# Email Configuration

## Server

All mail is handled by Postfix + Dovecot on **kaburusvr** (Hetzner, 49.13.202.144).

| Setting | Value |
|---|---|
| Hostname | `mail.kaburu.cc` |
| IP | 49.13.202.144 |
| PTR/reverse DNS | mail.kaburu.cc |
| Status | ✅ Working (HELO fixed 2026-07-08) |

## Standard Client Settings

All domains share the same mail server. Use either:

| | Server | Port | Security |
|---|---|---|---|
| **IMAP** | `mail.kaburu.cc` | 993 | SSL/TLS |
| **SMTP** | `mail.kaburu.cc` | 587 | STARTTLS |
| **Webmail** | `https://webmail.[domain]/snappymail/` | 443 | HTTPS |

Or use domain-specific (if DNS records exist):
| | Server | Port |
|---|---|---|
| IMAP | `mail.[domain]` | 993 SSL/TLS |
| SMTP | `mail.[domain]` | 587 STARTTLS |
| Webmail | `webmail.[domain]` | 443 HTTPS |

Username is always **full email address**. Password is the mailbox password set in CyberPanel.

## Mailboxes by Domain

### touchwell.co.uk
| Mailbox | Purpose |
|---|---|
| steve@touchwell.co.uk | Steve's primary inbox |
| no-reply@touchwell.co.uk | Automated sends |

Note: Steve is blind — phone settings may need in-person setup. Client contact: **Steven** (WhatsApp +44 7715 002776).

**2026-08-03 mail cert fix (touchwell):** Steven's phone got a cert error sending (replying to Alan Gibson). Root cause: Postfix had NO SNI maps (`tls_server_sni_maps` empty) → served the mail.kaburu.cc cert for every domain's SMTP; and no `mail.touchwell.co.uk` cert existed at all. Fixed:
- Issued `mail.touchwell.co.uk` LE cert via acme.sh DNS-01 (live dir created)
- Added Dovecot `local_name mail.touchwell.co.uk` block (IMAP side)
- Built Postfix SNI map `/etc/postfix/sni_maps` for ALL 21 `mail.*` hosts — combined key-first PEMs in `/etc/postfix/sni/`, built with **`postmap -F`** (mandatory — plain postmap yields "malformed BASE64 value" errors). Alternative: use `texthash:/etc/postfix/sni_maps` instead of `hash:` — no postmap needed, reads text file directly.
- Repointed Dovecot default cert away from contaminated longniddry→mail.test1 cert → mail.kaburu.cc
- Verified: `mail.touchwell.co.uk:465` + `:993` now serve `CN=mail.touchwell.co.uk`
- Test email sent 2026-08-03 21:08 to steve@touchwell.co.uk from gwen@kaburu.cc; reply watcher cron `watch-touchwell-reply` (91cf3d8aee5e, every 5m)
- **support@kaburu.cc alias created 2026-08-03** (e_forwardings id 17 → gwen@kaburu.cc) — verified end-to-end (postfix lookup + delivery, DKIM signed). Use support@kaburu.cc for client-facing sends instead of support@kaburu.co (that domain has NO local mailboxes).
- **Mail watcher cron `watch-mail` (334d1b398184) every 5m** — watches gwen@kaburu.cc INBOX (incl. support@ alias) for new mail + flags real delivery failures (bounces/NOQUEUE rejects, filtered for scanner noise) in the last 10 min. Script ~/.hermes/scripts/watch-mail.sh, state ~/.hermes/cache/watch-mail.lastuid (seeded 713). Silent when nothing; Telegram alert on any new mail. Replaced narrow watch-touchwell-reply (91cf3d8aee5e, removed).
- Note: many `mail.*` DNS records don't exist (billing.myretonmarquees, dm-ph, ggsgenerators, jafricasafari, l8waterhygiene, myretonmarquees, rf.*, test*, womenunlimited) and several resolve to Cloudflare IPs (24hrresponse, aberdeenrda, bankhouse, doctorfin, kaburusvr.uk, pilates-edinburgh) — SNI entries harmless, DNS cleanup is separate work. TLS renewal for mail certs = acme.sh cron handles; SNI PEMs under /etc/postfix/sni/ are NOT auto-regenerated on renew (manual: rebuild + postmap -F + postfix reload).

### kaburu.cc
| Mailbox | Purpose |
|---|---|
| gwen@kaburu.cc | Agent inbox — DMARC reports, alerts |
| steve@kaburu.cc | Steve's account |
| server@kaburu.cc | Server alerts |
| claude@kaburu.cc | Legacy |
| sys.ops@kaburu.cc | Legacy |

### claybusters.scot
| Mailbox | Purpose |
|---|---|
| info@claybusters.scot | General enquiries |
| no-reply@claybusters.scot | Automated sends |
| webmaster@claybusters.scot | Site admin |

### friendscic.org
| Mailbox | Purpose |
|---|---|
| hello@friendscic.org | General enquiries |
| newsletter@friendscic.org | Mailing list |
| no-reply@friendscic.org | Automated sends |
| secretary@friendscic.org | Committee |
| webmaster@friendscic.org | Site admin |

### longniddrybowlingclub.co.uk
| Mailbox | Purpose |
|---|---|
| info@longniddrybowlingclub.co.uk | General enquiries |
| committee@longniddrybowlingclub.co.uk | Committee |
| matchsecretary@longniddrybowlingclub.co.uk | Match admin |
| secretary@longniddrybowlingclub.co.uk | Secretary |
| treasurer@longniddrybowlingclub.co.uk | Treasurer |
| vice.president@longniddrybowlingclub.co.uk | VP |
| wpo@longniddrybowlingclub.co.uk | Welfare |

### longniddrybowlingclub.com
| Mailbox | Purpose |
|---|---|
| info@longniddrybowlingclub.com | Redirect/alias |

### aberdeenrda.co.uk
No mailboxes configured — mail disabled or not in use.

### thechippyvan.co.uk
| Mailbox | Purpose |
|---|---|
| van@thechippyvan.co.uk | Orders, customer queries, order confirmations |

## Verification Checklist

When a user reports "no email":

1. ✅ Check `mail.kaburu.cc` resolves to 49.13.202.144
2. ✅ Check Postfix: `systemctl is-active postfix`
3. ✅ Check Dovecot: `systemctl is-active dovecot`
4. ✅ Check mailbox: `ls /home/vmail/[domain]/[user]/Maildir/new/ | wc -l`
5. ✅ Check IMAP connections: `grep "[user]@[domain]" /var/log/mail.log | grep imap`
6. ✅ If no IMAP connections → user's device isn't connecting (likely wrong settings)
7. ✅ Webmail test: `curl -sk -o /dev/null -w "%{http_code}" https://webmail.[domain]/`

## Outbound Mail

- Postfix HELO: `mail.kaburu.cc` (fixed 2026-07-08 — was `kaburusvr.uk` causing Virgin Media rejects)
- SPF: all domains include `ip4:49.13.202.144`
- DMARC: all domains set to `rua=mailto:gwen@kaburu.cc`
- DKIM: managed by CyberPanel per-domain

## Known Issues

- **Webmail per-domain**: Not all domains have `webmail.[domain]` DNS records. Use `https://mail.kaburu.cc/rainloop/` as fallback.
- **Stuck queue**: Old messages from Dovecot outages may persist. Flush with `postqueue -f`. Non-deliverable spam/bills will expire automatically.
- **HELO mismatch**: Fixed 2026-07-08. Virgin Media, BT, and other strict receivers now accept mail.
- **doctorfin.co.uk / pilates-edinburgh.co.uk**: MX still points at residual `_dc-mx.*` (M365 verification hostnames) that resolve to 49.13.202.144. No Maildirs in `/home/vmail/`. Fix MX to `mail.<domain>` if self-hosted, or real provider MX. See [[dns-spf-audit]].
- **Proton domains (kaburu.co, kaburu.co.uk, 24hrresponse.com)**: SPF has both `include:_spf.protonmail.ch` and `ip4:49.13.202.144`. Keep if kaburusvr still sends; otherwise prune.

## Dovecot Maildir Structure

**Location**: `/home/vmail/<domain>/<user>/Maildir/`

**Folder naming**: Dot-prefixed subdirectories of `Maildir/`
- `Maildir/` = INBOX
- `Maildir/.Trash/` = Trash
- `Maildir/.Sent/` = Sent
- `Maildir/.Drafts/` = Drafts
- `Maildir/.Archive/` = Archive
- `Maildir/.Junk/` or `Maildir/.spam/` = Spam

### Cyrus Migration Directory Bug

**Problem**: Cyrus (Chemicloud) uses `Maildir.Sent`, `Maildir.Trash` etc. (no dot, no slash). Migration preserves the wrong naming. Dovecot expects `Maildir/.Sent/` format. Messages exist physically but are invisible to IMAP.

**Fix**:
```bash
# 1. Rename all Maildir.X → Maildir/.X
for domain_dir in /home/vmail/*; do
  for user_dir in "$domain_dir"/*; do
    for mal in "$user_dir"/Maildir.*; do
      [ ! -d "$mal" ] && continue
      folder=$(basename "$mal" | sed 's/Maildir\.//')
      target="$user_dir/Maildir/.$folder"
      mv "$mal" "$target"
    done
  done
done

# 2. Delete all dovecot indexes (forces full reindex)
find /home/vmail/ -name "dovecot.index*" -delete

# 3. Fix ownership
chown -R vmail:vmail /home/vmail/

# 4. Verify
doveadm fetch -u steve@touchwell.co.uk uid mailbox INBOX.Sent | wc -l
```

**Root cause**: Chemicloud uses cPanel/Cyrus Maildir naming which differs from Dovecot's dot-prefix convention. The migration rsync doesn't normalize paths.