Email and mail server

How do I setup internal mail to be sent over SMTP?

By default, emails generated by Hestia (Notifications, Forgot password, update logs, etc.) are sent the internal mail. If you want, you can setup mail to be send over a SMTP account.

Execute the following script and follow the instructions:

bash /usr/local/hestia/install/upgrade/manual/configure-server-smtp.sh

The script will ask you for the following SMTP parameters:

• Host (e.g. smtp.example.com)
• Port (e.g. 25, 465 or 587)
• Security (e.g. STARTTLS)
• Username
• Password
• Email Address (i.e. the sender address).

I am unable to send email

First, check that port 25 is open for outgoing traffic. A lot of providers block port 25 by default to combat spam.

To do so, run the following command:

telnet ASPMX.L.GOOGLE.COM 25

If the connection was successful you will see something similar to this:

Trying 2a00:1450:400c:c00::1b...
Connected to ASPMX.L.GOOGLE.COM.
Escape character is '^]'.
220 mx.google.com ESMTP a7si1253985wrr.455 - gsmtp

If not, you have 2 options:

1. Contact you provider and ask them to open port 25 for outgoing traffic.
2. Setup a mail relay under the mail domain settings or set it up generally for the server in system settings. For this you need to use an SMTP relay service like:
   • Amazon SES
   • SMTP2GO
   • Brevo

What is an SMTP relay service and how to set it up

SMTP mail relay is the process of transferring an email from one server to another for delivery. Often email from a server is blocked by the service provider due to fear of spam. Or the IP reputation is so low that all email go straight into the spam box. To prevent such issues a lot of companies offer a SMTP relay that takes care of the delivery part. As they send a lot email via the same ip addresses they have a better reputation.

To setup create a account by the provider you want or use and follow their instruction to update your DNS. When completed you can enter the SMTP user account they provider in the settings under "Global SMTP" or under the "Edit mail domain" -> "SMTP relay"

I am unable to receive email

If you are unable to receive emails, make sure you have setup your DNS properly. If you are using Cloudflare, disable the use of the proxy for mail.domain.tld.

When you are done you can check the configuration via MXToolBox.

Rejected because [ip] is in black list at zen.spamhaus.org. Error open resolver: https://www.spamhaus.org/returnc/pub/65.1.174.102

1. Go to Spamhaus free data query account
2. Fill in the form and verify your email address by via the link in the email you recive.
3. Once logged, go to Products → DQS and you will see your Query Key and below you will see the exactly fqdn that you will need to use Zen Spamhaus black list. Something like: HereYourQueryKey.zen.dq.spamhaus.net
4. Edit /etc/exim4/dnsbl.conf and replace zen.spamhaus.org with HereYourQueryKey.zen.dq.spamhaus.net
5. Also edit /etc/exim4/exim4.conf.template on the line: deny message = Rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text to deny message = Rejected because $sender_host_address is in a black list to prevent your Query key from leaking
6. Restart exim4 with systemctl restart exim4

How do I disable internal lookup for email

If you use an SMTP relay or want to use DKIM on your web server but host email on gmail you need to disable internal lookup in Exim4.

nano /etc/exim4/exim4.conf.template

dnslookup:
driver = dnslookup
domains = !+local_domains
transport = remote_smtp
no_more

Replace with:

dnslookup:
driver = dnslookup
domains = *
transport = remote_smtp
no_more

How do I install SnappyMail?

You can install SnappyMail by running the following command:

v-add-sys-snappymail

Can I login into the backend of SnappyMail

In the root folder, there is a file called .snappymail containing the username and password:

Username: admin_f0e5a5aa
Password: D0ung4naLOptuaa
Secret key: admin_f0e5a5aa

You can access the admin by navigating to https://webmail.domain.tld/?admin_f0e5a5aa, and login by using the data you found in the file. Once it’s not needed anymore, remove the file, for security reasons.

Can I use Cloudflare Proxy with email

No, Cloudflare’s Proxy does not work with email. If you use email hosted on you server, make sure the proxy for the A record mail.domain.tld is switched off. Otherwise, you will not be able receive emails. The following records are suggested if you want to use Hestia as your mail server:

• A record with name mail pointing to your server IP.
• A record with name webmail pointing to your server IP.
• MX record with name @ with pointing to mail.domain.tld.
• TXT record with name @ containing v=spf1 a mx ip4:your ip; \~all
• TXT record with name _domainkey containing t=y; o=~;
• TXT record with name mail._domainkey containing t=y; o=~DKIM key;
• TXT record with name _dmarc containing v=DMARC1; p=quarantine; sp=quarantine; adkim=s; aspf=s;

The DKIM key and SPF record can be found in the Mail Domains list (documentation).

When sending send emails from my server, they end up in the spam folder

Make sure you have set up the correct RDNS, SPF records and DKIM records.

If this doesn’t work, it’s be possible that your IP address is on one or more blacklists. You can try to unblock yourself, but often the easier method is to use SMTP and SMTP Relay with Amazon SES or another SMTP provider.

How can I enable ManageSieve?

During Hestia’s installation, use the --sieve flag. If Hestia is already installed, there is a an upgrade script provided at the following path: /usr/local/hestia/install/upgrade/manual/install_sieve.sh

Can I allow access to ManageSieve via an external mail client?

Open port 4190 in the firewall. Read the firewall documentation.

How can I enable ManageSieve for Snappymail?

Edit /etc/snappymail/data/_data_/_default_/domains/default.json and modify the following settings:

"Sieve": {
	"host": "localhost",
	"port": 4190,
	"type": 0,
	"timeout": 10,
	"shortLogin": false,
	"lowerLogin": true,
	"sasl": [
		"SCRAM-SHA3-512",
		"SCRAM-SHA-512",
		"SCRAM-SHA-256",
		"SCRAM-SHA-1",
		"PLAIN",
		"LOGIN"
	],
	"ssl": {
		"verify_peer": false,
		"verify_peer_name": false,
		"allow_self_signed": false,
		"SNI_enabled": true,
		"disable_compression": true,
		"security_level": 1
	},
	"enabled": false # Change this to true
},

Oracle Cloud + SMTP relay

If you want to use the SMTP from Oracle Cloud you need to make the following changes to Exim4 Configuration:

Open /etc/exim4/exim4.conf.template and replace the following code:

smtp_relay_login:
driver = plaintext
public_name = LOGIN
hide client_send = : SMTP_RELAY_USER : SMTP_RELAY_PASS

With:

smtp_relay_login:
driver = plaintext
public_name = PLAIN
hide client_send = ^SMTP_RELAY_USER^SMTP_RELAY_PASS

See forum topic for more info

Setting up mail hooks

Some SMTP relay services might require you to set the domain within the SMTP relay account. To automate this hooks have been added to v-add-mail-domain and v-delete-mail domains.

Create: $HESTIA/data/extensions/add-mail-domain.sh and $HESTIA/data/extensions/v-delete-mail-domain.sh

Proxmox mail server

See: Github

# v-add-mail-domain
SMTP_RELAY_PMG_USER="user"
SMTP_RELAY_PMG_PASS="password"
SMTP_RELAY_PMG_HOST="host"
SMTP_RELAY_PMG_PORT="port"

pmg_auth=$(curl -s --request POST -d "username=$SMTP_RELAY_PMG_USER&password=$SMTP_RELAY_PMG_PASS" \
	--url https://$SMTP_RELAY_PMG_HOST:$SMTP_RELAY_PMG_PORT/api2/json/access/ticket)
pmg_ticket=$(echo $pmg_auth | jq -r '.data.ticket')
pmg_csrf=$(echo $pmg_auth | jq -r '.data.CSRFPreventionToken')
if [ -n "$pmg_ticket" ]; then
	pmg_config_domain=$(curl -s --request POST -d "domain=$domain" \
		-H "CSRFPreventionToken: $pmg_csrf" -H "Cookie: PMGAuthCookie=$pmg_ticket" \
		https://$SMTP_RELAY_PMG_HOST:$SMTP_RELAY_PMG_PORT/api2/json/config/domains)
	pmg_config_transport=$(curl -s --request POST -d "domain=$domain&host=$SMTP_RELAY_PMG_LOCAL_IP" \
		-H "CSRFPreventionToken: $pmg_csrf" -H "Cookie: PMGAuthCookie=$pmg_ticket" \
		https://$SMTP_RELAY_PMG_HOST:$SMTP_RELAY_PMG_PORT/api2/json/config/transport)
fi

# v-delete-mail-domain.sh
SMTP_RELAY_PMG_USER="user"
SMTP_RELAY_PMG_PASS="password"
SMTP_RELAY_PMG_HOST="host"
SMTP_RELAY_PMG_PORT="port"

if [ -n "$SMTP_RELAY_PMG" ]; then
	pmg_auth=$(curl -s --request POST -d "username=$SMTP_RELAY_PMG_USER&password=$SMTP_RELAY_PMG_PASS" \
		--url https://$SMTP_RELAY_PMG_HOST:$SMTP_RELAY_PMG_PORT/api2/json/access/ticket)
	pmg_ticket=$(echo $pmg_auth | jq -r '.data.ticket')
	pmg_csrf=$(echo $pmg_auth | jq -r '.data.CSRFPreventionToken')
	if [ -n "$pmg_ticket" ]; then
		pmg_config_domain=$(curl -s --request DELETE \
			-H "CSRFPreventionToken: $pmg_csrf" -H "Cookie: PMGAuthCookie=$pmg_ticket" \
			https://$SMTP_RELAY_PMG_HOST:$SMTP_RELAY_PMG_PORT/api2/json/config/domains/$domain)
		pmg_config_transport=$(curl -s --request DELETE \
			-H "CSRFPreventionToken: $pmg_csrf" -H "Cookie: PMGAuthCookie=$pmg_ticket" \
			https://$SMTP_RELAY_PMG_HOST:$SMTP_RELAY_PMG_PORT/api2/json/config/transport/$domain)
	fi
fi