lukasandClaude Opus 5.5
b88855931e
Hosted mailboxes (SPEC App. D), behind HOSTED_MAILBOXES (off: unchanged):
- Stalwart mail server, provisioned by `python -m app.hosted.provision`;
directory read from a Postgres view, app passwords only for mail apps
- native account per user, the worker signs in as master for the user
- raw messages of hosted mailboxes only cached, fetched back on demand
- migrations 0025 (accounts.kind, directory view), 0026 (IMAP ids bigint)
Mail:
- dark message mode switch in the reading pane (Thunderbird's algorithm)
- moves and folder creation quote the folder name ("Deleted Items"):
swipe-to-delete / Trash no longer bounce back
- thread unread counters: lock before recount, sorted lock order,
UIDVALIDITY re-import recounts, nightly repair_threads
- sidebar accounts sorted alphabetically, more space above headings
Settings: Security headings renamed; antispam accounts are explicit
(none ticked = none filtered), input widths, Activity hidden.
Plugin bundles served with Cache-Control: no-cache.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
5.5 KiB
Hosted mail (M6): network and DNS plan
Notes for switching ultimo.email mail from home.pl to Ultimo's own mail server
(Stalwart on the QNAP). Companion to the M6 plan in
webmail-client-spec_v1.5.md Appendix D. Gathered 2026-10-09/10.
Decisions
| Decision | |
|---|---|
| Hosting | Everything on the QNAP — receive and send directly (spec §D.1 option A). A relay (home.pl SMTP, SMTP2GO, Brevo) is optional, as a fallback only. |
| Domain | Addresses name@ultimo.email; webmail stays at https://ultimo.email. |
| Mail apps | Allowed: Thunderbird and phone mail apps use the mailboxes over IMAP/SMTP, signing in with app passwords only (never the webmail password). |
| Mail host name | mail.ultimo.email (recommended; ultimo.email would also work, see below). |
Current setup
- Static public IP
178.219.143.96(ISP: Multiplay). - Traffic → router → Synology DSM → DSM reverse proxy → QNAP (the webmail).
- All DNS records are at home.pl:
- A
ultimo.email→178.219.143.96(the QNAP, through the Synology); - MX
ultimo.email→serwer2295308.home.pl— mail is still at home.pl; - other records also point at home.pl.
- A
Checks of the connection (2026-10-10)
| Check | Result |
|---|---|
| Blocklists — Spamhaus ZEN (incl. PBL), Barracuda, SpamCop, SORBS, UCEPROTECT | Not listed |
| Outbound port 25 (tested on the QNAP) | Open |
Reverse DNS of 178.219.143.96 |
pub-143.96.multiplay.pl — generic: must change (below) |
| Inbound 25 / 465 / 587 / 993 from outside | Time out — expected: not forwarded yet, nothing listening. Re-test after setup. |
| Inbound 443 | Open (webmail) |
To do before switching
1. Reverse DNS (ask Multiplay)
Set the reverse DNS (PTR) of 178.219.143.96 to mail.ultimo.email.
Why: receiving servers (Gmail, Outlook…) check that three things agree — the
IP's reverse DNS name, that name's A record pointing back to the IP, and the
name the mail server introduces itself with (its SMTP greeting). A generic ISP
name or a mismatch reads as a hijacked home computer and hurts delivery.
ultimo.email itself would work too (its A record already points here); a
separate mail. name keeps mail working if the website ever moves elsewhere.
2. Router: forward the mail ports straight to the QNAP
DSM's reverse proxy carries only web traffic (HTTP/HTTPS); SMTP and IMAP are other protocols, so these ports go from the router directly to the QNAP:
| Outside port | To | Purpose |
|---|---|---|
| 443, 80 | Synology (as today) | webmail, CalDAV/CardDAV (/dav/, /.well-known/…), certificates |
| 25 | QNAP | receiving mail from other servers (must be 25: MX delivery always uses it) |
| 465 | QNAP | sending from mail apps (SMTP over TLS) |
| 587 | QNAP | sending from mail apps (SMTP + STARTTLS) |
| 993 | QNAP | mail apps reading mail (IMAP over TLS) |
Mail sent by the QNAP leaves through the same router, i.e. from
178.219.143.96 — the address the reverse DNS names.
3. The container's ports
Stalwart listens inside its container on the standard ports; Docker publishes
them on the QNAP — the same numbers if free ("25:25", "465:465", "587:587",
"993:993"), or any free QNAP port (e.g. "2525:25") with the router mapping
the standard outside port to it. Outside ports stay standard: 25 is mandatory,
and mail apps assume 465/587/993 when setting up an account.
Verify after setup: Stalwart must see the real IP of connecting servers and apps (not a Docker address) — its spam checks and sign-in throttling use it.
4. TLS certificate for the mail server
The Synology holds the HTTPS certificate, but IMAP/SMTP connections end at the
QNAP, so Stalwart needs its own for mail.ultimo.email. Options:
- (recommended) Stalwart's own Let's Encrypt certificate: Let's Encrypt
checks over port 80, which goes to the Synology — add a DSM reverse-proxy
rule: host
mail.ultimo.email, port 80 → QNAP, Stalwart's HTTP port. Renews itself. - DNS-based check, if home.pl's DNS can be updated automatically.
- Copy the Synology's certificate to the QNAP after every renewal (clumsiest).
5. DNS records at home.pl (at switch-over)
Lower the TTLs a day before.
| Record | Value |
|---|---|
A mail.ultimo.email |
178.219.143.96 |
MX ultimo.email |
10 mail.ultimo.email. (replaces serwer2295308.home.pl) |
TXT ultimo.email (SPF) |
v=spf1 mx -all (add the relay's include if one is used) |
TXT <selector>._domainkey.ultimo.email (DKIM) |
the public key Stalwart generates |
TXT _dmarc.ultimo.email |
v=DMARC1; p=none; rua=mailto:postmaster@ultimo.email — watch the reports, then move to quarantine / reject |
(optional) autoconfig / SRV records |
so Thunderbird and phones find the server settings by themselves |
| (optional) MTA-STS, TLS-RPT | enforce encrypted delivery to us |
6. Moving the existing mail from home.pl
- Create the mailboxes in Ultimo.
- Copy each home.pl mailbox into its new one over IMAP.
- Switch the MX.
- Keep the home.pl account in the webmail for a while to catch mail that still arrives there (DNS caches), then remove it.
7. Checks after switching
- From outside: ports 25 / 465 / 587 / 993 answer (with a TLS certificate for
mail.ultimo.email). - Reverse DNS →
mail.ultimo.email→178.219.143.96, and Stalwart greets asmail.ultimo.email. - Mail to and from Gmail and Outlook: headers show SPF, DKIM and DMARC pass, delivered to the inbox (not spam).
- Thunderbird sets up an account with just the address and an app password.