webmail-client/docs/mail-server-network.md

# Hosted mail (M6): network and DNS plan

Notes for switching `ultimo.email` mail from home.pl to Ultimo's own mail server
(Stalwart on the QNAP). Companion to the M6 plan in
`webmail-client-spec_v1.5.md` Appendix D. Gathered 2026-10-09/10.

## Decisions

| | Decision |
|---|---|
| Hosting | **Everything on the QNAP** — receive and send directly (spec §D.1 option A). A relay (home.pl SMTP, SMTP2GO, Brevo) is optional, as a fallback only. |
| Domain | Addresses `name@ultimo.email`; webmail stays at `https://ultimo.email`. |
| Mail apps | **Allowed**: Thunderbird and phone mail apps use the mailboxes over IMAP/SMTP, signing in with **app passwords** only (never the webmail password). |
| Mail host name | **`mail.ultimo.email`** (recommended; `ultimo.email` would also work, see below). |

## Current setup

- Static public IP **`178.219.143.96`** (ISP: Multiplay).
- Traffic → **router** → **Synology DSM** → DSM **reverse proxy** → **QNAP** (the webmail).
- All DNS records are at **home.pl**:
  - A `ultimo.email` → `178.219.143.96` (the QNAP, through the Synology);
  - MX `ultimo.email` → `serwer2295308.home.pl` — **mail is still at home.pl**;
  - other records also point at home.pl.

## Checks of the connection (2026-10-10)

| Check | Result |
|---|---|
| Blocklists — Spamhaus ZEN (incl. PBL), Barracuda, SpamCop, SORBS, UCEPROTECT | **Not listed** |
| Outbound port 25 (tested on the QNAP) | **Open** |
| Reverse DNS of `178.219.143.96` | `pub-143.96.multiplay.pl` — generic: **must change** (below) |
| Inbound 25 / 465 / 587 / 993 from outside | Time out — expected: not forwarded yet, nothing listening. Re-test after setup. |
| Inbound 443 | Open (webmail) |

## To do before switching

### 1. Reverse DNS (ask Multiplay)

Set the reverse DNS (PTR) of `178.219.143.96` to **`mail.ultimo.email`**.

Why: receiving servers (Gmail, Outlook…) check that three things agree — the
IP's reverse DNS name, that name's A record pointing back to the IP, and the
name the mail server introduces itself with (its SMTP greeting). A generic ISP
name or a mismatch reads as a hijacked home computer and hurts delivery.
`ultimo.email` itself would work too (its A record already points here); a
separate `mail.` name keeps mail working if the website ever moves elsewhere.

### 2. Router: forward the mail ports straight to the QNAP

DSM's reverse proxy carries only web traffic (HTTP/HTTPS); SMTP and IMAP are
other protocols, so these ports go from the router directly to the QNAP:

| Outside port | To | Purpose |
|---|---|---|
| 443, 80 | Synology (as today) | webmail, CalDAV/CardDAV (`/dav/`, `/.well-known/…`), certificates |
| **25** | QNAP | receiving mail from other servers (must be 25: MX delivery always uses it) |
| **465** | QNAP | sending from mail apps (SMTP over TLS) |
| **587** | QNAP | sending from mail apps (SMTP + STARTTLS) |
| **993** | QNAP | mail apps reading mail (IMAP over TLS) |

Mail sent by the QNAP leaves through the same router, i.e. from
`178.219.143.96` — the address the reverse DNS names.

### 3. The container's ports

Stalwart listens inside its container on the standard ports; Docker publishes
them on the QNAP — the same numbers if free (`"25:25"`, `"465:465"`, `"587:587"`,
`"993:993"`), or any free QNAP port (e.g. `"2525:25"`) with the router mapping
the standard outside port to it. Outside ports stay standard: 25 is mandatory,
and mail apps assume 465/587/993 when setting up an account.

Verify after setup: Stalwart must see the **real IP** of connecting servers and
apps (not a Docker address) — its spam checks and sign-in throttling use it.

### 4. TLS certificate for the mail server

The Synology holds the HTTPS certificate, but IMAP/SMTP connections end at the
QNAP, so Stalwart needs its own for `mail.ultimo.email`. Options:

- **(recommended)** Stalwart's own Let's Encrypt certificate: Let's Encrypt
  checks over port 80, which goes to the Synology — add a **DSM reverse-proxy
  rule: host `mail.ultimo.email`, port 80 → QNAP, Stalwart's HTTP port**.
  Renews itself.
- DNS-based check, if home.pl's DNS can be updated automatically.
- Copy the Synology's certificate to the QNAP after every renewal (clumsiest).

### 5. DNS records at home.pl (at switch-over)

Lower the TTLs a day before.

| Record | Value |
|---|---|
| A `mail.ultimo.email` | `178.219.143.96` |
| MX `ultimo.email` | `10 mail.ultimo.email.` (replaces `serwer2295308.home.pl`) |
| TXT `ultimo.email` (SPF) | `v=spf1 mx -all` (add the relay's include if one is used) |
| TXT `<selector>._domainkey.ultimo.email` (DKIM) | the public key Stalwart generates |
| TXT `_dmarc.ultimo.email` | `v=DMARC1; p=none; rua=mailto:postmaster@ultimo.email` — watch the reports, then move to `quarantine` / `reject` |
| (optional) `autoconfig` / SRV records | so Thunderbird and phones find the server settings by themselves |
| (optional) MTA-STS, TLS-RPT | enforce encrypted delivery to us |

### 6. Moving the existing mail from home.pl

1. Create the mailboxes in Ultimo.
2. Copy each home.pl mailbox into its new one over IMAP.
3. Switch the MX.
4. Keep the home.pl account in the webmail for a while to catch mail that
   still arrives there (DNS caches), then remove it.

### 7. Checks after switching

- From outside: ports 25 / 465 / 587 / 993 answer (with a TLS certificate for
  `mail.ultimo.email`).
- Reverse DNS → `mail.ultimo.email` → `178.219.143.96`, and Stalwart greets as
  `mail.ultimo.email`.
- Mail to and from Gmail and Outlook: headers show SPF, DKIM and DMARC **pass**,
  delivered to the inbox (not spam).
- Thunderbird sets up an account with just the address and an app password.