Open sourceIn the free reqad package (GPL-3.0).

Email

Reqad ships a complete mail stack: exim and dovecot for sending and receiving, Roundcube for webmail, and SpamAssassin for filtering - with SPF, DKIM and SRS.

The email overview

Email in the sidebar opens a single page for the whole mail stack. At a glance it shows how many mailboxes, forwarders and autoresponders exist and how many messages are sitting in the queue - each figure links to the page that manages it.

Below that, one card per component: exim and dovecot with their version, whether the service is running, which ports and protocols they answer on, and how long they have been up; dovecot also reports whether full-text search is available. Further cards cover SpamAssassin, ClamAV and Roundcube with its webmail plugins. Anything that needs your attention has a small (i) icon next to it that opens the fix below, under When the Email page shows a problem.

Enable email for an account

1. Open the account and toggle email on.
2. Reqad generates DKIM keys and the required DNS records.
3. Verify SPF, DKIM and reverse DNS from the email settings page.

Mailboxes & forwarders

• Create mailboxes per domain, with disk usage tracking.
• Add forwarders, including pipe-to-program forwards.
• Set up autoresponders with start/end dates.
• Filter incoming mail per server, per domain or per mailbox - see Email filters.

Filters

Mail can be sorted, flagged, redirected or blocked as it arrives, with rules at three levels - the whole server, one domain, or a single mailbox. Per-mailbox rules are the same ones users see in webmail. See Email filters.

The mail queue

Mail that could not be delivered on the first attempt waits in exim's queue. The queue manager at the bottom of the Email page lists each message with its age, size, sender, recipients and subject, and marks anything exim has frozen - a message it has stopped retrying, usually because the recipient is rejecting it.

• View the full headers and the start of the body.
• Deliver forces an immediate retry and streams exim's own delivery log into the window, which is usually where the reason for a failure is written.
• Freeze and Thaw stop and resume retries for one message.
• Delete removes it. This is permanent - the message is not bounced or archived.

Use Select to act on several messages at once, or search by sender or recipient to find one. Run queue retries everything, and Delete all frozen clears out mail that is never going to be delivered.

Mail server settings

The Configure button on the exim and dovecot cards opens that server's settings in the browser - no SSH needed. The common options are grouped into a form:

• Exim - minimum TLS version, cipher list and listening ports; maximum message size, recipients and connections; hostname, SMTP banner and logging; and queue behaviour, such as how long a frozen message is kept and when it is retried.
• Exim blocklists - the DNS blocklists (RBLs) consulted while accepting mail, on their own tab. Blocklists that no longer answer are flagged, because a dead one does not fail quietly: every lookup waits for a DNS timeout, on every message.
• Dovecot - TLS settings, per-user connection limits, and authentication debug switches for tracking down a login problem.

An Advanced tab exposes the raw configuration file for anything the form does not cover, with the last five versions kept so you can go back.

Webmail

Roundcube is available at the webmail URL for each server, so users can read mail in the browser.

You can also switch on webmail auto-login in the dovecot settings. Each row on the Email Accounts page then gains a Webmail button that opens that mailbox in Roundcube, already signed in - useful for checking a user's mail without asking for, or resetting, their password. It works through a dovecot master user, so no password is exposed and the link is single-use and expires within seconds.

When the Email page shows a problem

Each of these has an (i) icon next to it on the Email page that links straight to its fix. The commands run as root on the server.

A service is stopped

Start it again from Services in the panel, or from the shell (the services are exim, dovecot, spamassassin and clamd):

systemctl restart exim

If it stops again straight away, its log says why:

journalctl -u exim -n 50 --no-pager

The usual cause is a configuration error after a manual edit. The Configure button on the exim and dovecot cards keeps the last five versions of the configuration on its Advanced tab, so you can go back to one that worked. ClamAV does not start until it has downloaded its first signature database - see ClamAV signatures are out of date.

Local delivery: Exim appender (legacy)

Exim writes incoming mail into the mailboxes itself. Mail is delivered, but email filters and filter editing from webmail need dovecot to do the delivering (dovecot LMTP). First check that the server is ready - this only reads and changes nothing:

bash /usr/local/reqad/scripts/update/setup_dovecot_sieve.sh --check

Then switch:

bash /usr/local/reqad/scripts/update/setup_dovecot_sieve.sh

The script stops if the check fails, and puts the old configuration back if exim or dovecot rejects the new one. It is safe to run again.

Local delivery: unknown

Exim's configuration has no route to the local mailboxes that Reqad recognises, so mail for your own domains may not be delivered. This happens when the exim configuration is damaged or was changed by hand. Restore it from the newest good backup:

bash /usr/local/reqad/scripts/update/repair_truncated_exim_conf.sh

The script does nothing when the configuration is complete. In that case open Configure on the exim card and go back to an earlier version on the Advanced tab.

SpamAssassin is not installed

Without it, incoming mail is accepted without a spam score. Install it with Reqad's settings:

dnf install -y spamassassin
cp /usr/local/reqad/scripts/install/config/spamassassin_local.txt /etc/mail/spamassassin/local.cf
echo 'SPAMDOPTIONS="-c -m5 -H"' > /etc/sysconfig/spamassassin
sa-update -v
systemctl enable --now spamassassin sa-update.timer
bash /usr/local/reqad/scripts/update/setup_spam_score_logging.sh

The last line makes exim score every incoming message as the account that receives it, so each account's own allow and block lists from Spam Filters apply.

SpamAssassin rules are out of date

New rules are published every few days to a few weeks and fetched by the sa-update timer. If the card says never, or the last update is months old, the timer is not running. Turn it on and fetch the rules now:

systemctl enable --now sa-update.timer
sa-update -v && systemctl restart spamassassin

sa-update exits with code 1 when there is simply nothing new; that is not an error.

ClamAV is not installed

ClamAV scans incoming mail for viruses and other malware. One script installs the scanner, its services and the extra signature databases:

bash /usr/local/reqad/scripts/install/install-clamav.sh

It leaves exim as it is; turn scanning on afterwards from the ClamAV card (see below). To do both in one go, run it as SCAN_MODE=tag bash ... or SCAN_MODE=deny bash ....

ClamAV signatures are out of date

The freshclam service fetches new signatures several times a day, so an update that is days old means it has stopped. Restart it and fetch once by hand:

systemctl stop freshclam
freshclam
systemctl start freshclam clamd

Stop the service first: while it runs, a second freshclam cannot open the log file and gives up. If the fetch fails, the error usually points at DNS or the firewall blocking outgoing HTTPS. Its log is /var/log/clamav/freshclam.log.

ClamAV scanning: not wired into exim

ClamAV is running but exim does not send mail to it, so nothing is scanned. Use the buttons at the bottom of the ClamAV card:

• Enable scanning (tag only) - infected mail is still delivered, with a header saying what was found. A safe way to start.
• Reject infected - infected mail is refused while it is being received, so the sender gets the error and nothing reaches the mailbox.
• Turn off - stops scanning again.

Roundcube plugin missing

A plugin is listed in Roundcube's configuration but its folder is not in /usr/local/reqad/roundcubemail/plugins/. Roundcube may then fail to load. Either put the plugin back or take its name out of the $config['plugins'] list in /usr/local/reqad/roundcubemail/config/config.inc.php. For the plugins Reqad itself adds:

• reqad_autologin - run bash /usr/local/reqad/scripts/update/install-webmail-autologin.sh, or switch webmail auto-login off and on in the dovecot settings.
• managesieve and the other plugins that come with Roundcube - copy the folder back from the Roundcube release of the version shown on the card, or let the next Roundcube update put it back (bash /usr/local/reqad/scripts/update/update_roundcube.sh copies the files only when a newer version is out).

Deliverability

For best inbox placement, make sure each sending domain has a valid SPF record, a published DKIM key (Reqad creates one per domain), and correct reverse DNS for your server IP.

Need a hand? Create a free account or contact us.