Kaburu Wiki

# Email Configuration

## Server

All mail is handled by Postfix + Dovecot on kaburusvr (Hetzner, 49.13.202.144).

## Standard Client Settings

All domains share the same mail server. Use either:

Or use domain-specific (if DNS records exist):

Username is always full email address. Password is the mailbox password set in CyberPanel.

## Mailboxes by Domain

### touchwell.co.uk

Note: Steve is blind — phone settings may need in-person setup. Client contact: Steven (WhatsApp +44 7715 002776).

2026-08-03 mail cert fix (touchwell): Steven's phone got a cert error sending (replying to Alan Gibson). Root cause: Postfix had NO SNI maps (`tls_server_sni_maps` empty) → served the mail.kaburu.cc cert for every domain's SMTP; and no `mail.touchwell.co.uk` cert existed at all. Fixed: - Issued `mail.touchwell.co.uk` LE cert via acme.sh DNS-01 (live dir created) - Added Dovecot `local_name mail.touchwell.co.uk` block (IMAP side) - Built Postfix SNI map `/etc/postfix/sni_maps` for ALL 21 `mail.*` hosts — combined key-first PEMs in `/etc/postfix/sni/`, built with `postmap -F` (mandatory — plain postmap yields “malformed BASE64 value” errors). Alternative: use `texthash:/etc/postfix/sni_maps` instead of `hash:` — no postmap needed, reads text file directly. - Repointed Dovecot default cert away from contaminated longniddry→mail.test1 cert → mail.kaburu.cc - Verified: `mail.touchwell.co.uk:465` + `:993` now serve `CN=mail.touchwell.co.uk` - Test email sent 2026-08-03 21:08 to [email protected] from [email protected]; reply watcher cron `watch-touchwell-reply` (91cf3d8aee5e, every 5m) - [email protected] alias created 2026-08-03 (e_forwardings id 17 → [email protected]) — verified end-to-end (postfix lookup + delivery, DKIM signed). Use [email protected] for client-facing sends instead of [email protected] (that domain has NO local mailboxes). - Mail watcher cron `watch-mail` (334d1b398184) every 5m — watches [email protected] INBOX (incl. support@ alias) for new mail + flags real delivery failures (bounces/NOQUEUE rejects, filtered for scanner noise) in the last 10 min. Script ~/.hermes/scripts/watch-mail.sh, state ~/.hermes/cache/watch-mail.lastuid (seeded 713). Silent when nothing; Telegram alert on any new mail. Replaced narrow watch-touchwell-reply (91cf3d8aee5e, removed). - Note: many `mail.*` DNS records don't exist (billing.myretonmarquees, dm-ph, ggsgenerators, jafricasafari, l8waterhygiene, myretonmarquees, rf.*, test*, womenunlimited) and several resolve to Cloudflare IPs (24hrresponse, aberdeenrda, bankhouse, doctorfin, kaburusvr.uk, pilates-edinburgh) — SNI entries harmless, DNS cleanup is separate work. TLS renewal for mail certs = acme.sh cron handles; SNI PEMs under /etc/postfix/sni/ are NOT auto-regenerated on renew (manual: rebuild + postmap -F + postfix reload).

### kaburu.cc

### claybusters.scot

### friendscic.org

### longniddrybowlingclub.co.uk

### longniddrybowlingclub.com

### aberdeenrda.co.uk No mailboxes configured — mail disabled or not in use.

### thechippyvan.co.uk

## Verification Checklist

When a user reports “no email”:

1. ✅ Check `mail.kaburu.cc` resolves to 49.13.202.144 2. ✅ Check Postfix: `systemctl is-active postfix` 3. ✅ Check Dovecot: `systemctl is-active dovecot` 4. ✅ Check mailbox: `ls /home/vmail/[domain]/[user]/Maildir/new/ | wc -l` 5. ✅ Check IMAP connections: `grep “[user]@[domain]” /var/log/mail.log | grep imap` 6. ✅ If no IMAP connections → user's device isn't connecting (likely wrong settings) 7. ✅ Webmail test: `curl -sk -o /dev/null -w “%{http_code}” https://webmail.[domain]/`

## Outbound Mail

- Postfix HELO: `mail.kaburu.cc` (fixed 2026-07-08 — was `kaburusvr.uk` causing Virgin Media rejects) - SPF: all domains include `ip4:49.13.202.144` - DMARC: all domains set to `rua=mailto:[email protected]` - DKIM: managed by CyberPanel per-domain

## Known Issues

- Webmail per-domain: Not all domains have `webmail.[domain]` DNS records. Use `https://mail.kaburu.cc/rainloop/` as fallback. - Stuck queue: Old messages from Dovecot outages may persist. Flush with `postqueue -f`. Non-deliverable spam/bills will expire automatically. - HELO mismatch: Fixed 2026-07-08. Virgin Media, BT, and other strict receivers now accept mail. - doctorfin.co.uk / pilates-edinburgh.co.uk: MX still points at residual `_dc-mx.*` (M365 verification hostnames) that resolve to 49.13.202.144. No Maildirs in `/home/vmail/`. Fix MX to `mail.<domain>` if self-hosted, or real provider MX. See dns-spf-audit. - Proton domains (kaburu.co, kaburu.co.uk, 24hrresponse.com): SPF has both `include:_spf.protonmail.ch` and `ip4:49.13.202.144`. Keep if kaburusvr still sends; otherwise prune.

## Dovecot Maildir Structure

Location: `/home/vmail/<domain>/<user>/Maildir/`

Folder naming: Dot-prefixed subdirectories of `Maildir/` - `Maildir/` = INBOX - `Maildir/.Trash/` = Trash - `Maildir/.Sent/` = Sent - `Maildir/.Drafts/` = Drafts - `Maildir/.Archive/` = Archive - `Maildir/.Junk/` or `Maildir/.spam/` = Spam

### Cyrus Migration Directory Bug

Problem: Cyrus (Chemicloud) uses `Maildir.Sent`, `Maildir.Trash` etc. (no dot, no slash). Migration preserves the wrong naming. Dovecot expects `Maildir/.Sent/` format. Messages exist physically but are invisible to IMAP.

Fix: ```bash # 1. Rename all Maildir.X → Maildir/.X for domain_dir in /home/vmail/*; do

for user_dir in "$domain_dir"/*; do
  for mal in "$user_dir"/Maildir.*; do
    [ ! -d "$mal" ] && continue
    folder=$(basename "$mal" | sed 's/Maildir\.//')
    target="$user_dir/Maildir/.$folder"
    mv "$mal" "$target"
  done
done

done

# 2. Delete all dovecot indexes (forces full reindex) find /home/vmail/ -name “dovecot.index*” -delete

# 3. Fix ownership chown -R vmail:vmail /home/vmail/

# 4. Verify doveadm fetch -u [email protected] uid mailbox INBOX.Sent | wc -l ```

Root cause: Chemicloud uses cPanel/Cyrus Maildir naming which differs from Dovecot's dot-prefix convention. The migration rsync doesn't normalize paths.