# Email & webmail
URL: https://openship.io/docs/guides/email-webmail.md

Run your own self-hosted mail server and a webmail app with Openship — provision it, manage domains and mailboxes, and put an inbox in the browser.

import { Step, Steps } from 'fumadocs-ui/components/steps';

Most people rent their email from someone else — Gmail, Outlook, and the like. Openship lets you run the
whole post office yourself: a real mail server on your own machine, with your own domain, that sends and
receives mail and even gives you a webmail inbox in the browser. Think of it as the difference between renting
a PO box and owning the building.

You're not limited to one, either. Each mail server runs on its own host (one mail setup per server), and
Openship keeps them all in a single **Mail servers** list — provision as many as you like and switch between
them from one place. A lone server opens straight into its admin panel; once you have more than one, you land
on the list first.

This is a big, hands-on feature, so this guide stays at the map level: what each screen does and the order you
go through them. The fiddly bits — the exact DNS records and the reverse-DNS setup — are called out where they
happen, because the wizard walks you through those live.

<Callout title="Self-hosted only" type="warn">
Email lives entirely in **self-hosted Openship**. The **Emails** item only appears in the sidebar when you're
running Openship on your own infrastructure — it isn't part of the managed cloud. If you don't see it, you're
on a hosted plan. See [Installation](/docs/getting-started/installation) to self-host.
</Callout>

<Callout title="What you need first">
- Openship running self-hosted, with at least one **connected server** (a clean Ubuntu or Debian machine is
  recommended). See [Connect your own server](/docs/guides/custom-servers) if you don't have one yet.
- A **domain name** you control, where you can edit DNS records.
- **Port 25 open** for outbound mail — some hosting providers block it by default, so check before you start.
- Access to your **VPS provider's panel** (for the reverse-DNS step near the end).
</Callout>

A few words you'll see a lot:

- **Mail server** — the software that actually sends and receives email. Openship installs a well-known stack
  (Postfix, Dovecot, and anti-spam tools) for you.
- **Mailbox** — one email account, like `you@yourdomain.com`, with its own password and inbox.
- **DNS records** — public settings for your domain that tell the rest of the internet where your mail lives.
- **Webmail** — an email app you open in a browser, so you don't need to configure a separate mail app.

## Step 1 — Provision a mail server

<Steps>

<Step>

### Open the Emails page

In the sidebar, click **Emails**. With no mail server set up yet, you land straight on the **Mail Server
Setup** form. If you already run **several** mail servers, you'll see a list of them first — click **Add mail
server** to start another. (With a single existing server, Openship opens it straight to its admin panel; use
the **Add mail server** button there to set up another.)

<Callout title="Screenshot">The **Emails** page showing the "Mail Server Setup" form (server picker, Domain field, Admin Password field). *(screenshot pending)*</Callout>

</Step>

<Step>

### Pick a server and a domain

Choose which of your connected servers the mail stack should run on. If you only have one, Openship picks it
for you.

Then fill in two things:

- **Domain** — your bare domain, like `example.com` (no `https://`, no path). Openship shows you that your
  mail server will live at `mail.example.com`.
- **Admin Password** — the password for the first mailbox, `postmaster@yourdomain`. You'll use it to log in
  after setup. Don't want to think one up? Click **Generate** for a strong random one, then copy it somewhere
  safe.

The right-hand panel lists exactly what gets installed — the mail stack, an automatic **Let's Encrypt** SSL
certificate, the DNS records you'll need, and the admin panel — plus the prerequisites (a domain with DNS
access, port 25 open, a clean server).

</Step>

<Step>

### Press Start Setup and watch it run

Click **Start Setup**. Openship connects to your server and works through the install one step at a time
(system update, mail stack, SSL, and so on), streaming the logs live — like watching the oven through the
glass door. You don't have to do anything while it runs.

Partway through, it pauses twice to wait for you. Those two pauses are the next two steps.

</Step>

<Step>

### Publish your DNS records

The install stops and shows a banner: **Publish DNS records before continuing**. Below it are cards — one per
record (things like MX, SPF, DKIM, and DMARC) — each with a **Copy value** button.

Go to wherever your domain's DNS is managed, add each record, and come back. Then click **I've set the records
- continue**.

<Callout title="Screenshot">The DNS hold banner on the Emails page: the "Publish DNS records" heading with a card per record and copy buttons. *(screenshot pending)*</Callout>

<Callout title="Why this matters" type="info">
Email delivery breaks without these records — they're how Gmail and Outlook decide your mail is real and not
spam. If you host DNS at a supported provider, the banner also offers **Auto-configure DNS**, which pushes the
records for you. Otherwise, copy them in by hand. For a gentler intro to DNS, see [Custom domains](/docs/guides/custom-domains).
</Callout>

</Step>

<Step>

### Set reverse DNS (PTR)

Next comes a second banner: **Set reverse DNS (PTR) before continuing**. This one is different — you set it at
your **VPS provider's panel** (Hostinger, DigitalOcean, AWS, and so on), **not** at your DNS provider.

The banner shows your server's IP address and the value to point it at (`mail.yourdomain`). Set it there, wait
a few minutes for it to take effect, then click **I've set the PTRs - continue**.

<Callout title="Screenshot">The PTR hold banner showing the server IP, the target `mail.<domain>` value, and the "I've set the PTRs - continue" button. *(screenshot pending)*</Callout>

<Callout title="Reverse DNS in one line" type="info">
Normal DNS turns a name into an IP address; reverse DNS (a **PTR** record) turns the IP back into a name. Big
mail providers reject mail from servers whose reverse DNS doesn't match — so this step is not optional.
</Callout>

</Step>

<Step>

### Done

Openship finishes the SSL step and the page flips to the **admin panel**. Your mail server is live. It also
offers to send a quick welcome test email so you can confirm mail is flowing.

</Step>

</Steps>

<Callout title="Already have a mail server from Openship?" type="info">
If you set one up before and Openship lost track of it (for example, you moved to a new computer), you don't
have to reinstall. On the setup form, click **Already have a mail server? Adopt it**, pick the server, and
click **Scan server**. If a mail stack is found, click **Adopt** — it's brought back into the dashboard with
your mailboxes and data left untouched.
</Callout>

## Step 2 — Manage domains and mailboxes

Once a server is provisioned, the **Emails** page becomes its admin panel — your home base for running the mail
server. It's organized into tabs:

- **Overview** — the hostname, the webmail button, mail stats (domains, mailboxes, storage), and quick links.
- **Domains** — add extra domains you want to receive mail for. A new domain accepts mail once its MX record
  points at this server.
- **Mailboxes** — create email accounts under a domain. Each one is a login (`name@domain`) with its own
  password and quota. This is also where you change the `postmaster` password later.
- **DNS** — a reference copy of every record each domain needs, with a **Verify** button that checks whether
  they're actually published.
- **Health** — live status of each mail process, refreshed automatically.
- **Test** — send a real test email to confirm delivery.
- **Backup** — snapshot the mail server (accounts, messages, keys) to one of your backup destinations.
- **Advanced** — the IMAP/SMTP connection settings for wiring up a mail app by hand, plus power-user actions
  like restarting the stack or re-running the wizard.

<Callout title="Screenshot">The mail admin panel on the Emails page: the tab bar (Overview, Domains, Mailboxes, DNS, Health, Test, Backup, Advanced) with the Overview tab open. *(screenshot pending)*</Callout>

<Callout title="Adding a second domain" type="info">
When you add a domain under the **Domains** tab, Openship generates its DNS records (including a fresh DKIM
key). Publish those at your DNS provider — the **DNS** tab shows them and can verify them — before you rely on
that domain for mail.
</Callout>

## Step 3 — Deploy the webmail app

A mail server on its own has no web page — you'd point a mail app at it. Openship can also deploy **Zero**, a
webmail app, so you (and your users) get an inbox in the browser instead.

<Steps>

<Step>

### Start from the Overview tab

On the admin panel's **Overview** tab, find the mail server card and click **Deploy webmail**. This opens the
**Deploy webmail** screen.

</Step>

<Step>

### Choose where it runs and at which address

Two choices:

- **Deploy to** — where the webmail app should run. You can put it on **this mail server**, on **another one of
  your servers**, or (where offered) on the managed **Opshcloud** option.
- **Domain** — the web address people will open to reach the inbox. It defaults to `mail.yourdomain`. Whatever
  you pick, its DNS must point at the deploy target — the on-screen hint tells you what's expected for the
  option you chose.

The summary panel on the right restates your target and domain.

<Callout title="Screenshot">The "Deploy webmail" screen: the "Deploy to" option cards, the Domain field, and the summary panel with the "Deploy webmail" button. *(screenshot pending)*</Callout>

</Step>

<Step>

### Press Deploy webmail

Click **Deploy webmail**. Openship creates a project and a deployment for you and drops you on the standard
**build screen**, which streams the logs live — the same screen you'd see [deploying any app](/docs/guides/deploy-from-github).
When it's done, the Overview card's button changes to **Open webmail**, which opens your inbox in a new tab.

</Step>

</Steps>

## Prefer the terminal?

The provisioning flow works from the CLI too (webmail deploy is dashboard-only for now). Every `mail` command
is self-hosted only.

```bash
# Start the install on a server for your domain (streams live)
openship mail setup <serverId> --domain example.com

# When it pauses for DNS: publish the records, then acknowledge and resume
openship mail dns-ack <serverId>
openship mail setup <serverId> --domain example.com --start-step <n>

# When it pauses for reverse DNS: set the PTR, then acknowledge and resume
openship mail ptr-ack <serverId>
openship mail setup <serverId> --domain example.com --start-step <n>

# Check where things stand at any time
openship mail status <serverId>

# Re-adopt an existing install (after losing the dashboard's record of it)
openship mail scan <serverId>
openship mail adopt <serverId>
```

<Callout title="Tip" type="info">
When the install pauses, the CLI prints the exact `--start-step` number to resume from. Copy it into the next
`mail setup` command and it picks up right where it left off.
</Callout>

## If something goes wrong

<Callout title="I don't see an “Emails” item in the sidebar" type="warn">
Email is self-hosted only. It appears when Openship is running on your own infrastructure. On a managed/cloud
plan it's hidden on purpose.
</Callout>

<Callout title="The “Check Port 25” step warns that port 25 is blocked" type="warn">
This step is a check, not a wall — the install keeps going even when it warns. But outbound mail won't actually
send until port 25 is open. Many hosting providers block it by default (some need a support request to open it).
Ask your provider to open it, then use the **Test** tab to confirm mail flows once setup has finished.
</Callout>

<Callout title="Mail sends but lands in spam" type="warn">
This is normal for a brand-new domain — providers are cautious for the first day or two. Make sure your DNS
records (SPF, DKIM, DMARC) and your reverse DNS (PTR) are all published and verified: use the **DNS** tab's
**Verify** button and the **Health** tab. Marking early test messages as "not spam" speeds things up.
</Callout>

<Callout title="A record won't verify" type="error">
DNS changes can take a few minutes (sometimes longer) to spread. Give it time, then re-check on the **DNS**
tab. Double-check you pasted the value exactly and added it to the right domain.
</Callout>

## What next?

<Cards>
  <Card title="Custom domains" href="/docs/guides/custom-domains" description="How DNS and automatic HTTPS work for your apps — useful background for the mail DNS steps." />
  <Card title="Deploy from GitHub" href="/docs/guides/deploy-from-github" description="Understand the build screen you land on when deploying webmail." />
  <Card title="Connect your own server" href="/docs/guides/custom-servers" description="Add the machine your mail stack runs on, over SSH." />
</Cards>