@ -142,7 +142,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-quarantine.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html" aria-current="page"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -82,7 +81,7 @@
         </form>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Held, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
+        <thead><tr><th>Held</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example</td><td>owner@<wbr>lists.example.org</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Outstanding invoice — action required</strong></a></td><td class="sp-muted sp-small">score 9.8 · PHISHING</td><td class="sp-muted sp-nowrap">48 kB</td><td class="sp-nowrap">14 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-20 22:14:40</td><td>no-reply@<wbr>shipping-update.example</td><td>jobs@<wbr>acme.io</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Your parcel could not be delivered</strong></a></td><td class="sp-muted sp-small">score 8.1 · URL_SHORTENER</td><td class="sp-muted sp-nowrap">12 kB</td><td class="sp-nowrap">13 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>
@@ -92,7 +91,7 @@
       <div class="sp-box-foot"><span>3 messages · 3.0 MB of 500 MB</span><span class="sp-end">A domain administrator sees only their assigned inbound domains</span></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-queue.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html" aria-current="page"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -74,7 +73,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes every 10 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes on its own</div><a class="sp-help" href="help.html#inbound-queue" title="What waits here and why"><i class="ti ti-help-circle"></i></a></div>
       <div class="sp-empty"><i class="ti ti-stack-2"></i>Nothing is waiting. Every accepted message has reached its upstream.</div>
     </div>
 
@@ -90,7 +89,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/login-no-admin.html

@@ -23,7 +23,7 @@
       <h1 class="title is-3">No administrator yet</h1>
       <p class="sp-muted">Open the one-time setup link printed in the container log to create one.</p>
     </div>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>
 

docs/assets/panel-redesign/panel/login-reset-sent.html

@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="light">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Sign in · SelfPost</title>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
+<link rel="stylesheet" href="../shared/brand.css">
+<link rel="stylesheet" href="theme.css">
+</head>
+<body>
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="overview.html">
+      <p class="sp-kicker">mail.example.org</p>
+      <h1 class="title is-3">Sign in</h1>
+      <div class="notification is-success is-light"><i class="ti ti-circle-check"></i>If that account has a confirmed e-mail, the link is on its way. It works once, for 30 minutes.</div>
+      <div class="field">
+        <label class="label" for="username">Username</label>
+        <div class="control has-icons-left"><input class="input" id="username" name="username" autocomplete="username" required><span class="icon is-left"><i class="ti ti-user"></i></span></div>
+      </div>
+      <div class="field">
+        <label class="label" for="password">Password</label>
+        <div class="control has-icons-left"><input class="input" id="password" name="password" type="password" autocomplete="current-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
+      </div>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Sign in</button></div>
+      <p class="mt-4"><a href="login-reset.html">Forgot your password?</a></p>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>
+
+</body>
+</html>

docs/assets/panel-redesign/panel/login-reset-set.html

@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="light">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>New password · SelfPost</title>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
+<link rel="stylesheet" href="../shared/brand.css">
+<link rel="stylesheet" href="theme.css">
+</head>
+<body>
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="login.html">
+      <p class="sp-kicker">mail.example.org · admin</p>
+      <h1 class="title is-3">New password</h1>
+      <p class="sp-muted mb-4">Setting it signs every session of this account out; sign in with it afterwards.</p>
+      <div class="field">
+        <label class="label" for="new_password">New password</label>
+        <div class="control has-icons-left"><input class="input" id="new_password" name="new_password" type="password" autocomplete="new-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
+      </div>
+      <div class="field">
+        <label class="label" for="new_password_confirm">Repeat</label>
+        <div class="control has-icons-left"><input class="input" id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
+      </div>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Set password</button></div>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>
+
+</body>
+</html>

docs/assets/panel-redesign/panel/login-reset.html

@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="light">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Reset password · SelfPost</title>
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
+<link rel="stylesheet" href="../shared/brand.css">
+<link rel="stylesheet" href="theme.css">
+</head>
+<body>
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="login-reset-sent.html">
+      <p class="sp-kicker">mail.example.org</p>
+      <h1 class="title is-3">Reset password</h1>
+      <p class="sp-muted mb-4">A link to set a new password goes to the e-mail of the account, once that address is confirmed under Account. It works once, for 30 minutes.</p>
+      <div class="field">
+        <label class="label" for="username">Username</label>
+        <div class="control has-icons-left"><input class="input" id="username" name="username" autocomplete="username" required><span class="icon is-left"><i class="ti ti-user"></i></span></div>
+      </div>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Send the link</button></div>
+      <p class="mt-4"><a href="login.html">Back to sign in</a></p>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>
+
+</body>
+</html>

docs/assets/panel-redesign/panel/login.html

@@ -30,8 +30,9 @@
         <div class="control has-icons-left"><input class="input" id="password" name="password" type="password" autocomplete="current-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
       </div>
       <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Sign in</button></div>
+      <p class="mt-4"><a href="login-reset.html">Forgot your password?</a></p>
     </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>
 

docs/assets/panel-redesign/panel/out-app-created.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html" aria-current="page"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -100,7 +99,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-app.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html" aria-current="page"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -69,7 +68,7 @@
       <div class="sp-grow">
         <p class="sp-kicker"><a href="out-domains.html">Outbound domains</a> / <a href="out-domain.html">example.org</a> / Applications /</p>
         <h1 class="title is-3 sp-mono">prod-server</h1>
-        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h. The same form, empty, adds a new application.</p>
+        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h.</p>
       </div>
       <div class="buttons">
         <a class="button" href="out-app-created.html"><i class="ti ti-key"></i>New password</a>
@@ -85,7 +84,7 @@
             <div class="sp-box-body">
               <div class="field"><label class="label" for="login">Login</label>
                 <div class="control"><input class="input sp-mono" id="login" name="login" value="prod-server" autocomplete="off" spellcheck="false" required></div>
-                <p class="help">Unique across domains; letters, digits, <code>.</code> <code>-</code> <code>_</code>.</p></div>
+                <p class="help">Fixed: add a new application to use another login.</p></div>
               <div class="field"><label class="label" for="amode">May send as</label>
                 <div class="control"><div class="select is-fullwidth"><select id="amode" name="mode"><option selected>Any address of the domain</option><option>Specific addresses (list)</option></select></div></div></div>
               <div class="field"><label class="label" for="addresses">Addresses</label>
@@ -129,7 +128,7 @@
       </div>
     </form>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domain-delete.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html" aria-current="page"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -81,6 +80,7 @@
             <ul class="sp-list-check">
               <li><i class="ti ti-x"></i>permanently delete its DKIM signing key;</li>
               <li><i class="ti ti-x"></i>delete <strong>both applications</strong> (<span class="sp-mono">prod-server</span>, <span class="sp-mono">alerts</span>) with their credentials and sender bindings;</li>
+              <li><i class="ti ti-x"></i>delete the <strong>12 DMARC reports</strong> received for it;</li>
               <li><i class="ti ti-x"></i>stop signing mail as the domain.</li>
             </ul>
             <p class="sp-muted mb-4">The published DKIM record becomes invalid — remove it from DNS unless you plan to re-add the domain. Inbound domains are not touched.</p>
@@ -103,7 +103,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domain-settings.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html" aria-current="page"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -104,6 +103,8 @@
                 <div class="field"><label class="label" for="encpw2">Repeat password</label><div class="control"><input class="input" id="encpw2" type="password"></div></div>
               </div>
               <p class="help mb-3">Keep this password: SelfPost does not store it, and the file cannot be opened without it.</p>
+              <div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password" required></div>
+                <p class="help">The one you sign in with, asked at every export: the file holds the domain's DKIM key and its applications' credentials.</p></div>
               <button type="submit" class="button"><i class="ti ti-download"></i>Export domain</button>
             </form>
           </div>
@@ -117,9 +118,9 @@
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="mode">Limit mode</label>
                 <div class="control"><div class="select is-fullwidth"><select id="mode" name="mode"><option>Manual</option><option selected>Auto (from statistics)</option></select></div></div></div>
-              <div class="field"><label class="label" for="mult">Multiplier (1.5–10, default 3)</label>
+              <div class="field"><label class="label" for="mult">Multiplier (1.5–5, default 2.5)</label>
                 <div class="control"><input class="input" id="mult" name="auto_multiplier" type="number" min="1.5" max="10" step="0.1" value="3"></div>
-                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00 UTC.</p></div>
+                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00.</p></div>
               <div class="buttons">
                 <button type="submit" class="button is-primary">Save limit</button>
                 <button type="submit" class="button" formaction="#recalc">Recalculate now</button>
@@ -140,7 +141,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domain.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html" aria-current="page"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -106,8 +105,8 @@
         <div class="box" id="dns">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>DNS records</h2><div class="sp-end">Checked 3 min ago</div><a class="sp-help" href="help.html#dns" title="What to publish and why"><i class="ti ti-help-circle"></i></a></div>
 
-          <div class="sp-record">
+          <details class="sp-record">
-            <div class="sp-record-head"><h3>DKIM</h3><span class="tag is-success is-light">published</span><small>Not a secret · selector <code>sp2026</code></small></div>
+            <summary class="sp-record-head"><h3>DKIM</h3><span class="tag is-success is-light">published</span><small>Not a secret · selector <code>sp2026</code></small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="sp2026._domainkey.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -115,7 +114,7 @@
             </div>
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><textarea class="textarea" rows="3" readonly>v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx3kqV0mJd8e2f1Yb7Qw5uT9sLr4nHc6pZaXo1vKe0yWm2gBt8RjN5dCq3hUf7lPs9aEi4oMz6xTb1kGv0nYw…IDAQAB</textarea></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-          </div>
+          </details>
 
           <div class="sp-record">
             <div class="sp-record-head"><h3>SPF</h3><span class="tag is-danger is-light">mismatch</span><small>Merge into the existing record — never publish a second one</small></div>
@@ -131,8 +130,8 @@
               <p class="help is-danger">The published record does not authorize 203.0.113.25. Add <code>ip4:203.0.113.25</code> before <code>~all</code>. Shallow check: <code>include:</code> is not followed.</p></div>
           </div>
 
-          <div class="sp-record">
+          <details class="sp-record">
-            <div class="sp-record-head"><h3>DMARC</h3><span class="tag is-success is-light">published</span><small>Report address: <a href="out-domain-settings.html">example.org@dmarc.mail.example.org</a></small></div>
+            <summary class="sp-record-head"><h3>DMARC</h3><span class="tag is-success is-light">published</span><small>Report address: <a href="out-domain-settings.html">example.org@dmarc.mail.example.org</a></small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="_dmarc.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -141,7 +140,7 @@
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=DMARC1; p=none; rua=mailto:example.org@dmarc.mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div>
               <p class="help"><code>p=none</code> does not affect delivery. Tighten to <code>quarantine</code>, then <code>reject</code>, once the <a href="dmarc-domain.html">reports</a> look clean.</p></div>
-          </div>
+          </details>
         </div>
 
         <div class="box" id="apps">
@@ -172,7 +171,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domains.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html" aria-current="page"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -100,7 +99,7 @@
       <div class="sp-box-foot">Each tag is one check. Green — published and correct; amber — published but weak; red — missing or wrong.</div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-log.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html" aria-current="page"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -87,7 +86,7 @@
         <a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td>shop@<wbr>shop.example.org</td><td>m.keller@<wbr>gmx.de</td><td class="sp-clip">Your order #48213 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:50</td><td>shop@<wbr>shop.example.org</td><td>anna.lind@<wbr>outlook.com</td><td class="sp-clip">Your order #48212 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
@@ -101,7 +100,7 @@
       <div class="sp-box-foot"><span>Page 1 of 412</span><a href="#">Older →</a><span class="sp-end">New rows appear on their own</span></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-message.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html" aria-current="page"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -81,8 +80,8 @@
             <dl class="sp-facts">
               <div><dt>Domain</dt><dd><a href="out-domain.html">example.org</a></dd></div>
               <div><dt>Application</dt><dd class="sp-mono"><a href="out-app.html">alerts</a></dd></div>
-              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07 UTC</dd></div>
+              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07</dd></div>
-              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09 UTC</dd></div>
+              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09</dd></div>
               <div><dt>Queue id</dt><dd class="sp-mono">4XcB7k2Jm9z1</dd></div>
               <div><dt>Journal id</dt><dd class="sp-mono">184220</dd></div>
             </dl>
@@ -94,9 +93,9 @@
           <div class="sp-box-head"><span class="sp-no">02</span><h2>History</h2><a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Accepted</strong> from <span class="sp-mono">alerts</span> at 198.51.100.7</li>
+              <li><time>2026-09-21 13:58:07</time><strong>Accepted and queued</strong> — Postfix accepted the message over an authenticated submission and the journal-milter recorded it.</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — the receiving server asked to retry later</li>
+              <li class="sp-warn"><time>2026-09-21 13:58:09</time><strong>Deferred, will be retried</strong> — the receiving server could not take the message yet. Postfix retries: first after 5 minutes, then with increasing gaps up to 1 hour 7 minutes, for up to 5 days.</li>
-              <li class="sp-pending"><time>next attempt ≈ 14:08 UTC</time>Still in the <a href="out-queue.html">queue</a>; kept for 5 days, then bounced</li>
+              <li class="sp-pending"><time>not yet</time>Still in the queue; the next attempt is Postfix's own, and after 5 days it is bounced.</li>
             </ol>
           </div>
         </div>
@@ -105,13 +104,14 @@
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">03</span><h2>Delivery log</h2><div class="sp-end">Lines from <code>mail.log</code> with this queue id</div></div>
-<pre class="sp-log"><span class="sp-d">13:58:07</span> postfix/smtpd[2114]: 4XcB7k2Jm9z1: client=unknown[198.51.100.7], sasl_username=alerts
+<pre class="sp-log"><span class="sp-ll"><span class="sp-d">13:58:07</span> postfix/smtpd[2114]: 4XcB7k2Jm9z1: client=unknown[198.51.100.7], sasl_username=alerts
-<span class="sp-d">13:58:07</span> postfix/cleanup[2120]: 4XcB7k2Jm9z1: message-id=&lt;a81f0c@alertmanager&gt;
+</span><span class="sp-ll"><span class="sp-d">13:58:07</span> postfix/cleanup[2120]: 4XcB7k2Jm9z1: message-id=&lt;a81f0c@alertmanager&gt;
-<span class="sp-d">13:58:07</span> postfix/qmgr[2061]: 4XcB7k2Jm9z1: from=&lt;alerts@example.org&gt;, size=2214, nrcpt=1 (queue active)
+</span><span class="sp-ll"><span class="sp-d">13:58:07</span> postfix/qmgr[2061]: 4XcB7k2Jm9z1: from=&lt;alerts@example.org&gt;, size=2214, nrcpt=1 (queue active)
-<span class="sp-d">13:58:09</span> <span class="sp-w">postfix/smtp[2123]: 4XcB7k2Jm9z1: to=&lt;noc@example.org&gt;, relay=mx1.example.org[192.0.2.10]:25, delay=1.9, status=deferred (host mx1.example.org said: 451 4.7.1 Greylisted, try again in 5 minutes)</span></pre>
+</span><span class="sp-ll"><span class="sp-d">13:58:09</span> <span class="sp-w">postfix/smtp[2123]: 4XcB7k2Jm9z1: to=&lt;noc@example.org&gt;, relay=mx1.example.org[192.0.2.10]:25, delay=1.9, status=deferred (host mx1.example.org said: 451 4.7.1 Greylisted, try again in 5 minutes)</span>
+</span></pre>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-queue.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html" aria-current="page"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -69,14 +68,14 @@
       <div class="sp-grow">
         <p class="sp-kicker">Outbound</p>
         <h1 class="title is-3">Outbound queue</h1>
-        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes every 10 s.</p>
+        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes on its own.</p>
       </div>
     </div>
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">1 message · 3.1 kB</div><a class="sp-help" href="help.html#queue" title="What waits here and how Postfix retries"><i class="ti ti-help-circle"></i></a></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Queue id</th><th>Arrived, UTC</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
+        <thead><tr><th>Queue id</th><th>Arrived</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono">4XcB7k2Jm9z1</td><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:58:07</td><td>alerts@<wbr>example.org</td><td>noc@<wbr>example.org</td><td class="sp-muted">451 4.7.1 Greylisted, try again in 5 minutes</td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
         </tbody>
@@ -95,7 +94,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/outlines.json

@@ -90,7 +90,8 @@
       "box[Milter sockets]:table",
       "box[TLS certificate]:body",
       "box[Notification mail]:table+body",
-      "box[Configuration]:body"
+      "box[Configuration]:body",
+      "box[Test message]:body"
      ]
     }
    ]
@@ -107,9 +108,9 @@
     },
     {
      "is-9": [
-      "box[Overview]:help×3",
+      "box[Overview]:help×4",
       "box[Outbound]:help×7",
-      "box[Inbound]:help×6",
+      "box[Inbound]:help×7",
       "box[Server]:help×4",
       "box[Account]:help"
      ]
@@ -379,32 +380,28 @@
    ]
   }
  ],
- "preflight": [
-  "head+postmark+actions",
-  "box[Checks]:table",
-  "box[Send a test e-mail]:body"
- ],
  "settings": [
-  "head",
+  "head+actions",
   {
-   "form": [
+   "columns": [
     {
-     "columns": [
+     "is-6": [
       {
-       "is-6": [
+       "form": [
         "box[Log retention]:body",
-        "box[Sending rate limits]:body"
-       ]
-      },
-      {
-       "is-6": [
         "box[Notifications]:body",
-        "box[Notification mail]:record×2"
+        "submit_row"
        ]
       }
      ]
     },
-    "submit_row"
+    {
+     "is-6": [
+      "box[Notification mail]:record×3",
+      "box[Sending rate limits]:body",
+      "box[Time zone]:body"
+     ]
+    }
    ]
   }
  ],

docs/assets/panel-redesign/panel/overview.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html" aria-current="page">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item sp-current" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -70,9 +69,9 @@
       <div class="sp-grow">
         <p class="sp-kicker">mail.example.org</p>
         <h1 class="title is-3">Mail is flowing. One thing needs attention.</h1>
-        <p class="sp-lead">The TLS certificate expires in 12 days and has not renewed yet.</p>
+        <p class="sp-lead"><a href="health.html">TLS certificate</a>: expires in 12 days.</p>
       </div>
-      <div class="sp-muted sp-small">Updated 14:02:31 UTC<br>refreshes every 10 s</div>
+      <div class="sp-muted sp-small">Updated 14:02:31<br>refreshes on its own</div>
     </div>
 
     <div class="box">
@@ -82,7 +81,7 @@
         <a href="health.html"><span class="sp-h-icon"><i class="ti ti-server-cog"></i></span><span><span class="sp-h-name">Processes</span><span class="sp-h-value">5 of 5 running</span><span class="sp-h-sub">up 18 days</span></span></a>
         <a href="health.html" class="sp-warn"><span class="sp-h-icon"><i class="ti ti-certificate"></i></span><span><span class="sp-h-name">TLS certificate</span><span class="sp-h-value">Expires in 12 days</span><span class="sp-h-sub">renewal has not run</span></span></a>
         <a href="out-queue.html"><span class="sp-h-icon"><i class="ti ti-stack-2"></i></span><span><span class="sp-h-name">Queues</span><span class="sp-h-value">Both empty</span><span class="sp-h-sub">outbound and inbound</span></span></a>
-        <a href="health.html"><span class="sp-h-icon"><i class="ti ti-plug-connected"></i></span><span><span class="sp-h-name">Milter sockets</span><span class="sp-h-value">5 of 5 answering</span><span class="sp-h-sub">incl. the spam filter</span></span></a>
+        <a href="health.html"><span class="sp-h-icon"><i class="ti ti-plug-connected"></i></span><span><span class="sp-h-name">Milter sockets</span><span class="sp-h-value">6 of 6 answering</span><span class="sp-h-sub">incl. the spam filter</span></span></a>
         <a href="health.html"><span class="sp-h-icon"><i class="ti ti-arrows-exchange"></i></span><span><span class="sp-h-name">Reverse DNS</span><span class="sp-h-value">Forward = reverse</span><span class="sp-h-sub">203.0.113.25</span></span></a>
       </div>
     </div>
@@ -115,7 +114,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/preflight.html

@@ -1,124 +0,0 @@
-<!DOCTYPE html>
-<html lang="en" data-theme="light">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Preflight · SelfPost</title>
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
-<link rel="stylesheet" href="../shared/brand.css">
-<link rel="stylesheet" href="theme.css">
-</head>
-<body>
-<nav class="navbar is-primary" aria-label="main navigation">
-  <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
-      <div class="navbar-start">
-        <a class="navbar-item" href="overview.html">Overview</a>
-        <div class="navbar-item has-dropdown is-hoverable">
-          <a class="navbar-link" href="out-domains.html">Outbound</a>
-          <div class="navbar-dropdown">
-            <a class="navbar-item" href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a>
-            <a class="navbar-item" href="out-log.html"><i class="ti ti-list-details"></i>Log</a>
-            <a class="navbar-item" href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a>
-            <a class="navbar-item" href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a>
-          </div>
-        </div>
-        <div class="navbar-item has-dropdown is-hoverable">
-          <a class="navbar-link" href="in-domains.html">Inbound</a>
-          <div class="navbar-dropdown">
-            <a class="navbar-item" href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a>
-            <a class="navbar-item" href="in-log.html"><i class="ti ti-list-details"></i>Log</a>
-            <a class="navbar-item" href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a>
-            <a class="navbar-item" href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a>
-            <a class="navbar-item" href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a>
-          </div>
-        </div>
-        <div class="navbar-item has-dropdown is-hoverable sp-current">
-          <a class="navbar-link" href="health.html">Server</a>
-          <div class="navbar-dropdown">
-            <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item is-active" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
-            <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
-            <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
-            <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
-            <a class="navbar-item" href="settings.html"><i class="ti ti-settings"></i>Settings</a>
-          </div>
-        </div>
-      </div>
-      <div class="navbar-end">
-        <div class="navbar-item has-dropdown is-hoverable">
-          <a class="navbar-link" href="account.html"><i class="ti ti-user-circle"></i>admin</a>
-          <div class="navbar-dropdown is-right">
-            <a class="navbar-item" href="account.html"><i class="ti ti-key"></i>Account</a>
-            <a class="navbar-item" href="help.html"><i class="ti ti-help"></i>Help</a>
-            <hr class="navbar-divider">
-            <form method="post" action="login.html"><button type="submit" class="navbar-item"><i class="ti ti-logout"></i>Sign out</button></form>
-          </div>
-        </div>
-      </div>
-    </div>
-  </div>
-</nav>
-<div class="sp-perf" aria-hidden="true"></div>
-<div class="sp-subnav"><div class="container"><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html" aria-current="page"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></div></div>
-<main>
-  <div class="container sp-page">
-<div class="sp-head">
-      <div class="sp-postmark sp-warn"><span>PREFLIGHT</span><b>WARN</b><span>1 OF 7 CHECKS</span></div>
-      <div class="sp-grow">
-        <p class="sp-kicker">Server</p>
-        <h1 class="title is-3">Preflight</h1>
-        <p class="sp-lead">Is this installation ready to deliver mail? Run it after the first start, after moving the server, or when receivers start refusing you. Health watches what runs; Preflight checks what the outside world sees.</p>
-      </div>
-      <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-refresh"></i>Run again</button></form>
-    </div>
-
-    <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Checks</h2><div class="sp-end">Ran 14:02 UTC · 3.1 s</div></div>
-      <div class="table-container"><table class="table is-fullwidth">
-        <thead><tr><th>Check</th><th>Result</th><th>Found</th><th>What to do</th></tr></thead>
-        <tbody>
-          <tr><td class="sp-nowrap"><strong>Reverse DNS</strong></td><td><span class="tag is-success is-light">ok</span></td><td class="sp-mono sp-small">203.0.113.25 ⇄ mail.example.org</td><td class="sp-muted">—</td></tr>
-          <tr><td class="sp-nowrap"><strong>TLS certificate</strong></td><td><span class="tag is-warning is-light">warn</span></td><td class="sp-small">Valid for <span class="sp-mono">mail.example.org</span>, expires in 12 days</td><td>Renewal has not run. Check that port 80 reaches the ACME client and look for <code>acme</code> in the <a href="system-log.html">system log</a>.</td></tr>
-          <tr><td class="sp-nowrap"><strong>Port 25</strong></td><td><span class="tag is-success is-light">ok</span></td><td class="sp-mono sp-small">220 mail.example.org ESMTP</td><td class="sp-muted">—</td></tr>
-          <tr><td class="sp-nowrap"><strong>Ports 465, 587</strong></td><td><span class="tag is-success is-light">ok</span></td><td class="sp-mono sp-small">TLS handshake, 220 banner on both</td><td class="sp-muted">—</td></tr>
-          <tr><td class="sp-nowrap"><strong>HELO name</strong></td><td><span class="tag is-success is-light">ok</span></td><td class="sp-mono sp-small">mail.example.org</td><td class="sp-muted">—</td></tr>
-          <tr><td class="sp-nowrap"><strong>Proxy headers</strong></td><td><span class="tag is-success is-light">ok</span></td><td class="sp-small">Peer <span class="sp-mono">172.18.0.2</span> is trusted; <span class="sp-mono">X-Forwarded-Proto: https</span></td><td class="sp-muted">—</td></tr>
-          <tr><td class="sp-nowrap"><strong>DKIM signing</strong></td><td><span class="tag is-success is-light">ok</span></td><td class="sp-mono sp-small">inet:127.0.0.1:8891 answers</td><td class="sp-muted">—</td></tr>
-        </tbody>
-      </table></div>
-      <div class="sp-box-foot"><span>Ports are dialled from inside the container at the public address; a firewall that treats inside and outside differently can make this pass while the world is still blocked. SPF, DKIM and DMARC are per domain — each <a href=\"out-domains.html\">outbound domain</a> shows its own.</span></div>
-    </div>
-
-    <div class="box">
-      <div class="sp-box-head"><span class="sp-no">02</span><h2>Send a test e-mail</h2><div class="sp-end">Confirms the relay accepted it, not that it arrived</div></div>
-      <div class="sp-box-body">
-        <div class="columns">
-          <div class="column is-6">
-            <form class="sp-form" method="post" action="#">
-              <div class="field"><label class="label" for="rcpt">Recipient</label>
-                <div class="field has-addons">
-                  <div class="control is-expanded has-icons-left"><input class="input" id="rcpt" name="recipient" type="email" placeholder="you@elsewhere.example" required><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
-                  <div class="control"><button type="submit" class="button is-primary"><i class="ti ti-send"></i>Send</button></div>
-                </div>
-                <p class="help">Sent from <span class="sp-mono">postmaster@mail.example.org</span> through the local Postfix.</p></div>
-            </form>
-          </div>
-          <div class="column is-6">
-            <dl class="sp-facts">
-              <div><dt>Last test</dt><dd>14:03 UTC to <span class="sp-mono">mix@elsewhere.example</span></dd></div>
-              <div><dt>Result</dt><dd><span class="tag is-success is-light">queued</span> <span class="sp-mono sp-small">4XcC1d8Pq2z1</span></dd></div>
-              <div><dt>Then</dt><dd><a href="out-message.html">Follow it in the outbound log</a></dd></div>
-            </dl>
-          </div>
-        </div>
-      </div>
-    </div>
-
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
-  </div>
-</main>
-</body>
-</html>

docs/assets/panel-redesign/panel/settings.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group" open><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html" aria-current="page"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -39,7 +39,6 @@
           <a class="navbar-link" href="health.html">Server</a>
           <div class="navbar-dropdown">
             <a class="navbar-item" href="health.html"><i class="ti ti-heartbeat"></i>Health</a>
-            <a class="navbar-item" href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a>
             <a class="navbar-item" href="system-log.html"><i class="ti ti-file-text"></i>System log</a>
             <a class="navbar-item" href="backup.html"><i class="ti ti-archive"></i>Backup</a>
             <a class="navbar-item" href="users.html"><i class="ti ti-users"></i>Users</a>
@@ -62,7 +61,7 @@
   </div>
 </nav>
 <div class="sp-perf" aria-hidden="true"></div>
-<div class="sp-subnav"><div class="container"><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html" aria-current="page"><i class="ti ti-settings"></i>Settings</a></div></div>
+<div class="sp-subnav"><div class="container"><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html" aria-current="page"><i class="ti ti-settings"></i>Settings</a></div></div>
 <main>
   <div class="container sp-page">
 <div class="sp-head">
@@ -71,11 +70,14 @@
         <h1 class="title is-3">Settings</h1>
         <p class="sp-lead">What holds for the whole instance, whoever is signed in. Your own name, e-mail and password are under <a href="account.html">Account</a>.</p>
       </div>
+      <div class="buttons">
+        <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-refresh"></i>Re-check DNS</button></form>
+      </div>
     </div>
 
-    <form class="sp-form" method="post" action="#">
+    <div class="columns">
-      <div class="columns">
+      <div class="column is-6">
-        <div class="column is-6">
+        <form class="sp-form" method="post" action="#">
           <div class="box">
             <div class="sp-box-head"><span class="sp-no">01</span><h2>Log retention</h2><a class="sp-help" href="help.html#settings" title="How long rows are kept"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
@@ -88,58 +90,80 @@
             </div>
           </div>
 
-          <div class="box" id="rate-limits">
-            <div class="sp-box-head"><span class="sp-no">02</span><h2>Sending rate limits</h2><div class="sp-end">Read-only</div><a class="sp-help" href="help.html#limits" title="Levels 1 and 2"><i class="ti ti-help-circle"></i></a></div>
-            <div class="sp-box-body">
-              <dl class="sp-facts">
-                <div><dt>Level 1 · per client IP</dt><dd class="sp-big">600 / h</dd><dd class="sp-muted">Set in <code>.env</code>; restart to change. Nothing below may exceed it.</dd></div>
-                <div><dt>Level 2 · domain, application</dt><dd>Set on each <a href="out-domain-settings.html">domain</a> and <a href="out-app.html">application</a>.</dd></div>
-              </dl>
-            </div>
-          </div>
-        </div>
-
-        <div class="column is-6">
           <div class="box" id="notifications">
-            <div class="sp-box-head"><span class="sp-no">03</span><h2>Notifications</h2><a class="sp-help" href="help.html#notifications" title="What is sent and when"><i class="ti ti-help-circle"></i></a></div>
+            <div class="sp-box-head"><span class="sp-no">02</span><h2>Notifications</h2><a class="sp-help" href="help.html#notifications" title="What is sent and when"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <div class="field"><label class="checkbox"><input type="checkbox" name="notify" checked> Send notification e-mails</label>
                 <p class="help">From <span class="sp-mono">postmaster@mail.example.org</span>, to every user who has an e-mail and has not turned them off under <a href="account.html">Account</a>.</p></div>
             </div>
           </div>
+          <div class="buttons"><button type="submit" class="button is-primary">Save settings</button></div>
+        </form>
+      </div>
 
-          <div class="box" id="notification-mail">
+      <div class="column is-6">
-            <div class="sp-box-head"><span class="sp-no">04</span><h2>Notification mail</h2><div class="sp-end">DNS records of the server's own name</div><a class="sp-help" href="help.html#notifications" title="What the panel sends and what makes it arrive"><i class="ti ti-help-circle"></i></a></div>
+        <div class="box" id="notification-mail">
+          <div class="sp-box-head"><span class="sp-no">03</span><h2>Notification mail</h2><div class="sp-end">The server's own name · checked 3 min ago</div><a class="sp-help" href="help.html#notifications" title="What the panel sends and what makes it arrive"><i class="ti ti-help-circle"></i></a></div>
 
-            <div class="sp-record">
+          <details class="sp-record">
-              <div class="sp-record-head"><h3>DKIM</h3><span class="tag is-success is-light">published</span><small>Not a secret · selector <code>sp2026</code></small></div>
+            <summary class="sp-record-head"><h3>DKIM</h3><span class="tag is-success is-light">published</span><small>Not a secret · selector <code>sp2026</code></small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
-              <div class="sp-row">
+            <div class="sp-row">
-                <div class="field"><label class="label">Host / name</label>
+              <div class="field"><label class="label">Host / name</label>
-                  <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="sp2026._domainkey.mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
+                <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="sp2026._domainkey.mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-                <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
+              <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
-              </div>
-              <div class="field"><label class="label">Value to publish</label>
-                <div class="field has-addons"><div class="control is-expanded"><textarea class="textarea" rows="5" readonly>v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7n2Lw0c5vXeR1dYt8uJb3mKs6pHf9aZoWg4iNy2TqCx0lVjE7rUh5sBk1dMa8fPz3oGc6yXw9tIe4nQv2uL…IDAQAB</textarea></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
             </div>
+            <div class="field"><label class="label">Value to publish</label>
+              <div class="field has-addons"><div class="control is-expanded"><textarea class="textarea" rows="5" readonly>v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7n2Lw0c5vXeR1dYt8uJb3mKs6pHf9aZoWg4iNy2TqCx0lVjE7rUh5sBk1dMa8fPz3oGc6yXw9tIe4nQv2uL…IDAQAB</textarea></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
+          </details>
 
-            <div class="sp-record">
+          <div class="sp-record">
-              <div class="sp-record-head"><h3>SPF</h3><span class="tag is-warning is-light">missing</span><small>For the server's own name, not for your domains</small></div>
+            <div class="sp-record-head"><h3>SPF</h3><span class="tag is-warning is-light">missing</span><small>For the server's own name, not for your domains</small></div>
-              <div class="sp-row">
+            <div class="sp-row">
-                <div class="field"><label class="label">Host / name</label>
+              <div class="field"><label class="label">Host / name</label>
-                  <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
+                <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-                <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
+              <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
-              </div>
-              <div class="field"><label class="label">Value to publish</label>
-                <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=spf1 a -all"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-              <p class="help">Notifications are sent without it, and a receiver may file them as spam.</p>
             </div>
+            <div class="field"><label class="label">Value to publish</label>
+              <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=spf1 a -all"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
+            <p class="help">Notifications are sent without it, and a receiver may file them as spam.</p>
+          </div>
+
+          <div class="sp-record">
+            <div class="sp-record-head"><h3>DMARC</h3><span class="tag is-warning is-light">missing</span><small>For the server's own name, not for your domains</small></div>
+            <div class="sp-row">
+              <div class="field"><label class="label">Host / name</label>
+                <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="_dmarc.mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
+              <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
+            </div>
+            <div class="field"><label class="label">Value to publish</label>
+              <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=DMARC1; p=reject"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
+            <p class="help">Without it a receiver does not refuse mail forged in the server's name - a false password-reset message included. Only the panel sends as this name, signed, so reject is safe.</p>
+          </div>
+        </div>
+
+        <div class="box" id="rate-limits">
+          <div class="sp-box-head"><span class="sp-no">04</span><h2>Sending rate limits</h2><div class="sp-end">Read-only</div><a class="sp-help" href="help.html#limits" title="Levels 1 and 2"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <dl class="sp-facts">
+              <div><dt>Level 1 · per client IP</dt><dd class="sp-big">600 / h</dd><dd class="sp-muted">Set in <code>.env</code>; restart to change. Nothing below may exceed it.</dd></div>
+              <div><dt>Level 2 · domain, application</dt><dd>Set on each <a href="out-domain-settings.html">domain</a> and <a href="out-app.html">application</a>.</dd></div>
+            </dl>
+          </div>
+        </div>
+
+        <div class="box" id="time-zone">
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>Time zone</h2><div class="sp-end">Read-only</div><a class="sp-help" href="help.html#settings" title="Times and days of the panel"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <dl class="sp-facts">
+              <div><dt>Zone</dt><dd class="sp-mono">Europe/Moscow</dd><dd class="sp-muted">UTC+03:00. Set in <code>.env</code> (<code>TZ</code>); restart to change.</dd></div>
+            </dl>
+            <p class="mt-4 sp-muted">Every time the panel shows, and every day it counts - today on Health, the days of the statistics - is this zone's, and so are the stamps of <code>mail.log</code>. One exception: the day a DMARC report covers is the reporter's, in UTC.</p>
           </div>
         </div>
       </div>
-      <div class="buttons"><button type="submit" class="button is-primary">Save settings</button></div>
+    </div>
-    </form>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/setup.html

@@ -36,7 +36,7 @@
       </div>
       <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Create administrator</button></div>
     </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>
 

docs/assets/panel-redesign/panel/src/account.html

@@ -14,12 +14,18 @@
           <div class="sp-box-body">
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="username">Username</label><div class="control has-icons-left"><input class="input" id="username" name="username" value="admin" autocomplete="username" spellcheck="false" required><span class="icon is-left"><i class="ti ti-user"></i></span></div></div>
-              <div class="field"><label class="label" for="email">E-mail</label><div class="control has-icons-left"><input class="input" id="email" name="email" type="email" value="mix@example.org" autocomplete="email"><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
+              <div class="field"><label class="label" for="email">E-mail <span class="tag is-warning is-light">not confirmed</span></label><div class="control has-icons-left"><input class="input" id="email" name="email" type="email" value="mix@example.org" autocomplete="email"><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
-                <p class="help">Your own address. A domain's report address can be filled with it from Domain settings.</p></div>
+                <p class="help">Your own address. Saving a new one sends it a link to confirm it; once confirmed it is where a link to reset your password can go. A domain's report address can be filled with it from Domain settings.</p></div>
+              <div class="field"><label class="label" for="pcur">Current password</label><div class="control"><input class="input" id="pcur" name="current_password" type="password" autocomplete="current-password"></div>
+                <p class="help">Needed only to change the e-mail.</p></div>
               <div class="field"><label class="checkbox"><input type="checkbox" name="notify" checked> Send me notifications</label>
                 <p class="help">To this address, when something needs you: a DNS record of a domain stops matching, a rate limit refuses mail, the TLS certificate is about to expire, a message has waited in the queue for three days. <a href="help.html#notifications">What is sent and when</a></p></div>
               <button type="submit" class="button is-primary">Save profile</button>
             </form>
+            <form class="sp-form mt-4" method="post" action="#">
+              <p class="help mb-3">A link was sent to <span class="sp-mono">mix@example.org</span> at 14:02; it works once, for 24 hours.</p>
+              <button type="submit" class="button">Send the link again</button>
+            </form>
           </div>
         </div>
       </div>

docs/assets/panel-redesign/panel/src/backup.html

@@ -20,6 +20,8 @@
                 <div class="field"><label class="label" for="pw2">Repeat password</label><div class="control"><input class="input" id="pw2" type="password"></div></div>
               </div>
               <p class="help mb-3">Keep this password: SelfPost does not store it, and the file cannot be opened without it.</p>
+              <div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password" required></div>
+                <p class="help">The one you sign in with, asked at every download: the archive holds every secret of the server, and a session left open must not be enough to take it.</p></div>
               <button type="submit" class="button is-primary"><i class="ti ti-download"></i>Download full backup</button>
             </form>
           </div>

docs/assets/panel-redesign/panel/src/components.html

@@ -84,9 +84,9 @@
     <div class="columns">
       <div class="column is-7">
         <div class="box">
-          <div class="sp-box-head"><span class="sp-no">05</span><h2>dns_record · copy_field</h2><div class="sp-end">One block per record</div></div>
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>dns_record · copy_field</h2><div class="sp-end">One block per record · folded when DNS holds it as shown</div></div>
-          <div class="sp-record">
+          <details class="sp-record">
-            <div class="sp-record-head"><h3>Record</h3><span class="tag is-success is-light">published</span><small>A one-line note</small></div>
+            <summary class="sp-record-head"><h3>Record</h3><span class="tag is-success is-light">published</span><small>A one-line note</small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="copy_field — single line"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -94,7 +94,7 @@
             </div>
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><textarea class="textarea" rows="2" readonly>copy_field — multi-line, for a DKIM key</textarea></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-          </div>
+          </details>
           <div class="sp-record">
             <div class="sp-record-head"><h3>Record</h3><span class="tag is-danger is-light">mismatch</span><small>"In DNS now" appears only when it differs</small></div>
             <div class="field"><label class="label">In DNS now</label>
@@ -106,7 +106,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">07</span><h2>Table conventions</h2><div class="sp-end">Always inside <code>table-container</code> · an address breaks after its @</div></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Time, UTC</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
+            <thead><tr><th>Time</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td><a href="#"><strong>the row's link</strong></a></td><td class="sp-clip">A long subject is clipped with an ellipsis instead of wrapping the row</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="#">Details</a><form method="post" action="#"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
             </tbody>
@@ -116,9 +116,10 @@
 
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">09</span><h2>log_pane</h2><div class="sp-end">sp-d time · sp-w warning · sp-e error</div></div>
-<pre class="sp-log"><span class="sp-d">13:58:07</span> an ordinary line
+<pre class="sp-log"><span class="sp-ll"><span class="sp-d">13:58:07</span> an ordinary line
-<span class="sp-d">13:58:09</span> <span class="sp-w">a deferred delivery — sp-w</span>
+</span><span class="sp-ll"><span class="sp-d">13:58:09</span> <span class="sp-w">a deferred delivery — sp-w</span>
-<span class="sp-d">13:57:41</span> <span class="sp-e">a reject or a bounce — sp-e</span></pre>
+</span><span class="sp-ll"><span class="sp-d">13:57:41</span> <span class="sp-e">a reject or a bounce — sp-e</span>
+</span></pre>
         </div>
       </div>
 
@@ -129,7 +130,9 @@
             <dl class="sp-facts">
               <div><dt>Label</dt><dd>Value</dd></div>
               <div><dt>Mono value</dt><dd class="sp-mono">4XcB7k2Jm9z1</dd></div>
+              <div><dt>Label with a tag <span class="tag is-success is-light">matches</span></dt><dd>a verdict on the value</dd></div>
               <div><dt>sp-big</dt><dd class="sp-big">5 days</dd><dd class="sp-muted">a supporting line</dd></div>
+              <div class="sp-wide"><dt>sp-wide</dt><dd class="sp-mono">a value that takes the whole row, a line of a server's own</dd></div>
             </dl>
           </div>
         </div>
@@ -138,9 +141,9 @@
           <div class="sp-box-head"><span class="sp-no">08</span><h2>timeline</h2></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Done</strong> — default</li>
+              <li><time>13:58:07</time><strong>Done</strong> — default</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — sp-warn</li>
+              <li class="sp-warn"><time>13:58:09</time><strong>Deferred</strong> — sp-warn</li>
-              <li class="sp-fail"><time>14:40:00 UTC</time><strong>Bounced</strong> — sp-fail</li>
+              <li class="sp-fail"><time>14:40:00</time><strong>Bounced</strong> — sp-fail</li>
               <li class="sp-pending"><time>not yet</time>Expected next — sp-pending</li>
             </ol>
           </div>

docs/assets/panel-redesign/panel/src/confirm-email-signin.html

@@ -0,0 +1,18 @@
+<!-- title: Confirm e-mail | shell: bare -->
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <div class="sp-form">
+      <p class="sp-kicker">mail.example.org</p>
+      <h1 class="title is-3">Confirm e-mail</h1>
+      <div class="notification is-danger is-light"><i class="ti ti-alert-circle"></i>Sign in to the account in this browser, then open the link again.</div>
+      <p><a href="login.html">Sign in</a></p>
+    </div>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>

docs/assets/panel-redesign/panel/src/confirm-email.html

@@ -0,0 +1,18 @@
+<!-- title: Confirm e-mail | shell: bare -->
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="account.html">
+      <p class="sp-kicker">mail.example.org · admin</p>
+      <h1 class="title is-3">Confirm e-mail</h1>
+      <p class="sp-muted mb-4"><span class="sp-mono">mix@example.org</span> becomes the confirmed address of this account: where a link to reset its password can be sent.</p>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Confirm</button></div>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>

docs/assets/panel-redesign/panel/src/dmarc-domain.html

@@ -26,7 +26,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Reports</h2></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Received, UTC</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+            <thead><tr><th>Received</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 02:15</td><td class="sp-muted">google.com</td><td>20 Sep</td><td>6 410</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>

docs/assets/panel-redesign/panel/src/dmarc-report.html

@@ -2,7 +2,7 @@
     <div class="sp-head">
       <div class="sp-grow">
         <p class="sp-kicker"><a href="dmarc.html">DMARC reports</a> / <a href="dmarc-domain.html">shop.example.org</a> /</p>
-        <h1 class="title is-4">Outlook.com · 20 Sep 2026</h1>
+        <h1 class="title is-4">Outlook.com · 20 Sep</h1>
         <p class="sp-route"><span>shop.example.org</span><span class="tag is-success is-light">1 903 pass</span><span class="tag is-warning is-light">7 fail</span></p>
       </div>
     </div>
@@ -15,8 +15,8 @@
             <dl class="sp-facts">
               <div><dt>Reporter</dt><dd>Outlook.com</dd></div>
               <div><dt>Report id</dt><dd class="sp-mono sp-small">5f1c9a0e7b2d4e61a3</dd></div>
-              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00 UTC</dd></div>
+              <div><dt>Window</dt><dd>20 Sep 03:00 – 21 Sep 03:00</dd><dd class="sp-muted">The reporter's day, 20 Sep: reports count their days in UTC, and the title and the lists name that day. The times are this panel's zone.</dd></div>
-              <div><dt>Received</dt><dd>2026-09-21 04:40 UTC</dd></div>
+              <div><dt>Received</dt><dd>2026-09-21 04:40</dd></div>
             </dl>
           </div>
         </div>

docs/assets/panel-redesign/panel/src/dmarc.html

@@ -11,7 +11,7 @@
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Ingest</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#dmarc" title="What the reports are and where they go"><i class="ti ti-help-circle"></i></a></div>
       <div class="sp-box-body">
         <dl class="sp-facts">
-          <div><dt>Last report</dt><dd>2026-09-21 06:12 UTC</dd></div>
+          <div><dt>Last report</dt><dd>2026-09-21 06:12</dd></div>
           <div><dt>This week</dt><dd>14 kept · 0 parse failures</dd></div>
           <div><dt>Hosted addresses</dt><dd class="sp-mono sp-small">dmarc-reports+&lt;domain&gt;@mail.example.org</dd></div>
           <div><dt>Retention</dt><dd>500 reports a domain or 90 days</dd></div>
@@ -22,7 +22,7 @@
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">02</span><h2>Recent reports</h2></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Received, UTC</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+        <thead><tr><th>Received</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 06:12</td><td><a href="dmarc-domain.html">example.org</a></td><td class="sp-muted">google.com</td><td>20 Sep</td><td>412</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td><a href="dmarc-domain.html">shop.example.org</a></td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>

docs/assets/panel-redesign/panel/src/health.html

@@ -3,7 +3,7 @@
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">Health</h1>
-        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes every 10 s.</p>
+        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes automatically.</p>
       </div>
       <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-refresh"></i>Re-check DNS</button></form>
     </div>
@@ -42,6 +42,7 @@
             <dl class="sp-facts">
               <div><dt>Hostname</dt><dd class="sp-mono">mail.example.org</dd></div>
               <div><dt>Lookup</dt><dd class="sp-mono">→ 203.0.113.25<br>← mail.example.org</dd></div>
+              <div class="sp-wide"><dt>Greeting</dt><dd class="sp-mono">220 mail.example.org ESMTP</dd></div>
             </dl>
           </div>
         </div>
@@ -67,6 +68,7 @@
               <tr><td>dkim-signer <span class="sp-muted">· notifications</span><br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/sign-local.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
               <tr><td>journal-milter<br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/journal.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
               <tr><td>sender-check<br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/sender.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
+              <tr><td>inbound-journal-milter <span class="sp-muted">· Inbound log</span><br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/inbound-journal.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
               <tr><td>rspamd <span class="sp-muted">· inbound spam filter</span><br><span class="sp-muted sp-mono sp-small">inet:antispam:11332</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
             </tbody>
           </table></div>
@@ -75,10 +77,10 @@
           <div class="sp-box-head"><span class="sp-no">04</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#certificate" title="When it warns and what to do"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14 UTC</dd></div>
+              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14</dd></div>
-              <div><dt>Names</dt><dd class="sp-mono">mail.example.org</dd></div>
+              <div><dt>Names <span class="tag is-success is-light">matches</span></dt><dd class="sp-mono">mail.example.org</dd></div>
-              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02 UTC</dd></div>
+              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02</dd></div>
-              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12 UTC</dd></div>
+              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12</dd></div>
             </dl>
             <p class="mt-4 sp-muted">Postfix still serves the certificate above. A renewed one is waiting in the mounted file; Postfix takes it up at its next check for a renewal, at most a day after it was mounted.</p>
           </div>
@@ -90,6 +92,7 @@
             <tbody>
               <tr><td>DKIM<br><span class="sp-muted sp-mono sp-small">sp2026._domainkey.mail.example.org</span></td><td><span class="tag is-success is-light">published</span></td></tr>
               <tr><td>SPF<br><span class="sp-muted sp-mono sp-small">mail.example.org</span></td><td><span class="tag is-warning is-light">missing</span></td></tr>
+              <tr><td>DMARC<br><span class="sp-muted sp-mono sp-small">_dmarc.mail.example.org</span></td><td><span class="tag is-warning is-light">missing</span></td></tr>
             </tbody>
           </table></div>
           <div class="sp-box-body">
@@ -99,9 +102,25 @@
         <div class="box" id="configuration" data-order="8">
           <div class="sp-box-head"><span class="sp-no">08</span><h2>Configuration</h2><div class="sp-end">Safe to run at any time</div></div>
           <div class="sp-box-body">
+            <div class="mb-3"><dl class="sp-facts">
+              <div><dt>Your address</dt><dd class="sp-mono">198.51.100.7</dd><dd class="sp-muted">From X-Forwarded-For, which the trusted proxy 172.18.0.1 set</dd></div>
+            </dl></div>
             <p class="mb-3">Regenerates the Postfix configuration and the spam filter's lists from the database, removes the keys of deleted domains, and reloads Postfix. Use it after editing the files by hand, after restoring a backup, or when the running configuration looks out of step with the domain and application lists. It does not touch the queue or the TLS certificate.</p>
             <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-reload"></i>Reload configuration</button></form>
           </div>
         </div>
+        <div class="box" id="test-message" data-order="9">
+          <div class="sp-box-head"><span class="sp-no">09</span><h2>Test message</h2><div class="sp-end">Shows what the receiving server answers</div><a class="sp-help" href="help.html#test-message" title="What the test proves"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <form class="sp-form" method="post" action="out-message.html">
+              <div class="field"><label class="label" for="rcpt">Recipient</label>
+                <div class="field has-addons">
+                  <div class="control is-expanded has-icons-left"><input class="input" id="rcpt" name="recipient" type="email" placeholder="you@elsewhere.example" required><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
+                  <div class="control"><button type="submit" class="button is-primary"><i class="ti ti-send"></i>Send</button></div>
+                </div>
+                <p class="help">From <span class="sp-mono">postmaster@mail.example.org</span>, signed with the server's own key, through Postfix as its notifications go. It opens in the <a href="out-log.html">Outbound log</a>, where its page follows it to the receiving server. Ten an hour.</p></div>
+            </form>
+          </div>
+        </div>
       </div>
     </div>

docs/assets/panel-redesign/panel/src/help.html

@@ -14,6 +14,7 @@
           <ul class="menu-list">
             <li><a class="is-active" href="#checks"><i class="ti ti-activity-heartbeat"></i>Health checks</a></li>
             <li><a href="#certificate"><i class="ti ti-certificate"></i>TLS certificate</a></li>
+            <li><a href="#test-message"><i class="ti ti-send"></i>Test message</a></li>
             <li><a href="#rdns"><i class="ti ti-arrows-exchange"></i>Reverse DNS</a></li>
           </ul>
           <p class="menu-label">Outbound</p>
@@ -33,6 +34,7 @@
             <li><a href="#recipients"><i class="ti ti-address-book"></i>Valid recipients</a></li>
             <li><a href="#filter"><i class="ti ti-shield-check"></i>Spam filter</a></li>
             <li><a href="#inbound-log"><i class="ti ti-list-details"></i>Inbound log</a></li>
+            <li><a href="#inbound-queue"><i class="ti ti-stack-2"></i>Inbound queue</a></li>
             <li><a href="#filter-lists"><i class="ti ti-filter"></i>Filter lists</a></li>
           </ul>
           <p class="menu-label">Server</p>
@@ -51,39 +53,41 @@
       <div class="column is-9">
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>Overview</h2></div>
-          <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, and the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now. <a href="health.html">Health</a> shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total.</p></div>
+          <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, and the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now. <a href="health.html">Health</a> shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total. <em>Your address</em>, in the Configuration card, is the address the panel sees your browser at: behind a reverse proxy it must be your own, taken from <code>X-Forwarded-For</code>; when it is the proxy's, every visitor shares one sign-in limit, and Health warns and names the address to put in <code>TRUSTED_PROXY_CIDR</code>.</p></div>
-          <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. Postfix serves its own copy of the mounted file and looks for a renewed one once a day by default; until it takes one up, the card shows it as a renewal waiting, and warns once it has waited longer than that check allows - the container log's cert-reload lines say why. It warns 14 days before expiry unless a renewal is already waiting, and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect.</p></div>
+          <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. Postfix serves its own copy of the mounted file and looks for a renewed one once a day by default; until it takes one up, the card shows it as a renewal waiting, and warns once it has waited longer than that check allows - the container log's cert-reload lines say why. It warns 14 days before expiry unless a renewal is already waiting, and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect. It also fails when none of its names is the hostname (<code>SELFPOST_HOSTNAME</code>) - the tag beside <em>Names</em> says which: a client that verifies the name refuses it however valid it is.</p></div>
-          <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname (<code>SELFPOST_HOSTNAME</code>) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone.</p></div>
+          <div class="sp-help-topic" id="test-message"><h3>Test message</h3><p>A message from <code>postmaster@</code> the server's hostname to one address you type, sent the way notifications are: through Postfix, signed with the DKIM key of the server's own name. It proves the path from this server - TLS, its address's reputation, the SPF and DKIM records of its name - not your domains', which only mail from an application does. The page that opens is its row in the Outbound log: it shows whether the receiving server took it, put it off or refused it, with the lines of <code>mail.log</code>. Whether it then reached the inbox or the spam folder only the mailbox can say. The global role sends it, at most ten an hour.</p></div>
+          <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname (<code>SELFPOST_HOSTNAME</code>) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone. <em>Greeting</em> is the line Postfix opens every connection with, <code>220</code> and its banner; it must name the hostname too - a receiver compares it with the name it looked up - and a container id or <code>localhost</code> there is a warning.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Outbound</h2></div>
-          <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
+          <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. A record DNS already holds as shown is folded to its name and status; Show values opens it to copy them again. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
-          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once at creation or regeneration and is not stored in readable form.</p></div>
+          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once, at creation or regeneration, and the panel does not show it again; the server keeps it, so a domain export can carry it.</p></div>
-          <div class="sp-help-topic" id="sender-check"><h3>Sender check</h3><p>An application sends only as itself, and that holds for both senders a message has. The envelope sender is held against the login by Postfix. The <code>From:</code> line, the one a mail program shows and the one DMARC holds the DKIM signature to, is held against it by the panel, under the same rule: an application set to any address of its domain may write any address of that domain, and one with a list of addresses only those. A message with any other <code>From:</code> - another of your domains, the server's own name, an address somewhere else, or none at all - is refused for good with <code>550 5.7.1</code>. The line must hold one address, read as a mail program reads it: what a display name around it says is not judged, and a line holding more than one address is refused. It is a rejected row of the Outbound log, and its page says which address was refused. This is what keeps one application from sending, under this server's signature, as another domain or another application.<br><br>The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were refused with a temporary error in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message refused in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own.</p></div>
+          <div class="sp-help-topic" id="sender-check"><h3>Sender check</h3><p>An application sends only as itself, and that holds for every sender a message names. The envelope sender is held against the login by Postfix. The <code>From:</code> line, the one a mail program shows and the one DMARC holds the DKIM signature to, is held against it by the panel, under the same rule: an application set to any address of its domain may write any address of that domain, and one with a list of addresses only those. A message with any other <code>From:</code> - another of your domains, the server's own name, an address somewhere else, or none at all - is refused for good with <code>550 5.7.1</code>. The line must hold one address, read as a mail program reads it: what a display name around it says is not judged, and a line holding more than one address is refused. A <code>Sender:</code> line, which a mail program shows beside <code>From:</code> as "on behalf of", is held to the same rule when the message has one. A system that writes for people outside your domains writes its own address in <code>From:</code> with the person's name, and the person's address in <code>Reply-To:</code>: their domain in <code>From:</code> would fail DMARC at the receiver anyway. It is a rejected row of the Outbound log, and its page says which address was refused. This is what keeps one application from sending, under this server's signature, as another domain or another application.<br><br>The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were refused with a temporary error in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message refused in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own.</p></div>
           <div class="sp-help-topic" id="limits"><h3>Rate limits</h3><p>Level 1 is a per-IP ceiling set in <code>.env</code>. Level 2 is optional, per domain and per application, entered by hand or computed from the last 30 days of sending, and can never exceed level 1. An application's own limit replaces its domain's.</p></div>
-          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient, with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
+          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient (a message refused for its From: or Sender: line is one row, however many recipients it had), with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> or <code>Sender:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
-          <div class="sp-help-topic" id="queue"><h3>Queue and retries</h3><p>The page lists, as <code>postqueue -p</code> prints it, the messages Postfix has accepted and not yet delivered: mail being sent right now and mail deferred for a later attempt. Only the global role can open it, and it only shows; nothing here deletes or forces a message. A deferred message is tried again after the first retry delay, then at gaps that double up to a cap, until the receiving server takes it or the queue lifetime runs out and it bounces; there is no attempt counter, and the box on the page shows this server's values. A queue that keeps growing means a receiver is refusing or not answering: open the message from the Outbound log to read the reason Postfix logged.</p></div>
+          <div class="sp-help-topic" id="queue"><h3>Queue and retries</h3><p>The page lists the messages Postfix has accepted and not yet delivered, one row per recipient: mail being sent right now and mail deferred for a later attempt, with the last reply of the receiving server, or why no connection was made. Mail for an inbound domain waits under Inbound › Queue instead. Only the global role can open it, and it only shows; nothing here deletes or forces a message, and Details opens the message in the Outbound log. A deferred message is tried again after the first retry delay, then at gaps that double up to a cap, until the receiving server takes it or the queue lifetime runs out and it bounces; there is no attempt counter, and the box on the page shows this server's values. A queue that keeps growing means a receiver is refusing or not answering; the last reply says which.</p></div>
-          <div class="sp-help-topic" id="dmarc"><h3>DMARC reports</h3><p>An aggregate report is the summary a receiving provider sends, usually daily, to the <code>rua=</code> address of your DMARC record: which servers sent mail as your domain and whether SPF or DKIM passed for it. A domain's report address is one of three choices, set in its Domain settings: no reports (the default for a new domain), the SelfPost hosted address (an address on this server whose reports are parsed and shown under DMARC reports; offered only while hosted reports are enabled on the server), or an address typed for the domain (an ordinary mailbox that receives the raw XML; a button fills in your own profile e-mail). When the typed address is on another domain than the one sending, that domain must publish a report-authorization record, or providers will not send; the domain's page shows it with the other DNS records and checks it. In the tables pass means SPF or DKIM passed and aligned, fail means neither did, and your own server shows as <em>this relay</em>. A fail from any other source is someone else sending as your domain — a forwarder, an application you forgot, or abuse — so do not tighten <code>p=</code> until that sender is fixed or removed. A domain administrator reads the reports of their own domains.</p></div>
+          <div class="sp-help-topic" id="dmarc"><h3>DMARC reports</h3><p>An aggregate report is the summary a receiving provider sends, usually daily, to the <code>rua=</code> address of your DMARC record - its day is the reporter's, counted in UTC, and that is the day the lists and a report's title name, while the report's page gives its window in this panel's zone: which servers sent mail as your domain and whether SPF or DKIM passed for it. A domain's report address is one of three choices, set in its Domain settings: no reports (the default for a new domain), the SelfPost hosted address (an address on this server whose reports are parsed and shown under DMARC reports; offered only while hosted reports are enabled on the server), or an address typed for the domain (an ordinary mailbox that receives the raw XML; a button fills in your own profile e-mail). When the typed address is on another domain than the one sending, that domain must publish a report-authorization record, or providers will not send; the domain's page shows it with the other DNS records and checks it. In the tables pass means SPF or DKIM passed and aligned, fail means neither did, and your own server shows as <em>this relay</em>. A fail from any other source is someone else sending as your domain — a forwarder, an application you forgot, or abuse — so do not tighten <code>p=</code> until that sender is fixed or removed. A domain administrator reads the reports of their own domains.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">03</span><h2>Inbound</h2></div>
           <div class="sp-help-topic" id="inbound"><h3>Backup-MX and forwarding</h3><p>An optional backup-MX or forwarder, switched on in the server's <code>.env</code>; the Inbound menu exists only then. Postfix accepts mail on port 25 for the listed domains only and hands each message on to that domain's upstream; there are no mailboxes. For each domain publish the MX record its page shows, and keep a primary MX the domain already has if this is a backup. The MX tag is green when at least one MX of the domain points at this server, and a domain accepts no mail until an upstream is saved on its page. Adding and deleting domains is for the global role.</p></div>
-          <div class="sp-help-topic" id="upstream"><h3>Upstream</h3><p>The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear; Required sends only over TLS, and the mail waits in the queue while the upstream does not offer it or the TLS handshake fails - an upstream that answers STARTTLS with a permanent error bounces it; Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.</p></div>
+          <div class="sp-help-topic" id="upstream"><h3>Upstream</h3><p>The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear; Required sends only over TLS, and the mail waits in the queue while the upstream does not offer it or the TLS handshake fails - an upstream that answers STARTTLS with a permanent error bounces it. Neither checks the upstream's certificate: TLS here keeps the mail from whoever only listens on the way, not from one who answers in the upstream's place. Verified is Required with that check too: the upstream's certificate has to be issued by a trusted authority for the host given here, so the host is given by name, not by address, and the mail waits in the queue while the check fails - a certificate for another name, or one the upstream signed itself, included. Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.</p></div>
           <div class="sp-help-topic" id="recipients"><h3>Valid recipients</h3><p>Choose whom this domain accepts. Listed addresses only: the relay accepts exactly the addresses you list, one per line or comma-separated, and refuses any other while the sender is still connected, so it never has to send a bounce for them. Any recipient: everything at the domain is accepted and passed on, and an address the upstream then rejects comes back as a bounce from this server to a sender who is often forged — backscatter. Prefer a list, and keep it in step with the mailboxes upstream.</p></div>
           <div class="sp-help-topic" id="filter"><h3>Spam filter</h3><p>The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's <code>.env</code>, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or refused with a temporary error, so the sending server tries again later, as the server's setting says; the box states which.</p></div>
-          <div class="sp-help-topic" id="inbound-log"><h3>Inbound log</h3><p>One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: <span class="tag is-success is-light">accept</span> — handed on to the upstream; <span class="tag is-danger is-light">reject</span> — refused for good; <span class="tag is-warning is-light">tempfail</span> — the sender was asked to come back later; <span class="tag is-primary is-light">quarantine</span> — held by the filter. <em>Why</em> names who decided. <code>rspamd</code> is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; <code>postfix</code> is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; <code>selfpost</code> means nobody judged the message: it was relayed with no filter attached. Accept says what this server did, not what the upstream did with the message afterwards.<br><br>Accepted mail is recorded as it passes; refused mail is read from <code>mail.log</code>, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.</p></div>
+          <div class="sp-help-topic" id="inbound-log"><h3>Inbound log</h3><p>One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: <span class="tag is-success is-light">accept</span> — taken for the upstream; <span class="tag is-danger is-light">reject</span> — refused for good; <span class="tag is-warning is-light">tempfail</span> — the sender was asked to come back later; <span class="tag is-primary is-light">quarantine</span> — held by the filter. <em>Why</em> names who decided. <code>rspamd</code> is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; <code>postfix</code> is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; <code>selfpost</code> means nobody judged the message: it was relayed with no filter attached. <em>Upstream</em> says what became of an accepted message: <span class="tag is-light">queued</span> — not tried yet; <span class="tag is-primary is-light">held</span> — held in the queue by the filter, not tried until it is released; <span class="tag is-success is-light">sent</span> — the upstream took it; <span class="tag is-warning is-light">deferred</span> — the upstream put it off or could not be reached, and Postfix tries again; <span class="tag is-danger is-light">bounced</span> — the upstream refused it, or it waited in the queue too long, and the sender was sent a bounce, if it had a return address. It opens the last reply and the host that gave it. A refused message has no upstream result, and neither has a row logged before 2.10.0.<br><br>Accepted mail is recorded as it passes; refused mail is read from <code>mail.log</code>, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.</p></div>
+          <div class="sp-help-topic" id="inbound-queue"><h3>Inbound queue</h3><p>Mail accepted on port 25 and not yet taken by its upstream, one row per recipient, with the upstream's last reply or why it could not be reached. It is the same Postfix queue as Outbound › Queue, split by the recipient's domain, and retried the same way; an upstream that refuses or does not answer is what makes it grow. Only the global role can open it, and it only shows.</p></div>
           <div class="sp-help-topic" id="filter-lists"><h3>Filter lists</h3><p>Two lists for the whole server that correct the spam filter by hand. An entry is a sender address, a sender domain — that domain, not its subdomains — or a client address or network in CIDR form. A sender on the Deny list is refused outright. A sender on the Allow list is given a weight no spam score outweighs, so the filter lets it through. The sender's address is whatever the sending server says it is - anyone can claim to be a sender you allow - so allow a client address or network where you can, and a sender address only for mail you would rather receive forged than lose. When entries of both lists match one message, <strong>Deny wins</strong>.<br><br>SelfPost does not apply the lists itself: it writes them as files under <code>/data/antispam/</code>, and rspamd rereads a file within seconds of a change. With the spam filter off the lists are kept and can be edited, but nothing reads them. The sender matched is the envelope sender — the one in the log — not the From line a mail program shows. Matched counts the messages in the Inbound log that the entry decided, so it reaches back as far as the log does; never means not once in that time, and such an entry is one to consider removing.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Server</h2></div>
-          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10998 on the host (<code>chgrp 10998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
+          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. Both it and a domain's export ask for your account password - the one you sign in with - at every download, so a session left open is not enough to take them; a wrong one counts against the limit of a password change, ten in 15 minutes. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10997 on the host (<code>chgrp 10997</code>, <code>chmod 640</code>), a group only the panel is in, so Postfix's daemons cannot read it. Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
-          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out of their other sessions.</p></div>
+          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out everywhere; set for yourself, it keeps the session you set it from. Adding a user, changing a user's password, e-mail or role, and deleting a user ask for your own account password, as a backup does, with the same limit on wrong guesses.</p></div>
-          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
+          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. The time zone is the container's, <code>TZ</code> in <code>.env</code> (UTC when it is not set): every time the panel shows and every day it counts is that zone's, as are the stamps Postfix writes in <code>mail.log</code>, so the two always agree; changing it is a restart of the container. The one exception is the day a DMARC report covers, which is the reporter's, counted in UTC. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
-          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same limit. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish, and Server › Health shows whether they are in place. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
+          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same sending domain. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, an SPF record, <code>v=spf1 a -all</code>, and a DMARC record, <code>v=DMARC1; p=reject</code>, which has receivers refuse mail forged in the server's name - a false password-reset message among it; only the panel sends as this name, signed, so reject is safe. Server › Settings gives all three with the values to publish and whether they are in place, and its Re-check DNS checks them again once they are published; Server › Health shows them too. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains depends on none of them.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">05</span><h2>Account</h2></div>
-          <div class="sp-help-topic" id="account"><h3>Your account</h3><p>Account is your own, whatever your role: your username and e-mail, whether the panel sends you notifications, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected.</p></div>
+          <div class="sp-help-topic" id="account"><h3>Your account</h3><p>Account is your own, whatever your role: your username and e-mail, whether the panel sends you notifications, and your password. Changing the password signs out every other session of this account and keeps the one you are using; applications have their own logins and are not affected. A new e-mail is sent a link that confirms it, which works once, for 24 hours; changing the e-mail asks for your password. Notifications go to the address whether it is confirmed or not, but only a confirmed one can get a link to reset a forgotten password: <em>Forgot your password?</em> on the sign-in page sends it, for 30 minutes and once, and setting the new password signs every session of the account out. Without a confirmed e-mail the global administrator sets a new password under Users, and the only global administrator recovers from the container.</p></div>
         </div>
       </div>
     </div>

docs/assets/panel-redesign/panel/src/in-domain.html

@@ -4,7 +4,7 @@
       <div class="sp-grow">
         <p class="sp-kicker"><a href="in-domains.html">Inbound domains</a> /</p>
         <h1 class="title is-3">lists.example.org</h1>
-        <p class="sp-lead">Accepted on port 25, handed to <span class="sp-mono">mx.internal:25</span> over required TLS · 4 recipients</p>
+        <p class="sp-lead">Accepted on port 25, handed to <span class="sp-mono">mx.internal:25</span> over verified TLS · 4 recipients</p>
       </div>
       <div class="buttons">
         <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-refresh"></i>Re-check DNS</button></form>
@@ -35,8 +35,8 @@
       <div class="column is-9">
         <div class="box" id="dns">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>MX record</h2><div class="sp-end">Checked 1 min ago</div><a class="sp-help" href="help.html#inbound" title="Backup-MX and forwarding"><i class="ti ti-help-circle"></i></a></div>
-          <div class="sp-record">
+          <details class="sp-record">
-            <div class="sp-record-head"><h3>MX</h3><span class="tag is-success is-light">published</span><small>Keep any existing primary MX if this is a backup-MX</small></div>
+            <summary class="sp-record-head"><h3>MX</h3><span class="tag is-success is-light">published</span><small>Keep any existing primary MX if this is a backup-MX</small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="lists.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -44,7 +44,7 @@
             </div>
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="10 mail.example.org."></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-          </div>
+          </details>
         </div>
 
         <div class="columns">
@@ -58,7 +58,8 @@
                     <div class="field"><label class="label" for="port">Port</label><div class="control"><input class="input sp-mono" id="port" name="port" inputmode="numeric" value="25" required></div></div>
                   </div>
                   <div class="field"><label class="label" for="tls">TLS to upstream</label>
-                    <div class="control"><div class="select is-fullwidth"><select id="tls" name="tls_mode"><option>Opportunistic</option><option selected>Required</option><option>Off</option></select></div></div></div>
+                    <div class="control"><div class="select is-fullwidth"><select id="tls" name="tls_mode"><option>Opportunistic</option><option>Required</option><option selected>Verified</option><option>Off</option></select></div></div>
+                    <p class="help">Required encrypts the hop without checking who answers. Verified also checks the upstream's certificate: issued by a trusted authority for the host above, which is then given by name.</p></div>
                   <button type="submit" class="button is-primary">Save upstream</button>
                 </form>
               </div>
@@ -76,7 +77,7 @@
 dev@lists.example.org
 owner@lists.example.org
 security@lists.example.org</textarea></div>
-                    <p class="help">Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
+                    <p class="help">One per line or comma-separated. Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
                   <button type="submit" class="button is-primary">Save recipients</button>
                 </form>
               </div>
@@ -88,10 +89,9 @@ security@lists.example.org</textarea></div>
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Spam filter</h2><div class="sp-end"><span class="tag is-success is-light">on</span></div><a class="sp-help" href="help.html#filter" title="A server setting"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Engine</dt><dd>rspamd, for every inbound domain of this server</dd></div>
+              <div><dt>Applies to</dt><dd>Every inbound domain of this server</dd></div>
-              <div><dt>Suspicious mail</dt><dd>Held — <a href="in-quarantine.html">1 message in quarantine</a> for this domain</dd></div>
+              <div><dt>Filter</dt><dd class="sp-mono">inet:antispam:11332</dd></div>
-              <div><dt>Spam</dt><dd>Refused at the door; see <em>reject</em> in the <a href="in-log.html">log</a></dd></div>
+              <div><dt>If the filter is down</dt><dd>Mail is accepted unfiltered</dd></div>
-              <div><dt>Allow and deny lists</dt><dd class="sp-muted">Kept by the global administrator, one pair for the whole server</dd></div>
             </dl>
           </div>
         </div>

docs/assets/panel-redesign/panel/src/in-domains.html

@@ -25,7 +25,7 @@
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
         <thead><tr><th>Domain</th><th>DNS</th><th>Upstream</th><th>Recipients</th><th>TLS to upstream</th><th></th></tr></thead>
         <tbody>
-          <tr><td><a href="in-domain.html"><strong>lists.example.org</strong></a></td><td><span class="tag is-success is-light">MX</span></td><td class="sp-mono sp-muted">mx.internal:25</td><td>4 addresses</td><td><span class="tag is-success is-light">required</span></td><td class="sp-actions"><a href="in-domain.html">Open</a><a class="has-text-danger" href="in-domain-delete.html">Delete</a></td></tr>
+          <tr><td><a href="in-domain.html"><strong>lists.example.org</strong></a></td><td><span class="tag is-success is-light">MX</span></td><td class="sp-mono sp-muted">mx.internal:25</td><td>4 addresses</td><td><span class="tag is-success is-light">verified</span></td><td class="sp-actions"><a href="in-domain.html">Open</a><a class="has-text-danger" href="in-domain-delete.html">Delete</a></td></tr>
           <tr><td><a href="in-domain.html"><strong>acme.io</strong></a></td><td><span class="tag is-success is-light">MX</span></td><td class="sp-mono sp-muted">10.0.4.12:2525</td><td>any address</td><td><span class="tag is-light">opportunistic</span></td><td class="sp-actions"><a href="in-domain.html">Open</a><a class="has-text-danger" href="in-domain-delete.html">Delete</a></td></tr>
         </tbody>
       </table></div>

docs/assets/panel-redesign/panel/src/in-filter-lists.html

@@ -66,7 +66,7 @@
         <dl class="sp-facts">
           <div><dt>Applied by</dt><dd>rspamd, from map files it rereads within seconds of a change</dd></div>
           <div><dt>Files</dt><dd><span class="sp-mono">/data/antispam/</span> — six, one for each list and kind of entry</dd></div>
-          <div><dt>Last written</dt><dd>2026-09-11 08:40 UTC</dd></div>
+          <div><dt>Last written</dt><dd>2026-09-11 08:40</dd></div>
           <div><dt>When both lists match</dt><dd>Deny wins, whichever entries they are.</dd></div>
         </dl>
       </div>

docs/assets/panel-redesign/panel/src/in-log.html

@@ -3,7 +3,7 @@
       <div class="sp-grow">
         <p class="sp-kicker">Inbound</p>
         <h1 class="title is-3">Inbound log</h1>
-        <p class="sp-lead">What port 25 decided about each message, one row per recipient. Accepted mail is recorded as it passes, refused mail is read from <code>mail.log</code>; the filter's verdict appears when the spam filter is on. Rows older than 90 days are deleted — change that in <a href="settings.html">Settings</a>.</p>
+        <p class="sp-lead">What port 25 decided about each message and what the upstream answered, one row per recipient. Accepted mail is recorded as it passes, refused mail is read from <code>mail.log</code>; the filter's verdict appears when the spam filter is on. Rows older than 90 days are deleted — change that in <a href="settings.html">Settings</a>.</p>
       </div>
     </div>
 
@@ -20,15 +20,16 @@
         <a class="sp-help" href="help.html#inbound-log" title="What the decisions mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th>Upstream</th><th></th></tr></thead>
         <tbody>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:18</td><td>t.berg@<wbr>uni.example<br><span class="sp-mono sp-muted sp-small">192.0.2.77</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">Re: [dev] patch series v3</td><td><button type="button" class="tag is-success is-light" popovertarget="why-1">accept</button><div class="sp-sheet" id="why-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 0.40 / 15.00</td></tr><tr><th>Subject</th><td>Re: [dev] patch series v3</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:31</td><td>ci@<wbr>builds.example<br><span class="sp-mono sp-muted sp-small">192.0.2.90</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">[ci] nightly build passed</td><td><button type="button" class="tag is-success is-light" popovertarget="why-7">accept</button><div class="sp-sheet" id="why-7" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-7" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 1.10 / 15.00</td></tr><tr><th>Subject</th><td>[ci] nightly build passed</td></tr></tbody></table></div></div></div></div></td><td><span class="tag is-light">queued</span></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example<br><span class="sp-mono sp-muted sp-small">203.0.113.140</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip">Outstanding invoice — action required</td><td><button type="button" class="tag is-success is-light" popovertarget="why-2">accept</button><div class="sp-sheet" id="why-2" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-2" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>add header, score 9.80 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">PHISHING(5.00)<br>FORGED_SENDER(3.00)<br>R_SPF_FAIL(1.00)</td></tr><tr><th>Subject</th><td>Outstanding invoice — action required</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:18</td><td>t.berg@<wbr>uni.example<br><span class="sp-mono sp-muted sp-small">192.0.2.77</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">Re: [dev] patch series v3</td><td><button type="button" class="tag is-success is-light" popovertarget="why-1">accept</button><div class="sp-sheet" id="why-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 0.40 / 15.00</td></tr><tr><th>Subject</th><td>Re: [dev] patch series v3</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-success is-light" popovertarget="up-1">sent</button><div class="sp-sheet" id="up-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">sent</span><h2>Upstream</h2><button type="button" popovertarget="up-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Host</th><td class="sp-mono sp-small">mx.upstream.example[198.51.100.5]:25</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">250 2.0.0 Ok: queued as CE05D10261D</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 14:00:19</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:57:41</td><td>promo@<wbr>bulk.example<br><span class="sp-mono sp-muted sp-small">198.51.100.90</span></td><td>sales@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-3">reject</button><div class="sp-sheet" id="why-3" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-3" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>postfix</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">550 5.1.1 &lt;sales@lists.example.org&gt;: Recipient address rejected: User unknown in relay recipient table</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example<br><span class="sp-mono sp-muted sp-small">203.0.113.140</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip">Outstanding invoice — action required</td><td><button type="button" class="tag is-success is-light" popovertarget="why-2">accept</button><div class="sp-sheet" id="why-2" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-2" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>add header, score 9.80 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">PHISHING(5.00)<br>FORGED_SENDER(3.00)<br>R_SPF_FAIL(1.00)</td></tr><tr><th>Subject</th><td>Outstanding invoice — action required</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-danger is-light" popovertarget="up-2">bounced</button><div class="sp-sheet" id="up-2" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">bounced</span><h2>Upstream</h2><button type="button" popovertarget="up-2" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Host</th><td class="sp-mono sp-small">mx.upstream.example[198.51.100.5]:25</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">550 5.7.1 Message rejected as spam by the upstream filter</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 13:59:04</td></tr><tr><th>Then</th><td>The sender was sent a bounce</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:51:30</td><td>billing@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">198.51.100.12</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-4">reject</button><div class="sp-sheet" id="why-4" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-4" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">5.7.1 Spam message rejected</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:57:41</td><td>promo@<wbr>bulk.example<br><span class="sp-mono sp-muted sp-small">198.51.100.90</span></td><td>sales@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-3">reject</button><div class="sp-sheet" id="why-3" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-3" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>postfix</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">550 5.1.1 &lt;sales@lists.example.org&gt;: Recipient address rejected: User unknown in relay recipient table</td></tr></tbody></table></div></div></div></div></td><td class="sp-muted">—</td><td class="sp-actions"></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:44:02</td><td>hr@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">192.0.2.31</span></td><td>jobs@<wbr>acme.io</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-warning is-light" popovertarget="why-5">tempfail</button><div class="sp-sheet" id="why-5" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-warning is-light">tempfail</span><h2>Why</h2><button type="button" popovertarget="why-5" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">4.7.1 Try again later</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:51:30</td><td>billing@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">198.51.100.12</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-4">reject</button><div class="sp-sheet" id="why-4" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-4" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">5.7.1 Spam message rejected</td></tr></tbody></table></div></div></div></div></td><td class="sp-muted">—</td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:30:55</td><td>noreply@<wbr>github.example<br><span class="sp-mono sp-muted sp-small">192.0.2.200</span></td><td>security@<wbr>lists.example.org</td><td class="sp-clip">[advisory] new report</td><td><button type="button" class="tag is-success is-light" popovertarget="why-6">accept</button><div class="sp-sheet" id="why-6" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-6" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score -98.10 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">SELFPOST_ALLOW_FROM(-100.00)<br>R_DKIM_ALLOW(-0.20)</td></tr><tr><th>Subject</th><td>[advisory] new report</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:44:02</td><td>hr@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">192.0.2.31</span></td><td>jobs@<wbr>acme.io</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-warning is-light" popovertarget="why-5">tempfail</button><div class="sp-sheet" id="why-5" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-warning is-light">tempfail</span><h2>Why</h2><button type="button" popovertarget="why-5" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">4.7.1 Try again later</td></tr></tbody></table></div></div></div></div></td><td class="sp-muted">—</td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:30:55</td><td>noreply@<wbr>github.example<br><span class="sp-mono sp-muted sp-small">192.0.2.200</span></td><td>security@<wbr>lists.example.org</td><td class="sp-clip">[advisory] new report</td><td><button type="button" class="tag is-success is-light" popovertarget="why-6">accept</button><div class="sp-sheet" id="why-6" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-6" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score -98.10 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">SELFPOST_ALLOW_FROM(-100.00)<br>R_DKIM_ALLOW(-0.20)</td></tr><tr><th>Subject</th><td>[advisory] new report</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-warning is-light" popovertarget="up-6">deferred</button><div class="sp-sheet" id="up-6" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-warning is-light">deferred</span><h2>Upstream</h2><button type="button" popovertarget="up-6" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Reply</th><td class="sp-mono sp-small">connect to mx.upstream.example[198.51.100.5]:25: Connection refused</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 13:45:12</td></tr><tr><th>Then</th><td>Postfix tries again; the message is in the queue</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
         </tbody>
       </table></div>
-      <div class="sp-box-foot"><span>Page 1 of 38</span><a href="#">Older →</a><span class="sp-end">A decision opens its reason · Allow / Deny sender opens <a href="in-filter-lists.html">Filter lists</a> with the entry filled in</span></div>
+      <div class="sp-box-foot"><span>Page 1 of 38</span><a href="#">Older →</a><span class="sp-end">A decision opens its reason, an upstream result its last reply · Allow / Deny sender opens <a href="in-filter-lists.html">Filter lists</a> with the entry filled in</span></div>
     </div>

docs/assets/panel-redesign/panel/src/in-quarantine-message.html

@@ -15,7 +15,7 @@
             <dl class="sp-facts">
               <div><dt>Inbound domain</dt><dd><a href="in-domain.html">lists.example.org</a></dd></div>
               <div><dt>Client</dt><dd class="sp-mono">203.0.113.140</dd></div>
-              <div><dt>Held</dt><dd>2026-09-21 13:59:02 UTC</dd></div>
+              <div><dt>Held</dt><dd>2026-09-21 13:59:02</dd></div>
               <div><dt>Deleted on</dt><dd>2026-10-05 · in 14 days</dd></div>
               <div><dt>Size</dt><dd>48 kB · 1 attachment (<span class="sp-mono">invoice.html</span>)</dd></div>
               <div><dt>Would go to</dt><dd class="sp-mono">mx.internal:25</dd></div>
@@ -40,13 +40,14 @@
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">03</span><h2>Headers</h2><div class="sp-end">The body and attachments are never rendered in the panel</div></div>
-<pre class="sp-log"><span class="sp-d">Received:</span> from mail.partner-billing.example (unknown [203.0.113.140]) by mail.example.org
+<pre class="sp-log"><span class="sp-ll"><span class="sp-d">Received:</span> from mail.partner-billing.example (unknown [203.0.113.140]) by mail.example.org
-<span class="sp-d">From:</span> "Partner Billing" &lt;invoice@partner-billing.example&gt;
+</span><span class="sp-ll"><span class="sp-d">From:</span> "Partner Billing" &lt;invoice@partner-billing.example&gt;
-<span class="sp-d">Reply-To:</span> <span class="sp-w">payments.dept@freemail.example</span>
+</span><span class="sp-ll"><span class="sp-d">Reply-To:</span> <span class="sp-w">payments.dept@freemail.example</span>
-<span class="sp-d">To:</span> owner@lists.example.org
+</span><span class="sp-ll"><span class="sp-d">To:</span> owner@lists.example.org
-<span class="sp-d">Subject:</span> Outstanding invoice — action required
+</span><span class="sp-ll"><span class="sp-d">Subject:</span> Outstanding invoice — action required
-<span class="sp-d">Date:</span> Mon, 21 Sep 2026 13:58:57 +0000
+</span><span class="sp-ll"><span class="sp-d">Date:</span> Mon, 21 Sep 2026 13:58:57 +0000
-<span class="sp-d">Authentication-Results:</span> <span class="sp-e">spf=fail dkim=none dmarc=fail</span></pre>
+</span><span class="sp-ll"><span class="sp-d">Authentication-Results:</span> <span class="sp-e">spf=fail dkim=none dmarc=fail</span>
+</span></pre>
     </div>
 
     <div class="columns">

docs/assets/panel-redesign/panel/src/in-quarantine.html

@@ -16,7 +16,7 @@
         </form>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Held, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
+        <thead><tr><th>Held</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example</td><td>owner@<wbr>lists.example.org</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Outstanding invoice — action required</strong></a></td><td class="sp-muted sp-small">score 9.8 · PHISHING</td><td class="sp-muted sp-nowrap">48 kB</td><td class="sp-nowrap">14 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-20 22:14:40</td><td>no-reply@<wbr>shipping-update.example</td><td>jobs@<wbr>acme.io</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Your parcel could not be delivered</strong></a></td><td class="sp-muted sp-small">score 8.1 · URL_SHORTENER</td><td class="sp-muted sp-nowrap">12 kB</td><td class="sp-nowrap">13 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>

docs/assets/panel-redesign/panel/src/in-queue.html

@@ -8,7 +8,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes every 10 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes on its own</div><a class="sp-help" href="help.html#inbound-queue" title="What waits here and why"><i class="ti ti-help-circle"></i></a></div>
       <div class="sp-empty"><i class="ti ti-stack-2"></i>Nothing is waiting. Every accepted message has reached its upstream.</div>
     </div>
 

docs/assets/panel-redesign/panel/src/login-no-admin.html

@@ -12,6 +12,6 @@
       <h1 class="title is-3">No administrator yet</h1>
       <p class="sp-muted">Open the one-time setup link printed in the container log to create one.</p>
     </div>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>

docs/assets/panel-redesign/panel/src/login-reset-sent.html

@@ -0,0 +1,27 @@
+<!-- title: Sign in | shell: bare -->
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="overview.html">
+      <p class="sp-kicker">mail.example.org</p>
+      <h1 class="title is-3">Sign in</h1>
+      <div class="notification is-success is-light"><i class="ti ti-circle-check"></i>If that account has a confirmed e-mail, the link is on its way. It works once, for 30 minutes.</div>
+      <div class="field">
+        <label class="label" for="username">Username</label>
+        <div class="control has-icons-left"><input class="input" id="username" name="username" autocomplete="username" required><span class="icon is-left"><i class="ti ti-user"></i></span></div>
+      </div>
+      <div class="field">
+        <label class="label" for="password">Password</label>
+        <div class="control has-icons-left"><input class="input" id="password" name="password" type="password" autocomplete="current-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
+      </div>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Sign in</button></div>
+      <p class="mt-4"><a href="login-reset.html">Forgot your password?</a></p>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>

docs/assets/panel-redesign/panel/src/login-reset-set.html

@@ -0,0 +1,26 @@
+<!-- title: New password | shell: bare -->
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="login.html">
+      <p class="sp-kicker">mail.example.org · admin</p>
+      <h1 class="title is-3">New password</h1>
+      <p class="sp-muted mb-4">Setting it signs every session of this account out; sign in with it afterwards.</p>
+      <div class="field">
+        <label class="label" for="new_password">New password</label>
+        <div class="control has-icons-left"><input class="input" id="new_password" name="new_password" type="password" autocomplete="new-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
+      </div>
+      <div class="field">
+        <label class="label" for="new_password_confirm">Repeat</label>
+        <div class="control has-icons-left"><input class="input" id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
+      </div>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Set password</button></div>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>

docs/assets/panel-redesign/panel/src/login-reset.html

@@ -0,0 +1,23 @@
+<!-- title: Reset password | shell: bare -->
+<div class="columns is-gapless sp-signin">
+  <div class="column is-half sp-signin-brand">
+    <div>
+      <img src="../../selfpost-stamp.svg" alt="SelfPost">
+      <p>YOUR SMTP. YOUR RULES.</p>
+    </div>
+  </div>
+  <div class="column is-half sp-signin-form">
+    <form class="sp-form" method="post" action="login-reset-sent.html">
+      <p class="sp-kicker">mail.example.org</p>
+      <h1 class="title is-3">Reset password</h1>
+      <p class="sp-muted mb-4">A link to set a new password goes to the e-mail of the account, once that address is confirmed under Account. It works once, for 30 minutes.</p>
+      <div class="field">
+        <label class="label" for="username">Username</label>
+        <div class="control has-icons-left"><input class="input" id="username" name="username" autocomplete="username" required><span class="icon is-left"><i class="ti ti-user"></i></span></div>
+      </div>
+      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Send the link</button></div>
+      <p class="mt-4"><a href="login.html">Back to sign in</a></p>
+    </form>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+  </div>
+</div>

docs/assets/panel-redesign/panel/src/login.html

@@ -19,7 +19,8 @@
         <div class="control has-icons-left"><input class="input" id="password" name="password" type="password" autocomplete="current-password" required><span class="icon is-left"><i class="ti ti-lock"></i></span></div>
       </div>
       <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Sign in</button></div>
+      <p class="mt-4"><a href="login-reset.html">Forgot your password?</a></p>
     </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>

docs/assets/panel-redesign/panel/src/out-app.html

@@ -3,7 +3,7 @@
       <div class="sp-grow">
         <p class="sp-kicker"><a href="out-domains.html">Outbound domains</a> / <a href="out-domain.html">example.org</a> / Applications /</p>
         <h1 class="title is-3 sp-mono">prod-server</h1>
-        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h. The same form, empty, adds a new application.</p>
+        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h.</p>
       </div>
       <div class="buttons">
         <a class="button" href="out-app-created.html"><i class="ti ti-key"></i>New password</a>
@@ -19,7 +19,7 @@
             <div class="sp-box-body">
               <div class="field"><label class="label" for="login">Login</label>
                 <div class="control"><input class="input sp-mono" id="login" name="login" value="prod-server" autocomplete="off" spellcheck="false" required></div>
-                <p class="help">Unique across domains; letters, digits, <code>.</code> <code>-</code> <code>_</code>.</p></div>
+                <p class="help">Fixed: add a new application to use another login.</p></div>
               <div class="field"><label class="label" for="amode">May send as</label>
                 <div class="control"><div class="select is-fullwidth"><select id="amode" name="mode"><option selected>Any address of the domain</option><option>Specific addresses (list)</option></select></div></div></div>
               <div class="field"><label class="label" for="addresses">Addresses</label>

docs/assets/panel-redesign/panel/src/out-domain-delete.html

@@ -15,6 +15,7 @@
             <ul class="sp-list-check">
               <li><i class="ti ti-x"></i>permanently delete its DKIM signing key;</li>
               <li><i class="ti ti-x"></i>delete <strong>both applications</strong> (<span class="sp-mono">prod-server</span>, <span class="sp-mono">alerts</span>) with their credentials and sender bindings;</li>
+              <li><i class="ti ti-x"></i>delete the <strong>12 DMARC reports</strong> received for it;</li>
               <li><i class="ti ti-x"></i>stop signing mail as the domain.</li>
             </ul>
             <p class="sp-muted mb-4">The published DKIM record becomes invalid — remove it from DNS unless you plan to re-add the domain. Inbound domains are not touched.</p>

docs/assets/panel-redesign/panel/src/out-domain-settings.html

@@ -38,6 +38,8 @@
                 <div class="field"><label class="label" for="encpw2">Repeat password</label><div class="control"><input class="input" id="encpw2" type="password"></div></div>
               </div>
               <p class="help mb-3">Keep this password: SelfPost does not store it, and the file cannot be opened without it.</p>
+              <div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password" required></div>
+                <p class="help">The one you sign in with, asked at every export: the file holds the domain's DKIM key and its applications' credentials.</p></div>
               <button type="submit" class="button"><i class="ti ti-download"></i>Export domain</button>
             </form>
           </div>
@@ -51,9 +53,9 @@
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="mode">Limit mode</label>
                 <div class="control"><div class="select is-fullwidth"><select id="mode" name="mode"><option>Manual</option><option selected>Auto (from statistics)</option></select></div></div></div>
-              <div class="field"><label class="label" for="mult">Multiplier (1.5–10, default 3)</label>
+              <div class="field"><label class="label" for="mult">Multiplier (1.5–5, default 2.5)</label>
                 <div class="control"><input class="input" id="mult" name="auto_multiplier" type="number" min="1.5" max="10" step="0.1" value="3"></div>
-                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00 UTC.</p></div>
+                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00.</p></div>
               <div class="buttons">
                 <button type="submit" class="button is-primary">Save limit</button>
                 <button type="submit" class="button" formaction="#recalc">Recalculate now</button>

docs/assets/panel-redesign/panel/src/out-domain.html

@@ -40,8 +40,8 @@
         <div class="box" id="dns">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>DNS records</h2><div class="sp-end">Checked 3 min ago</div><a class="sp-help" href="help.html#dns" title="What to publish and why"><i class="ti ti-help-circle"></i></a></div>
 
-          <div class="sp-record">
+          <details class="sp-record">
-            <div class="sp-record-head"><h3>DKIM</h3><span class="tag is-success is-light">published</span><small>Not a secret · selector <code>sp2026</code></small></div>
+            <summary class="sp-record-head"><h3>DKIM</h3><span class="tag is-success is-light">published</span><small>Not a secret · selector <code>sp2026</code></small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="sp2026._domainkey.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -49,7 +49,7 @@
             </div>
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><textarea class="textarea" rows="3" readonly>v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx3kqV0mJd8e2f1Yb7Qw5uT9sLr4nHc6pZaXo1vKe0yWm2gBt8RjN5dCq3hUf7lPs9aEi4oMz6xTb1kGv0nYw…IDAQAB</textarea></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-          </div>
+          </details>
 
           <div class="sp-record">
             <div class="sp-record-head"><h3>SPF</h3><span class="tag is-danger is-light">mismatch</span><small>Merge into the existing record — never publish a second one</small></div>
@@ -65,8 +65,8 @@
               <p class="help is-danger">The published record does not authorize 203.0.113.25. Add <code>ip4:203.0.113.25</code> before <code>~all</code>. Shallow check: <code>include:</code> is not followed.</p></div>
           </div>
 
-          <div class="sp-record">
+          <details class="sp-record">
-            <div class="sp-record-head"><h3>DMARC</h3><span class="tag is-success is-light">published</span><small>Report address: <a href="out-domain-settings.html">example.org@dmarc.mail.example.org</a></small></div>
+            <summary class="sp-record-head"><h3>DMARC</h3><span class="tag is-success is-light">published</span><small>Report address: <a href="out-domain-settings.html">example.org@dmarc.mail.example.org</a></small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="_dmarc.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -75,7 +75,7 @@
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=DMARC1; p=none; rua=mailto:example.org@dmarc.mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div>
               <p class="help"><code>p=none</code> does not affect delivery. Tighten to <code>quarantine</code>, then <code>reject</code>, once the <a href="dmarc-domain.html">reports</a> look clean.</p></div>
-          </div>
+          </details>
         </div>
 
         <div class="box" id="apps">

docs/assets/panel-redesign/panel/src/out-log.html

@@ -21,7 +21,7 @@
         <a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td>shop@<wbr>shop.example.org</td><td>m.keller@<wbr>gmx.de</td><td class="sp-clip">Your order #48213 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:50</td><td>shop@<wbr>shop.example.org</td><td>anna.lind@<wbr>outlook.com</td><td class="sp-clip">Your order #48212 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>

docs/assets/panel-redesign/panel/src/out-message.html

@@ -15,8 +15,8 @@
             <dl class="sp-facts">
               <div><dt>Domain</dt><dd><a href="out-domain.html">example.org</a></dd></div>
               <div><dt>Application</dt><dd class="sp-mono"><a href="out-app.html">alerts</a></dd></div>
-              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07 UTC</dd></div>
+              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07</dd></div>
-              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09 UTC</dd></div>
+              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09</dd></div>
               <div><dt>Queue id</dt><dd class="sp-mono">4XcB7k2Jm9z1</dd></div>
               <div><dt>Journal id</dt><dd class="sp-mono">184220</dd></div>
             </dl>
@@ -28,9 +28,9 @@
           <div class="sp-box-head"><span class="sp-no">02</span><h2>History</h2><a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Accepted</strong> from <span class="sp-mono">alerts</span> at 198.51.100.7</li>
+              <li><time>2026-09-21 13:58:07</time><strong>Accepted and queued</strong> — Postfix accepted the message over an authenticated submission and the journal-milter recorded it.</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — the receiving server asked to retry later</li>
+              <li class="sp-warn"><time>2026-09-21 13:58:09</time><strong>Deferred, will be retried</strong> — the receiving server could not take the message yet. Postfix retries: first after 5 minutes, then with increasing gaps up to 1 hour 7 minutes, for up to 5 days.</li>
-              <li class="sp-pending"><time>next attempt ≈ 14:08 UTC</time>Still in the <a href="out-queue.html">queue</a>; kept for 5 days, then bounced</li>
+              <li class="sp-pending"><time>not yet</time>Still in the queue; the next attempt is Postfix's own, and after 5 days it is bounced.</li>
             </ol>
           </div>
         </div>
@@ -39,8 +39,9 @@
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">03</span><h2>Delivery log</h2><div class="sp-end">Lines from <code>mail.log</code> with this queue id</div></div>
-<pre class="sp-log"><span class="sp-d">13:58:07</span> postfix/smtpd[2114]: 4XcB7k2Jm9z1: client=unknown[198.51.100.7], sasl_username=alerts
+<pre class="sp-log"><span class="sp-ll"><span class="sp-d">13:58:07</span> postfix/smtpd[2114]: 4XcB7k2Jm9z1: client=unknown[198.51.100.7], sasl_username=alerts
-<span class="sp-d">13:58:07</span> postfix/cleanup[2120]: 4XcB7k2Jm9z1: message-id=&lt;a81f0c@alertmanager&gt;
+</span><span class="sp-ll"><span class="sp-d">13:58:07</span> postfix/cleanup[2120]: 4XcB7k2Jm9z1: message-id=&lt;a81f0c@alertmanager&gt;
-<span class="sp-d">13:58:07</span> postfix/qmgr[2061]: 4XcB7k2Jm9z1: from=&lt;alerts@example.org&gt;, size=2214, nrcpt=1 (queue active)
+</span><span class="sp-ll"><span class="sp-d">13:58:07</span> postfix/qmgr[2061]: 4XcB7k2Jm9z1: from=&lt;alerts@example.org&gt;, size=2214, nrcpt=1 (queue active)
-<span class="sp-d">13:58:09</span> <span class="sp-w">postfix/smtp[2123]: 4XcB7k2Jm9z1: to=&lt;noc@example.org&gt;, relay=mx1.example.org[192.0.2.10]:25, delay=1.9, status=deferred (host mx1.example.org said: 451 4.7.1 Greylisted, try again in 5 minutes)</span></pre>
+</span><span class="sp-ll"><span class="sp-d">13:58:09</span> <span class="sp-w">postfix/smtp[2123]: 4XcB7k2Jm9z1: to=&lt;noc@example.org&gt;, relay=mx1.example.org[192.0.2.10]:25, delay=1.9, status=deferred (host mx1.example.org said: 451 4.7.1 Greylisted, try again in 5 minutes)</span>
+</span></pre>
     </div>

docs/assets/panel-redesign/panel/src/out-queue.html

@@ -3,14 +3,14 @@
       <div class="sp-grow">
         <p class="sp-kicker">Outbound</p>
         <h1 class="title is-3">Outbound queue</h1>
-        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes every 10 s.</p>
+        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes on its own.</p>
       </div>
     </div>
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">1 message · 3.1 kB</div><a class="sp-help" href="help.html#queue" title="What waits here and how Postfix retries"><i class="ti ti-help-circle"></i></a></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Queue id</th><th>Arrived, UTC</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
+        <thead><tr><th>Queue id</th><th>Arrived</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono">4XcB7k2Jm9z1</td><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:58:07</td><td>alerts@<wbr>example.org</td><td>noc@<wbr>example.org</td><td class="sp-muted">451 4.7.1 Greylisted, try again in 5 minutes</td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
         </tbody>