webmail-client/docs/mail-server-network.md

Hosted mail (M6): network and DNS plan

Notes for switching ultimo.email mail from home.pl to Ultimo's own mail server (Stalwart on the QNAP). Companion to the M6 plan in webmail-client-spec_v1.5.md Appendix D. Gathered 2026-10-09/10.

Decisions

	Decision
Hosting	Everything on the QNAP — receive and send directly (spec §D.1 option A). A relay (home.pl SMTP, SMTP2GO, Brevo) is optional, as a fallback only.
Domain	Addresses name@ultimo.email; webmail stays at https://ultimo.email.
Mail apps	Allowed: Thunderbird and phone mail apps use the mailboxes over IMAP/SMTP, signing in with app passwords (required when 2FA is on).
Mail host name	mail.ultimo.email (recommended; ultimo.email would also work, see below).

Current setup

• Static public IP 178.219.143.96 (ISP: Multiplay).
• Traffic → router → Synology DSM → DSM reverse proxy → QNAP (the webmail).
• All DNS records are at home.pl:
  • A ultimo.email → 178.219.143.96 (the QNAP, through the Synology);
  • MX ultimo.email → serwer2295308.home.pl — mail is still at home.pl;
  • other records also point at home.pl.

Checks of the connection (2026-10-10)

Check	Result
Blocklists — Spamhaus ZEN (incl. PBL), Barracuda, SpamCop, SORBS, UCEPROTECT	Not listed
Outbound port 25 (tested on the QNAP)	Open
Reverse DNS of 178.219.143.96	pub-143.96.multiplay.pl — generic: must change (below)
Inbound 25 / 465 / 587 / 993 from outside	Time out — expected: not forwarded yet, nothing listening. Re-test after setup.
Inbound 443	Open (webmail)

To do before switching

1. Reverse DNS (ask Multiplay)

Set the reverse DNS (PTR) of 178.219.143.96 to mail.ultimo.email.

Why: receiving servers (Gmail, Outlook…) check that three things agree — the IP's reverse DNS name, that name's A record pointing back to the IP, and the name the mail server introduces itself with (its SMTP greeting). A generic ISP name or a mismatch reads as a hijacked home computer and hurts delivery. ultimo.email itself would work too (its A record already points here); a separate mail. name keeps mail working if the website ever moves elsewhere.

2. Router: forward the mail ports straight to the QNAP

DSM's reverse proxy carries only web traffic (HTTP/HTTPS); SMTP and IMAP are other protocols, so these ports go from the router directly to the QNAP:

Outside port	To	Purpose
443, 80	Synology (as today)	webmail, CalDAV/CardDAV (/dav/, /.well-known/…), certificates
25	QNAP	receiving mail from other servers (must be 25: MX delivery always uses it)
465	QNAP	sending from mail apps (SMTP over TLS)
587	QNAP	sending from mail apps (SMTP + STARTTLS)
993	QNAP	mail apps reading mail (IMAP over TLS)

Mail sent by the QNAP leaves through the same router, i.e. from 178.219.143.96 — the address the reverse DNS names.

3. The container's ports

Stalwart listens inside its container on the standard ports; Docker publishes them on the QNAP — the same numbers if free ("25:25", "465:465", "587:587", "993:993"), or any free QNAP port (e.g. "2525:25") with the router mapping the standard outside port to it. Outside ports stay standard: 25 is mandatory, and mail apps assume 465/587/993 when setting up an account.

Verify after setup: Stalwart must see the real IP of connecting servers and apps (not a Docker address) — its spam checks and sign-in throttling use it.

4. TLS certificate for the mail server

The Synology holds the HTTPS certificate, but IMAP/SMTP connections end at the QNAP, so Stalwart needs its own for mail.ultimo.email. Options:

• (recommended) Stalwart's own Let's Encrypt certificate: Let's Encrypt checks over port 80, which goes to the Synology — add a DSM reverse-proxy rule: host mail.ultimo.email, port 80 → QNAP, Stalwart's HTTP port. Renews itself.
• DNS-based check, if home.pl's DNS can be updated automatically.
• Copy the Synology's certificate to the QNAP after every renewal (clumsiest).

5. DNS records at home.pl (at switch-over)

Lower the TTLs a day before.

Record	Value
A mail.ultimo.email	178.219.143.96
MX ultimo.email	10 mail.ultimo.email. (replaces serwer2295308.home.pl)
TXT ultimo.email (SPF)	v=spf1 mx -all (add the relay's include if one is used)
TXT <selector>._domainkey.ultimo.email (DKIM)	the public key Stalwart generates
TXT _dmarc.ultimo.email	v=DMARC1; p=none; rua=mailto:postmaster@ultimo.email — watch the reports, then move to quarantine / reject
(optional) autoconfig / SRV records	so Thunderbird and phones find the server settings by themselves
(optional) MTA-STS, TLS-RPT	enforce encrypted delivery to us

6. Moving the existing mail from home.pl

1. Create the mailboxes in Ultimo.
2. Copy each home.pl mailbox into its new one over IMAP.
3. Switch the MX.
4. Keep the home.pl account in the webmail for a while to catch mail that still arrives there (DNS caches), then remove it.

7. Checks after switching

• From outside: ports 25 / 465 / 587 / 993 answer (with a TLS certificate for mail.ultimo.email).
• Reverse DNS → mail.ultimo.email → 178.219.143.96, and Stalwart greets as mail.ultimo.email.
• Mail to and from Gmail and Outlook: headers show SPF, DKIM and DMARC pass, delivered to the inbox (not spam).
• Thunderbird sets up an account with just the address and an app password.