Set up email for a customer

Before you start

Email accounts are a Pro-tier feature. The gate is server-side only: on Community the Email page still renders, the mailbox list still loads (empty), and the create button still opens its modal — but saving fails with a generic Failed toast, because the API answers with a 503 rather than anything that names the tier. If you're on Community, this guide won't apply. Confirm you're on Pro by checking https://<your-host>:2087/license — the badge at the top of the page should say Pro or Developer.

You also need port 25 to be reachable outbound. Most VPS providers block port 25 by default to prevent spam. Hetzner, OVH, Scaleway will lift the block after a verification step; DigitalOcean and Vultr typically won't. If your provider blocks 25, you'll need to configure an SMTP relay (Mailgun / SES / Postmark) for outbound — inbound still works fine on 25 once your DNS points at the panel.

Step 1 — Add the domain

Domains live in the customer panel (port 2083, log in as that customer) → Domains → Add domain. There's no admin-side Domains page, and you don't pick a customer here — you pick which of that customer's sites the domain points at.

The only thing this does for mail is create the DNS zone in PowerDNS, with apex and www A records. SPF, DKIM, and DMARC aren't generated yet — those appear when you create the first mailbox on the domain (Step 3).

One thing to know up front: if the panel's own HTTPS is set up, Postfix and Dovecot reuse the certificate Caddy already holds for the panel hostname — so a mail client pointed at that hostname sees a valid certificate and no warning. If panel HTTPS was never provisioned, the mail services fall back to the server's self-signed certificate and clients will warn until you accept it. Point mail clients at the panel hostname, not mail.<domain>: that is the name the certificate is issued for.

Step 2 — Create the mailbox

Still in the customer panel → Email → Create Account (the modal is titled Create Email Account).

• Address: e.g. info@example.com
• Password: minimum 8 chars.
• Quota: per-mailbox disk cap, chosen from a fixed list — 256, 512, 1024 or 2048 MB, defaulting to 256. Packages cap the number of mailboxes a customer can have, not their size.

Step 3 — DNS records (published automatically)

When you create the first mailbox on a domain, NovaPanel publishes the MX, SPF, DKIM, and DMARC records into PowerDNS for you — including generating the DKIM signing key and wiring opendkim to sign outbound mail. If PowerDNS is authoritative for the domain, there's nothing to copy. The records look like:

; replace mail.example.com with the panel hostname
@        MX  10 mail.example.com.

; SPF — bare zone, authorises the panel's A/MX hosts
@        TXT "v=spf1 a mx ip4:203.0.113.10 ~all"

; DKIM — selector is "nova"
nova._domainkey  TXT "v=DKIM1; k=rsa; p=MIGfMA0G..."

; DMARC — policy comes from Mail Server → DMARC Policy
_dmarc   TXT "v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com; fo=1"

If the domain's registrar (not PowerDNS) is authoritative, copy these from admin → DNS Zones → <domain> and add them at the registrar instead. Created mailboxes before this version? Click Republish mail DNS on the Mail Server page to generate keys and (re)publish all four records for every existing mail domain.

Connecting a mail client

Use the panel hostname as the server for both incoming and outgoing mail — that is the name the TLS certificate is issued for. The username is always the full email address, and the password is the one set on the mailbox.

Setting	Value
IMAP (recommended)	port 993, SSL/TLS
POP3	port 995, SSL/TLS
SMTP	port 587, STARTTLS — or 465 for implicit TLS
Username	the full address, e.g. info@example.com
Authentication	required on both incoming and outgoing

Port 587 requires authentication before it will accept anything, so the server is never an open relay. Port 25 is for other mail servers delivering to you, not for your own client.

Step 4 — Wait for propagation, then test

Give the DNS records 5-30 minutes to propagate. There's no send-test button on a mailbox — the row actions are Autoresponder, Edit and Delete. To check the domain, go to admin → Mail Deliverability, pick the domain, and it runs live SPF / DKIM / DMARC / PTR / blocklist checks against what public DNS actually serves. For an end-to-end delivery and spam score, send a message from the mailbox to mail-tester.com.

To send that message, open the bundled Roundcube webmail from the customer panel's Email → Roundcube button (served on <your-host>:2096 over HTTPS, :2095 over HTTP), log in with the mailbox address + password, and send yourself a message.

Common issues

"Mail accepted by us but never arriving at Gmail"

Almost always SPF / DKIM / DMARC misalignment, or a missing PTR record. Start at admin → Mail Deliverability: pick the domain and it runs live checks for SPF, DKIM, DMARC, reverse DNS (PTR), and the major blocklists (Spamhaus, SpamCop, Barracuda) against what the rest of the internet actually sees. Anything red there is your culprit. You can also cross-check with mail-tester.com. Note: PTR/rDNS is set at your VPS/cloud provider, not in NovaPanel.

"Connection refused on port 25"

Your VPS provider is blocking outbound 25. Two options: (1) ask them to lift the block (most will after a verification email), (2) configure an SMTP relay in admin → Mail Server → Relay. Postmark and SES both work well.

"DKIM signature failed"

Confirm the TXT record is published exactly as the panel shows it — line breaks and quotes are easy to mangle in registrar UIs. Some registrars (Hover, GoDaddy) insert linebreaks silently; paste into a text editor first to confirm there's only one logical line.

Next steps

• Configure DNS for a new domain — if PowerDNS isn't authoritative yet
• Troubleshooting — Mail issues section covers more edge cases