| docs

Appearance

Mail SNI ​

AdminBolt serves a per-domain TLS certificate on mail connections using SNI (Server Name Indication). When a user's mail client connects to mail.<domain>, the mail server presents the certificate that belongs to that domain, so the client sees a valid, matching certificate with no name-mismatch warning.

Like mail autodiscovery, this is automatic - there is nothing to configure by hand.

How it works ​

  • When an SSL certificate is issued for a domain (through AutoSSL or a manual certificate), it covers the mail names as well: <domain>, www.<domain>, mail.<domain>, autoconfig.<domain>, and autodiscover.<domain>.
  • The IMAP/POP3 service (Dovecot) and the SMTP service (Postfix) select the right certificate per connection based on the hostname the client asked for (SNI).
  • Each domain gets its own certificate - certificates are not shared between domains on the same server.

Per-domain host or shared hostname ​

The mail hostname a domain uses depends on whether its certificate is in place:

  • Before a valid certificate exists - mail uses the shared server hostname (covered by the panel's own hostname certificate). Mail works; clients just connect to the server hostname.
  • After a certificate covering mail.<domain> is in place - the domain switches to mail.<domain>. Autodiscovery, the mail SRV records, and the MX record all update to point at mail.<domain>.
  • If the certificate is later removed - the domain falls back to the shared hostname, and the autodiscovery and DNS records revert with it.

Certificate provisioning is best-effort and never blocks domain creation: if a certificate or the SNI setup is not ready yet, the domain simply stays on the shared hostname until it is.

What the user sees ​

  • The IMAP and SMTP host in their mail client is mail.<domain> once the per-domain certificate is active, or the server hostname before that.
  • No certificate warnings, because the presented certificate matches the hostname they connect to.
  • Ports and security are unchanged by SNI: IMAP 993 (SSL), POP3 995 (SSL), SMTP submission 587 (STARTTLS) or 465 (SSL).

Requirements ​

  • A valid SSL certificate that includes mail.<domain> in its names. AutoSSL requests this automatically for domains that have mail enabled - see Certificate Providers and Certificates.
  • The mail.<domain> name must resolve to the server, which AdminBolt publishes automatically as part of mail autodiscovery.