| docs

Appearance

Mail SNI ​

AdminBolt serves a per-domain TLS certificate on mail connections using SNI (Server Name Indication). When a user's mail client connects to mail.<domain>, the mail server presents the certificate that belongs to that domain, so the client sees a valid, matching certificate with no name-mismatch warning.

Like mail autodiscovery, this is automatic - there is nothing to configure by hand, so there is no SNI screen in the panel. What decides the outcome is the domain's certificate: check it in the SSL group, and the issuance policy behind it on Settings > SSL > SSL Providers.

How it works ​

  • When an SSL certificate is issued for a domain (through AutoSSL or a manual certificate), it covers the mail names as well: <domain>, www.<domain>, mail.<domain>, autoconfig.<domain>, and autodiscover.<domain>.
  • The IMAP/POP3 service (Dovecot) and the SMTP service (Postfix) select the right certificate per connection based on the hostname the client asked for (SNI).
  • Each domain gets its own certificate - certificates are not shared between domains on the same server.

Per-domain host or shared hostname ​

The mail hostname a domain uses depends on whether its certificate is in place:

  • Before a valid certificate exists - mail uses the shared server hostname (covered by the panel's own hostname certificate). Mail works; clients connect to the server hostname instead.
  • After a certificate covering mail.<domain> is in place - the domain switches to mail.<domain>. Autodiscovery and the mail SRV records update to point at mail.<domain>, and so does the MX record where it points at this server (see MX records).
  • If the certificate is later removed, for example with Disable SSL - the domain falls back to the shared hostname, and the autodiscovery and DNS records revert with it.

Certificate provisioning is best-effort and never blocks domain creation: if a certificate or the SNI setup is not ready yet, the domain stays on the shared hostname until it is.

MX records ​

Since panel 1.9.3, issuing or disabling a domain's certificate moves only the MX records that point at this server: at the server hostname, at mail.<domain>, or at one of the panel's mail servers. An MX record that points elsewhere, for example at an external mail provider, stays as it is, and so does an MX record you added by hand. While the domain uses MailChannels or SpamExperts, or its email routing is set to remote, no MX record is moved.

After a domain is renamed ​

Since panel 1.9.3, renaming a domain removes the mail SNI settings of its previous name. If the mail server does not confirm the removal, the rename still applies, and a warning asks you to check that Dovecot and Postfix are running.

The certificate is not reissued at once. A free certificate on an account with AutoSSL switched on is reissued under the new name in the next nightly AutoSSL run. Until then the previous certificate is served for the new name, and mail clients use the shared server hostname; mail.<new name> is offered as the mail host once a certificate covers it. A certificate from another issuer, or a domain of an account with AutoSSL switched off, needs a new certificate for the new name: issue one or upload it on the account's SSL Certificates screen.

Updating to 1.9.3 cleans up after domains renamed earlier: it moves the mail SNI settings whose certificate no longer exists into a dated backup on the server, and marks the certificates that do not cover their domain's current name to be reissued.

What the user sees ​

  • The IMAP and SMTP host in their mail client is mail.<domain> once the per-domain certificate is active, or the server hostname before that.
  • No certificate warnings, because the presented certificate matches the hostname they connect to.
  • Ports and security are unchanged by SNI: IMAP 993 (SSL), POP3 995 (SSL), SMTP submission 587 (STARTTLS) or 465 (SSL).

Requirements ​

  • A valid SSL certificate that includes mail.<domain> in its names. AutoSSL requests this automatically for domains that have mail enabled - see Certificate Providers and Certificates.
  • The mail.<domain> name must resolve to the server, which AdminBolt publishes automatically as part of mail autodiscovery.