# Coritan Docs
# Email
> Host mailboxes on your own domain with Mail Hosting, send your applications' mail with SMTP Relay, and read mail in webmail.
Source: https://www.coritan.com/docs/mail/
In the dashboard:
- /solutions/mail: https://www.coritan.com/solutions/mail
- /dashboard/mail: https://www.coritan.com/dashboard/mail
Coritan has two mail products. *Mail Hosting* gives people mailboxes on your own domain, which they read in a mail app or in webmail. *SMTP Relay* sends the mail your software writes, such as receipts, password resets and newsletters, over SMTP or an HTTPS API, and reports what happened to each message.
Both run in the region you choose when you order, and both use DNS records on your domain to prove the mail is yours. You can order more than one of each.
## What you can do
Start here:
- [Order Mail Hosting or SMTP Relay](/docs/mail/order-a-mail-service/)
- [Mail DNS records](/docs/mail/dns-records/): what each record is for and how to publish it
- [How the DMARC stage ramp works](/docs/mail/dmarc/)
Mail Hosting:
- [How Mail Hosting works](/docs/mail/mail-hosting/)
- [Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/)
- [Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/)
- [Secure a mailbox](/docs/mail/mail-hosting/mailbox-security/) with two-factor sign-in and app passwords
- [Forward addresses with aliases](/docs/mail/mail-hosting/aliases/)
- [Connect a mail app](/docs/mail/mail-hosting/connect-a-mail-app/)
- [Move existing mail into a mailbox](/docs/mail/mail-hosting/move-mail-in/)
- [Change Mail Hosting settings](/docs/mail/mail-hosting/settings/)
SMTP Relay:
- [How SMTP Relay works](/docs/mail/smtp-relay/)
- [Add a sending domain](/docs/mail/smtp-relay/add-a-sending-domain/)
- [Send over SMTP with credentials](/docs/mail/smtp-relay/credentials/)
- [Create and revoke send API keys](/docs/mail/smtp-relay/api-keys/) and [send email over HTTPS](/docs/mail/smtp-relay/send-with-the-api/)
- [Transactional and marketing mail](/docs/mail/smtp-relay/message-categories/)
- [Receive delivery events with webhooks](/docs/mail/smtp-relay/webhooks/), [look up message events](/docs/mail/smtp-relay/events/) and [manage the suppression list](/docs/mail/smtp-relay/suppressions/)
- [How sending limits work](/docs/mail/smtp-relay/sending-limits/) and [request a higher hourly limit](/docs/mail/smtp-relay/request-a-higher-limit/)
- [Sending reputation and deliverability](/docs/mail/smtp-relay/deliverability/)
Webmail:
- [How webmail works](/docs/mail/webmail/), from [getting a free coritan.gg mailbox](/docs/mail/webmail/claim-a-mailbox/) to [filters](/docs/mail/webmail/labels-and-filters/) and [keyboard shortcuts](/docs/mail/webmail/keyboard-shortcuts/)
When something goes wrong, see [Troubleshoot mail](/docs/mail/troubleshooting/).
## Find your mail services
In the dashboard, go to **Email**. The list shows every Mail Hosting and SMTP Relay service on your account, with its **Domain**, **Product**, **Status**, **Plan** and **Since** date. Filter it by status, or search by domain or plan. Select a row to open the service's panel.
The **Plan** column says what the service holds: a count of mailboxes for Mail Hosting, and the monthly email allowance for SMTP Relay. A service that is still being set up reads `Not set up yet`.
To order, select **Order Mail Hosting** or **Order SMTP Relay** at the top of the list. Each opens the product's order page. The public [Mail page](https://www.coritan.com/solutions/mail) lists the current plans before you sign in.
## Billing
Each service is billed for its plan and renews every billing cycle until you cancel it. SMTP Relay's order page also offers a free plan. [How Mail Hosting and SMTP Relay are billed](/docs/mail/billing/) covers plan changes, the monthly sending allowance and cancelling.
## Limits that apply to every mail service
- A service lives in the region you chose when you ordered it, and its mail is stored there.
- Prove you own a domain and publish its records before you send from it. A domain counts as verified once its ownership, SPF and DKIM checks pass, and for Mail Hosting its MX check too. See [Mail DNS records](/docs/mail/dns-records/).
- A domain can be on one mail service at a time. To use a domain on both products, give the relay a sending subdomain, such as `send.example.com`.
- The plan sets how many domains, mailboxes or SMTP credentials the service may hold. The panel shows each count against its limit.
- Coritan pauses a service's sending when its bounce or complaint rate crosses the platform's limit. See [Sending reputation and deliverability](/docs/mail/smtp-relay/deliverability/).
## With the API
List your mail services:
```bash
curl https://api.coritan.com/api/v1/client/mail/services \
-H "Authorization: Bearer $CORITAN_TOKEN"
```
`GET /client/smtp-relay/services` returns the same list. Both answer `{"items": [...], "total": n}` with one item for every Mail Hosting and SMTP Relay service on your account:
```json
{
"items": [
{
"service_id": 4812,
"tenant_id": 97,
"internal": false,
"module_name": "smtp_relay",
"product_name": "Relay 50K",
"status": "active",
"hostname": "send.example.com",
"tenant": { "...": "..." },
"created_at": "2026-09-01T10:12:00"
}
],
"total": 1
}
```
`module_name` is `mail` for Mail Hosting and `smtp_relay` for SMTP Relay. Use `service_id` as `{service_id}` in every other mail request. The two prefixes share one set of routes, so `/client/mail/{service_id}/...` and `/client/smtp-relay/{service_id}/...` reach the same service. An operation that belongs to the other product answers `400` or `404` with a message that says so, such as `Mailboxes are only available on Mail Hosting services`.
An item with `"internal": true` and `"service_id": null` is an [internal mail tenant](/docs/mail/internal-tenants/). Reach it through `/client/platform-mail/{tenant_id}/...` instead.
A service that is still being set up answers `409` `This mail service is still provisioning`. See [Authentication](/docs/api/authentication/) for tokens.
## API
- `GET /api/v1/client/mail/services`: List services (https://www.coritan.com/docs/api/reference/client/mail/mail/#op-get-api-v1-client-mail-services)
- `GET /api/v1/client/smtp-relay/services`: List services (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay/#op-get-api-v1-client-smtp-relay-services)
# Order Mail Hosting or SMTP Relay
> Choose Mail Hosting for mailboxes or SMTP Relay for application mail, pick a plan and a domain, and pay for the order on the page it lands on.
Source: https://www.coritan.com/docs/mail/order-a-mail-service/
In the dashboard:
- /dashboard/mail: https://www.coritan.com/dashboard/mail
- /dashboard/order/mail-hosting: https://www.coritan.com/dashboard/order/mail-hosting
- /dashboard/order/smtp-relay: https://www.coritan.com/dashboard/order/smtp-relay
- /dashboard/order/relay-dedicated-ip: https://www.coritan.com/dashboard/order/relay-dedicated-ip
Order Mail Hosting when people need mailboxes on your domain, and SMTP Relay when software needs to send mail, such as receipts, alerts and newsletters. Each product has an order page of its own, and you can hold several of each. A relay on a large enough plan can also take a dedicated sending IP, which you order for that relay.
## Before you begin
- Decide which product you need. [How Mail Hosting works](/docs/mail/mail-hosting/) and [How SMTP Relay works](/docs/mail/smtp-relay/) describe each.
- For a paid plan, credit on your account pays the first invoice first. Otherwise you pay by card or PayPal on the page the order lands on ([How the first payment works](/docs/get-started/order-a-service/#how-the-first-payment-works)).
- Optionally, have a domain whose DNS you can change. You can also add it after the order.
- To use one domain for both products, plan a sending subdomain for the relay, such as `send.example.com`. A domain can be on one mail service at a time.
## Open the order page
Any of these opens the order page for Mail Hosting or SMTP Relay:
- In [**Email**](https://www.coritan.com/dashboard/mail), select **Order Mail Hosting** or **Order SMTP Relay**. With no mail service yet, the same buttons are in the middle of the page.
- In a mail service's panel, select **Order another** in its header. It opens the page for the same product.
- On [**Order a service**](https://www.coritan.com/dashboard/order), select the **Mail Hosting** or **SMTP Relay** card under **Email**.
You can also add Mail Hosting or SMTP Relay to a Cloud Compute or Container Apps order, and SMTP Relay to a Mail Hosting order ([Add products to the order](/docs/get-started/order-a-service/#add-products-to-the-order)).
## Order the service
The page has numbered sections, and the summary under **Your order** sits beside them. On a phone the summary follows the sections, and **Review order** at the bottom of the screen takes you to it.
1. Under **Plan**, choose a plan. We start with the plan the catalogue recommends, or else the first one on sale.
- A Mail Hosting plan shows how many mailboxes it holds, the storage each mailbox gets and how many domains it takes, such as `5 mailboxes · 10 GB each · 1 domain`.
- An SMTP Relay plan shows its emails a month, its price per 1,000, whether it has a buffer over the allowance or `stops at the allowance`, its sending domains and any dedicated IPs. The free plan shows **Free** as its price.
2. Check the billing cycle beside the **Plan** heading. When the plans sell more than one cycle, select one of its buttons, such as **Monthly**. A longer term names what it saves, such as `Annually · save 20%`. Relay plans are billed monthly, so the SMTP Relay page reads `Billed monthly` there.
3. Under **Domain** (Mail Hosting) or **Sending domain** (SMTP Relay), optionally enter a domain such as `example.com` in **First domain** or **First sending domain**. Leave it empty to add domains from the panel later.
- If you hold free [coritan.gg names](/docs/proxies/coritan-gg-names/), they appear beside **Your names:** under the field. Select one to use it.
4. On a Mail Hosting order, **Add-ons** offers an SMTP Relay for the mail your applications send. To add one, turn on the switch on the **SMTP Relay** card. Choose its **Plan** when the card lists more than one, and optionally enter a **Sending domain**. Only paid relay plans are offered here: order the free plan on the SMTP Relay page.
5. Check the summary. It lists the plan with its billing cycle and the domain, with **Change** beside each to go back to its section. Under **Billed** are the plan and any add-on. The **Total** shows the price for each billing cycle and what is due today, and the line under it says how the first invoice is paid.
6. On a free plan, complete the verification check above the button. We check every order whose plan costs nothing.
7. Select the button under the summary. It reads **Place order and pay** when you pay after placing the order, **Place order** when your credit pays for it or your account is billed in arrears, and **Order for free** on a free plan.
We do not ask for a region. We set the service up in our mail region, and the panel shows the region's code in its header.
If we refuse the order, **Could not place the order** appears above the button with the reason, and your choices stay as they were.
## Pay for the order
Once you place the order, its own page opens, and its title says what comes next:
- **Order placed, payment due**: pay under **Pay invoice** with account credit, a saved card or PayPal account, or a new card. Setup starts once the payment goes through. [Pay and follow the order](/docs/get-started/order-a-service/#pay-and-follow-the-order) walks through each way to pay.
- **Order placed**: nothing is due now, because credit paid the invoice, the plan is free or your account is billed in arrears. We are setting up the service, and the page updates on its own.
- **Your order is ready**: every service in the order is active.
**What you ordered** lists the service and any SMTP Relay you added, each with its status and price. To pay later, leave the page and pay the invoice under [Invoices](/docs/billing/invoices/). The service waits until it is paid.
## Order a dedicated sending IP
A relay whose plan sends 100,000 emails a month or more can take a dedicated sending address. Each one is a service of its own, with its own invoice ([Dedicated sending addresses](/docs/mail/smtp-relay/sending-limits/#dedicated-sending-addresses)).
1. Open the relay's panel from [**Email**](https://www.coritan.com/dashboard/mail) and stay on the **Overview** tab.
2. On the **Sending IPs** card, select **Order dedicated IP**. On a smaller plan the button is greyed out, and the card says which plan you need.
3. The **Dedicated sending IP** page opens with the relay chosen under **Relay**. If you opened the page another way, choose the relay there.
4. If **This relay cannot take a dedicated IP yet** appears, select **Change plan** and move the relay to a larger plan first.
5. Under **Plan**, choose the address's plan.
6. Check the summary, then select **Order dedicated IP**, and pay on the order's page as for any order.
When the address is ready, it is on the relay's **Sending IPs** card with an **Add-on** badge, and a **Warming up** badge while it warms up. Look for it there, on the relay's **Overview** tab.
## Result
Every service in the order appears in [**Email**](https://www.coritan.com/dashboard/mail) with the status `pending`, then `provisioning` while we set it up, then `active`. We email you when each one is ready. Until then, its panel shows one of these:
- **Waiting for payment**, with **Open invoices**, until the invoice is paid.
- **Setting up** while we create the service.
- **Not set up yet** on every tab but **Billing**, until the service exists.
When the service is active, the button at the top of the order's page opens its panel. If you entered a first domain, it is on the **Domains** tab as the primary domain, with the DNS records to publish. Continue with [Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/) or [Add a sending domain](/docs/mail/smtp-relay/add-a-sending-domain/).
## Troubleshooting
The button under the summary is greyed out
: The line under the button names the first answer still missing, such as `Enter a valid domain, or leave it empty.` or `Complete the verification check.` Select it to go to that section.
`Enter a domain, such as example.com.`
: Type the domain on its own, such as `example.com`, with no `https://`, path or address. Or clear the field and add the domain later. On the **SMTP Relay** add-on, the line under the button reads `Enter a domain for SMTP Relay, such as example.com, or leave it empty.`
`The verification check did not pass. Complete it and try again.`
: The check on a free order expired or failed. Complete it again, then select **Order for free**.
`You already have 1 free SMTP Relay. Upgrade or remove one to create another.`
: Each account may hold one free relay, and a free relay counts until it has ended. Order a paid plan instead, or cancel the free relay with **Immediately** and order again once it has ended ([The free SMTP Relay plan](/docs/mail/billing/#the-free-smtp-relay-plan)).
`This plan has no price yet.`
: The plan cannot be ordered yet. Choose another plan, or ask [support](/docs/support/conversations/).
A plan shows **Sold out**
: The plan cannot be ordered right now. Choose another plan.
`No Mail Hosting plans yet` or `No SMTP Relay plans yet`
: The product is not in the catalogue for your account. Ask [support](/docs/support/conversations/) if you expected it there.
**Could not load the plans**
: The plans did not load. Select **Try again**, or reload the page.
The first domain is not on the Domains tab
: The order goes ahead even when the domain cannot be added, for example because it is already on another mail service. Add it from the **Domains** tab, which shows the reason if it is refused again.
**No relays yet** on the dedicated IP page
: A dedicated IP sends for one of your relays, and the account has no active or suspended relay. Select **Order SMTP Relay** to order one first.
`Upgrade the relay's plan first.`
: The relay's plan sends fewer than 100,000 emails a month. Select **Change plan** under **This relay cannot take a dedicated IP yet**, move to a larger plan, then order the address.
`Could not check the relay. Reload the page and try again.`
: We could not read the relay's plan. Reload the page. If **Could not load your relays** appears instead, reload the page too.
## Related
- [Mail DNS records](/docs/mail/dns-records/)
- [How Mail Hosting and SMTP Relay are billed](/docs/mail/billing/)
- [How SMTP Relay sending limits work](/docs/mail/smtp-relay/sending-limits/)
- [Order a service](/docs/get-started/order-a-service/)
- [Claim a free coritan.gg name](/docs/proxies/coritan-gg-names/)
## With the API
Order either product with [`POST /services/order`](/docs/api/reference/client/services/#op-post-api-v1-services-order). List the plans with [`GET /products/`](/docs/api/reference/client/catalog/#op-get-api-v1-products): Mail Hosting plans have the `module_name` `mail`, and SMTP Relay plans `smtp_relay`. Copy the plan's `config_schema` into `config` as it is, and add `domain` for a first domain. We refuse a Mail Hosting order without the plan's `mailboxes` and `storage_gb_per_mailbox`, and a relay order without its `monthly_messages`.
This example orders Mail Hosting with an SMTP Relay on the same invoice:
```bash
curl -X POST https://api.coritan.com/api/v1/services/order \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"product_id": 61,
"pricing_id": 140,
"hostname": "example.com",
"config": {"mailboxes": 5, "storage_gb_per_mailbox": 10, "domains": 1, "domain": "example.com"},
"addons": [
{
"product_id": 72,
"config": {"monthly_messages": 25000, "domains": 0, "credentials": 0, "dedicated_ips": 0, "quota_buffer_pct": 12, "domain": "send.example.com"}
}
]
}'
```
`hostname` is the name the service is listed under, and the dashboard sends the first domain there. An add-on needs a price above $0, so the free relay plan is ordered on its own, with a `turnstile_token` from the verification check on the website. The answer is `201` with the new `service`, its `addons`, and `invoice_id` and `amount_due` when `requires_payment` is `true`. [Order a service](/docs/get-started/order-a-service/#with-the-api) describes the answer and the errors every order shares. These are the mail ones:
- `422` with `{"detail": {"errors": [...]}}` for a config we cannot use, such as `mailboxes must be at least 1` or `monthly_messages must be at least 1000`. An add-on's message starts with its plan name.
- `409` with `"error": "free_limit_reached"` when the account already holds a free relay.
A dedicated sending IP is an order of the `smtp_relay` product whose `config_schema` has `"addon": "dedicated_ip"`. Send that `config_schema` with `relay_service_id`, the service id of the relay it sends for. It cannot be an add-on of another order. Check the relay first with [`GET /client/smtp-relay/{service_id}`](/docs/api/reference/client/mail/smtp-relay/#op-get-api-v1-client-smtp-relay-service-id): `limits.dedicated_ip_addon_eligible` must be `true`. We check the plan again when we set the address up, and the setup fails on a relay that sends fewer than `limits.dedicated_ip_min_monthly` emails a month.
```bash
curl -X POST https://api.coritan.com/api/v1/services/order \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"product_id": 79, "pricing_id": 160, "config": {"addon": "dedicated_ip", "dedicated_ips": 1, "relay_service_id": 1187}}'
```
## API
- `POST /api/v1/services/order`: Order a platform service, and any add-ons bought with it (https://www.coritan.com/docs/api/reference/client/services/#op-post-api-v1-services-order)
- `GET /api/v1/client/smtp-relay/{service_id}`: Get summary (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay/#op-get-api-v1-client-smtp-relay-service-id)
# How Mail Hosting works
> What a Mail Hosting service includes, how domains, mailboxes and aliases fit together, and what its Overview tab shows.
Source: https://www.coritan.com/docs/mail/mail-hosting/
In the dashboard:
- /dashboard/mail/…/overview: https://www.coritan.com/dashboard/mail
A Mail Hosting service gives people mailboxes on your own domain. They read and send mail in a mail app over IMAP and SMTP, over JMAP, or in webmail. You manage everything from the service's panel in the dashboard: go to **Email** and open the service.
## How the parts fit together
*Domains*
: The names your addresses end in, such as `example.com`. You add a domain, prove you own it and publish its DNS records. See [Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/).
*Mailboxes*
: Addresses that store mail and can sign in, such as `alex@example.com`. Each has its own password and storage quota. See [Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/).
*Aliases*
: Extra addresses that deliver to one or more mailboxes on the service, including a catch-all for a whole domain. See [Forward addresses with aliases](/docs/mail/mail-hosting/aliases/).
A mailbox or alias can only use a domain on the same service, and the dashboard offers only domains that are verified. Each domain can be on one mail service at a time.
## What the plan sets
The plan sets how many mailboxes and domains the service may hold, and how much storage it has. The storage is one pool for the whole service: the number of mailboxes multiplied by the storage per mailbox that the plan lists.
Each mailbox takes a share of that pool as its quota. A new mailbox gets an equal share by default, and you can give one mailbox more and another less, as long as the quotas together fit in the pool. The smallest quota is 100 MB.
Aliases do not count against the plan. To get more mailboxes, domains or storage, see [Move to a bigger or smaller plan](/docs/mail/billing/#move-to-a-bigger-or-smaller-plan).
## What the Overview tab shows
In the dashboard, go to **Email**, open the service, then the **Overview** tab.
The four figures at the top show **Storage**, **Mailboxes** and **Domains** used against the plan, and the number of **Aliases**.
**Mail server addresses**
: The names to enter in a mail app: **SMTP** (ports 587 with STARTTLS and 465 with TLS), **IMAP** (port 993 with TLS) and **JMAP** (port 443). It also shows the **Webmail** address and the **MX suffix**, which ends the `mx1`, `mx2` names your domains' MX records point to.
**Mail client setup**
: The settings a mail app asks for, in the order it asks. See [Connect a mail app](/docs/mail/mail-hosting/connect-a-mail-app/).
**Recent activity**
: The latest delivery events from the last seven days, such as delivered, bounced or deferred messages.
**Service**
: The service's **Status**, **Plan**, **Region**, the date it **Renews**, when it was **Created** and its **Service ID**. When we pause the service's sending, the status reads **Sending paused**.
**Tags**
: Labels you add to find the service. See [Tags](/docs/get-started/tags/).
**Domains**
: Each domain and its verification status. Select one to open its DNS records.
The panel header has **Open webmail**, which opens the webmail address in a new tab, and **Order another**, which opens the Mail Hosting order page for a second service.
## Sending from a mailbox
A mailbox sends through the service's SMTP server after it signs in. The rules that apply to every mail service apply to it too:
- The From address must be on a domain of the service that has passed its ownership check.
- A recipient on the service's suppression list is refused with `Recipient … is suppressed after a bounce or complaint`. Bounces and spam complaints add addresses to it.
- The service has an hourly sending limit, `rate_per_hour` in the [service summary](#with-the-api). Mail over it waits in the queue and goes out in a later hour.
- We watch each service's bounce and complaint rates. When they cross the pause threshold, we pause the service and the panel shows **Sending is paused**. Until our staff lift the pause, its mailboxes cannot sign in, send or receive mail. See [Sending reputation and deliverability](/docs/mail/smtp-relay/deliverability/).
To send mail from an application rather than a person, use [SMTP Relay](/docs/mail/smtp-relay/).
## When the service ends
When you [cancel the service](/docs/billing/cancel-a-service/) and it ends, we delete its mailboxes, aliases and stored mail. Move anything you want to keep first.
## With the API
Read the service summary:
```bash
curl https://api.coritan.com/api/v1/client/mail/4812 \
-H "Authorization: Bearer $CORITAN_TOKEN"
```
The fields you need most:
`kind`
: `hosting` for Mail Hosting.
`status`
: `active` once the service is ready.
`quota_mailboxes`, `quota_domains`, `quota_storage_bytes`
: What the plan allows. `quota_storage_bytes` is the whole pool.
`counts`
: How many of each thing the service holds: `mailbox`, `alias`, `group` and `domains`.
`used_bytes`
: The storage the mailboxes use.
`rate_per_hour`
: The service's hourly sending limit.
`hostnames`
: `smtp_host`, `imap_host` and `jmap_host` for mail apps, `webmail_url`, and `mx_hostname_base`, the MX suffix.
`cluster.region`, `cluster.region_name`
: The region the service runs in: its code, and its name, such as `Frankfurt`, or `null` when we have no name for it.
`sending_frozen`, `review_flag`, `reputation_note`
: Whether sending is paused or under review, and why.
`service`
: The service's `id`, `status` and `hostname`.
A service that is still being set up answers `409` with `This mail service is still provisioning`.
## API
- `GET /api/v1/client/mail/{service_id}`: Get summary (https://www.coritan.com/docs/api/reference/client/mail/mail/#op-get-api-v1-client-mail-service-id)
# Add a domain to Mail Hosting
> Add your domain to a Mail Hosting service, publish its DNS records and verify it so its mailboxes can send and receive mail.
Source: https://www.coritan.com/docs/mail/mail-hosting/add-a-domain/
In the dashboard:
- /dashboard/mail/…/domains: https://www.coritan.com/dashboard/mail
Add the domain your addresses will be on, such as `example.com`, publish its DNS records and verify it. Once it is verified, it receives mail here and you can create mailboxes and aliases on it.
## Before you begin
- A Mail Hosting service with the status `active`. [Order one](/docs/mail/order-a-mail-service/) if you have none. While a service is being set up, **Add domain…** is greyed out.
- A domain whose DNS you can change. When its zone is on [Coritan DNS](/docs/websites/add-an-existing-domain/) in the same account, we publish the records for you.
- Room on the plan. The **Domains** card shows how many domains the plan allows, such as `1 of 1 on this plan.`
- A domain that is on no other mail service. A domain can be on one mail service at a time.
> [!IMPORTANT]
> Verifying a Mail Hosting domain needs its MX records to point here, and new mail follows the MX records straight away. If the domain receives mail somewhere else today, read [Move a domain that already receives mail](#move-a-domain-that-already-receives-mail) first.
## Add the domain
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the Mail Hosting service, then the **Domains** tab.
2. Select **Add domain…**.
3. In **Domain**, enter the domain, such as `example.com`. Names you claimed under [coritan.gg](/docs/proxies/coritan-gg-names/) are listed beside **Your names:**; select one to fill it in.
4. Leave **Make this the primary domain** ticked if this is the service's main domain. The primary domain names the service in lists. The box starts ticked when the service has no primary domain yet.
5. Select **Add domain**.
The domain's page opens, with its records on the **DNS records** card.
## Publish the records
What you do depends on where the domain's DNS is:
- On Coritan DNS, in this account: nothing. We have already written the records into the zone, and the card reads *We publish these into your hosted zone and keep them up to date.* A record your zone already had wins over ours; see [Records we publish for you](/docs/mail/dns-records/#records-we-publish-for-you).
- On Coritan DNS, but added to this account after the domain: use the [**Publish to your zone**](/docs/mail/dns-records/#publish-to-your-zone) card on the domain's page.
- A claimed coritan.gg name: nothing. We publish its records and check the domain as soon as you add it.
- Anywhere else: create the records at your DNS provider, as the steps below describe.
To publish the records at another DNS provider:
1. Create the ownership record first: the TXT record at `_mailverify.example.com`. Copy its name and value from the **DNS records** card.
2. Create the MX, SPF and DMARC records and the rest of the list.
3. On the domain's page, select **Verify now**. Once we find the ownership record, we make the domain's two DKIM keys.
4. Reload the page. The card now lists the two DKIM records.
5. Create the two DKIM records.
[Mail DNS records](/docs/mail/dns-records/) explains every record and what its check looks for.
## Verify the domain
1. On the domain's page, select **Verify now**.
2. Read the toast. `example.com is verified.` means you are done. `example.com is still pending:` is followed by the first problem the check found.
3. If it is still pending, fix what the **Checks** row and the **The last check found problems** list show, and select **Verify now** again.
We also check pending domains about every ten minutes, so a domain whose records are right verifies on its own. The card's **Status** column shows each record's result from the last check.
## Result
- The domain shows `Verified` on the **Domains** tab, and **Ownership**, **MX**, **SPF** and **DKIM** are ticked. **DMARC** is shown too, but a domain is verified without it.
- The domain is offered in the **Mailboxes** and **Aliases** forms. See [Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/).
- Mail to addresses on the domain arrives here.
- When we publish into your zone, the page shows *Ready: the records are in your zone*, with **Create your first mailbox** (or **Create mailbox** once the service has mailboxes).
## Move a domain that already receives mail
The dashboard creates mailboxes only on a verified domain, and a domain verifies only once its MX records point here. To have the mailboxes ready before mail arrives, create them with the API instead: it accepts a domain as soon as its ownership record is found.
1. Add the domain as above.
2. Publish the ownership record, and add `include:_spf.` from the card to your current SPF record, so the domain keeps one SPF record. Leave your MX records as they are.
3. Select **Verify now**. The ownership check passes; the domain stays pending because of MX.
4. Reload the page, then publish the two DKIM records it now lists.
5. Create the mailboxes with the API. See [Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/#with-the-api).
6. Copy the old mail in if you want to. See [Move existing mail into a mailbox](/docs/mail/mail-hosting/move-mail-in/).
7. Replace your MX records with the ones on the **DNS records** card, and publish the rest of the list.
8. Select **Verify now**.
Mail other servers already queued for the old MX hosts can still arrive there for a while after the change, so check the old mailboxes for a few days. Once you no longer send through the old provider, remove its include from your SPF record.
## Remove a domain
> [!WARNING]
> Removing a domain stops mail to and from it at once. If you add it again later, it gets a new ownership token and new DKIM keys, so you publish and verify it from the start.
1. Delete the mailboxes and aliases on the domain first. See [Delete a mailbox](/docs/mail/mail-hosting/mailboxes/#delete-a-mailbox) and [Forward addresses with aliases](/docs/mail/mail-hosting/aliases/).
2. On the **Domains** tab, select the domain.
3. In the **Remove this domain** card, select **Remove domain…**.
4. Type the domain name to confirm, then select **Remove domain**.
The **Settings** tab has the same **Remove domain…** button for each domain, under **Danger zone**. We delete the records we published into a hosted zone. Records at another DNS provider are yours to delete.
## Troubleshooting
**Add domain…** is greyed out
: The service is not `active` yet, or the plan's domains are all used. A full plan shows `This plan allows 1 domain. Remove one or change the plan to add another.` Remove a domain or [move to a bigger plan](/docs/mail/billing/#move-to-a-bigger-or-smaller-plan).
`Enter a domain, such as example.com.`
: The **Domain** field is empty or is not a domain name. Enter the name alone, without `https://` or an address.
`Enter a valid domain name such as example.com`
: The API refused the name. Use letters, digits and hyphens in each label, and a real top-level domain.
`Wildcard domains cannot receive mail`
: Enter a name such as `example.com` rather than `*.example.com`.
`That domain is already attached to a mail service`
: Someone else's mail service has it. If the domain is yours, contact [support](/docs/support/conversations/).
`example.com is a sending domain on your SMTP Relay service. To host mailboxes on it, remove it there and give the relay a sending subdomain such as send.example.com.`
: A domain can be on one mail service. [Add a sending subdomain](/docs/mail/smtp-relay/add-a-sending-domain/) to the relay, remove the domain from the relay, then add it here. The relay can still send as `@example.com`.
`example.com is already on another of your mail services`
: Remove it from the other Mail Hosting service first.
`example.com is a name the mail platform uses itself` or `example.com is one of the platform's own domains, so it cannot be added to this service`
: The name belongs to Coritan. Use a domain of your own.
`Claim a coritan.gg name before using alex.coritan.gg; it is not yours yet`
: [Claim the name](/docs/proxies/coritan-gg-names/) first. `coritan.gg is the platform's own domain; claim a name under it first` means you entered `coritan.gg` itself.
`This plan allows 1 domain(s)`
: The plan is full. Remove a domain or [move to a bigger plan](/docs/mail/billing/#move-to-a-bigger-or-smaller-plan).
`MX points to` followed by other hosts
: The domain's MX records still name another provider. Replace them with the ones on the **DNS records** card. When we publish into your zone, we add no MX records while another provider's are there, so delete those yourself.
`DKIM selector cor202609r not published`
: The DKIM record with that selector is missing or holds a different key. Copy the whole value again; some DNS providers split long TXT values, which is fine as long as nothing is lost.
`No DKIM keys yet: the mail engine has not made them`
: We have not finished making the domain's keys. Select **Verify now** again in a minute.
`DMARC publishes p=none, expected p=quarantine`
: Your DMARC record has a different stage from the one we expect. The domain verifies without DMARC; see [DMARC](/docs/mail/dmarc/) to fix it.
`The zone is busy with another change. Check the domain again in a minute.`
: Another change to the same zone was being saved. Select **Verify now** again.
`Remove the mailboxes and aliases on this domain first`
: Delete them, then remove the domain.
**Sending only**
: An older domain that passed its checks before MX was required. Its MX records point elsewhere, so it sends but does not receive mail here. Publish the MX records on the card to receive mail.
## Related
- [Mail DNS records](/docs/mail/dns-records/)
- [Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/)
- [How the DMARC stage ramp works](/docs/mail/dmarc/)
- [Mail troubleshooting](/docs/mail/troubleshooting/)
## With the API
Add a domain:
```bash
curl -X POST https://api.coritan.com/api/v1/client/mail/4812/domains \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"domain": "example.com", "primary": true}'
```
`domain` is the name (3–253 characters) and `primary` defaults to `false`. The answer is `201` with the domain and its `records`, in the shape [the records endpoint](/docs/mail/dns-records/#with-the-api) returns. A name the service refuses answers `400` with one of the messages in [Troubleshooting](#troubleshooting). The coritan.gg claim messages answer `403`, and a service that is not active answers `409` `Service is not active`.
Check the domain now:
```bash
curl -X POST https://api.coritan.com/api/v1/client/mail/4812/domains/311/verify \
-H "Authorization: Bearer $CORITAN_TOKEN"
```
```json
{
"domain": { "id": 311, "domain": "example.com", "status": "pending", "checks": { "ownership": true, "mx": false, "spf": true, "dkim": true, "dmarc": true } },
"result": {
"ownership": true,
"mx": false,
"spf": true,
"dkim": true,
"dmarc": true,
"dmarc_policy": "none",
"errors": ["MX points to aspmx.example.net"],
"dkim_pending_published": []
}
}
```
The other domain operations:
| Operation | What it does |
| --- | --- |
| `GET /client/mail/{service_id}/domains` | Lists the service's domains as `{"items": [...]}`, each with `status`, `checks`, `is_primary`, `dmarc_policy` and `last_error`. |
| `GET /client/mail/{service_id}/domains/{domain_id}/records` | The records to publish. See [Mail DNS records](/docs/mail/dns-records/#with-the-api). |
| `PATCH /client/mail/{service_id}/domains/{domain_id}/dmarc` | Sets or holds the DMARC stage. See [DMARC](/docs/mail/dmarc/#with-the-api). |
| `DELETE /client/mail/{service_id}/domains/{domain_id}` | Removes the domain and answers `{"ok": true}`. |
A domain that is not on the service answers `404` `Domain not found`.
## API
- `GET /api/v1/client/mail/{service_id}/domains`: List domains (https://www.coritan.com/docs/api/reference/client/mail/mail-domains/#op-get-api-v1-client-mail-service-id-domains)
- `POST /api/v1/client/mail/{service_id}/domains`: Add domain (https://www.coritan.com/docs/api/reference/client/mail/mail-domains/#op-post-api-v1-client-mail-service-id-domains)
- `DELETE /api/v1/client/mail/{service_id}/domains/{domain_id}`: Remove domain (https://www.coritan.com/docs/api/reference/client/mail/mail-domains/#op-delete-api-v1-client-mail-service-id-domains-domain-id)
- `PATCH /api/v1/client/mail/{service_id}/domains/{domain_id}/dmarc`: Set DMARC (https://www.coritan.com/docs/api/reference/client/mail/mail-domains/#op-patch-api-v1-client-mail-service-id-domains-domain-id-dmarc)
- `GET /api/v1/client/mail/{service_id}/domains/{domain_id}/records`: Domain records (https://www.coritan.com/docs/api/reference/client/mail/mail-domains/#op-get-api-v1-client-mail-service-id-domains-domain-id-records)
- `POST /api/v1/client/mail/{service_id}/domains/{domain_id}/verify`: Verify domain (https://www.coritan.com/docs/api/reference/client/mail/mail-domains/#op-post-api-v1-client-mail-service-id-domains-domain-id-verify)
# Create and manage mailboxes
> Create mailboxes on your domain, reset their passwords, change storage quotas, and turn off or delete a mailbox.
Source: https://www.coritan.com/docs/mail/mail-hosting/mailboxes/
In the dashboard:
- /dashboard/mail/…/mailboxes: https://www.coritan.com/dashboard/mail
A *mailbox* is an address with its own storage, such as `alex@example.com`, that people sign in to with webmail or a mail app. Each Mail Hosting plan allows a number of mailboxes and a pool of storage they share. This page covers creating mailboxes and looking after them.
## Before you begin
- A Mail Hosting service with a domain whose ownership you have proved. See [Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/).
- Room on the plan. The **Mailboxes** card shows how many the plan allows, such as `3 of 5 on this plan.`
## Create a mailbox
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the Mail Hosting service, then the **Mailboxes** tab.
2. Select **Create mailbox…**.
3. In **Name**, enter the part before the @, such as `alex`. The hint under the field shows the full address.
4. In **Domain**, choose the domain. The list holds every domain whose ownership you have proved. A domain whose other DNS records are not in place yet is marked `not fully set up`: you can create the mailbox, but its mail may land in spam or not arrive until you finish the domain, and the mailbox's row says `Domain not fully set up` until then.
5. Optionally, enter a **Display name**, such as `Alex Morgan`.
6. In **Quota (GB)**, set the mailbox's storage. The field starts at an equal share of the plan's storage, and its hint shows the plan's total.
7. Under **Password**, choose **Generate a strong password**, or **Set one now** and enter it in **New password** (at least 12 characters).
8. Select **Create mailbox**.
A dialog shows the **Address**, the **Password** if we generated it, and the **IMAP**, **SMTP** and **Webmail** settings. Copy the password now: we show a generated password once and cannot show it again.
The mailbox appears in the list, with its **Security**, **Quota**, **Password set** and **Enabled** columns. To open it in webmail with its address filled in, open the menu at the end of its row and select **Open webmail**. To set up a mail app, see [Connect a mail app to Mail Hosting](/docs/mail/mail-hosting/connect-a-mail-app/).
## Reset a mailbox password
1. On the **Mailboxes** tab, open the menu at the end of the mailbox's row.
2. Select **Reset password…**.
3. Choose **Generate a strong password**, or **Set one now** and enter the new password.
4. Select **Reset password**.
The dialog that follows shows a generated password once. Resetting the password signs the mailbox out of webmail everywhere, and its app passwords keep working. Update the password in every mail app that uses it.
> [!NOTE]
> A generated password also turns off two-factor sign-in for the mailbox, because whoever holds the new password is taken to be its owner. A password you set yourself keeps two-factor sign-in on. The **Security** column shows the change after you reload the page.
## Change a mailbox's quota
1. On the **Mailboxes** tab, open the menu at the end of the mailbox's row.
2. Select **Change quota…**.
3. In **Quota (GB)**, enter the new size. The hint shows the current quota and the plan's total.
4. Select **Save quota**.
The toast confirms the new quota. A quota is at least 100 MB, and all the mailboxes' quotas together cannot exceed the plan's storage. To give one mailbox more, shrink another first or [move to a bigger plan](/docs/mail/billing/#move-to-a-bigger-or-smaller-plan).
## Turn a mailbox off or on
On the **Mailboxes** tab, use the switch in the mailbox's **Enabled** column.
A mailbox you turn off cannot sign in, send or receive mail, and is signed out of webmail. Its stored mail stays, and turning it back on restores everything. A mailbox that is off still counts towards the plan.
## Delete a mailbox
> [!CAUTION]
> Deleting a mailbox destroys every message in it, and you cannot get them back. Aliases that deliver to it deliver nowhere until you change them.
1. On the **Mailboxes** tab, open the menu at the end of the mailbox's row.
2. Select **Delete mailbox…**.
3. Type the mailbox's address to confirm, then select **Delete mailbox**.
The mailbox leaves the list, and its place and storage go back to the plan.
## Troubleshooting
**Create mailbox…** is greyed out
: The plan's mailboxes are all in use, or the service is not active. A full plan shows `This plan allows 5 mailboxes. Delete one or change the plan to add another.` Delete a mailbox, or [move to a bigger plan](/docs/mail/billing/#move-to-a-bigger-or-smaller-plan).
**Prove you own a domain first**
: No domain on the service has its ownership proved yet, so the form has nothing to offer. Publish the domain's ownership record, shown on the **Domains** tab, then [check the domain](/docs/mail/mail-hosting/add-a-domain/#verify-the-domain).
`Use only letters, digits, dots, dashes, plus signs and underscores.`
: The name has another character, or starts or ends with a dot, dash, plus sign or underscore. Names are at most 64 characters and are stored in lower case.
`That address already exists`
: The address is already a mailbox or an alias. Choose another name, or delete the alias first.
`Not enough storage left on this plan for another mailbox of that size`
: The other mailboxes' quotas leave too little room. Enter a smaller **Quota (GB)**, shrink another mailbox, or [move to a bigger plan](/docs/mail/billing/#move-to-a-bigger-or-smaller-plan).
`That would exceed the plan's total storage`
: The new quota does not fit beside the others. Shrink another mailbox first.
`The domain is not registered in the mail engine yet; check the domain again in a minute`
: The domain was verified moments ago and its setup is not finished. Select **Verify now** on the domain's page, then try again.
The address shows a warning and the mailbox is off
: We turn a mailbox off by ourselves when it suddenly sends far more than it usually does, which is what a stolen password looks like. The warning under the address says what we saw, and we email the account owner. [Reset the password](#reset-a-mailbox-password), then turn the mailbox back on. The warning stays under the address after that.
## Related
- [Secure a mailbox](/docs/mail/mail-hosting/mailbox-security/)
- [Connect a mail app to Mail Hosting](/docs/mail/mail-hosting/connect-a-mail-app/)
- [Move existing mail into a mailbox](/docs/mail/mail-hosting/move-mail-in/)
- [Forward addresses with aliases](/docs/mail/mail-hosting/aliases/)
## With the API
Create a mailbox with a generated password:
```bash
curl -X POST https://api.coritan.com/api/v1/client/mail/4812/mailboxes \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"domain_id": 311, "local_part": "alex", "display_name": "Alex Morgan", "quota_bytes": 5368709120}'
```
The body takes these fields:
`domain_id`
: The domain, from `GET /client/mail/{service_id}/domains`. The API accepts a domain as soon as its ownership check has passed, before it is verified. See [Move a domain that already receives mail](/docs/mail/mail-hosting/add-a-domain/#move-a-domain-that-already-receives-mail).
`local_part`
: The part before the @, 1–64 characters: letters, digits and `.` `_` `+` `-`, starting and ending with a letter or digit.
`password`
: Optional, 12–128 characters. Leave it out and we generate a 24-character password.
`display_name`
: Optional, up to 255 characters.
`quota_bytes`
: Optional, at least `104857600` (100 MB). Leave it out for an equal share of the plan's storage.
The answer is `201` with the mailbox. `password` holds the generated password, shown this once, or `null` when you set one:
```json
{
"id": 5120,
"tenant_id": 902,
"domain_id": 311,
"kind": "mailbox",
"address": "alex@example.com",
"local_part": "alex",
"display_name": "Alex Morgan",
"quota_bytes": 5368709120,
"targets": [],
"status": "active",
"password_set_at": "2026-09-16T10:52:03.418207+00:00",
"created_at": "2026-09-16T10:52:03.418207+00:00",
"totp_enabled": false,
"app_passwords": 0,
"frozen_reason": null,
"user_id": null,
"password": "q7!Rk2mV9x#Tz4pLw8=Hs3Nd"
}
```
The other operations:
| Operation | Body | Answer |
| --- | --- | --- |
| `GET /client/mail/{service_id}/mailboxes` | | `{"items": [...]}`, each mailbox as above with `locked` (always `null` for a mailbox) in place of `password` |
| `POST /client/mail/{service_id}/mailboxes/{account_id}/password` | `{"password": "..."}`, or `{}` to generate one | `{"id", "address", "password"}` with the new password |
| `PATCH /client/mail/{service_id}/mailboxes/{account_id}/quota` | `{"quota_bytes": 10737418240}` | The mailbox |
| `PATCH /client/mail/{service_id}/mailboxes/{account_id}/enabled` | `{"enabled": false}` | The mailbox, with `status` `disabled` or `active` |
| `DELETE /client/mail/{service_id}/mailboxes/{account_id}` | | `{"ok": true}` |
A refused request answers `400` with one of the messages in [Troubleshooting](#troubleshooting), or with `This plan allows 5 mailboxes`, `Domain not found on this service` or `Prove you own example.com first: publish the ownership record shown under Domains, then check the domain`. A value outside a field's range answers `422`, an id that is not a mailbox on the service answers `404` `Not found`, and a failure on our side answers `502` with a message that starts `Mail engine error:`.
### On an SMTP Relay service
A relay has no mailboxes, but the same paths exist under `/client/smtp-relay/{service_id}/mailboxes`:
- `GET` answers `{"items": []}`, and `POST` answers `400` `Mailboxes are only available on Mail Hosting services`.
- `.../{account_id}/password` and `.../{account_id}/enabled` accept an SMTP credential's id and act on the credential. `password` is the only way to give a credential a password you choose; see [Send over SMTP with credentials](/docs/mail/smtp-relay/credentials/#with-the-api).
- Every other path under `.../mailboxes/{account_id}` answers `404` `Not found`.
## API
- `GET /api/v1/client/mail/{service_id}/mailboxes`: List mailboxes (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-get-api-v1-client-mail-service-id-mailboxes)
- `POST /api/v1/client/mail/{service_id}/mailboxes`: Create mailbox (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-post-api-v1-client-mail-service-id-mailboxes)
- `POST /api/v1/client/mail/{service_id}/mailboxes/{account_id}/password`: Mailbox password (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-post-api-v1-client-mail-service-id-mailboxes-account-id-password)
- `PATCH /api/v1/client/mail/{service_id}/mailboxes/{account_id}/quota`: Mailbox quota (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-patch-api-v1-client-mail-service-id-mailboxes-account-id-quota)
- `PATCH /api/v1/client/mail/{service_id}/mailboxes/{account_id}/enabled`: Mailbox enabled (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-patch-api-v1-client-mail-service-id-mailboxes-account-id-enabled)
- `DELETE /api/v1/client/mail/{service_id}/mailboxes/{account_id}`: Delete mailbox (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-delete-api-v1-client-mail-service-id-mailboxes-account-id)
- `GET /api/v1/client/smtp-relay/{service_id}/mailboxes`: List mailboxes (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-get-api-v1-client-smtp-relay-service-id-mailboxes)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes`: Create mailbox (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes)
- `DELETE /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}`: Delete mailbox (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-delete-api-v1-client-smtp-relay-service-id-mailboxes-account-id)
- `GET /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/app-passwords`: Mailbox app passwords (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-get-api-v1-client-smtp-relay-service-id-mailboxes-account-id-app-passwords)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/app-passwords`: Mailbox app password create (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-app-passwords)
- `DELETE /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/app-passwords/{credential_id}`: Mailbox app password delete (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-delete-api-v1-client-smtp-relay-service-id-mailboxes-account-id-app-passwords-cr)
- `PATCH /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/enabled`: Mailbox enabled (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-patch-api-v1-client-smtp-relay-service-id-mailboxes-account-id-enabled)
- `GET /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/imports`: Mailbox imports (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-get-api-v1-client-smtp-relay-service-id-mailboxes-account-id-imports)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/imports`: Mailbox import start (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-imports)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/imports/oauth`: Mailbox import sign in (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-imports-oauth)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/imports/upload`: Mailbox import upload (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-imports-upload)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/imports/{import_id}/{action}`: Mailbox import steer (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-imports-import-id)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/password`: Mailbox password (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-password)
- `PATCH /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/quota`: Mailbox quota (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-patch-api-v1-client-smtp-relay-service-id-mailboxes-account-id-quota)
- `GET /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/sessions`: Mailbox sessions (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-get-api-v1-client-smtp-relay-service-id-mailboxes-account-id-sessions)
- `DELETE /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/sessions`: Mailbox sessions end (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-delete-api-v1-client-smtp-relay-service-id-mailboxes-account-id-sessions)
- `DELETE /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/sessions/{session_id}`: Mailbox session end (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-delete-api-v1-client-smtp-relay-service-id-mailboxes-account-id-sessions-session)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/totp`: Mailbox totp enable (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-totp)
- `DELETE /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/totp`: Mailbox totp disable (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-delete-api-v1-client-smtp-relay-service-id-mailboxes-account-id-totp)
# Secure a mailbox
> Create app passwords for mail apps, turn on two-factor sign-in for a mailbox, and end its webmail sessions.
Source: https://www.coritan.com/docs/mail/mail-hosting/mailbox-security/
In the dashboard:
- /dashboard/mail/…/mailboxes: https://www.coritan.com/dashboard/mail
Each mailbox on a Mail Hosting service has three controls that decide who can sign in to it: *app passwords* for mail apps, *two-factor sign-in* with an authenticator app, and the list of browsers signed in to webmail. You reach all three from the mailbox's menu on the **Mailboxes** tab. The mailbox's own user can manage the same things in webmail; see [Protect your webmail mailbox](/docs/mail/webmail/security/).
## Before you begin
- A mailbox on a Mail Hosting service. See [Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/).
- For two-factor sign-in, an authenticator app on a phone or computer. Any app that reads an `otpauth://` link or takes a key by hand works.
## Create an app password
An app password signs one mail app in to the mailbox in place of its password, and skips the two-factor code. Give each app its own, so you can revoke one without touching the others.
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the Mail Hosting service, then the **Mailboxes** tab.
2. Open the menu at the end of the mailbox's row and select **App passwords…**.
3. Optionally, enter a **Label** that names the app or device, such as `phone`. It can be up to 64 characters.
4. Select **Create app password**.
5. Copy the **App password** from the dialog that opens. We show it once and cannot show it again.
In the mail app, use the mailbox's address as the username and the app password as the password. The mailbox's **Security** column counts its app passwords, such as `2 app passwords`.
A mailbox holds at most ten app passwords. Each browser signed in to webmail uses one of them, so the more browsers are signed in, the fewer you can create.
## Revoke an app password
1. On the **Mailboxes** tab, open the menu at the end of the mailbox's row and select **App passwords…**.
2. Find the password by its label. Each row also shows the date it was created.
3. Select **Revoke…**, then **Revoke app password**.
The app that used it can no longer sign in. The list also shows the passwords the mailbox's user made in webmail for their devices, and revoking one here signs that device out too.
## Turn on two-factor sign-in
With two-factor sign-in on, webmail asks for a six-digit code from an authenticator app after the password.
1. On the **Mailboxes** tab, open the menu at the end of the mailbox's row.
2. Select **Turn on two-factor sign-in**.
3. From the dialog that opens, add the mailbox to the authenticator app: open the **otpauth URI** on the device with the app, or type the **Secret** into it. We show them once. The app lists the mailbox under the service's mail server name, such as `mail-fra.coritan.com`.
The **Security** column changes to **Two-factor on**, and every browser signed in to webmail is signed out. The next time someone signs in, webmail shows **Enter your code** after the password and takes the code in **Code**. Codes change every 30 seconds.
Mail apps cannot ask for a code. A mail app that signed in with the mailbox's password stops working until you give it an [app password](#create-an-app-password). App passwords made before you turned two-factor sign-in on keep working.
## Turn off two-factor sign-in
To turn off two-factor sign-in from the dashboard, give the mailbox a new generated password:
1. On the **Mailboxes** tab, open the menu at the end of the mailbox's row.
2. Select **Reset password…**.
3. Choose **Generate a strong password**, then select **Reset password**.
4. Copy the new password from the dialog and give it to the mailbox's user.
The mailbox goes back to signing in with the password alone. Reload the page to see **Two-factor off** in the **Security** column. Resetting the password also signs the mailbox out of webmail everywhere; its app passwords keep working.
The mailbox's user can turn it off without a new password. In [webmail](https://www.coritan.com/webmail), signed in with the mailbox's address, they turn off **Ask for a code when signing in** on the **Security** tab of settings and confirm with the mailbox's password. [Turn off two-factor authentication](/docs/mail/webmail/security/#turn-off-two-factor-authentication) explains what changes when they open the mailbox through a Coritan account instead.
> [!NOTE]
> The mailbox menu also shows **Turn off two-factor sign-in…** while two-factor sign-in is on. It needs the mailbox's password, which the dashboard does not ask for, so it always ends with `Could not turn off two-factor sign-in`. Reset the password as above instead.
## End webmail sessions
A *webmail session* is one browser signed in to webmail as the mailbox. End one when a device is lost, or when someone should no longer read the mailbox.
1. On the **Mailboxes** tab, open the menu at the end of the mailbox's row and select **Webmail sessions…**.
2. Read the list. Each row names the browser and system, such as `Firefox on Windows`, then the IP address, when it was last used and when it started. Hover over the name to see the browser's full description.
3. To sign out one browser, select **End session…** on its row, then **End session**.
4. To sign out every browser, select **Sign out everywhere…**, then **Sign out everywhere**.
The browser has to sign in again with the mailbox's address and password. Ending sessions does not change the password, so anyone who knows it can sign in again: to lock someone out, [reset the password](/docs/mail/mail-hosting/mailboxes/#reset-a-mailbox-password) as well. Mail apps keep working, because they use the password or an app password rather than a session.
A session also ends by itself:
- after 30 days, or after 7 days without use;
- when a sixth browser signs in to the mailbox, which ends the one used longest ago;
- when you reset the password, turn two-factor sign-in on or off, or turn the mailbox off or delete it.
## Troubleshooting
`Turning two-factor login off needs the mailbox password; reset the password to clear it instead`
: **Turn off two-factor sign-in…** cannot work from the dashboard. [Reset the password](#turn-off-two-factor-sign-in) with a generated one, or ask the mailbox's user to turn it off in webmail.
A mail app stopped signing in after two-factor sign-in went on
: The app signs in with the mailbox's password, which now needs a code the app cannot send. [Create an app password](#create-an-app-password) and enter it in the app in place of the password.
`Mail engine error: AppPassword not created`
: The mail server refused to make the password. The mailbox may already hold ten app passwords, counting one for each browser signed in to webmail. Revoke one you no longer use, or end a webmail session, then try again.
`Mailbox is not registered in the engine yet`
: The mailbox was created moments ago and its setup has not finished. Wait a minute, then try again.
A browser keeps being signed out of webmail
: A mailbox keeps at most five webmail sessions, so signing in on a sixth browser ends the one used longest ago. A password reset, a two-factor change and turning the mailbox off end every session.
**No one is signed in to the webmail**
: No browser holds a session for the mailbox. Mail apps never appear in this list.
## Related
- [Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/)
- [Connect a mail app to Mail Hosting](/docs/mail/mail-hosting/connect-a-mail-app/)
- [Protect your webmail mailbox](/docs/mail/webmail/security/)
## With the API
All the paths below sit under `/client/mail/{service_id}/mailboxes/{account_id}`, where `account_id` is the mailbox's `id` from `GET /client/mail/{service_id}/mailboxes`.
Create an app password:
```bash
curl -X POST https://api.coritan.com/api/v1/client/mail/4812/mailboxes/5120/app-passwords \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"label": "phone"}'
```
`label` is 1–64 characters and defaults to `app password`. The answer is `201`, and `secret` is the password, returned this once:
```json
{
"id": 5120,
"address": "alex@example.com",
"credential_id": "b7",
"label": "phone",
"secret": "k3Vd9QxT2mLw7RpZ"
}
```
Turn on two-factor sign-in:
```bash
curl -X POST https://api.coritan.com/api/v1/client/mail/4812/mailboxes/5120/totp \
-H "Authorization: Bearer $CORITAN_TOKEN"
```
The answer carries the `secret` and the `otpauth_uri` once. The URI names SHA-1, six digits and a 30-second period, and its issuer is the service's mail server name:
```json
{
"id": 5120,
"address": "alex@example.com",
"otpauth_uri": "otpauth://totp/mail-fra.coritan.com%3Aalex%40example.com?secret=JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP&issuer=mail-fra.coritan.com&algorithm=SHA1&digits=6&period=30",
"secret": "JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP"
}
```
The other operations:
| Operation | Answer |
| --- | --- |
| `GET .../app-passwords` | `{"items": [...]}`, each with `credential_id`, `label`, `created_at` and `expires_at`. Webmail sessions are not listed. |
| `DELETE .../app-passwords/{credential_id}` | `{"deleted": true}`, or `404` `App password not found` |
| `DELETE .../totp` | Always `400` `Turning two-factor login off needs the mailbox password; reset the password to clear it instead`. Send `{}` to `POST .../password` instead. |
| `GET .../sessions` | `{"items": [...]}`, most recently used first |
| `DELETE .../sessions/{session_id}` | `204`, or `404` `Session not found` |
| `DELETE .../sessions` | `204`, after ending every session |
Each session in `GET .../sessions` has these fields:
`id`
: The session's id, for `DELETE .../sessions/{session_id}`.
`created_at`, `last_used_at`
: When it signed in and when it was last used, in UTC.
`expires_at`
: When it ends if nobody uses it from now on: 7 days after `last_used_at`, and never more than 30 days after `created_at`.
`ip`, `user_agent`
: The IP address and the browser's own description of itself.
An `account_id` that is not a mailbox on the service answers `404` `Not found`, and a failure on our side answers `502` with a message that starts `Mail engine error:`.
## API
- `GET /api/v1/client/mail/{service_id}/mailboxes/{account_id}/app-passwords`: Mailbox app passwords (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-get-api-v1-client-mail-service-id-mailboxes-account-id-app-passwords)
- `POST /api/v1/client/mail/{service_id}/mailboxes/{account_id}/app-passwords`: Mailbox app password create (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-post-api-v1-client-mail-service-id-mailboxes-account-id-app-passwords)
- `DELETE /api/v1/client/mail/{service_id}/mailboxes/{account_id}/app-passwords/{credential_id}`: Mailbox app password delete (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-delete-api-v1-client-mail-service-id-mailboxes-account-id-app-passwords-credenti)
- `POST /api/v1/client/mail/{service_id}/mailboxes/{account_id}/totp`: Mailbox totp enable (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-post-api-v1-client-mail-service-id-mailboxes-account-id-totp)
- `DELETE /api/v1/client/mail/{service_id}/mailboxes/{account_id}/totp`: Mailbox totp disable (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-delete-api-v1-client-mail-service-id-mailboxes-account-id-totp)
- `GET /api/v1/client/mail/{service_id}/mailboxes/{account_id}/sessions`: Mailbox sessions (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-get-api-v1-client-mail-service-id-mailboxes-account-id-sessions)
- `DELETE /api/v1/client/mail/{service_id}/mailboxes/{account_id}/sessions`: Mailbox sessions end (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-delete-api-v1-client-mail-service-id-mailboxes-account-id-sessions)
- `DELETE /api/v1/client/mail/{service_id}/mailboxes/{account_id}/sessions/{session_id}`: Mailbox session end (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-delete-api-v1-client-mail-service-id-mailboxes-account-id-sessions-session-id)
# Forward addresses with aliases
> Create an alias that delivers to one or more mailboxes, or a catch-all that takes every unknown address on a domain.
Source: https://www.coritan.com/docs/mail/mail-hosting/aliases/
In the dashboard:
- /dashboard/mail/…/aliases: https://www.coritan.com/dashboard/mail
An *alias* is an address with no storage of its own that delivers its mail to mailboxes on the same service. Use one for a role address such as `sales@example.com`, or for a *catch-all* that takes the mail sent to every address on a domain that has no mailbox or alias. Aliases do not count against the plan's mailboxes.
An alias takes one of three forms, decided by what you enter:
| You enter | The alias |
| --- | --- |
| A name and one mailbox | Delivers to that mailbox. |
| A name and several mailboxes | Delivers a copy to each of them, up to 50. |
| `*` and one mailbox | Is the domain's catch-all. A domain can have one. |
An alias delivers only to mailboxes on the same Mail Hosting service. To send a mailbox's mail on to an address somewhere else, its user sets up forwarding in webmail; see [Forward your mail to another address](/docs/mail/webmail/forwarding/).
## Before you begin
- A verified domain on the service. See [Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/).
- The mailboxes the alias delivers to. See [Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/).
## Create an alias
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the Mail Hosting service, then the **Aliases** tab.
2. Select **Create alias…**.
3. In **Alias**, enter the part before the @, such as `sales`. The hint under the field shows the full address.
4. In **Domain**, choose the domain. Only verified domains are listed.
5. In **Delivers to**, enter a mailbox's address and press Enter, or select it under **Mailboxes here**. Repeat for each mailbox.
6. Select **Create alias**.
The alias appears in the list with its **Delivers to** addresses and the date it was **Created**. Mail sent to it arrives in each of those mailboxes.
## Create a catch-all
A catch-all takes mail for any address on the domain that is not a mailbox or an alias, such as a mistyped name. It also takes spam sent to made-up addresses, so check its mailbox now and then.
1. On the **Aliases** tab, select **Create alias…**.
2. In **Alias**, enter `*`.
3. In **Domain**, choose the domain.
4. In **Delivers to**, add exactly one mailbox.
5. Select **Create alias**.
The alias shows as `*@example.com` with a **Catch-all** badge.
## Change where an alias delivers
An alias cannot be edited. To change its mailboxes, [delete the alias](#delete-an-alias), then [create it again](#create-an-alias) with the new list. Mail sent to the address in between does not arrive, so do both steps together.
## Delete an alias
> [!WARNING]
> Once you delete an alias, mail sent to its address bounces back to the sender, or goes to the domain's catch-all if it has one. The mailboxes it delivered to, and the mail already in them, stay as they are.
1. On the **Aliases** tab, select **Delete…** on the alias's row.
2. Type the alias's address to confirm, then select **Delete alias**.
The alias leaves the list. Deleting a catch-all makes mail to unknown addresses on the domain bounce again.
## Troubleshooting
`Destinations must be mailboxes on this service`
: One of the **Delivers to** addresses is not a mailbox on this service. The hint under the field suggests addresses elsewhere work, but they do not. Remove the address, or [create the mailbox](/docs/mail/mail-hosting/mailboxes/#create-a-mailbox) first. To reach an address elsewhere, use [forwarding in webmail](/docs/mail/webmail/forwarding/).
`A catch-all forwards to exactly one mailbox`
: A `*` alias has more than one address in **Delivers to**. Keep one.
`That address already exists`
: The address is already a mailbox or an alias, or the domain already has a catch-all. Choose another name, or delete the existing alias first.
`Use only letters, digits, dots, dashes, plus signs and underscores, or * for a catch-all.`
: The name has another character, or starts or ends with a dot, dash, plus sign or underscore. Names are at most 64 characters and are stored in lower case.
**Verify a domain first**
: The service has no verified domain yet. [Verify a domain](/docs/mail/mail-hosting/add-a-domain/#verify-the-domain), then create the alias.
`The domain is not registered in the mail engine yet; check the domain again in a minute`
: The domain was verified moments ago and its setup is not finished. Select **Verify now** on the domain's page, then try again.
An alias delivers nothing
: A mailbox it delivered to was deleted. An alias to one mailbox then delivers nowhere, and an alias to several stops delivering to the deleted one. [Delete the alias](#delete-an-alias) and create it again with mailboxes that exist.
## Related
- [Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/)
- [Forward your mail to another address](/docs/mail/webmail/forwarding/)
- [Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/)
## With the API
Create an alias that delivers to two mailboxes:
```bash
curl -X POST https://api.coritan.com/api/v1/client/mail/4812/aliases \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"domain_id": 311, "local_part": "sales", "targets": ["alex@example.com", "sam@example.com"]}'
```
The body takes these fields:
`domain_id`
: The domain, from `GET /client/mail/{service_id}/domains`. The API accepts a domain as soon as its ownership check has passed, before it is verified.
`local_part`
: The part before the @, 1–64 characters: letters, digits and `.` `_` `+` `-`, starting and ending with a letter or digit. `*` makes the domain's catch-all.
`targets`
: 1–50 addresses of mailboxes on this service. We lower-case them and drop duplicates. A catch-all takes exactly one.
The answer is `201` with the alias:
```json
{
"id": 5133,
"tenant_id": 902,
"domain_id": 311,
"kind": "alias",
"address": "sales@example.com",
"local_part": "sales",
"display_name": null,
"quota_bytes": null,
"targets": ["alex@example.com", "sam@example.com"],
"status": "active",
"password_set_at": null,
"created_at": "2026-09-16T11:04:27.160358+00:00",
"totp_enabled": false,
"app_passwords": 0,
"frozen_reason": null,
"user_id": null
}
```
The other operations:
| Operation | Answer |
| --- | --- |
| `GET /client/mail/{service_id}/aliases` | `{"items": [...]}`, each alias as above with `locked` set to `null` |
| `DELETE /client/mail/{service_id}/aliases/{account_id}` | `{"ok": true}` |
A refused request answers `400` with one of the messages in [Troubleshooting](#troubleshooting), with `Use letters, digits and . _ + - for the part before @`, with `An alias needs at least one destination address` when no target contains an @, or with `Domain not found on this service`. A body outside the field ranges answers `422`, an `account_id` that is not an alias on the service answers `404` `Not found`, and a failure on our side answers `502` with a message that starts `Mail engine error:`.
On an SMTP Relay service the same paths exist under `/client/smtp-relay/{service_id}/aliases`: `GET` answers `{"items": []}`, `POST` answers `400` `Aliases are only available on Mail Hosting services`, and `DELETE` answers `404` `Not found`.
## API
- `GET /api/v1/client/mail/{service_id}/aliases`: List aliases (https://www.coritan.com/docs/api/reference/client/mail/mail-aliases/#op-get-api-v1-client-mail-service-id-aliases)
- `POST /api/v1/client/mail/{service_id}/aliases`: Create alias (https://www.coritan.com/docs/api/reference/client/mail/mail-aliases/#op-post-api-v1-client-mail-service-id-aliases)
- `DELETE /api/v1/client/mail/{service_id}/aliases/{account_id}`: Delete alias (https://www.coritan.com/docs/api/reference/client/mail/mail-aliases/#op-delete-api-v1-client-mail-service-id-aliases-account-id)
- `GET /api/v1/client/smtp-relay/{service_id}/aliases`: List aliases (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-aliases/#op-get-api-v1-client-smtp-relay-service-id-aliases)
- `POST /api/v1/client/smtp-relay/{service_id}/aliases`: Create alias (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-aliases/#op-post-api-v1-client-smtp-relay-service-id-aliases)
- `DELETE /api/v1/client/smtp-relay/{service_id}/aliases/{account_id}`: Delete alias (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-aliases/#op-delete-api-v1-client-smtp-relay-service-id-aliases-account-id)
# Connect a mail app to Mail Hosting
> Set up a desktop or phone mail app with your mailbox, using automatic setup or the IMAP, SMTP and JMAP server addresses.
Source: https://www.coritan.com/docs/mail/mail-hosting/connect-a-mail-app/
In the dashboard:
- /dashboard/mail/…/overview: https://www.coritan.com/dashboard/mail
Any mail app that speaks IMAP and SMTP can use a Mail Hosting mailbox: it reads mail over IMAP and sends over SMTP, with the mailbox's address and password. Mail Hosting does not offer POP3. This page covers finding the server names for your service and entering them in an app.
## Before you begin
- A mailbox and its password. See [Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/).
- If two-factor sign-in is on for the mailbox, an app password for the app. See [Create an app password](/docs/mail/mail-hosting/mailbox-security/#create-an-app-password).
## Find your server settings
The server names depend on the region your service runs in, so copy them from the dashboard rather than typing them from memory.
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail) and open the Mail Hosting service. It opens on the **Overview** tab.
2. Find the **Mail server addresses** card. Select a name to copy it.
The **Mail client setup** card below it lists the same settings in the order most apps ask for them:
| Setting | Value |
| --- | --- |
| **Username** | The mailbox's full address, such as `alex@example.com` |
| **Password** | The mailbox's password, or an app password when two-factor sign-in is on |
| **Incoming (IMAP)** | The **IMAP** name, such as `imap.mail-fra.coritan.com`, port `993`, SSL/TLS |
| **Outgoing (SMTP)** | The **SMTP** name, such as `smtp.mail-fra.coritan.com`, port `587`, STARTTLS, or port `465`, SSL/TLS |
| **Authentication** | Normal password, with the same username and password for both servers |
For an app that cannot use port `993`, IMAP also answers on port `143` with STARTTLS. The **Mail server addresses** card also lists:
**JMAP**
: A newer protocol for reading and sending mail over HTTPS, on port `443`. Use it only in an app that asks for a JMAP server.
**Webmail**
: The address of webmail, where the mailbox can sign in from a browser. For Coritan it is `https://www.coritan.com/webmail`.
**MX suffix**
: The name your domain's MX records point under. A mail app does not need it.
## Set up an app automatically
Once a domain is verified, it carries `autoconfig` and `autodiscover` records and SRV records that point mail apps at the right servers. See [Mail DNS records](/docs/mail/dns-records/). In an app that supports automatic setup:
1. Add a new mail account.
2. Enter the mailbox's full address and its password or app password.
3. Let the app look up the settings. Check that it found the **IMAP** and **SMTP** names from the dashboard.
If the app cannot find the settings, or asks for server details, set it up by hand instead.
## Set up an app by hand
The labels differ between apps, but each asks for the same things.
1. Add a new mail account and choose IMAP, or the manual or advanced setup.
2. For the incoming server, enter the **IMAP** name, port `993` and SSL/TLS.
3. For the outgoing server, enter the **SMTP** name, port `587` and STARTTLS. If the app offers only SSL/TLS, use port `465`.
4. For both servers, enter the mailbox's full address as the username, the mailbox's password or an app password as the password, and normal password as the authentication method.
5. Save the account.
On an iPhone, iPad or Mac, the mailbox's user can skip these steps: webmail makes a QR code that installs a profile setting up Mail and Contacts. See [Set up mail apps and devices](/docs/mail/webmail/mail-apps/).
## Result
The app shows the mailbox's folders and mail, and can send from the address. When the app saves the mail it sends to the server, those messages also appear in the **Sent** folder in webmail.
## Troubleshooting
The app says the username or password is wrong
: Check that the username is the full address and not only the part before the @. If two-factor sign-in is on for the mailbox, the app needs an [app password](/docs/mail/mail-hosting/mailbox-security/#create-an-app-password), because it cannot send a code. A mailbox that is turned off cannot sign in; check its **Enabled** switch on the **Mailboxes** tab.
The app warns about the server's certificate
: The app is using a name under your own domain, such as `imap.example.com`. Enter the **IMAP** and **SMTP** names from the **Mail server addresses** card instead: the certificate covers those names.
The app cannot connect to the outgoing server
: Port `25` is for servers passing mail to each other, and many networks block it. Use port `587` with STARTTLS, or port `465` with SSL/TLS.
The app stopped signing in after many failed attempts
: After 30 failed sign-ins in an hour from one IP address, the mail server refuses that address for 24 hours. Fix the password in every app that uses the mailbox, then wait for the block to end.
A message with large attachments will not send
: The mail server accepts messages up to 50 MB. Mail apps encode attachments on the way out, which makes them about a third larger, so the files themselves need to add up to less. Share large files by link instead.
A mail app stopped working after the password was reset
: Every app that signs in with the mailbox's password needs the new one. Apps that use an app password keep working.
## Related
- [Secure a mailbox](/docs/mail/mail-hosting/mailbox-security/)
- [Mail DNS records](/docs/mail/dns-records/)
- [Set up mail apps and devices](/docs/mail/webmail/mail-apps/)
# Move existing mail into a mailbox
> Copy mail into a mailbox from another server over IMAP, from Gmail or Microsoft 365, or from an mbox, eml, zip or cPanel backup file.
Source: https://www.coritan.com/docs/mail/mail-hosting/move-mail-in/
In the dashboard:
- /dashboard/mail/…/mailboxes: https://www.coritan.com/dashboard/mail
An *import* copies mail into a mailbox from another mail server or from a file. It runs on our side, so it carries on after you close the page. Messages keep their folders, their read and flagged state and their original dates, and nothing changes on the other server.
The mailbox's own user can start the same imports from webmail; see [Import mail into webmail](/docs/mail/webmail/import/).
## Before you begin
- A mailbox to copy the mail into, with room for it: an import pauses when the mailbox is full. To make room, [change the mailbox's quota](/docs/mail/mail-hosting/mailboxes/#change-a-mailbox-s-quota).
- For another server: the address and password of the old mailbox, and IMAP turned on there. Many providers want an *app password* made in their own settings rather than the account password; the hint under **Provider** says what each one needs.
- For a file: a copy of the mail as an mbox file, a single `.eml` message, a zip or tar of mail files, or a cPanel backup.
## Import from another server
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the Mail Hosting service, then the **Mailboxes** tab.
2. Open the menu at the end of the mailbox's row and select **Bring mail in…**.
3. In **Provider**, choose where the mail is now, such as `Yahoo Mail` or `iCloud Mail`. For a server that is not listed, or a cPanel host, choose `Another IMAP server` or `cPanel`, then enter its name in **Server**.
4. In **Username**, enter the old mailbox's sign-in name, usually its full address. In **Password**, enter its password or app password.
5. To copy the old Trash or Spam folders too, turn on **Also bring Trash** or **Also bring Spam**.
6. Select **Import from the server**.
We sign in to the old server first, so a wrong password shows at once. The import then appears in the list under the form, and the list updates by itself while it runs.
The server must offer IMAP over TLS on port `993`. We use the password only for this import and forget it when the import ends.
## Import from Gmail or Microsoft 365 by signing in
When the **Provider** list offers **Gmail: sign in with Google** or **Microsoft 365 or Outlook.com: sign in with Microsoft**, you can sign in on the provider's own page instead of giving us a password.
1. In **Bring mail in**, choose one of those two in **Provider**.
2. Optionally, turn on **Also bring Trash** or **Also bring Spam**.
3. Select the button that continues to the provider, and sign in there.
You come back to the **Mailboxes** tab with the message `Signed in. The import has started, and goes on with this page closed.` If the sign-in did not work, the message says why.
Microsoft 365 no longer accepts passwords over IMAP, so signing in is the only way to import from it. For Gmail without signing in, choose `Gmail with an app password` and make an app password in your Google account.
## Import from a file
1. In **Bring mail in**, select a file in **Or a file**.
2. Select **Upload and import**. The button shows how much has uploaded; keep the page open until it finishes.
When the upload ends, the import appears in the list. We tell what the file is from its name and first bytes:
| File | What we import |
| --- | --- |
| mbox (`.mbox`, `.mbx`), including a Google Takeout export | Every message in it |
| `.eml` | The one message |
| zip or tar of mail files | Every message, keeping its folders |
| cPanel backup (`backup-…` or `cpmove-…` archive) | The mailbox in the backup with the same address as this one |
Mail from a file that has no folders, such as an mbox or an `.eml`, goes into a folder named `Imported`. A Google Takeout mbox is the exception: its messages go where their Gmail labels say, as they would from Gmail itself.
## Where the mail goes
- The old Inbox, Sent, Drafts and Archive go into the mailbox's own folders of the same kind, and Trash and Spam too when you turned them on. We recognise them by the flags servers put on them, or by their usual names in several languages.
- Any other folder is made in the mailbox with the same name and path.
- From Gmail, each message is copied once and placed in every folder its labels name. Starred and Important become flags, and a message with no label goes to Archive.
- We leave out messages marked deleted, messages larger than 50 MB, and messages already in the mailbox from an earlier import.
## Follow an import
Each import in the list shows its source, a status, and its counts: how many messages were imported, how many were **already there**, and how many were **left out**.
| Status | Meaning |
| --- | --- |
| **Waiting** | Queued to start. |
| **Importing** | Copying mail now. |
| **Paused** | Stopped for now: you paused it, the mailbox is full, or an error interrupted it. **Resume** goes on from where it stopped. |
| **Done** | Every message has been copied. |
| **Stopped** | It failed. The row says why, for example the old server refused the password or the file could not be read. |
| **Cancelled** | You cancelled it. |
When the old server does not answer, an import tries again on its own, up to five times, a few minutes apart. When Gmail stops handing over mail for the day, the import tries again every six hours until it finishes.
## Pause, resume or cancel an import
- To pause a waiting or running import, select **Pause** on its row.
- To go on with a paused import, select **Resume**.
- To stop one for good, select **Cancel…**, then **Cancel import**. The mail already copied stays in the mailbox, and we forget the password or delete the file.
Running the same import again is safe: messages already copied count as **already there** and are not copied twice.
## Troubleshooting
`… refused that username and password.`
: The old server did not accept the sign-in. Check the username, and whether the provider wants an app password or needs IMAP turned on first. The hint under **Provider** says which.
`… did not answer`
: We could not reach the server on port `993`. Check the name in **Server**, and that the server offers IMAP over TLS.
`3 imports are under way into this mailbox; wait for one to end`
: A mailbox takes three imports at a time, counting waiting and paused ones. Wait for one to finish, or cancel one.
`Too many requests for this action. Please wait and try again.`
: A mailbox takes up to 20 import attempts a day, counting those the old server refused. Try again later.
`That file is not an mbox, an .eml, a zip or a tar of mail, or a cPanel backup`
: We could not tell what the file is. Check that it is one of those, with its usual file name ending.
`Imports take files up to … MB`
: The file is larger than an import takes. Split it into smaller files, or import from the server instead.
`This backup holds no mailbox …`
: The cPanel backup has no mailbox with this mailbox's address. The message lists the mailboxes it does hold. Import into a mailbox with one of those addresses, or choose the one you want with the API's `cpanel_mailbox` field.
The import is **Paused** and the mailbox is full
: The import stops when the mailbox reaches its quota. [Raise the quota](/docs/mail/mail-hosting/mailboxes/#change-a-mailbox-s-quota) or delete mail, then select **Resume**.
## Related
- [Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/)
- [Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/)
- [Import mail into webmail](/docs/mail/webmail/import/)
## With the API
All the paths below sit under `/client/mail/{service_id}/mailboxes/{account_id}/imports`.
Start an import from another server:
```bash
curl -X POST https://api.coritan.com/api/v1/client/mail/4812/mailboxes/5120/imports \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"preset": "other", "host": "imap.example.net", "username": "alex@example.net", "password": "old-mailbox-password", "since": "2024-01-01"}'
```
The body takes these fields:
`preset`
: The provider, as an `id` from the `presets` list in `GET .../imports`: `cpanel`, `gmail`, `yahoo`, `icloud`, `zoho`, `fastmail`, `aol`, `gmx`, `yandex` or `other`. Defaults to `other`.
`host`
: The server's name, for `cpanel` and `other`. A preset with its own host ignores it.
`username`, `password`
: The old mailbox's sign-in, 1–254 and 1–512 characters.
`folders`
: Optional, up to 200 folder paths to import. Leave it out to import every folder.
`since`, `until`
: Optional dates such as `2024-01-01`. We leave out messages dated outside them.
`trash`, `spam`
: Optional, `false` by default. Whether to import the Trash and Spam folders.
The answer is `201` with the import:
```json
{
"id": 77,
"kind": "imap",
"status": "queued",
"source": {"host": "imap.example.net", "port": 993, "username": "alex@example.net", "preset": "other"},
"options": {"trash": false, "spam": false, "since": "2024-01-01"},
"imported": 0,
"duplicates": 0,
"skipped": 0,
"failed": 0,
"total": null,
"error": null,
"started_by": "the Mail Hosting panel",
"folders_done": 0,
"folders": 0,
"created_at": "2026-09-16T11:20:05.201344+00:00",
"started_at": null,
"finished_at": null
}
```
Upload a file as `multipart/form-data`:
```bash
curl -X POST https://api.coritan.com/api/v1/client/mail/4812/mailboxes/5120/imports/upload \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-F "file=@backup-example.com.tar.gz" \
-F "kind=cpanel" \
-F "cpanel_mailbox=alex@example.com"
```
The form takes `file`, and optionally `kind` (`cpanel` or `eml`, when the file's name does not say), `folder` (where mail from a file with no folders goes, `Imported` by default), `cpanel_mailbox` (which mailbox of a cPanel backup to import; this mailbox's address by default), `trash` and `spam`. The answer is `201` with the import.
The other operations:
| Operation | Body | Answer |
| --- | --- | --- |
| `GET .../imports` | | `{"items": [...], "presets": [...], "max_upload_mb": ..., "oauth": {"google": ..., "microsoft": ...}}`: the last 20 imports, newest first, the providers, the largest file an upload takes in MB, and which sign-ins are available |
| `POST .../imports/oauth` | `{"provider": "google", "return_path": "/dashboard/mail/4812/mailboxes"}`, with optional `since`, `until`, `trash` and `spam` | `{"url": "..."}`: send the browser there to sign in. It comes back to `return_path` on the host the request went to, which must be `www.coritan.com`, so send this one to `https://www.coritan.com/api/v1`. |
| `POST .../imports/{import_id}/pause` | | The import, `paused` |
| `POST .../imports/{import_id}/resume` | | The import, `queued` |
| `POST .../imports/{import_id}/cancel` | | The import, `cancelled` |
A refused request answers with a `detail` object that holds a `code` and a `message`:
| Status | `code` | When |
| --- | --- | --- |
| `422` | `source_refused`, `source_unreachable` | The old server refused the sign-in or did not answer |
| `422` | `unknown_preset`, `source_incomplete` | The `preset` is not one of the list, or the server, username or password is missing |
| `422` | `unknown_file`, `empty_file` | We could not tell what the file is, or it is empty |
| `422` | `oauth_unavailable` | Signing in to that provider is not available |
| `422` | `oauth_origin` | A sign-in was started through a host other than `www.coritan.com`, such as `api.coritan.com` |
| `409` | `imports_busy` | Three imports are under way into the mailbox |
| `409` | `import_state` | The import's status does not allow the action, such as resuming one that is running |
| `413` | `file_too_large` | The file is larger than `max_upload_mb` |
An `import_id` that is not on the mailbox answers `404` `Import not found`, and the 21st attempt in a day answers `429`.
## API
- `GET /api/v1/client/mail/{service_id}/mailboxes/{account_id}/imports`: Mailbox imports (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-get-api-v1-client-mail-service-id-mailboxes-account-id-imports)
- `POST /api/v1/client/mail/{service_id}/mailboxes/{account_id}/imports`: Mailbox import start (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-post-api-v1-client-mail-service-id-mailboxes-account-id-imports)
- `POST /api/v1/client/mail/{service_id}/mailboxes/{account_id}/imports/oauth`: Mailbox import sign in (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-post-api-v1-client-mail-service-id-mailboxes-account-id-imports-oauth)
- `POST /api/v1/client/mail/{service_id}/mailboxes/{account_id}/imports/upload`: Mailbox import upload (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-post-api-v1-client-mail-service-id-mailboxes-account-id-imports-upload)
- `POST /api/v1/client/mail/{service_id}/mailboxes/{account_id}/imports/{import_id}/{action}`: Mailbox import steer (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-post-api-v1-client-mail-service-id-mailboxes-account-id-imports-import-id-action)
# Change Mail Hosting settings
> Set the default category for the mail your mailboxes send, set or hold each domain's DMARC stage, and remove a domain from the Settings tab.
Source: https://www.coritan.com/docs/mail/mail-hosting/settings/
In the dashboard:
- /dashboard/mail/…/settings: https://www.coritan.com/dashboard/mail
The **Settings** tab of a Mail Hosting service holds the choices that apply across the service: the **Sending defaults**, the **DMARC** stage of each domain, and the **Danger zone**, where you remove a domain. To cancel the service itself, see [How Mail Hosting and SMTP Relay are billed](/docs/mail/billing/).
## Before you begin
- A Mail Hosting service. The DMARC and **Danger zone** cards appear once the service has a domain.
- For DMARC, read [How the DMARC stage ramp works](/docs/mail/dmarc/) first: it explains what each stage asks of receiving servers.
## Set the default message category
Every message your mailboxes send has a *category*: *transactional* or *marketing*. A message takes its category from its `X-Mail-Category` header, and one without the header takes the service's default. Most mailboxes send person-to-person mail, which is transactional, so keep the default at **Transactional** unless the service's mailboxes send newsletters.
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the Mail Hosting service, then the **Settings** tab.
2. In the **Sending defaults** card, choose a **Default message category**.
The toast confirms the new default, such as `Default category is now marketing.` It applies to the next message a mailbox sends.
When a marketing message has exactly one recipient and no `List-Unsubscribe` header of its own, we add the one-click unsubscribe headers that Gmail and Yahoo require on bulk mail. A message to several recipients is left as it is. See [Transactional and marketing mail](/docs/mail/smtp-relay/message-categories/).
> [!IMPORTANT]
> A person who unsubscribes goes on the service's suppression list, and from then on the mail server refuses mail to them from every mailbox on the service. Mail Hosting has no tab for that list, so taking someone off it needs the API. See [Manage the suppression list](/docs/mail/smtp-relay/suppressions/#with-the-api).
## Set or hold a domain's DMARC stage
A domain's DMARC stage starts at `p=none` and moves up by itself as the reports show your mail passes. The **DMARC** card lists each domain with its current stage, how long it has been there, and whether it is **held** or **ramps automatically**.
1. On the **Settings** tab, find the domain in the **DMARC** card.
2. To set a stage now, choose `p=none`, `p=quarantine` or `p=reject` in the list beside it. Choosing a stage also holds it there.
3. To stop the stage moving without changing it, turn on **Hold stage**. To let it move up again, turn **Hold stage** off.
The toast confirms the change, such as `DMARC for example.com set to p=quarantine.` When we publish the domain's records in a DNS zone we host, we update the DMARC record for you. When the zone is elsewhere, the domain's page shows the new record for you to publish; until you do, the domain's DMARC check fails. **Records and verification** opens the **Domains** tab.
## Remove a domain
> [!WARNING]
> Removing a domain stops all mail to and from its addresses, and deletes the records we published for it in a DNS zone we host. You cannot remove a domain that still has mailboxes or aliases, so this never deletes stored mail.
1. Delete the domain's mailboxes and aliases first. See [Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/#delete-a-mailbox) and [Forward addresses with aliases](/docs/mail/mail-hosting/aliases/#delete-an-alias).
2. On the **Settings** tab, in the **Danger zone** card, select **Remove domain…** beside the domain.
3. Type the domain name to confirm, then select **Remove domain**.
The domain leaves the service, and its place on the plan is free again. Remove the records you published yourself in a zone elsewhere.
## Troubleshooting
`The DMARC record for example.com in your DNS was not added by us. Change its p= value in the zone instead.`
: The domain's zone is hosted here, but its DMARC record was there before we published ours, so we left it alone. Edit that record's `p=` value in the zone.
`Remove the mailboxes and aliases on this domain first`
: The domain still has at least one mailbox or alias. Delete them, then remove the domain.
The stage moved up while the domain's DMARC check shows a problem
: The zone is elsewhere, and the ramp moved the stage without the new record being published. Open the domain on the **Domains** tab and publish the DMARC record it shows, or choose the stage your zone publishes to hold it there.
## Related
- [How the DMARC stage ramp works](/docs/mail/dmarc/)
- [Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/)
- [Transactional and marketing mail](/docs/mail/smtp-relay/message-categories/)
## With the API
Set the service's default category:
```bash
curl -X PATCH https://api.coritan.com/api/v1/client/mail/4812/category \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"default_category": "transactional"}'
```
`default_category` is `transactional` or `marketing`; any other value answers `422`. The answer is the new default:
```json
{"default_category": "transactional"}
```
`GET /client/mail/{service_id}` returns it as `default_category`. To set a domain's DMARC stage, see [How the DMARC stage ramp works](/docs/mail/dmarc/#with-the-api); to remove a domain, see [Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/#with-the-api).
## API
- `PATCH /api/v1/client/mail/{service_id}/category`: Set category (https://www.coritan.com/docs/api/reference/client/mail/mail/#op-patch-api-v1-client-mail-service-id-category)
# How SMTP Relay works
> How SMTP Relay sends your applications' mail over SMTP or HTTPS, what its plan sets, and what the Overview tab shows.
Source: https://www.coritan.com/docs/mail/smtp-relay/
In the dashboard:
- /dashboard/mail/…/overview: https://www.coritan.com/dashboard/mail
SMTP Relay sends the mail your software writes: receipts, password resets, alerts and newsletters. Your application hands each message to the relay, and the relay signs it for your domain, delivers it and records what happened. SMTP Relay only sends. To receive mail on a domain, use [Mail Hosting](/docs/mail/mail-hosting/).
## Two ways to send
Over SMTP
: Point any SMTP library or application at the relay's SMTP host on port 587 (STARTTLS) or 465 (TLS), and sign in with an *SMTP credential*: a username and password the relay creates for one application. See [Send over SMTP with credentials](/docs/mail/smtp-relay/credentials/).
Over HTTPS
: Post a JSON message to the send API with an *API key* in the `X-Api-Key` header. See [Send email over HTTPS](/docs/mail/smtp-relay/send-with-the-api/).
Both need a verified *sending domain* on the relay, and the From address must be on it. The HTTPS API sends through one of the relay's SMTP credentials, so create at least one credential even if you only use the API.
## How a message is handled
1. The relay checks the sender, the monthly allowance and the hourly limit, and drops any recipient on the [suppression list](/docs/mail/smtp-relay/suppressions/).
2. It signs the message with your domain's DKIM key and delivers it.
3. Each step becomes an *event*: accepted, delivered, deferred, bounced or complaint. You can [look events up](/docs/mail/smtp-relay/events/) for up to 90 days, or [receive them with webhooks](/docs/mail/smtp-relay/webhooks/).
4. A bounce or a spam complaint adds the address to the suppression list, so the relay stops sending to it.
Each message is either *transactional* or *marketing*. Marketing mail gets one-click unsubscribe headers. See [Transactional and marketing mail](/docs/mail/smtp-relay/message-categories/).
## What the plan sets
- Emails a month: the plan's allowance. Paid plans accept a buffer beyond it; the free plan stops at its allowance. The count resets on the 1st of each month.
- Sending domains: a number, or unlimited. An unlimited plan still stops at 1,000 domains.
- SMTP credentials: a number, or unlimited. An unlimited plan still stops at 200 credentials.
- Dedicated IPs: some plans include a dedicated sending address, and a relay whose plan sends 100,000 emails a month or more can add one.
The *hourly limit* is separate from the plan. Every new relay starts with a small one, and it rises as the relay sends clean mail. [How SMTP Relay sending limits work](/docs/mail/smtp-relay/sending-limits/) covers the allowance, the buffer and the hourly limit.
## What the Overview tab shows
In the dashboard, go to **Email**, open the relay, then the **Overview** tab.
The three figures at the top are **Emails this month** against the allowance, and the **Sending domains** and **SMTP credentials** used against the plan. Once the relay has sent 80% of its plan's emails for the month, an alert above them says how much is left; see [Sending limits](/docs/mail/smtp-relay/sending-limits/#what-happens-near-the-allowance).
**Deliverability**
: The bounce and complaint rates over the recent days the card names, the relay's health checks, and the **Default message category**. See [Sending reputation and deliverability](/docs/mail/smtp-relay/deliverability/).
**SMTP endpoint**
: The **SMTP** host name to connect to, with its ports.
**Recent activity**
: The latest events from the last seven days. **All events** opens the **Events** tab.
**Service**
: The relay's **Status**, **Plan**, **Region**, the date it **Renews**, when it was **Created** and its **Service ID**.
**Tags**
: Labels you add to find the relay. See [Tags](/docs/get-started/tags/).
**Hourly limit**
: The **Current limit**, the **Next step** it rises to, and when and how it was **Set**. **Request limit increase…** asks for more; see [Request a higher hourly limit](/docs/mail/smtp-relay/request-a-higher-limit/).
**Sending IPs**
: Whether the relay sends from addresses we share between customers or from dedicated addresses. Each dedicated address shows its reverse DNS name, its hourly cap, and a **Warming up** badge while it warms up. **Order dedicated IP** opens the order page for another dedicated address where the plan allows one ([Order a dedicated sending IP](/docs/mail/order-a-mail-service/#order-a-dedicated-sending-ip)).
**Domains**
: Each sending domain and its verification status.
## With the API
Read the relay's summary:
```bash
curl https://api.coritan.com/api/v1/client/smtp-relay/4812 \
-H "Authorization: Bearer $CORITAN_TOKEN"
```
The fields you need most:
`kind`
: `relay` for SMTP Relay.
`status`
: `active` once the relay is ready.
`month_to_date_sent`
: Emails counted this month.
`limits`
: The allowance, the buffer, what is left, and the hourly limit with its next step. [Sending limits](/docs/mail/smtp-relay/sending-limits/#with-the-api) lists every field.
`counts`
: `relay_credential` and `domains`, the credentials and sending domains the relay holds.
`default_category`
: `transactional` or `marketing`, the category of a message that does not set one.
`dedicated_ips`
: Each dedicated address, with `address`, `ptr`, `warming_up` (`true` until its warm-up ends), `hourly_limit`, `enabled` and `addon_service_id` (set when you bought it as an add-on).
`cluster`
: The region the relay runs in: `region`, its code, and `region_name`, such as `Frankfurt`, or `null` when we have no name for it.
`hostnames.smtp_host`
: The host to connect to over SMTP.
`sending_frozen`, `review_flag`, `reputation_note`
: Whether sending is paused or under review, and why.
## API
- `GET /api/v1/client/smtp-relay/{service_id}`: Get summary (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay/#op-get-api-v1-client-smtp-relay-service-id)
# Add a sending domain to SMTP Relay
> Add the domain your application sends from, publish its SPF, DKIM and DMARC records, and verify it before you send.
Source: https://www.coritan.com/docs/mail/smtp-relay/add-a-sending-domain/
In the dashboard:
- /dashboard/mail/…/domains: https://www.coritan.com/dashboard/mail
An SMTP Relay sends only from domains you have shown are yours. Add the domain your application sends from, publish its records and verify it. The relay adds no MX record, so the domain's inbox stays wherever it is.
## Before you begin
- An SMTP Relay service with the status `active`. [Order one](/docs/mail/order-a-mail-service/) if you have none. While a service is being set up, **Add domain…** is greyed out.
- A domain whose DNS you can change. When its zone is on [Coritan DNS](/docs/websites/add-an-existing-domain/) in the same account, we publish the records for you.
- Room on the plan. The **Domains** card shows the plan's limit, such as `1 of 2 on this plan.`, or *The domains your applications send from.* when the plan has no limit.
- If the domain is on your Mail Hosting service, a sending subdomain for the relay, such as `send.example.com`. A domain can be on one mail service at a time, and the relay can still send as `@example.com` over SMTP.
## Add the domain
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the SMTP Relay service, then the **Domains** tab.
2. Select **Add domain…**.
3. In **Domain**, enter the domain, such as `example.com` or `send.example.com`. Names you claimed under [coritan.gg](/docs/proxies/coritan-gg-names/) are listed beside **Your names:**.
4. Leave **Make this the primary domain** ticked if this is the relay's main domain. The primary domain names the relay in lists.
5. Select **Add domain**.
The domain's page opens, with its records on the **DNS records** card: the ownership record, SPF, two DKIM records once ownership passes, and DMARC.
## Publish the records
When the domain's zone is on Coritan DNS in this account, or the domain is a claimed coritan.gg name, we have already published the records. When the zone is on Coritan DNS but was added to this account after the domain, use the [**Publish to your zone**](/docs/mail/dns-records/#publish-to-your-zone) card on the domain's page.
At any other DNS provider:
1. Create the ownership record: the TXT record at `_mailverify.example.com`. Copy its name and value from the **DNS records** card.
2. Create the SPF record. If the domain already has one because another service sends for it, add `include:_spf.` from the card to that record instead of creating a second one.
3. Create the DMARC record at `_dmarc.example.com`.
4. On the domain's page, select **Verify now**. Once we find the ownership record, we make the domain's two DKIM keys.
5. Reload the page, then create the two DKIM records it now lists.
[Mail DNS records](/docs/mail/dns-records/) explains each record and what its check looks for.
## Verify the domain
1. On the domain's page, select **Verify now**.
2. Read the toast. `example.com is verified.` means you are done. `example.com is still pending:` is followed by the first problem the check found.
3. If it is still pending, fix what the **Checks** row and the **The last check found problems** list show, and select **Verify now** again.
We also check pending domains about every ten minutes, so a domain whose records are right verifies on its own.
## Result
- The domain shows `Verified` on the **Domains** tab, with **Ownership**, **SPF** and **DKIM** ticked. **DMARC** is shown too, but a domain is verified without it.
- The **Send** tab and the [send API](/docs/mail/smtp-relay/send-with-the-api/) accept From addresses on the domain.
- When we publish into your zone, the page shows *Ready: the records are in your zone*, with **Open Credentials**.
Next, [create an SMTP credential](/docs/mail/smtp-relay/credentials/). The relay needs one for SMTP and for the send API.
> [!NOTE]
> Over SMTP, the relay already accepts a From address on the domain once its ownership check passes. Wait for the domain to be verified anyway: mail sent before SPF and DKIM are published fails those checks at the receiving servers.
## Remove a domain
> [!WARNING]
> Removing a domain stops the relay sending from it at once. If you add it again later, it gets a new ownership token and new DKIM keys, so you publish and verify it from the start.
1. Delete the SMTP credentials on the domain first. See [Send over SMTP with credentials](/docs/mail/smtp-relay/credentials/).
2. On the **Domains** tab, select the domain.
3. In the **Remove this domain** card, select **Remove domain…**.
4. Type the domain name to confirm, then select **Remove domain**.
We delete the records we published into a hosted zone. Records at another DNS provider are yours to delete.
## Troubleshooting
**Add domain…** is greyed out
: The service is not `active` yet, or the plan's domains are all used. A full plan shows `This plan allows 2 domains. Remove one or change the plan to add another.` Remove a domain or [move to a bigger plan](/docs/mail/billing/#move-to-a-bigger-or-smaller-plan).
`example.com receives mail on your Mail Hosting service. Add a sending subdomain here instead, such as send.example.com. Your relay can still send as @example.com.`
: Add `send.example.com` instead. Over SMTP, the relay may still write `@example.com` in From, because the same account has proved that domain on Mail Hosting.
`example.com is already on another of your mail services`
: Remove it from your other SMTP Relay service first, or use a different sending subdomain.
`That domain is already attached to a mail service`
: Someone else's mail service has it. If the domain is yours, contact [support](/docs/support/conversations/).
`This plan allows 2 domain(s)` or `A mail service may hold at most 1000 domains`
: The plan, or the limit for a plan with no domain limit, is reached. Remove a domain or [move to a bigger plan](/docs/mail/billing/#move-to-a-bigger-or-smaller-plan).
`MX points to` followed by other hosts
: The relay does not use MX records, so this is information only: the domain can be verified with it. It shows when the domain receives its mail somewhere else.
`DKIM selector cor202609r not published`
: The DKIM record with that selector is missing or holds a different key. Copy the whole value from the card again.
`No DKIM keys yet: the mail engine has not made them`
: We have not finished making the domain's keys. Select **Verify now** again in a minute.
`DMARC publishes p=reject, expected p=none`
: The domain already had a DMARC record with a different stage. Keep yours and set the same stage on the domain's **DMARC policy** card, or change your record. See [DMARC](/docs/mail/dmarc/).
`The zone is busy with another change. Check the domain again in a minute.`
: Another change to the same zone was being saved. Select **Verify now** again.
`Remove the mailboxes and aliases on this domain first`
: On a relay, this means the domain still has SMTP credentials. Delete them, then remove the domain.
[Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/#troubleshooting) lists the messages both products share, such as an invalid name or a platform domain.
## Related
- [Mail DNS records](/docs/mail/dns-records/)
- [Send over SMTP with credentials](/docs/mail/smtp-relay/credentials/)
- [Send email over HTTPS](/docs/mail/smtp-relay/send-with-the-api/)
- [How the DMARC stage ramp works](/docs/mail/dmarc/)
## With the API
Add a sending domain:
```bash
curl -X POST https://api.coritan.com/api/v1/client/smtp-relay/4812/domains \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"domain": "send.example.com"}'
```
`domain` is the name (3–253 characters) and `primary` defaults to `false`. The answer is `201` with the domain and its `records`. A name the service refuses answers `400` with one of the messages above, and a service that is not active answers `409` `Service is not active`.
The other domain operations work as they do for Mail Hosting, with `/client/smtp-relay/` in the path:
| Operation | What it does |
| --- | --- |
| `GET /client/smtp-relay/{service_id}/domains` | Lists the relay's domains as `{"items": [...]}`. |
| `GET /client/smtp-relay/{service_id}/domains/{domain_id}/records` | The records to publish. See [Mail DNS records](/docs/mail/dns-records/#with-the-api). |
| `POST /client/smtp-relay/{service_id}/domains/{domain_id}/verify` | Checks the domain now and answers `{"domain": {...}, "result": {...}}`. See [the example](/docs/mail/mail-hosting/add-a-domain/#with-the-api). |
| `PATCH /client/smtp-relay/{service_id}/domains/{domain_id}/dmarc` | Sets or holds the DMARC stage. See [DMARC](/docs/mail/dmarc/#with-the-api). |
| `DELETE /client/smtp-relay/{service_id}/domains/{domain_id}` | Removes the domain and answers `{"ok": true}`. |
A domain that is not on the service answers `404` `Domain not found`.
## API
- `GET /api/v1/client/smtp-relay/{service_id}/domains`: List domains (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-domains/#op-get-api-v1-client-smtp-relay-service-id-domains)
- `POST /api/v1/client/smtp-relay/{service_id}/domains`: Add domain (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-domains/#op-post-api-v1-client-smtp-relay-service-id-domains)
- `DELETE /api/v1/client/smtp-relay/{service_id}/domains/{domain_id}`: Remove domain (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-domains/#op-delete-api-v1-client-smtp-relay-service-id-domains-domain-id)
- `PATCH /api/v1/client/smtp-relay/{service_id}/domains/{domain_id}/dmarc`: Set DMARC (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-domains/#op-patch-api-v1-client-smtp-relay-service-id-domains-domain-id-dmarc)
- `GET /api/v1/client/smtp-relay/{service_id}/domains/{domain_id}/records`: Domain records (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-domains/#op-get-api-v1-client-smtp-relay-service-id-domains-domain-id-records)
- `POST /api/v1/client/smtp-relay/{service_id}/domains/{domain_id}/verify`: Verify domain (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-domains/#op-post-api-v1-client-smtp-relay-service-id-domains-domain-id-verify)
# Send over SMTP with credentials
> Create an SMTP credential for an application, connect it to the relay on port 587 or 465, and rotate, disable or revoke it.
Source: https://www.coritan.com/docs/mail/smtp-relay/credentials/
In the dashboard:
- /dashboard/mail/…/credentials: https://www.coritan.com/dashboard/mail
An *SMTP credential* is a username and password that an application uses to sign in to SMTP Relay. Create one for each application, so that you can rotate or revoke one without touching the others. The [send API](/docs/mail/smtp-relay/send-with-the-api/) also sends through a credential, so a relay needs at least one even if you only send over HTTPS.
## Before you begin
- An SMTP Relay service with the status `active`. While the service is being set up, **Create credential…** is greyed out.
- A domain on the relay whose ownership check has passed. See [Add a sending domain to SMTP Relay](/docs/mail/smtp-relay/add-a-sending-domain/).
- Room for another credential. A relay holds up to 200. When its plan sets a lower limit, the **SMTP credentials** card shows it, such as `2 of 5 on this plan.`
## Create a credential
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the SMTP Relay service, then the **Credentials** tab.
2. Select **Create credential…**.
3. In **Domain**, choose the domain the application sends from. A domain that is not verified yet shows `(pending)` after its name.
4. In **Label**, name the application, such as `billing app`. Leave it empty and the label is `default`.
5. Select **Create credential**.
6. Copy the **Username** and **Password** from the dialog, or select **Copy all**, and store them where the application keeps its secrets. We show the password only this once.
7. Select **I have saved them**.
The username is built from the label and the domain: the label in lower case with anything other than letters and digits turned into hyphens, cut to 24 characters, then a hyphen and six random characters. A credential labelled `billing app` on `example.com` gets a username such as `billing-app-3f9a1c@example.com`. The password has 32 characters.
## Connect your application
Give the application these settings. The **SMTP endpoint** card on the **Credentials** tab shows the host for your relay.
| Setting | Value |
| --- | --- |
| Host | The **Host** on the **SMTP endpoint** card, such as `smtp.mail-fra.coritan.com` |
| Port and security | `587` with STARTTLS, or `465` with implicit TLS (often called SSL/TLS) |
| Authentication | `PLAIN` or `LOGIN` |
| Username | The credential's full username, such as `billing-app-3f9a1c@example.com` |
| Password | The credential's password |
| From address | Any address on a domain of this relay, such as `receipts@example.com` |
The From address does not have to be on the credential's own domain: one credential can send for every domain on the relay. To send a message as marketing mail, add the header `X-Mail-Category: marketing`; see [Transactional and marketing mail](/docs/mail/smtp-relay/message-categories/).
To test the credential from a terminal, write a message to a file:
```text title="message.txt"
From: Receipts
To: alex@example.com
Subject: Test from SMTP Relay
This message came through SMTP Relay.
```
Then send it with `curl`, which upgrades the connection with STARTTLS:
```bash
curl --url "smtp://smtp.mail-fra.coritan.com:587" --ssl-reqd \
--user "billing-app-3f9a1c@example.com:$SMTP_PASSWORD" \
--mail-from "receipts@example.com" \
--mail-rcpt "alex@example.com" \
--upload-file message.txt
```
In application code, use your language's SMTP library. With Python's standard library:
```python
import os
import smtplib
from email.message import EmailMessage
msg = EmailMessage()
msg["From"] = "Receipts "
msg["To"] = "alex@example.com"
msg["Subject"] = "Your receipt"
msg.set_content("Thanks for your order.")
with smtplib.SMTP("smtp.mail-fra.coritan.com", 587) as smtp:
smtp.starttls()
smtp.login("billing-app-3f9a1c@example.com", os.environ["SMTP_PASSWORD"])
smtp.send_message(msg)
```
## Result
- The credential is listed on the **Credentials** tab with its label, its username, when its password was set and its **Enabled** switch on.
- The application's messages go out signed for your domain, and each one appears on the [**Events** tab](/docs/mail/smtp-relay/events/).
## Rotate a password
Rotate a credential's password when it may have leaked, or on a schedule.
1. On the **Credentials** tab, open the menu at the end of the credential's row and select **Rotate password…**.
2. Select **Rotate password** to confirm. The old password stops working at once.
3. Copy the new **Password** from the dialog, then select **I have saved them**.
4. Put the new password in the application straight away.
The new password has 24 characters. The **Password set** column shows when it changed. To give a credential a password you choose, use the API: see [With the API](#with-the-api).
## Turn a credential off or on
Turning a credential off stops it signing in but keeps its username and password, so you can turn it back on later.
1. On the **Credentials** tab, find the credential.
2. Use the switch in its **Enabled** column. A toast confirms the change, such as `billing-app-3f9a1c@example.com disabled.`
## Revoke a credential
> [!CAUTION]
> Revoking deletes the credential and its password. Any application still using it is refused from then on, and a new credential gets a different username. To pause a credential instead, turn it off.
1. On the **Credentials** tab, open the menu at the end of the credential's row and select **Revoke credential…**.
2. Type the credential's username to confirm, then select **Revoke credential**.
The send API needs an active credential. It uses one on the From address's domain when there is one, and otherwise any active credential on the relay, so revoke the last one only when nothing sends through the relay.
On an [internal mail tenant](/docs/mail/internal-tenants/), the credential the platform sends its own mail with can be rotated but not turned off or revoked: **Revoke credential…** shows **Staff only**.
## Troubleshooting
`Prove you own example.com first: publish the ownership record shown under Domains, then check the domain`
: The domain's ownership check has not passed yet. Publish the ownership record and select **Verify now** on the domain's page. See [Add a sending domain to SMTP Relay](/docs/mail/smtp-relay/add-a-sending-domain/#publish-the-records).
`A relay may hold at most 200 SMTP credentials; remove one you no longer use` or `This plan allows 5 SMTP credentials`
: The relay holds as many credentials as it can. Revoke one you no longer use. Several applications can share a credential, but you then rotate them together.
`The domain is not registered in the mail engine yet; check the domain again in a minute`
: The domain's ownership check passed moments ago and we are still setting it up. Select **Verify now** on the domain's page, then create the credential again.
`Service is not active`
: The service is suspended or not set up yet. Its status is on the **Overview** tab.
The application says the username or password is wrong
: Use the whole username, including the six random characters before the @, and the password from when you created or last rotated the credential. A credential that is turned off cannot sign in, and while sending is paused for the relay, no credential can: the panel then shows **Sending is paused**. After 30 failed sign-ins in an hour from one IP address, the relay refuses that address for 24 hours, so fix the password before the application retries many times.
The application cannot sign in when its settings are a URL
: Some frameworks take the settings as one URL, such as `smtp://user:password@host:587`. The username contains an @, and passwords can contain `@`, `#`, `%`, `?`, `+` and `=`, so percent-encode both, or pass the username and password as separate settings.
`550 5.7.1 Sender domain example.org is not verified on this account`
: The envelope sender, the address the application gives in `MAIL FROM`, is not on a domain of this relay whose ownership has been proved. Send from an address on one of the relay's domains.
`550 5.7.1 From address must use a verified domain, not example.org`
: The `From` header is on a domain the relay has not proved. Change the From address, or [add the domain](/docs/mail/smtp-relay/add-a-sending-domain/).
`550 5.7.1 Sending is not available for this account`
: The credential is turned off, or the relay is not active. Turn the credential on, or check the relay's status on the **Overview** tab.
`550 5.7.1 Sending is paused for this account; contact support`
: Sending is paused for the relay: its bounce or complaint rate passed our limit, or our staff paused it. See [Sending reputation and deliverability](/docs/mail/smtp-relay/deliverability/).
`550 5.7.1 Monthly allowance and its 12% buffer are used up; upgrade the plan to continue`
: The relay has sent everything its plan allows this month. A free plan says `Monthly sending allowance reached; upgrade the plan to continue`. See [How SMTP Relay sending limits work](/docs/mail/smtp-relay/sending-limits/).
`550 5.1.1 Recipient alex@example.com is suppressed after a bounce or complaint`
: The address is on the relay's suppression list. See [Manage the suppression list](/docs/mail/smtp-relay/suppressions/).
`550 5.7.1 This login is not a mail account we know`
: The credential belongs to a relay that no longer exists. Create a credential on an active relay.
The application cannot connect
: Check the host and the port. Port `587` needs STARTTLS and port `465` needs TLS from the start, so an application that uses the wrong security for the port cannot connect. Use port `587` or `465`: many networks block port `25`.
A large message is refused
: SMTP accepts messages up to 50 MB, including the encoded attachments, which are about a third larger than the files. The send API takes up to 25 MB.
## Related
- [Add a sending domain to SMTP Relay](/docs/mail/smtp-relay/add-a-sending-domain/)
- [Send email over HTTPS](/docs/mail/smtp-relay/send-with-the-api/)
- [Transactional and marketing mail](/docs/mail/smtp-relay/message-categories/)
- [How SMTP Relay sending limits work](/docs/mail/smtp-relay/sending-limits/)
## With the API
Create a credential:
```bash
curl -X POST https://api.coritan.com/api/v1/client/smtp-relay/4812/credentials \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"domain_id": 311, "label": "billing app"}'
```
The body takes these fields:
`domain_id`
: The domain the username goes on, from `GET /client/smtp-relay/{service_id}/domains`. Its ownership check must have passed.
`label`
: Optional, 1–100 characters, `default` when left out. It names the credential in lists and starts its username.
The answer is `201` with the credential, its `password`, shown this once, and `smtp`, the host names to connect to:
```json
{
"id": 7731,
"tenant_id": 903,
"domain_id": 311,
"kind": "relay_credential",
"address": "billing-app-3f9a1c@example.com",
"local_part": "billing-app-3f9a1c",
"display_name": "billing app",
"quota_bytes": 0,
"targets": [],
"status": "active",
"password_set_at": "2026-09-16T10:52:03.418207+00:00",
"created_at": "2026-09-16T10:52:03.418207+00:00",
"totp_enabled": false,
"app_passwords": 0,
"frozen_reason": null,
"user_id": null,
"password": "Vq8#nT2mLw!4Rz=Kp7Xc9@Hd3Fs+Gy6J",
"smtp": {
"smtp_host": "smtp.mail-fra.coritan.com",
"imap_host": "imap.mail-fra.coritan.com",
"jmap_host": "jmap.mail-fra.coritan.com",
"mx_hostname_base": "mail-fra.coritan.com",
"webmail_url": "https://jmap.mail-fra.coritan.com",
"display_name": null,
"support_url": null,
"postmaster_address": null,
"user_mailbox_domain": null
}
}
```
The username is `address`, and the label is `display_name`. Connect to `smtp.smtp_host`.
The other operations:
| Operation | Body | Answer |
| --- | --- | --- |
| `GET /client/smtp-relay/{service_id}/credentials` | | `{"items": [...], "smtp": {...}}`: each credential as above with `locked` in place of `password`, and the host names |
| `POST /client/smtp-relay/{service_id}/credentials/{account_id}/rotate` | | `{"id", "address", "password"}` with a new 24-character password |
| `PATCH /client/smtp-relay/{service_id}/credentials/{account_id}/enabled` | `{"enabled": false}` | The credential, with `status` `disabled` or `active` |
| `DELETE /client/smtp-relay/{service_id}/credentials/{account_id}` | | `{"ok": true}` |
`locked` is `null` on your own services. On an internal mail tenant it holds `The platform sends its own mail with this credential. You can rotate it, but only staff can disable or delete it.`, and turning that credential off or revoking it answers `409` with the same message.
To give a credential a password you choose, 12–128 characters, post it to the credential's id under `mailboxes`:
```bash
curl -X POST https://api.coritan.com/api/v1/client/smtp-relay/4812/mailboxes/7731/password \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"password": "a-long-passphrase-you-chose"}'
```
The answer is `{"id", "address", "password"}` with the password you sent. The send API goes on working after a rotation or a new password, because it always uses the current one.
A refused request answers `400` with one of the messages in [Troubleshooting](#troubleshooting), or `Domain not found on this service` for a `domain_id` that is not on the relay. An id that is not a credential of the relay answers `404` `Not found`, a value outside a field's range answers `422`, and a failure on our side answers `502` with a message that starts `Mail engine error:`.
### On a Mail Hosting service
The same paths exist under `/client/mail/{service_id}/credentials`, where they do this:
- `GET` answers `{"items": [], "smtp": {...}}`: no credentials, and the service's host names.
- `POST` answers `404` `Not an SMTP Relay service`.
- `.../{account_id}/rotate` and `.../{account_id}/enabled` accept a mailbox's id and act on the mailbox. `rotate` works as `POST .../mailboxes/{account_id}/password` with `{}`: it sets a generated password and turns off two-factor sign-in. See [Mailboxes](/docs/mail/mail-hosting/mailboxes/#with-the-api).
- `DELETE .../{account_id}` answers `404` `Not found`.
## API
- `GET /api/v1/client/smtp-relay/{service_id}/credentials`: List credentials (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-credentials/#op-get-api-v1-client-smtp-relay-service-id-credentials)
- `POST /api/v1/client/smtp-relay/{service_id}/credentials`: Create credential (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-credentials/#op-post-api-v1-client-smtp-relay-service-id-credentials)
- `DELETE /api/v1/client/smtp-relay/{service_id}/credentials/{account_id}`: Delete credential (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-credentials/#op-delete-api-v1-client-smtp-relay-service-id-credentials-account-id)
- `PATCH /api/v1/client/smtp-relay/{service_id}/credentials/{account_id}/enabled`: Credential enabled (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-credentials/#op-patch-api-v1-client-smtp-relay-service-id-credentials-account-id-enabled)
- `POST /api/v1/client/smtp-relay/{service_id}/credentials/{account_id}/rotate`: Rotate credential (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-credentials/#op-post-api-v1-client-smtp-relay-service-id-credentials-account-id-rotate)
- `GET /api/v1/client/mail/{service_id}/credentials`: List credentials (https://www.coritan.com/docs/api/reference/client/mail/mail-credentials/#op-get-api-v1-client-mail-service-id-credentials)
- `POST /api/v1/client/mail/{service_id}/credentials`: Create credential (https://www.coritan.com/docs/api/reference/client/mail/mail-credentials/#op-post-api-v1-client-mail-service-id-credentials)
- `DELETE /api/v1/client/mail/{service_id}/credentials/{account_id}`: Delete credential (https://www.coritan.com/docs/api/reference/client/mail/mail-credentials/#op-delete-api-v1-client-mail-service-id-credentials-account-id)
- `PATCH /api/v1/client/mail/{service_id}/credentials/{account_id}/enabled`: Credential enabled (https://www.coritan.com/docs/api/reference/client/mail/mail-credentials/#op-patch-api-v1-client-mail-service-id-credentials-account-id-enabled)
- `POST /api/v1/client/mail/{service_id}/credentials/{account_id}/rotate`: Rotate credential (https://www.coritan.com/docs/api/reference/client/mail/mail-credentials/#op-post-api-v1-client-mail-service-id-credentials-account-id-rotate)
# Create and revoke send API keys
> Create an API key that sends mail through SMTP Relay over HTTPS, keep its secret safe, and revoke it when you no longer need it.
Source: https://www.coritan.com/docs/mail/smtp-relay/api-keys/
In the dashboard:
- /dashboard/mail/…/api-keys: https://www.coritan.com/dashboard/mail
A *send API key* lets an application send mail through SMTP Relay over HTTPS instead of SMTP. The application puts the key in the `X-Api-Key` header of each request to the [send API](/docs/mail/smtp-relay/send-with-the-api/). A key can only send, and only through the relay that made it: it cannot read or change the service.
These keys are separate from the keys on the **API keys** tab of **Settings**, which are described in [Manage API keys](/docs/account/api-keys/). To manage the relay itself from code, use an access token, as [Make your first API request](/docs/get-started/first-steps-with-the-api/) shows.
## Before you begin
- An SMTP Relay service with the status `active`. While it is not, **Create API key…** is greyed out.
- A verified sending domain and at least one [SMTP credential](/docs/mail/smtp-relay/credentials/) on the relay. You can create a key without them, but the send API refuses to send until both exist.
- Fewer than 20 keys on the relay. The **API keys** card shows how many you have, such as `3 of 20 keys.`
## Create a key
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the SMTP Relay service, then the **API keys** tab.
2. Select **Create API key…**.
3. In **Label**, name the application that will hold the key, such as `billing service`. Leave it empty and the label is `default`.
4. Select **Create API key**.
5. Copy the **API key** from the dialog and store it where the application keeps its secrets. We show the key only this once.
6. Select **I have saved them**.
A key looks like `mk_5e0c9a7b_` followed by 43 more characters. The first part, such as `mk_5e0c9a7b`, is its *prefix*. We keep the prefix so that you can tell keys apart, and we cannot show the rest of the key again.
Keep the key on your server. Anyone who has it can send mail from your domains until you revoke it, so do not put it in a web page, a mobile app or a public repository.
## Result
The key is listed on the **API keys** tab with its label, its prefix, its **Abilities** (`send`), when it was **Last used** (`Never` until its first request) and when it was **Created**.
The **Send over HTTPS** card below the list holds two requests to copy, **Send a message** and **Your limits**, with one of your domains in the From address. Replace `mk_...` with the key and run them. [Send email over HTTPS](/docs/mail/smtp-relay/send-with-the-api/) explains every field.
## Revoke a key
> [!CAUTION]
> Revoking a key cannot be undone. We refuse requests with the key from then on, so replace it in every application that uses it first.
1. On the **API keys** tab, select **Revoke…** in the key's row.
2. Type the key's prefix, such as `mk_5e0c9a7b`, to confirm, then select **Revoke key**.
The key leaves the list, and a toast confirms it, such as `Key "billing service" revoked.` To give an application access again, create a new key.
To replace a key without stopping the application, create the new key, put it in the application, check that its **Last used** time moves, then revoke the old one.
## Troubleshooting
**Create API key…** is greyed out
: The relay is not active, or it already has 20 keys and the **API keys** card shows `20 of 20 keys.` Revoke a key you no longer use.
`Revoke an unused API key first (limit 20)`
: The relay already has 20 keys. Revoked keys do not count, so revoke one you no longer use.
`401` `Invalid API key`
: The key is mistyped, cut short or revoked, or the relay is not active. Check the whole key, including the `mk_` at the start. If you no longer have it, create a new key.
`401` `X-Api-Key header required`
: The request has no `X-Api-Key` header. Send the key in that header: the send API does not read `Authorization`.
You lost a key
: We cannot show a key again. Create a new one, put it in the application, and revoke the old one.
## Related
- [Send email over HTTPS](/docs/mail/smtp-relay/send-with-the-api/)
- [Send over SMTP with credentials](/docs/mail/smtp-relay/credentials/)
- [How SMTP Relay sending limits work](/docs/mail/smtp-relay/sending-limits/)
## With the API
Create a key:
```bash
curl -X POST https://api.coritan.com/api/v1/client/smtp-relay/4812/api-keys \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"label": "billing service"}'
```
`label` is optional, 1–100 characters, and `default` when left out. The answer is `201` with the key in `key`, shown this once:
```json
{
"id": 88,
"label": "billing service",
"key_prefix": "mk_5e0c9a7b",
"abilities": ["send"],
"last_used_at": null,
"revoked_at": null,
"created_at": "2026-09-16T10:52:03.418207+00:00",
"key": "mk_5e0c9a7b_Q2hSbE9wN3ZrTjRaWnFMY1d4dUJ5ZzFSbTZUaEg4ZXM"
}
```
The other operations:
| Operation | Answer |
| --- | --- |
| `GET /client/smtp-relay/{service_id}/api-keys` | `{"items": [...]}`: every key that is not revoked, as above without `key` |
| `DELETE /client/smtp-relay/{service_id}/api-keys/{key_id}` | `{"ok": true}`. The key stops working at once. |
A key id that is not on the relay answers `404` `Not found`, and a relay with 20 keys answers `400` `Revoke an unused API key first (limit 20)`. The API creates a key while the relay is not active, but the key answers `401` until the relay is active again.
### On a Mail Hosting service
Mail Hosting has no send API. Every path under `/client/mail/{service_id}/api-keys` answers `404` `Not an SMTP Relay service`.
## API
- `GET /api/v1/client/smtp-relay/{service_id}/api-keys`: List API keys (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-api-keys/#op-get-api-v1-client-smtp-relay-service-id-api-keys)
- `POST /api/v1/client/smtp-relay/{service_id}/api-keys`: Create API key (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-api-keys/#op-post-api-v1-client-smtp-relay-service-id-api-keys)
- `DELETE /api/v1/client/smtp-relay/{service_id}/api-keys/{key_id}`: Revoke API key (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-api-keys/#op-delete-api-v1-client-smtp-relay-service-id-api-keys-key-id)
- `GET /api/v1/client/mail/{service_id}/api-keys`: List API keys (https://www.coritan.com/docs/api/reference/client/mail/mail-api-keys/#op-get-api-v1-client-mail-service-id-api-keys)
- `POST /api/v1/client/mail/{service_id}/api-keys`: Create API key (https://www.coritan.com/docs/api/reference/client/mail/mail-api-keys/#op-post-api-v1-client-mail-service-id-api-keys)
- `DELETE /api/v1/client/mail/{service_id}/api-keys/{key_id}`: Revoke API key (https://www.coritan.com/docs/api/reference/client/mail/mail-api-keys/#op-delete-api-v1-client-mail-service-id-api-keys-key-id)
# Send email over HTTPS
> Send a test message from the Send tab, then send from your application with the send API and an API key.
Source: https://www.coritan.com/docs/mail/smtp-relay/send-with-the-api/
In the dashboard:
- /dashboard/mail/…/send: https://www.coritan.com/dashboard/mail
The *send API* takes a message as JSON over HTTPS and hands it to SMTP Relay, which signs it for your domain and delivers it as it does mail sent over SMTP. Use it where an SMTP connection is awkward, such as in a serverless function. Before you wire up an application, you can check a domain end to end by sending a test message from the **Send** tab.
## Before you begin
- A *verified* sending domain on the relay. Over SMTP a domain can send once its ownership check passes, but the send API waits until the domain shows `Verified`. See [Add a sending domain to SMTP Relay](/docs/mail/smtp-relay/add-a-sending-domain/).
- At least one [SMTP credential](/docs/mail/smtp-relay/credentials/) on the relay. The send API submits each message with one: a credential on the From address's domain when there is one, otherwise any active credential on the relay.
- A [send API key](/docs/mail/smtp-relay/api-keys/) for the application. The **Send** tab does not need one.
## Send a test message from the dashboard
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the SMTP Relay service, then the **Send** tab.
2. In **From**, enter the part of the address before the @, such as `no-reply`, and choose a verified domain after it.
3. Optionally, enter a **From name**, such as `Example Billing`.
4. In **To**, enter up to 50 addresses, separated by commas or spaces.
5. Enter a **Subject** and a **Message**. The message is plain text.
6. In **Category**, leave **Service default** or choose **Transactional** or **Marketing**. See [Transactional and marketing mail](/docs/mail/smtp-relay/message-categories/).
7. Select **Send message**.
A toast says `Accepted for 1 recipient.`, and a green **Accepted for delivery** box links to the **Events tab**, where you can watch the message arrive. The test message counts towards the month's allowance like any other. When the relay refuses the message, a **Could not send the message** box shows one of the messages in [Troubleshooting](#troubleshooting).
## Send from your application
Post the message to `/mail/send` with the key in the `X-Api-Key` header:
```bash
curl -X POST https://api.coritan.com/api/v1/mail/send \
-H "X-Api-Key: $MAIL_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"from": "receipts@example.com",
"from_name": "Example Billing",
"to": ["alex@example.com"],
"subject": "Your receipt",
"text": "Thanks for your order.",
"html": "Thanks for your order.
",
"category": "transactional"
}'
```
The dashboard's **API keys** tab shows the same endpoint on `www.coritan.com`. Both hosts answer it.
The body takes these fields. Only `from`, `to` and one of `text` or `html` are needed:
`from`
: The sender's address, 3–320 characters, on a verified domain of the relay. It is used as the envelope sender too. `from_address` is accepted as another name for it.
`from_name`
: Optional, up to 255 characters. The name shown next to the address.
`to`
: A list of 1–50 addresses.
`cc`
: Optional, a list of up to 50 addresses. A transactional message takes 50 recipients across `to` and `cc` together.
`subject`
: Optional, up to 998 characters. Empty when left out.
`text`
: The plain-text body, up to 5,000,000 characters.
`html`
: The HTML body, up to 10,000,000 characters. With `text` as well, the message carries both and the recipient's app picks one.
`reply_to`
: Optional, up to 320 characters. The address replies go to.
`headers`
: Optional, an object of extra headers, such as `{"X-Order-Id": "10492"}`. Only headers whose names start with `X-`, plus `List-Unsubscribe`, `List-Unsubscribe-Post`, `List-Id` and `Precedence`, are added; any other header is dropped without an error. A name can have up to 64 characters and a value is cut at 998.
`category`
: Optional, `transactional` or `marketing`. Left out, the message takes the relay's default category.
The send API has no field for attachments or blind copies, and it ignores fields it does not know, such as `bcc` or `attachments`. To send either, use [SMTP](/docs/mail/smtp-relay/credentials/). The whole message, as built, can be up to 25 MB.
We add `Date`, a `Message-ID` at your domain and an `X-Mail-Category` header that names the category we sent the message as.
## Read the answer
The answer is `202`: we accepted the message and queued it for delivery. It does not mean the message has arrived. Follow it on the [**Events** tab](/docs/mail/smtp-relay/events/) or with [webhooks](/docs/mail/smtp-relay/webhooks/).
A transactional message answers with the addresses we sent it to:
```json
{
"accepted": ["alex@example.com"],
"suppressed": [],
"node": "mx1.mail-fra.coritan.com",
"message_id": "<175890432171.2481.9311874401294517206@example.com>"
}
```
`accepted`
: The recipients we queued the message for.
`suppressed`
: The recipients we left out because they are on the relay's [suppression list](/docs/mail/smtp-relay/suppressions/). When every recipient is suppressed, nothing is sent, `accepted` is empty and `node` is `null`, and the answer is still `202`.
`node`
: The name of the mail server that took the message.
`message_id`
: The message's `Message-ID` header. Webhook events and receiving servers refer to the message by it.
## Send marketing mail
With `"category": "marketing"`, or no category on a relay whose default is marketing, the send API sends each address in `to` and `cc` its own copy, addressed to that person alone. Each copy carries `List-Unsubscribe` and `List-Unsubscribe-Post` headers with a link for that recipient, so receiving apps can show an unsubscribe button. [Transactional and marketing mail](/docs/mail/smtp-relay/message-categories/) explains what an unsubscribe does.
The answer counts the copies and lists each one:
```json
{
"accepted": 2,
"category": "marketing",
"messages": [
{
"accepted": ["alex@example.com"],
"suppressed": [],
"node": "mx1.mail-fra.coritan.com",
"message_id": "<175890432171.2481.9311874401294517206@example.com>"
},
{
"accepted": ["sam@example.com"],
"suppressed": [],
"node": "mx1.mail-fra.coritan.com",
"message_id": "<175890432172.2481.5170284763319902451@example.com>"
}
]
}
```
Here `accepted` is a number, the copies we queued, where a transactional answer gives a list of addresses. A copy to a suppressed address appears in `messages` with an empty `accepted` and is not counted.
## Check your limits
Read what the relay may still send with the same key:
```bash
curl https://api.coritan.com/api/v1/mail/send/limits \
-H "X-Api-Key: $MAIL_API_KEY"
```
The answer holds the relay's allowance and hourly limit, which [How SMTP Relay sending limits work](/docs/mail/smtp-relay/sending-limits/#with-the-api) describes field by field, and three more fields:
`sending_frozen`
: `true` while sending is paused for the relay.
`max_recipients`
: `50`, the most recipients one request can have.
`max_message_bytes`
: `26214400`, the largest message the send API builds, in bytes (25 MB).
Check `remaining` before a large batch: it is `null` when the relay has no monthly cap.
## Troubleshooting
`401` `X-Api-Key header required`
: The request has no `X-Api-Key` header. The send API does not read `Authorization`.
`401` `Invalid API key`
: The key is wrong or revoked, or the relay is not active. See [Create and revoke send API keys](/docs/mail/smtp-relay/api-keys/#troubleshooting).
`403` `API key cannot send`
: The key does not have the `send` ability. Keys you create on the **API keys** tab always have it, so create a new key.
`422` with a `detail` list
: A field is missing or out of range: no `from` or `to`, more than 50 addresses in `to` or `cc`, or a `category` other than `transactional` or `marketing`. Each item in `detail` names the field in `loc`.
`400` `Provide a text or html body`
: Add `text`, `html` or both.
`400` `At most 50 recipients per message`
: A transactional message has more than 50 addresses in `to` and `cc` together. Split it into several requests.
`400` `Message exceeds 25 MB`
: Shorten the message, or link to large content instead of putting it in the body.
`400` `example.org is not a domain on this service`
: The domain of `from` is not on the relay. Use an address on one of the relay's domains, or [add the domain](/docs/mail/smtp-relay/add-a-sending-domain/). A subdomain is a domain of its own: with only `send.example.com` on the relay, send from an address at `send.example.com`. Over SMTP, the From header can use `example.com` when your account also holds that domain, in Coritan DNS or on another mail service; the send API cannot.
`400` `example.com is not verified yet; publish its DNS records first`
: The domain is on the relay but not verified. Publish its records and verify it.
`400` `Create an SMTP credential on this service before sending through the API`
: The relay has no active SMTP credential. [Create one](/docs/mail/smtp-relay/credentials/#create-a-credential), or turn one back on.
`400` `Sending is paused on this service; contact support`
: Sending is paused for the relay. See [Sending reputation and deliverability](/docs/mail/smtp-relay/deliverability/).
`429` `Monthly allowance and its 12% buffer are used up; upgrade the plan to continue`
: Sending the request would take the relay past everything its plan allows this month. A free plan says `Monthly sending allowance reached; upgrade the plan to continue`. See [How SMTP Relay sending limits work](/docs/mail/smtp-relay/sending-limits/).
`400` `Rejected by mail engine:` followed by an SMTP reply
: The relay's mail server refused the message, and the reply after the colon says why. The replies it can give are listed under [SMTP credentials](/docs/mail/smtp-relay/credentials/#troubleshooting).
`400` `No mail node is available right now` or `400` `All mail nodes refused the connection:`
: We could not reach a mail server to take the message. Nothing was sent, so retry the request after a short wait.
`503` `Mail service unavailable`
: The relay's service could not be found on our side. Contact [support](/docs/support/conversations/) if it persists.
## Related
- [Create and revoke send API keys](/docs/mail/smtp-relay/api-keys/)
- [Transactional and marketing mail](/docs/mail/smtp-relay/message-categories/)
- [Look up message events](/docs/mail/smtp-relay/events/)
- [Mail Send API reference](/docs/api/reference/client/mail-send-api/)
## With the API
The **Send** tab posts to `/client/smtp-relay/{service_id}/messages`, which takes the same body and gives the same answers with an access token in place of an API key:
```bash
curl -X POST https://api.coritan.com/api/v1/client/smtp-relay/4812/messages \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"from": "no-reply@example.com", "to": ["alex@example.com"], "subject": "Test", "text": "Hello from SMTP Relay."}'
```
It answers `202` as above. A relay that is not active answers `409` `Service is not active`.
On a Mail Hosting service, `POST /client/mail/{service_id}/messages` answers `404` `Not an SMTP Relay service`. Mailboxes send through [a mail app or webmail](/docs/mail/mail-hosting/connect-a-mail-app/).
## API
- `POST /api/v1/mail/send`: Send (https://www.coritan.com/docs/api/reference/client/mail-send-api/#op-post-api-v1-mail-send)
- `GET /api/v1/mail/send/limits`: Limits (https://www.coritan.com/docs/api/reference/client/mail-send-api/#op-get-api-v1-mail-send-limits)
- `POST /api/v1/client/smtp-relay/{service_id}/messages`: Send message (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay/#op-post-api-v1-client-smtp-relay-service-id-messages)
- `POST /api/v1/client/mail/{service_id}/messages`: Send message (https://www.coritan.com/docs/api/reference/client/mail/mail/#op-post-api-v1-client-mail-service-id-messages)
# Transactional and marketing mail
> How the message category changes what the relay adds to each message, how one-click unsubscribe works, and how to set the default.
Source: https://www.coritan.com/docs/mail/smtp-relay/message-categories/
Every message SMTP Relay sends is either *transactional* or *marketing*. The category decides whether the relay adds *one-click unsubscribe* headers, which let the recipient's mail app show an unsubscribe button. Gmail and Yahoo ask for those headers on bulk mail.
Transactional
: Mail a person expects because of something they did: receipts, alerts, password resets, sign-in codes. The relay sends it as your application wrote it.
Marketing
: Newsletters, announcements and campaigns. The relay adds unsubscribe headers, and over the send API it sends each recipient a separate copy.
## How a message gets its category
The relay reads the first of these that is set:
1. Over the [send API](/docs/mail/smtp-relay/send-with-the-api/), the `category` field: `transactional` or `marketing`. The API refuses any other value.
2. Over [SMTP](/docs/mail/smtp-relay/credentials/), the header `X-Mail-Category: marketing` or `X-Mail-Category: transactional`. Case does not matter.
3. The relay's *default category*, which starts as transactional.
Over SMTP, an `X-Mail-Category` header with any other value, such as `newsletter`, makes the message transactional, whatever the default.
## What marketing adds
Each marketing message gets two headers:
```text
List-Unsubscribe:
List-Unsubscribe-Post: List-Unsubscribe=One-Click
```
The link points at our API. Its `{token}` is signed, and names the relay and the one recipient the copy is for. Because the link belongs to one person, how the relay adds it depends on how the message arrives.
Over the send API
: The relay sends each address in `to` and `cc` its own copy, addressed to that person alone, with its own link. The headers replace any `List-Unsubscribe` pair you put in `headers`. The message also carries `X-Mail-Category: marketing`.
Over SMTP
: The relay adds the headers only to a message with exactly one recipient and no `List-Unsubscribe` header of its own. A message with several recipients goes out as it is, without unsubscribe headers, because one link cannot name them all. For bulk mail over SMTP, send one message per recipient, or add your own `List-Unsubscribe` headers.
A transactional message gets no unsubscribe headers from the relay. Over the send API it carries `X-Mail-Category: transactional`, and any `List-Unsubscribe` pair you add in `headers` is kept.
## What an unsubscribe does
When the recipient selects the unsubscribe button, their mail app posts to the link, as RFC 8058 describes. Someone who opens the link in a browser gets the same result. Either way:
- We add the address to the relay's [suppression list](/docs/mail/smtp-relay/suppressions/) with the reason `unsubscribe`.
- The page says `alex@example.com will not receive further marketing email from this sender.`
- Selecting the link again changes nothing.
> [!IMPORTANT]
> A suppressed address receives nothing from the relay, transactional mail included, even though the page mentions only marketing email. The relay drops it from every message sent over the API and refuses it as a recipient over SMTP. If the person later needs a receipt or a password reset, [remove them from the suppression list](/docs/mail/smtp-relay/suppressions/#remove-an-address) once they ask to hear from you again.
The unsubscribe covers the whole relay, every sending domain included. A link does not expire.
## Set the default category
The default applies to every message that does not set a category. On the relay's **Overview** tab, in the **Deliverability** card, choose **Default message category**. A toast confirms the change, such as `Default category is now marketing.` It applies to messages sent from then on.
Set it to marketing only when most of what the relay sends is bulk mail, and mark receipts and other transactional messages as `transactional` one by one. A Mail Hosting service has its own default, on its **Settings** tab: see [Mail Hosting settings](/docs/mail/mail-hosting/settings/#set-the-default-message-category).
## With the API
Set the relay's default category:
```bash
curl -X PATCH https://api.coritan.com/api/v1/client/smtp-relay/4812/category \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"default_category": "marketing"}'
```
`default_category` is `transactional` or `marketing`; any other value answers `422`. The answer is the new default:
```json
{"default_category": "marketing"}
```
The unsubscribe link is `GET` or `POST /mail/unsubscribe/{token}`. It needs no key or token of yours, ignores the request body, and answers `200` with the plain-text sentence above. A link that has been changed or cut short answers `404` `Unknown unsubscribe link`. Your application does not call it: receiving mail apps and recipients do.
## API
- `PATCH /api/v1/client/smtp-relay/{service_id}/category`: Set category (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay/#op-patch-api-v1-client-smtp-relay-service-id-category)
- `GET /api/v1/mail/unsubscribe/{token}`: RFC 8058 target (https://www.coritan.com/docs/api/reference/client/mail-send-api/#op-get-api-v1-mail-unsubscribe-token)
- `POST /api/v1/mail/unsubscribe/{token}`: RFC 8058 target (https://www.coritan.com/docs/api/reference/client/mail-send-api/#op-post-api-v1-mail-unsubscribe-token)
# Receive delivery events with webhooks
> Add a webhook URL that receives delivery, bounce and complaint events, and check the signature on each request.
Source: https://www.coritan.com/docs/mail/smtp-relay/webhooks/
In the dashboard:
- /dashboard/mail/…/webhooks: https://www.coritan.com/dashboard/mail
A *webhook* is an HTTPS address in your application that we send a request to each time something happens to a message the relay sends: we queue it, the receiving server takes it or refuses it, or the recipient complains about it. Use webhooks to react to bounces and complaints as they happen.
Each request carries one event as JSON, signed with a secret that only you and we hold, so your application can check that the request came from us.
## Before you begin
- An SMTP Relay service with the status `active`. While it is not, **Add webhook…** is greyed out.
- An endpoint in your application that accepts `POST` requests at an `https://` URL reachable from the internet, with a valid certificate from a public certificate authority. We do not follow redirects, so use the final URL.
- Fewer than 10 webhooks on the relay. A webhook we have turned off still counts.
## Add a webhook
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the SMTP Relay service, then the **Webhooks** tab.
2. Select **Add webhook…**.
3. In **Endpoint URL**, enter the address of your endpoint, such as `https://app.example.com/hooks/mail`.
4. Under **Events**, clear the events you do not want. Every event is selected at first, and [Events](#events) describes each one.
5. Select **Add webhook**.
6. Copy the **Signing secret** from the dialog and store it where the application keeps its secrets. We show it only this once.
7. Select **I have saved them**.
## Result
The webhook is listed on the **Webhooks** tab with its URL, the events it receives, its **Status** and when it was **Created**. Its status is **Healthy** until a request to it fails.
The webhook receives the events we record from then on, and none from before. Requests go out about once a minute, so expect each one a minute or so after its event.
## Events
| Event | What happened | `type` values |
| --- | --- | --- |
| `accepted` | We queued the message for delivery. | `queue.authenticated-message-queued`, `queue.message-queued` |
| `delivered` | The receiving server took the message. | `delivery.delivered`, `delivery.dsn-success` |
| `deferred` | The receiving server refused the message for now, or a sending limit held it back. We try again later. | `delivery.dsn-temp-fail`, `delivery.rate-limit-exceeded`, `queue.rate-limit-exceeded`, `queue.quota-exceeded` |
| `bounced` | The message was not delivered and we will not try again. We add the recipient to the [suppression list](/docs/mail/smtp-relay/suppressions/). | `delivery.failed`, `delivery.dsn-perm-fail`, `delivery.double-bounce` |
| `complaint` | A report about the message reached us: the recipient marked it as spam, or a mailbox provider reported it as fraud or as failing authentication. We add the recipient to the suppression list. | `incoming-report.abuse-report`, `incoming-report.fraud-report`, `incoming-report.auth-failure-report` |
The dialog also offers `suppressed`, described as "Dropped: the address is on the suppression list", but we never send a request for it. Over SMTP the relay refuses a suppressed address with `550 5.1.1`, and the send API leaves it out and lists it in the `suppressed` field of its answer.
A message the relay refuses when your application submits it, such as one from a domain that is not verified, produces no request either. Your application sees the refusal as the SMTP reply or the API error.
## The request
Each request is a `POST` with `Content-Type: application/json` and one event in the body. It carries two headers of its own:
`X-Mail-Signature`
: The HMAC-SHA256 of the raw body, made with the webhook's signing secret and written as lower-case hex. [Verify the signature](#verify-the-signature) shows how to check it.
`X-Mail-Event`
: The event, the same as `event` in the body, such as `delivered`.
The body is compact JSON with its keys in alphabetical order, exactly as we signed it:
```json
{"event":"delivered","from":"receipts@example.com","id":90412,"message_id":"<175890432171.2481.9311874401294517206@example.com>","occurred_at":"2026-09-16T10:52:08","queue_id":"7d2c91a04e","response":"250 2.0.0 OK","to":"alex@example.com","type":"delivery.delivered"}
```
`id`
: The event's id, a number. It stays the same on every attempt to send the event, so use it to spot a repeat.
`event`
: The event: `accepted`, `delivered`, `deferred`, `bounced` or `complaint`.
`type`
: The detailed event the mail server recorded, one of the `type` values in [Events](#events).
`queue_id`
: Our id for the message in the delivery queue, the same on every event about that message.
`message_id`
: The message's `Message-ID` header.
`from`
: The sender address, in lower case.
`to`
: The recipient address, in lower case. An event about the whole message, such as `accepted`, names only its first recipient.
`response`
: The receiving server's reply or the reason for the event, up to 2,000 characters.
`occurred_at`
: When the event happened, in UTC, with no time zone suffix.
Any field except `id`, `event`, `type` and `occurred_at` is `null` when the event does not carry it, so do not assume that every event has every field. The **Payload** card on the **Webhooks** tab sums up the method, the signature and the fields.
## Verify the signature
Check the signature before you act on a request:
1. Read the raw body as bytes, before a JSON parser touches it. A parser that reads the JSON and writes it out again can change the bytes, and then the signature no longer matches.
2. Compute the HMAC-SHA256 of those bytes with the signing secret as the key. Use the secret as text, exactly as we showed it: do not decode it.
3. Write the result as lower-case hex and compare it with `X-Mail-Signature`, using a comparison that takes the same time whatever the input.
4. When they differ, answer `401` and ignore the body.
In Python with Flask:
```python
import hashlib
import hmac
import os
from flask import Flask, abort, request
app = Flask(__name__)
SECRET = os.environ["MAIL_WEBHOOK_SECRET"].encode()
@app.post("/hooks/mail")
def mail_event():
body = request.get_data()
expected = hmac.new(SECRET, body, hashlib.sha256).hexdigest().encode()
given = request.headers.get("X-Mail-Signature", "").encode()
if not hmac.compare_digest(expected, given):
abort(401)
handle(request.get_json())
return "", 204
```
In Node.js with Express:
```javascript
import crypto from "node:crypto";
import express from "express";
const app = express();
const secret = process.env.MAIL_WEBHOOK_SECRET;
app.post("/hooks/mail", express.raw({ type: "application/json" }), (req, res) => {
const expected = Buffer.from(crypto.createHmac("sha256", secret).update(req.body).digest("hex"));
const given = Buffer.from(req.get("X-Mail-Signature") || "");
if (given.length !== expected.length || !crypto.timingSafeEqual(given, expected)) {
return res.sendStatus(401);
}
handle(JSON.parse(req.body.toString("utf8")));
res.sendStatus(204);
});
app.listen(3000);
```
In both, `handle` stands for your own code. [Answer the request](#answer-the-request) says how long it may take.
The signature covers the body alone. The body holds `occurred_at`, so you can refuse an old event, and `id`, so you can refuse one you have already handled.
## Answer the request
Answer with any `2xx` status within 10 seconds. We count everything else as a failure: another status, a redirect, a timeout, a refused connection or a certificate we cannot verify. When your handling takes longer, store the event, answer, and process the event afterwards.
After a failed attempt we send the same event again, up to six attempts in all. We wait about 2 minutes before the second attempt, then about 4, 8, 16 and 32 minutes before each of the next four. When the sixth attempt fails, we stop sending that event to the webhook. It is still on the [**Events** tab](/docs/mail/smtp-relay/events/).
Because of retries, the same event can arrive more than once, and events can arrive in a different order from the one they happened in. Use `id` to ignore a repeat and `occurred_at` to put events in order.
### When we turn a webhook off
Every failed attempt, for any event, adds one to the webhook's count of failures in a row, and a request that succeeds sets the count back to zero. At 50 failures in a row we turn the webhook off: we drop the events waiting for it and send it nothing more. A relay that sends a lot can reach 50 within minutes of an outage on your side, because each waiting event counts on its own.
The **Status** column shows where each webhook stands:
**Healthy**
: The last request succeeded, or we have not sent one yet.
`3 failing`
: The last three attempts failed.
**Disabled**
: We turned the webhook off after 50 failures in a row.
Under the status, a line such as `Last HTTP 503 · 12 minutes ago` gives the status code your endpoint last answered with and the time since the last request that succeeded.
You cannot turn a webhook back on. Fix the endpoint, then delete the webhook and add it again. The new webhook has a new signing secret, and we do not send the events from the time the old one was off.
## Replace the signing secret
We cannot show a signing secret again or change it. To move to a new secret without missing events:
1. Add a second webhook with the same URL and events, and save its signing secret.
2. Make your endpoint accept a signature made with either secret.
3. Delete the old webhook.
4. Remove the old secret from your endpoint.
While both webhooks exist, each event arrives twice with the same `id`, once from each webhook.
## Delete a webhook
> [!WARNING]
> Deleting a webhook cannot be undone. We stop sending to it at once and drop the events waiting for it.
1. On the **Webhooks** tab, select **Delete…** in the webhook's row.
2. Type `delete` to continue, then select **Delete webhook**.
The webhook leaves the list, and a toast confirms `Webhook deleted.`
## Troubleshooting
**Add webhook…** is greyed out
: The relay's status is not `active`.
`Enter a URL starting with https://.`
: The address in **Endpoint URL** does not start with `https://` in lower case. We send events only over HTTPS.
`Choose at least one event.`
: Every event is cleared. Select at least one under **Events**.
`Limit of 10 webhooks per service`
: The relay already has 10 webhooks. Webhooks we have turned off count, so delete one you no longer use.
**Disabled**
: Fifty attempts in a row failed, so we turned the webhook off. Fix the endpoint, then delete the webhook and add it again.
The signature does not match
: Compute it over the raw body before you parse the JSON, use the secret as text exactly as we showed it, and compare lower-case hex. Each webhook has its own secret, so use the one we showed when you added this webhook.
No requests arrive
: Check that the webhook's events include the one you expect, that the endpoint is reachable from the internet over HTTPS with a valid certificate, and that it does not answer with a redirect. Requests go out about once a minute, and a new webhook receives only events we record after you add it.
You lost the signing secret
: We cannot show it again. Follow [Replace the signing secret](#replace-the-signing-secret).
## Related
- [Look up message events](/docs/mail/smtp-relay/events/)
- [Manage the suppression list](/docs/mail/smtp-relay/suppressions/)
- [Send email over HTTPS](/docs/mail/smtp-relay/send-with-the-api/)
- [SMTP Relay webhooks API reference](/docs/api/reference/client/mail/smtp-relay-webhooks/)
## With the API
Add a webhook:
```bash
curl -X POST https://api.coritan.com/api/v1/client/smtp-relay/4812/webhooks \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"url": "https://app.example.com/hooks/mail", "events": ["bounced", "complaint"]}'
```
`url`
: 8–1,024 characters, starting with `https://`.
`events`
: Optional. The events to send, from `accepted`, `delivered`, `deferred`, `bounced`, `complaint` and `suppressed`. We drop any other name. An empty list, or one with no name we know, means all six.
The answer is `201` with the signing secret in `secret`, shown this once:
```json
{
"id": 214,
"url": "https://app.example.com/hooks/mail",
"events": ["bounced", "complaint"],
"enabled": true,
"failure_count": 0,
"last_status": null,
"last_delivered_at": null,
"created_at": "2026-09-16T10:41:27.318204+00:00",
"secret": "3kQ9vR2xT7mW1pL5nH8cJ4bF6gD0sZyAeUoIiKqNtMw"
}
```
`enabled` is `false` once we have turned the webhook off. `failure_count` is its count of failures in a row, `last_status` is the status code your endpoint last answered with, and `last_delivered_at` is when a request to it last succeeded, in UTC.
The other operations:
| Operation | Answer |
| --- | --- |
| `GET /client/smtp-relay/{service_id}/webhooks` | `{"items": [...]}`: every webhook, including ones we have turned off, as above without `secret` |
| `DELETE /client/smtp-relay/{service_id}/webhooks/{webhook_id}` | `{"ok": true}`. We stop sending to the webhook at once. |
No operation turns a webhook back on or changes its URL, events or secret. A URL that does not start with `https://` answers `400` `Webhook URLs must use https://`, a new webhook on a relay that has 10 answers `400` `Limit of 10 webhooks per service`, and a webhook id that is not on the relay answers `404` `Not found`.
### On a Mail Hosting service
Mail Hosting has no **Webhooks** tab, but the same operations work under `/client/mail/{service_id}/webhooks`. A webhook there receives the events we record for mail the service's mailboxes send. Some bounces reach the sending mailbox only as an `Undelivered Mail Returned to Sender` message, so a webhook there does not see every bounce.
## API
- `GET /api/v1/client/smtp-relay/{service_id}/webhooks`: List webhooks (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-webhooks/#op-get-api-v1-client-smtp-relay-service-id-webhooks)
- `POST /api/v1/client/smtp-relay/{service_id}/webhooks`: Create webhook (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-webhooks/#op-post-api-v1-client-smtp-relay-service-id-webhooks)
- `DELETE /api/v1/client/smtp-relay/{service_id}/webhooks/{webhook_id}`: Delete webhook (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-webhooks/#op-delete-api-v1-client-smtp-relay-service-id-webhooks-webhook-id)
- `GET /api/v1/client/mail/{service_id}/webhooks`: List webhooks (https://www.coritan.com/docs/api/reference/client/mail/mail-webhooks/#op-get-api-v1-client-mail-service-id-webhooks)
- `POST /api/v1/client/mail/{service_id}/webhooks`: Create webhook (https://www.coritan.com/docs/api/reference/client/mail/mail-webhooks/#op-post-api-v1-client-mail-service-id-webhooks)
- `DELETE /api/v1/client/mail/{service_id}/webhooks/{webhook_id}`: Delete webhook (https://www.coritan.com/docs/api/reference/client/mail/mail-webhooks/#op-delete-api-v1-client-mail-service-id-webhooks-webhook-id)
# Manage the suppression list
> See which addresses the relay no longer sends to and why, add an address yourself, and remove one to send to it again.
Source: https://www.coritan.com/docs/mail/smtp-relay/suppressions/
In the dashboard:
- /dashboard/mail/…/suppressions: https://www.coritan.com/dashboard/mail
The *suppression list* holds the addresses that an SMTP Relay service no longer sends to. We add an address when a message to it bounces, when its recipient complains about a message, or when they unsubscribe from marketing mail, and you can add addresses yourself. Each relay has its own list.
A suppression covers every message the relay sends, over SMTP and over the send API, transactional and marketing alike. It lasts until you remove the address.
## Before you begin
- An SMTP Relay service. To add an address on the **Suppressions** tab, the relay's status must be `active`; while it is not, the **Address** field is greyed out.
## Why an address is on the list
The **Reason** column says how each address got there:
| **Reason** | `reason` in the API | When we add the address |
| --- | --- | --- |
| **Hard bounce** | `bounce` | A message to it was not delivered and we stopped trying: the `bounced` event. |
| **Spam complaint** | `complaint` | A report about a message to it reached us: the `complaint` event. |
| **Unsubscribed** | `unsubscribe` | The recipient used the unsubscribe link in a [marketing message](/docs/mail/smtp-relay/message-categories/). |
| **Added by you** | `manual` | You added it on the **Suppressions** tab or through the API. |
**Since** shows how long ago the address was added. [Receive delivery events with webhooks](/docs/mail/smtp-relay/webhooks/#events) says when each event happens.
We match the whole address and ignore case, so `Alex@Example.com` is the same entry as `alex@example.com`, while `alex+news@example.com` is a different one.
## What a suppression does
When a message goes to a suppressed address:
- Over SMTP, the relay refuses that recipient with `550 5.1.1 Recipient alex@example.com is suppressed after a bounce or complaint` and accepts the others. The reply names a bounce or complaint whatever the reason, including for an address you added.
- Through the send API, we leave the address out, send the message to the other recipients, and list the address in the `suppressed` field of the answer. [Send email over HTTPS](/docs/mail/smtp-relay/send-with-the-api/#read-the-answer) shows the answer.
Neither case produces a webhook request. A refusal over SMTP can appear on the [**Events** tab](/docs/mail/smtp-relay/events/) as `rejected`.
## Add an address
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the SMTP Relay service, then the **Suppressions** tab.
2. Under **Suppress an address**, enter the address in **Address**, such as `alex@example.com`.
3. Select **Suppress address**.
## Result
A toast confirms it, such as `alex@example.com suppressed.`, and the address is listed with the reason **Added by you**. From then on the relay refuses to send to it.
When the address is already on the list, the toast says `alex@example.com is already suppressed.` and the entry keeps its reason and date.
## Find an address
The list shows the 200 addresses added most recently, newest first. An older entry still applies, but it does not appear on the tab or in the API.
To narrow the list, type in the search field above it. It matches part of an address, or a reason as the API names it, such as `bounce` or `unsubscribe`.
## Remove an address
> [!WARNING]
> An address that bounced or complained is likely to do so again. Each bounce and complaint counts against the relay's reputation, and a relay whose rates get too high has its sending paused. [Sending reputation and deliverability](/docs/mail/smtp-relay/deliverability/) explains the thresholds.
1. On the **Suppressions** tab, find the address and select **Release…** in its row.
2. Select **Release address**.
A toast confirms it, such as `alex@example.com released.` The relay sends to the address again straight away. If a new message to it bounces or draws a complaint, we add it back.
For someone who unsubscribed, remove the address only once they have asked to hear from you again.
## Troubleshooting
`550 5.1.1 Recipient alex@example.com is suppressed after a bounce or complaint`
: The address is on the relay's suppression list, for any of the reasons above. Remove it if you should mail it again.
`Enter an email address, such as someone@example.com.`
: The text in **Address** is not an email address. Enter the whole address.
The **Address** field is greyed out
: The relay's status is not `active`.
An address you expect is not in the list
: The list shows only the 200 most recent entries, and the search looks only through those. An older entry still applies. Adding the address again tells you whether it is on the list: the toast says `is already suppressed` when it is.
## Related
- [Receive delivery events with webhooks](/docs/mail/smtp-relay/webhooks/)
- [Look up message events](/docs/mail/smtp-relay/events/)
- [Transactional and marketing mail](/docs/mail/smtp-relay/message-categories/)
- [SMTP Relay suppressions API reference](/docs/api/reference/client/mail/smtp-relay-suppressions/)
## With the API
List the addresses:
```bash
curl https://api.coritan.com/api/v1/client/smtp-relay/4812/suppressions \
-H "Authorization: Bearer $CORITAN_TOKEN"
```
```json
{
"items": [
{"id": 5120, "address": "alex@example.com", "reason": "bounce", "created_at": "2026-09-16T10:52:08"},
{"id": 5087, "address": "sam@example.net", "reason": "manual", "created_at": "2026-09-12T08:15:40"}
]
}
```
The list holds the 200 entries added most recently, newest first, and takes no paging parameters. `reason` is `bounce`, `complaint`, `unsubscribe` or `manual`, and `created_at` is in UTC.
Add an address:
```bash
curl -X POST https://api.coritan.com/api/v1/client/smtp-relay/4812/suppressions \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"address": "alex@example.com"}'
```
`address` is 3–320 characters. We store it in lower case, without surrounding spaces, with the reason `manual`. The answer is `201` `{"ok": true, "added": true}`. `added` is `false`, and nothing changes, when the address is already on the list or has no `@`. Unlike the tab, the API adds an address while the relay is not active.
Remove an address by its `id` from the list:
```bash
curl -X DELETE https://api.coritan.com/api/v1/client/smtp-relay/4812/suppressions/5120 \
-H "Authorization: Bearer $CORITAN_TOKEN"
```
The answer is `{"ok": true}`, or `404` `Not found` when the id is not on the relay.
### On a Mail Hosting service
A Mail Hosting service keeps a suppression list too, filled the same way, and the mail server refuses to send to an address on it from any of the service's mailboxes, with the same `550 5.1.1` reply. The service has no **Suppressions** tab, so use the same three operations under `/client/mail/{service_id}/suppressions` to see, add and remove addresses.
## API
- `GET /api/v1/client/smtp-relay/{service_id}/suppressions`: List suppressions (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-suppressions/#op-get-api-v1-client-smtp-relay-service-id-suppressions)
- `POST /api/v1/client/smtp-relay/{service_id}/suppressions`: Add suppression (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-suppressions/#op-post-api-v1-client-smtp-relay-service-id-suppressions)
- `DELETE /api/v1/client/smtp-relay/{service_id}/suppressions/{suppression_id}`: Remove suppression (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-suppressions/#op-delete-api-v1-client-smtp-relay-service-id-suppressions-suppression-id)
- `GET /api/v1/client/mail/{service_id}/suppressions`: List suppressions (https://www.coritan.com/docs/api/reference/client/mail/mail-suppressions/#op-get-api-v1-client-mail-service-id-suppressions)
- `POST /api/v1/client/mail/{service_id}/suppressions`: Add suppression (https://www.coritan.com/docs/api/reference/client/mail/mail-suppressions/#op-post-api-v1-client-mail-service-id-suppressions)
- `DELETE /api/v1/client/mail/{service_id}/suppressions/{suppression_id}`: Remove suppression (https://www.coritan.com/docs/api/reference/client/mail/mail-suppressions/#op-delete-api-v1-client-mail-service-id-suppressions-suppression-id)
# Look up message events
> Find out what happened to your messages by recipient or event type, from the last 24 hours to the last 90 days.
Source: https://www.coritan.com/docs/mail/smtp-relay/events/
In the dashboard:
- /dashboard/mail/…/events: https://www.coritan.com/dashboard/mail
The **Events** tab of an SMTP Relay service lists what happened to the messages it sent: each one we queued, delivered, deferred or bounced, each complaint, and each message or recipient the relay refused. Use it to answer a question such as "did my receipt reach alex@example.com?", up to 90 days back.
To have events sent to your application as they happen, add a [webhook](/docs/mail/smtp-relay/webhooks/).
## Before you begin
- An SMTP Relay service that has sent mail. Events appear a short time after each step of a delivery.
## Look up events
1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the SMTP Relay service, then the **Events** tab.
2. In **Event**, choose the kind of event to list, or leave **All events**. [Event categories](#event-categories) describes each one.
3. In **Window**, choose how far back to look: **Last 24 hours**, **Last 3 days**, **Last 7 days**, **Last 30 days** or **Last 90 days**. The tab opens on **Last 7 days**.
4. To see the events for one recipient, enter the whole address in **Recipient**, such as `alex@example.com`, and select **Filter**. Part of an address finds nothing. **Clear** removes the recipient filter.
Select **Refresh** to load events that arrived since you opened the tab.
## Result
The **Delivery events** card lists the matching events, newest first:
**Recipient**
: The recipient, with the sender under it.
**Event**
: The event's category.
**Response**
: What the receiving server replied. When there is no reply, the server we connected to, or the detailed event type. Hover over it to see the detailed event type.
**When**
: How long ago the event happened. Hover over it to see the date and time.
The list holds up to 200 events. When it is full, a note under it says `Showing the latest 200. Narrow the window or filter by recipient to see older events.` The count above the list is the number of events shown, so it stops at 200 too.
## Event categories
| `category` | What happened |
| --- | --- |
| `accepted` | We queued the message for delivery. |
| `delivered` | The receiving server took the message. |
| `deferred` | The receiving server refused the message for now, or a sending limit held it back. We try again later. |
| `bounced` | The message was not delivered and we will not try again. We add the recipient to the [suppression list](/docs/mail/smtp-relay/suppressions/). |
| `complaint` | A report about the message reached us: the recipient marked it as spam, or a mailbox provider reported it as fraud or as failing authentication. We add the recipient to the suppression list. |
| `rejected` | The relay refused the message, or one of its recipients, when your application submitted it over SMTP. The reply your application got says why. |
The **Event** column and the **Event** filter write each category with a capital letter. [Receive delivery events with webhooks](/docs/mail/smtp-relay/webhooks/#events) lists the detailed event types behind each category.
Rows marked **Other** (`other` or `null` in the API) are steps of a delivery that have no category of their own, such as the end of a delivery attempt. The **Event** filter cannot select them.
The **Event** filter also offers `suppressed` and `report`, and both normally find nothing:
- We record no `suppressed` event. A message to a suppressed address appears as `rejected` when the relay refused the address over SMTP, and not at all when the send API left it out.
- DMARC and TLS reports about your domains are kept apart from events. The dashboard does not list them, and the API returns them with the [reputation report](/docs/mail/smtp-relay/deliverability/#dmarc-and-tls-reports).
## Troubleshooting
**No events in this window**
: Nothing matches the filters. Choose a longer **Window**, check the whole address in **Recipient**, or select **Clear**. A message sent in the last minute or so may not have its events yet.
A message you sent is not listed
: When the relay refused the whole message before it was queued, your application got the refusal as an SMTP reply or an API error, and the list may hold a `rejected` event or nothing. [Send over SMTP with credentials](/docs/mail/smtp-relay/credentials/#troubleshooting) and [Send email over HTTPS](/docs/mail/smtp-relay/send-with-the-api/#troubleshooting) explain each refusal.
A recipient has `accepted` but nothing after it
: The message is still in the queue, or the receiving server has not answered yet. A `deferred` event means we are trying again. Check again later, and look at **Response** on the latest event.
## Related
- [Receive delivery events with webhooks](/docs/mail/smtp-relay/webhooks/)
- [Manage the suppression list](/docs/mail/smtp-relay/suppressions/)
- [Events API reference](/docs/api/reference/client/mail/smtp-relay/#op-get-api-v1-client-smtp-relay-service-id-events)
## With the API
```bash
curl "https://api.coritan.com/api/v1/client/smtp-relay/4812/events?category=bounced&hours=168&limit=50" \
-H "Authorization: Bearer $CORITAN_TOKEN"
```
`category`
: Optional. One of `accepted`, `delivered`, `deferred`, `bounced`, `complaint`, `rejected` and `report`. Any other value answers an empty list.
`recipient`
: Optional. The whole recipient address. Case does not matter.
`hours`
: How far back to look, 1–2160 hours (90 days). The default is `24`.
`limit`
: The most events to return, 1–500. The default is `100`.
A value for `hours` or `limit` outside its range answers `422`. The answer lists the newest events first:
```json
{
"items": [
{
"id": 90415,
"event_type": "delivery.failed",
"category": "bounced",
"queue_id": "7d2c91a04e",
"message_id": "<175890432171.2481.9311874401294517206@example.com>",
"sender": "receipts@example.com",
"recipient": "alex@example.com",
"remote_host": "mx.example.net",
"response": "550 5.1.1 : Recipient address rejected: User unknown",
"local_ip": "203.0.113.25",
"node_id": 3,
"occurred_at": "2026-09-16T10:52:08"
}
],
"total": 1
}
```
`id`
: The event's id, the same one a webhook request carries.
`event_type`
: The detailed event type, such as `delivery.failed`.
`category`
: The category from [Event categories](#event-categories), or `other` or `null` for a step that has none.
`queue_id`
: Our id for the message in the delivery queue, the same on every event about that message.
`message_id`
: The message's `Message-ID` header.
`sender` and `recipient`
: The sender and recipient addresses, in lower case. An event about the whole message, such as `accepted`, names only its first recipient.
`remote_host`
: The receiving server we connected to.
`response`
: The receiving server's reply or the reason for the event, up to 2,000 characters.
`local_ip`
: The address the message left our servers from.
`node_id`
: Our id for the mail server that handled the event. Use it only to tell servers apart.
`occurred_at`
: When the event happened, in UTC, with no time zone suffix.
`total`
: The number of events in this answer, which is never more than `limit`. It does not count the events the limit left out.
Any field except `id`, `event_type` and `occurred_at` is `null` when the event does not carry it.
### On a Mail Hosting service
Mail Hosting has no **Events** tab, but the same operation works under `/client/mail/{service_id}/events` and lists the events we record for mail the service's mailboxes send. The **Recent activity** card on its **Overview** tab shows the latest eight events from the last seven days. Some bounces reach the sending mailbox only as an `Undelivered Mail Returned to Sender` message and are not listed.
## API
- `GET /api/v1/client/smtp-relay/{service_id}/events`: List events (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay/#op-get-api-v1-client-smtp-relay-service-id-events)
- `GET /api/v1/client/mail/{service_id}/events`: List events (https://www.coritan.com/docs/api/reference/client/mail/mail/#op-get-api-v1-client-mail-service-id-events)
# How SMTP Relay sending limits work
> How the monthly allowance, its buffer and the hourly limit work, and how the hourly limit rises as your relay sends clean mail.
Source: https://www.coritan.com/docs/mail/smtp-relay/sending-limits/
In the dashboard:
- /dashboard/mail/…/overview: https://www.coritan.com/dashboard/mail
An SMTP Relay service has two sending limits. The *monthly allowance* is how many emails the relay may send in a calendar month, and the plan sets it. The *hourly limit* is how many emails the relay sends in an hour. It starts small on every new relay and rises as the relay builds a clean sending history. Both are on the service's **Overview** tab in the dashboard.
## The monthly allowance
The free plan includes 3,000 emails a month and stops there. Each paid plan includes more and adds a 12% *buffer*: the relay can send 12% more than the plan's number before sending stops. On a plan of 25,000 emails a month, the allowance is 28,000. The [Mail page](https://www.coritan.com/solutions/mail) lists the plans and their prices.
We count like this:
- Each message we accept counts once, however many recipients it has. The send API sends a marketing message as one copy for each recipient, so each copy counts.
- A message counts when we accept it, whether it is later delivered, deferred or bounced. A message we refuse does not count.
- The count starts again at 00:00 UTC on the 1st of each month.
- We add up accepted messages once an hour, so the count trails your sending by up to about an hour.
The first figure on the **Overview** tab is **Emails this month**, or **Emails this month (with buffer)** on a paid plan. It shows the count against the allowance and when it resets. A relay that our staff set up with no monthly cap shows **No monthly cap**.
## What happens near the allowance
As the count rises, we email you at your account's address, and the **Overview** tab shows an alert:
| When the count reaches | Email subject | Alert on the Overview tab |
| --- | --- | --- |
| 80% of the plan's number | `SMTP relay #4812: 80% of this month's emails used` | **Monthly allowance almost used** |
| 90% of the plan's number | `SMTP relay #4812: 90% of this month's emails used` | **Monthly allowance almost used** |
| The plan's number, on a paid plan | `SMTP relay #4812: monthly allowance reached` | **Monthly allowance reached; sending from the buffer** |
| The plan's number, on the free plan | `SMTP relay #4812: monthly allowance reached` | **Sending has stopped for this month** |
| The allowance, buffer included | `SMTP relay #4812: sending has stopped for this month` | **Sending has stopped for this month** |
The subject starts with the relay's service ID. We send each email once a month. When the count passes several points between two counts, we send only the email for the highest. While the relay sends from its buffer, the alert says how many emails the buffer still covers.
Once the count reaches the allowance, we refuse new mail:
- Over SMTP, the relay answers `550 5.7.1 Monthly allowance and its 12% buffer are used up; upgrade the plan to continue`. On the free plan it answers `550 5.7.1 Monthly sending allowance reached; upgrade the plan to continue`.
- The send API answers `429` with the same text in `detail`.
Both check the count plus the recipients of the message in hand. Near the end of the allowance, a message to many recipients can be refused while a message to one recipient still goes out. Because the count trails by up to about an hour, a relay can go past its allowance by up to about an hour of sending before we refuse mail.
Sending starts again at 00:00 UTC on the 1st. Each alert has **Change plan**, which opens the service's **Billing** tab. The plan-change dialog there only moves a service between billing cycles of the same plan, and each relay plan is a plan of its own, so it cannot move the relay to a larger plan. To raise the allowance before the month ends, [contact support](/docs/support/conversations/).
## The hourly limit
The hourly limit caps how many emails the relay sends in an hour, which protects the reputation of the addresses it shares with other senders. A new relay starts with a small limit, and a daily review raises it one step at a time. The steps are 100, 250, 500, 1,000, 2,500, 5,000, 10,000, 25,000 and 50,000 emails an hour.
Mail over the limit waits in the queue and goes out in a later hour. While it waits, the **Events** tab can show `deferred` events for it. If mail keeps arriving faster than the limit, the queue grows, and once six hours of mail at the hourly limit is waiting, we refuse new messages until the queue shrinks.
### How the limit rises
The review runs once a day and raises the limit one step when all of these are true:
- The relay has sent clean mail for its first 14 days, or has sent 5,000 clean messages sooner. Clean means the next rule holds.
- The relay is not under review, and its sending is not paused.
- Over the last 14 days, fewer than 2% of the messages it sent bounced and fewer than 0.1% drew a complaint.
- The relay has had its current limit for at least 2 days.
- In the last 14 days it sent at least 12 times its hourly limit, such as 1,200 messages at 100 an hour.
- The next step is not above the plan's automatic ceiling.
A raised limit takes effect within about an hour.
The *automatic ceiling* is the highest step at or below the plan's monthly emails divided by 25: a rate at which the relay could send the plan's monthly emails in about a day. A relay with no monthly cap can climb every step.
| Emails a month | Automatic ceiling |
| --- | --- |
| 3,000 | 100 an hour |
| 25,000 | 1,000 an hour |
| 50,000 | 1,000 an hour |
| 100,000 | 2,500 an hour |
| 250,000 | 10,000 an hour |
| 500,000 | 10,000 an hour |
| 1,000,000 | 25,000 an hour |
On the free plan, the limit does not rise above 100 on its own. Once the limit reaches the ceiling, the **Hourly limit** card says **This plan's automatic ceiling is reached; ask for more below**. To go higher, [request a higher limit](/docs/mail/smtp-relay/request-a-higher-limit/): our staff can set any limit, above the top step too. Changing the plan does not change the hourly limit, only the ceiling the review can reach.
The limit can also go down. When a relay goes under review or has its sending paused, or when 2% of its messages in the last 14 days bounce or 0.1% draw a complaint, the next daily review can set its limit back to the starting limit.
### The Hourly limit card
On the **Overview** tab, the **Hourly limit** card shows:
**Current limit**
: The limit now, such as `250 emails an hour`.
**Next step**
: The step the review raises the limit to next. The card leaves it out once the next step is above the plan's ceiling.
**Set**
: How and when the current limit was set: **Starting limit**, **Raised automatically**, **Set by support** or **Reset after a reputation review**, then how long ago.
**Request limit increase…** asks our staff for more. See [Request a higher hourly limit](/docs/mail/smtp-relay/request-a-higher-limit/).
## Dedicated sending addresses
A relay sends from addresses it shares with other relays unless it has a *dedicated address*: an IPv4 address that only your relay sends from, with a reverse DNS name of its own. Its reputation depends on your mail alone.
- Plans of 250,000 emails a month and more include one dedicated address.
- On plans of 100,000 emails a month and more, you can add dedicated addresses for $50 a month each. Each one you add is a service of its own, with its own invoice ([Dedicated IP add-ons](/docs/mail/billing/#dedicated-ip-add-ons)).
You add one with **Order dedicated IP** on the **Sending IPs** card of the **Overview** tab, which opens the address's order page ([Order a dedicated sending IP](/docs/mail/order-a-mail-service/#order-a-dedicated-sending-ip)). On a smaller plan the button is greyed out, and the card says which plan you need.
Until we have assigned an address, the card says **We are assigning your dedicated addresses**. Then it lists each address with its reverse DNS name and its current hourly cap, such as `500/h`. A **Warming up** badge shows until the address reaches its last stage ([Warm-up](#warm-up)). An address you bought on its own has an **Add-on** badge, and one that is turned off has a **Disabled** badge. From then on, the relay's mail leaves from its dedicated addresses.
When you [cancel](/docs/billing/cancel-a-service/) a dedicated address you bought on its own and it ends, we release the address. When a relay's last dedicated address goes, its mail goes back to the shared addresses. Cancelling the relay does not cancel the addresses you bought on their own, so cancel those too.
### Warm-up
Mail providers distrust a new address that suddenly sends a lot. So each dedicated address starts with a small hourly cap, which rises in stages:
| Stage | Hourly cap | Emails to send in the stage |
| --- | --- | --- |
| 0 | 50 | 200 |
| 1 | 200 | 800 |
| 2 | 500 | 2,000 |
| 3 | 1,000 | 4,000 |
| 4 | 2,000 | 8,000 |
| 5 | 5,000 | 20,000 |
| 6 | 10,000 | 40,000 |
| 7 | 20,000 | 80,000 |
| 8 | None of its own | — |
We check once a day. An address moves up one stage when it has spent at least 2 days in its stage, sent the emails the table gives, and kept bounces under 2% and complaints under 0.1% in that stage. We can also hold every address in a region at its stage for a while, when large providers are filtering mail from that region. From stage 8, only the relay's hourly limit applies.
During warm-up, mail to Gmail, Microsoft (Outlook.com, Hotmail, Live and MSN), Yahoo (with AOL) and Apple (iCloud) has a cap of its own at each address: a quarter of the address's hourly cap, and at least 10.
Mail over a cap waits in the queue, as mail over the hourly limit does. A warming address can have a lower cap than the relay's hourly limit, so plan large sends for after the warm-up.
## With the API
[`GET /client/smtp-relay/{service_id}/usage`](/docs/api/reference/client/mail/smtp-relay/#op-get-api-v1-client-smtp-relay-service-id-usage) returns the month's count, a daily series and the relay's limits:
```bash
curl "https://api.coritan.com/api/v1/client/smtp-relay/4812/usage?days=3" \
-H "Authorization: Bearer $CORITAN_TOKEN"
```
`days` is how far back the series goes, 1–365 days, and 30 when you leave it out. A value outside that range answers `422`.
```json
{
"series": [
{"day": "2026-09-14", "sent": 1204, "delivered": 1187, "bounced": 6, "deferred": 23, "complaints": 0},
{"day": "2026-09-15", "sent": 1318, "delivered": 1296, "bounced": 9, "deferred": 31, "complaints": 1},
{"day": "2026-09-16", "sent": 612, "delivered": 598, "bounced": 3, "deferred": 12, "complaints": 0}
],
"month_to_date_sent": 21460,
"quota_messages_month": 25000,
"quota_buffer_pct": 12,
"monthly_allowance": 28000,
"limits": {
"monthly_messages": 25000,
"quota_buffer_pct": 12,
"monthly_allowance": 28000,
"month_to_date_sent": 21460,
"remaining": 6540,
"over_quota": false,
"sending_stopped": false,
"free_tier": false,
"domains": null,
"credentials": null,
"rate_per_hour": 250,
"hourly_limit_since": "2026-09-11T04:15:09.482113+00:00",
"hourly_limit_source": "auto",
"hourly_limit_next": 500,
"hourly_limit_auto_ceiling": 1000,
"dedicated_ip_count": 0,
"dedicated_ip_addon_eligible": false,
"dedicated_ip_min_monthly": 100000
}
}
```
`series`
: One entry for each day with mail, oldest first, from `days` days ago up to today (UTC). Each has the `day` and its counts: `sent` (messages accepted), `delivered`, `bounced`, `deferred` and `complaints`. Days with no mail are left out.
`month_to_date_sent`
: Messages accepted since the 1st, as of the last hourly count.
`quota_messages_month`, `quota_buffer_pct`, `monthly_allowance`
: The plan's emails a month, the buffer as a percentage, and the allowance they make together. A `quota_messages_month` of `0` means no monthly cap.
`limits`
: The relay's limits. The service summary, [`GET /client/smtp-relay/{service_id}`](/docs/api/reference/client/mail/smtp-relay/), returns the same object.
The fields in `limits`:
`monthly_messages`, `quota_buffer_pct`, `monthly_allowance`, `month_to_date_sent`
: The same figures as at the top level.
`remaining`
: What is left of the allowance, never below `0`. `null` with no monthly cap.
`over_quota`
: `true` once the count reaches the plan's number, so the relay is sending from its buffer or has stopped.
`sending_stopped`
: `true` once the count reaches the allowance.
`free_tier`
: `true` on the free plan.
`domains`, `credentials`
: How many sending domains and SMTP credentials the plan allows. `null` means no cap.
`rate_per_hour`
: The hourly limit.
`hourly_limit_since`
: When the hourly limit was set.
`hourly_limit_source`
: How it was set: `start`, `auto` (the daily review), `staff` or `reset`.
`hourly_limit_next`
: The next step, or `null` above the top step. The review raises the limit to it only when it is not above `hourly_limit_auto_ceiling`.
`hourly_limit_auto_ceiling`
: The highest limit the review reaches on this plan.
`dedicated_ip_count`
: How many dedicated addresses the relay has, from the plan and bought on their own.
`dedicated_ip_addon_eligible`
: `true` when the plan allows buying more dedicated addresses.
`dedicated_ip_min_monthly`
: The emails a month a plan needs for that: `100000`.
The same operation is under [`GET /client/mail/{service_id}/usage`](/docs/api/reference/client/mail/mail/#op-get-api-v1-client-mail-service-id-usage), which answers for both products. On a Mail Hosting service it returns the `series` and `month_to_date_sent` for the mail its mailboxes send. Mail Hosting has no monthly allowance, so `quota_messages_month`, `quota_buffer_pct` and `monthly_allowance` are `0`, and the answer has no `limits`.
## API
- `GET /api/v1/client/smtp-relay/{service_id}/usage`: Usage report (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay/#op-get-api-v1-client-smtp-relay-service-id-usage)
- `GET /api/v1/client/mail/{service_id}/usage`: Usage report (https://www.coritan.com/docs/api/reference/client/mail/mail/#op-get-api-v1-client-mail-service-id-usage)
# Request a higher hourly limit
> Ask for a higher hourly sending limit on an SMTP Relay service from its Overview tab, and follow the request in support.
Source: https://www.coritan.com/docs/mail/smtp-relay/request-a-higher-limit/
In the dashboard:
- /dashboard/mail/…/overview: https://www.coritan.com/dashboard/mail
Every SMTP Relay service has an hourly limit that rises by itself as the relay sends clean mail, up to a ceiling its plan sets ([How the limit rises](/docs/mail/smtp-relay/sending-limits/#how-the-limit-rises)). When you need more before the daily review gets there, or more than the ceiling, ask for it. The request opens a support conversation, and our staff set the new limit when they grant it.
## Before you begin
- You need an SMTP Relay service. Mail Hosting has no request form.
- Ask for a limit higher than the relay's current one, and at most 1,000,000 emails an hour.
- You can send one request a day for each relay. A second request on the same day (UTC) opens no new conversation.
- Have the numbers ready: what the relay sends, and the rate you expect at the busiest time.
## Send the request
1. In the dashboard, go to **Email** and open the relay.
2. On the **Overview** tab, find the **Hourly limit** card and select **Request limit increase…**.
3. In **Emails per hour**, enter the limit you need. The field starts at the next step up from the current limit.
4. In **What the relay sends and why the volume is going up**, describe the mail and the reason for more, such as a launch or a seasonal peak, with the rate you expect at peak.
5. Select **Send request**.
## Result
A toast says `Requested; limit increases are reviewed within a few business hours`. Under **Support**, a new conversation called `Hourly sending limit increase for SMTP relay #4812` holds the number you asked for and your reason. It also holds the figures our staff review: the plan's monthly emails, how many emails the relay has sent this month, and its recent sent count, bounce rate and complaint rate.
We reply in that conversation. When we grant the request, the **Hourly limit** card shows the new **Current limit**, and **Set** reads **Set by support**. The new limit reaches the mail servers within the hour.
From there, the daily review can still raise the limit one step at a time, up to the plan's ceiling. A limit our staff set can be reset like any other when the relay's rates rise ([How the limit rises](/docs/mail/smtp-relay/sending-limits/#how-the-limit-rises)).
## Troubleshooting
**Send request** stays off
: The number in **Emails per hour** is not higher than the current limit, which the dialog states.
`The relay may already send 250 an hour`
: The number is not higher than the current limit. Enter a larger one.
**Request limit increase…** is off
: The relay is one of the platform's internal tenants, whose limits only our staff set. See [Internal mail tenants](/docs/mail/internal-tenants/).
No new conversation appears
: The relay already has a request today. The first conversation keeps its number and reason, so reply in it to change them.
**Could not send the request**
: The request failed, and the message after the title says why.
## Related
- [How SMTP Relay sending limits work](/docs/mail/smtp-relay/sending-limits/)
- [Sending reputation and deliverability](/docs/mail/smtp-relay/deliverability/)
- [Support conversations](/docs/support/conversations/)
- [`POST /client/smtp-relay/{service_id}/limits/increase-request`](/docs/api/reference/client/mail/smtp-relay/#op-post-api-v1-client-smtp-relay-service-id-limits-increase-request) in the API reference
## With the API
```bash
curl -X POST https://api.coritan.com/api/v1/client/smtp-relay/4812/limits/increase-request \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"requested_per_hour": 1000, "reason": "Order confirmations for a shop launching on 1 October, about 800 an hour at peak"}'
```
`requested_per_hour`
: Required. The limit you ask for, 10–1,000,000 emails an hour, and higher than the current limit.
`reason`
: Optional, up to 2,000 characters. What the relay sends and why the volume is going up.
The answer is `201`:
```json
{
"ok": true,
"conversation_id": 7731,
"current_per_hour": 250,
"requested_per_hour": 1000,
"message": "Requested; limit increases are reviewed within a few business hours"
}
```
`conversation_id` is the support conversation. Follow it with [`GET /chat/conversations/{conversation_id}`](/docs/api/reference/client/support/#op-get-api-v1-chat-conversations-conversation-id), and reply with [`POST /chat/conversations/{conversation_id}/messages`](/docs/api/reference/client/support/#op-post-api-v1-chat-conversations-conversation-id-messages). A second request on the same day (UTC) answers with the first request's `conversation_id`, and that conversation keeps its first number and reason.
To see the new limit once we grant it, read `limits.rate_per_hour` from the [usage report](/docs/mail/smtp-relay/sending-limits/#with-the-api).
The same operation is under `/client/mail/{service_id}/limits/increase-request`, which answers the same way for a relay.
| Status | `detail` | Cause |
| --- | --- | --- |
| `422` | `The relay may already send 250 an hour` | `requested_per_hour` is not higher than the current limit. |
| `422` | A validation error | `requested_per_hour` is missing or outside 10–1,000,000, or `reason` is longer than 2,000 characters. |
| `404` | `Not an SMTP Relay service` | The service is Mail Hosting. |
| `404` | `Mail service not found` | No mail service with that ID belongs to your account. |
| `409` | `This mail service is still provisioning` | We are still setting up the relay. |
## API
- `POST /api/v1/client/smtp-relay/{service_id}/limits/increase-request`: Request limit increase (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay/#op-post-api-v1-client-smtp-relay-service-id-limits-increase-request)
- `POST /api/v1/client/mail/{service_id}/limits/increase-request`: Request limit increase (https://www.coritan.com/docs/api/reference/client/mail/mail/#op-post-api-v1-client-mail-service-id-limits-increase-request)
# Sending reputation and deliverability
> How we measure your relay's bounce and complaint rates, when sending pauses, and how to read the Deliverability card.
Source: https://www.coritan.com/docs/mail/smtp-relay/deliverability/
In the dashboard:
- /dashboard/mail/…/overview: https://www.coritan.com/dashboard/mail
Mail providers decide whether your mail reaches the inbox largely from two numbers: how much of it bounces, and how often recipients report it as spam. We measure both for every SMTP Relay and Mail Hosting service. A service whose rates get too high has its sending paused. On an SMTP Relay service, the **Deliverability** card on the **Overview** tab shows the rates, where sending pauses and a health check of your setup.
## How we measure
- The *bounce rate* is the share of sent messages that ended as `bounced` [events](/docs/mail/smtp-relay/events/#event-categories): not delivered, and not tried again.
- The *complaint rate* is the share that drew a `complaint` event: the recipient marked the message as spam, or a mailbox provider reported it as fraud or as failing authentication.
- Both rates use the messages we accepted from the service over the last seven days. Every credential, API key and domain on the service counts together.
We work out the rates of every active service every 30 minutes. The counts behind them are added up once an hour, so they trail your sending by up to about an hour. When the seven days hold too few messages, we do not judge the rates at all.
## When sending pauses
| Rate | Sending paused from |
| --- | --- |
| Bounce rate | 10% |
| Complaint rate | 0.5% |
Reaching a line is enough: a bounce rate of exactly 10% pauses sending. The **Deliverability** card shows the line under each rate, such as `Pauses at 10%`.
### Under review
Our staff may review a service whose rates rise before they reach a pause line. Sending carries on. Above the tabs, every page of the service shows the **Under review** alert with the figures behind it, such as `flagged: 6.12% bounces, 0.04% complaints over 7d`.
While the review is open, a relay's hourly limit does not rise, and the next daily check can set it back to the starting limit.
The alert stays until our staff close the review, even after the rates fall. Once the rates are back to normal, the alert keeps its title and says `We are reviewing your delivery rates. Sending continues while the review is open.`
### Sending paused
When either rate reaches its pause line, we pause the service's sending:
- On an SMTP Relay service, no SMTP credential can sign in, and the send API answers `400` with `Sending is paused on this service; contact support`. A message that still reaches the relay over SMTP is refused with `550 5.7.1 Sending is paused for this account; contact support`.
- On a Mail Hosting service, its mailboxes cannot sign in, send or receive mail.
- Above the tabs, the **Sending is paused** alert shows the figures, such as `auto-frozen: 11.4% bounces, 0.08% complaints over 7d`. The **Status** on the **Service** card reads **Sending paused**, and on a relay the **Send** tab shows the alert too.
- On a relay, the next daily check can set the hourly limit back to the starting limit.
We do not email you when a service goes under review or is paused. The alerts on the service's pages are where you see it.
Only our staff lift a pause. Fix the cause first ([Bring the rates down](#bring-the-rates-down)), then [contact support](/docs/support/conversations/) and say what you changed. The check still looks at the last seven days: if the rates in that window are still at a pause line when our staff lift the pause, the next check pauses sending again.
Our staff can also pause a service by hand. The alert has the same title, and without figures it says `Bounce or complaint rates crossed the platform threshold. Clean your lists, then contact support to resume.`
Separately from these rates, we turn off a single mailbox that suddenly sends far more than it usually does. See [Manage mailboxes](/docs/mail/mail-hosting/mailboxes/#troubleshooting).
## Bring the rates down
- Send only to people who asked for your mail. Bought lists and old lists bounce and draw complaints.
- Confirm new addresses when people sign up, such as with a confirmation email, so typing mistakes never reach your list.
- Send newsletters and campaigns as `marketing`. Recipients then get an unsubscribe button in their mail app and can use it instead of reporting spam. See [Transactional and marketing mail](/docs/mail/smtp-relay/message-categories/).
- Leave addresses on the [suppression list](/docs/mail/smtp-relay/suppressions/) unless you know the problem is fixed. Each one bounced or complained before.
- Follow `bounced` and `complaint` events on the **Events** tab or with [webhooks](/docs/mail/smtp-relay/webhooks/), and take those addresses off your own lists too.
## Where your mail leaves from
We manage the shared addresses your mail leaves from and watch their reputation, so you have nothing to set up for them. If you want addresses that only your relay sends from, a [dedicated address](/docs/mail/smtp-relay/sending-limits/#dedicated-sending-addresses) is an add-on.
## The Deliverability card
On an SMTP Relay service, go to **Email**, open the relay, then the **Overview** tab. Mail Hosting services have no card, and their figures are in the [API](#with-the-api).
The card covers the last seven days, as its description says. It starts with a verdict on the rates as they are now:
| `verdict` | What the card says |
| --- | --- |
| `ok` | `Your bounce and complaint rates are healthy.` |
| `review` | `Your bounce or complaint rate is high. Clean your lists before sending pauses.` |
| `freeze` | `Sending is paused because your bounce or complaint rate got too high. Clean your lists, then contact support.` |
| `insufficient` | `Too few messages in the last 7 days to judge.` |
When the service is under review or paused, the figures behind it follow the verdict in brackets. The verdict follows the current rates, while the alerts above the tabs stay until our staff close them. So the card can call the rates healthy while the **Under review** alert is still there.
Four figures follow:
**Inbox health**
: A score out of 100, with a grade. See [The inbox health score](#the-inbox-health-score).
**Sent**
: Messages accepted in the window.
**Bounce rate**
: The bounce rate, with the pause line under it, such as `Pauses at 10%`. The rate turns to the warning colour at the pause line.
**Complaints**
: The complaint rate, with its pause line.
Then comes a list of checks, each with a short detail, such as **Domains** · `1 verified`. At the bottom, **Default message category** sets the category of messages that do not choose one ([Transactional and marketing mail](/docs/mail/smtp-relay/message-categories/#set-the-default-category)).
When the report cannot load, the card says `Reputation data is not available right now.`
### The checks
Every check is about your own setup and sending.
| Check | Weight | Passes when | Warns or waits when | Fails when |
| --- | --- | --- | --- | --- |
| **Domains** | 25 | Every domain is verified. | Some domains are still pending. | No domain is added, or none is verified. |
| **SPF and DKIM** | 20 | Both records pass on every verified domain. | No domain is verified yet. | A verified domain is missing either record. |
| **Bounces and complaints** | 15 | Bounces are under 2% and complaints under 0.1%. | Bounces reach 2% or complaints 0.1%, or the window holds fewer than 50 messages. | Bounces reach 5% or complaints 0.3%. |
| **DMARC** | 10 | Every verified domain has its DMARC record, and at least one is at `p=quarantine` or `p=reject`. | Every verified domain is at `p=none`, or no domain is verified yet. | A verified domain's DMARC record is missing or out of date. |
**Bounces and complaints** uses stricter lines than the pause lines: 2% bounces and 0.1% complaints are what Gmail asks of senders.
Three more checks carry no weight:
**TLS**
: Shown when we have recent results, and says whether your mail reached the large providers over an encrypted connection.
**Sending**
: Shown only while sending is paused, as `sending is paused`.
**Review**
: Shown only while the service is under review, as `our reputation checks flagged this for review`.
### The inbox health score
Each check with a weight earns all of it when it passes, half when it warns or waits for data, and none when it fails. **Inbox health** is the weight earned out of the weight of the checks shown, as a number out of 100. The score counts those checks alone. While sending is paused, or while **SPF and DKIM** fails, the score is at most 40.
| Score | Grade |
| --- | --- |
| 90–100 | Excellent |
| 75–89 | Good |
| 50–74 | Fair |
| 0–49 | Poor |
## DMARC and TLS reports
Mail providers send *aggregate reports* about the mail they receive from your domains: how many messages, from which servers, and whether they passed SPF, DKIM and DMARC. They send them to the `rua=` address in your DMARC record, when the record the dashboard shows has one. The reports drive the [DMARC stage ramp](/docs/mail/dmarc/#when-the-stage-moves-up).
On a Mail Hosting domain, *TLS reports* describe the mail sent to you: whether other servers could reach yours over an encrypted connection. They go to the address in the `_smtp._tls` record. [Mail DNS records](/docs/mail/dns-records/) lists both records.
The dashboard does not list the reports. The API returns the latest ones on your own domains with the reputation report below.
## With the API
[`GET /client/smtp-relay/{service_id}/reputation`](/docs/api/reference/client/mail/smtp-relay/#op-get-api-v1-client-smtp-relay-service-id-reputation) returns everything the card shows, and the reports:
```bash
curl "https://api.coritan.com/api/v1/client/smtp-relay/4812/reputation?limit=5" \
-H "Authorization: Bearer $CORITAN_TOKEN"
```
`limit` is how many reports to return, newest first: 1–200, and 50 when you leave it out. A value outside that range answers `422`.
```json
{
"health": {
"score": 93,
"grade": "excellent",
"items": [
{"key": "domains", "status": "pass", "weight": 25, "detail": "1 verified"},
{"key": "spf_dkim", "status": "pass", "weight": 20, "detail": "SPF and DKIM published on every verified domain"},
{"key": "dmarc", "status": "warn", "weight": 10, "detail": "p=none: monitoring only, tightened automatically after two clean weeks of reports"},
{"key": "rates", "status": "pass", "weight": 15, "detail": "bounce 1.2%, complaints 0.048%"}
]
},
"default_category": "transactional",
"window_days": 7,
"sent": 8412,
"bounced": 101,
"complaints": 4,
"bounce_pct": 1.2,
"complaint_pct": 0.048,
"verdict": "ok",
"thresholds": {
"bounce_freeze_pct": 10.0,
"complaint_freeze_pct": 0.5
},
"sending_frozen": false,
"review_flag": false,
"note": null,
"domains": [
{
"domain": "example.com",
"status": "verified",
"checks": {"ownership": true, "mx": false, "spf": true, "dkim": true, "dmarc": true},
"dmarc_policy": "none",
"mta_sts_mode": "testing"
}
],
"reports": [
{
"id": 90211,
"domain": "example.com",
"type": "dmarc",
"reporter": "google.com",
"range_begin": "2026-09-15T00:00:00",
"range_end": "2026-09-15T23:59:59",
"total": 1180,
"passed": 1176,
"failed": 4,
"summary": null,
"received_at": "2026-09-16T06:12:44"
}
]
}
```
`health`
: The inbox health score: `score` (0–100), `grade` (`excellent`, `good`, `fair` or `poor`) and `items`, one for each check. Each item has a `key`, a `status` (`pass`, `warn`, `fail` or `info`), its `weight` in the score and a `detail`. The score counts these items alone.
`health.items[].key`
: `domains`, `spf_dkim`, `dmarc`, `rates` (**Bounces and complaints**), `tls`, `frozen` (**Sending**) and `review`. A Mail Hosting service also gets `mx`, with a weight of 5: it passes when every verified domain receives its mail with us, and warns otherwise.
`default_category`
: `transactional` or `marketing`.
`window_days`
: The length of the window, in days.
`sent`, `bounced`, `complaints`
: Messages accepted, bounces and complaints in the window.
`bounce_pct`, `complaint_pct`
: The rates in percent: `bounce_pct` to two decimal places, `complaint_pct` to three. Both are `0.0` when nothing was sent.
`verdict`
: `ok`, `review` or `freeze`, or `insufficient` when the window holds too few messages to judge.
`thresholds`
: The pause lines in percent: `bounce_freeze_pct` and `complaint_freeze_pct`.
`sending_frozen`, `review_flag`
: Whether sending is paused, and whether the service is under review.
`note`
: The figures behind the review or the pause, such as `flagged: 6.12% bounces, 0.04% complaints over 7d`, or `null`.
`domains`
: Each domain with its `status`, the results of its `checks`, its DMARC stage in `dmarc_policy`, and `mta_sts_mode`, the mode of the MTA-STS policy we serve for it. [Mail DNS records](/docs/mail/dns-records/#what-each-check-looks-for) explains the checks.
`reports`
: The latest DMARC and TLS reports on your own domains, newest first, up to `limit`.
Each report has:
`type`
: `dmarc` for a DMARC aggregate report, or `tls` for a TLS report.
`domain`, `reporter`
: The domain the report is about, and the organisation that sent it.
`range_begin`, `range_end`
: The period the report covers, or `null` when it does not say.
`total`, `passed`, `failed`
: The messages or connections the report covers, and how many passed and failed.
`summary`
: Further detail we read from the report, or `null`.
`received_at`
: When the report reached us.
The service summary, [`GET /client/smtp-relay/{service_id}`](/docs/api/reference/client/mail/smtp-relay/), carries the results of the last check: `bounce_rate_pct` and `complaint_rate_pct` to two decimal places, `reputation_checked_at`, `reputation_note`, `sending_frozen` and `review_flag`.
The same report is under [`GET /client/mail/{service_id}/reputation`](/docs/api/reference/client/mail/mail/#op-get-api-v1-client-mail-service-id-reputation), which answers for both products. On a Mail Hosting service, its `reports` can also hold `tls` reports.
## API
- `GET /api/v1/client/smtp-relay/{service_id}/reputation`: Reputation report (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay/#op-get-api-v1-client-smtp-relay-service-id-reputation)
- `GET /api/v1/client/mail/{service_id}/reputation`: Reputation report (https://www.coritan.com/docs/api/reference/client/mail/mail/#op-get-api-v1-client-mail-service-id-reputation)
# How webmail works
> What Coritan Webmail is, how to open it, which mailboxes it shows, and what each way of signing in lets you do.
Source: https://www.coritan.com/docs/mail/webmail/
In the dashboard:
- /webmail: https://www.coritan.com/webmail
Coritan Webmail reads and sends mail in your browser, for mailboxes that Coritan hosts. It is at [www.coritan.com/webmail](https://www.coritan.com/webmail). The addresses mail.coritan.com and webmail.coritan.com send you there too, to the same page the link named.
Webmail is for anyone with a mailbox here: your own coritan.gg address, a mailbox on a [Mail Hosting](/docs/mail/mail-hosting/) service, or a mailbox someone shared with you. It changes the mailbox on the mail server itself, so mail you read, sort or send there shows the same way in your mail apps.
## Open webmail
- In the dashboard, select **Webmail** in the top bar. The account menu behind your initials has **Webmail** too.
- In the dashboard's search palette (Ctrl K), select **Open webmail**.
- On coritan.com, select **Webmail** at the top of the page while you are signed in.
- On a Mail Hosting service, select **Open webmail** at the top of its panel. On its **Mailboxes** tab, **Open webmail** in a mailbox's menu opens webmail with that address filled in. Both open a new tab.
When you are signed in to Coritan, your mailboxes open straight away. Otherwise webmail shows its sign-in card.
## Two ways to sign in
*Your Coritan account*
: While you are signed in on coritan.com, webmail opens every mailbox your account can open. It does not ask for a mailbox's password.
*A mailbox's address and password*
: You sign in to one mailbox, with no Coritan account needed. One browser keeps up to five mailboxes signed in this way. Your own coritan.gg address with your Coritan password is the exception: it opens every mailbox your account can open.
[Sign in to webmail](/docs/mail/webmail/sign-in/) covers each step, the codes webmail can ask for, and each way to sign out.
## Mailboxes webmail opens
*Your coritan.gg mailbox*
: A Coritan account can have one address on `coritan.gg`, such as `alex@coritan.gg`. You take it when you sign up, or claim it later in webmail. See [Get a coritan.gg mailbox](/docs/mail/webmail/claim-a-mailbox/).
*Mail Hosting mailboxes*
: Mailboxes on your own domain, such as `alex@example.com`. Sign in to one with its address and password, or add it to your account so that it opens wherever you sign in to Coritan.
*Mailboxes shared with you*
: A mailbox that another Coritan account shares with you opens beside your own, once you accept the invitation.
The account menu, behind the initials at the top right, lists every mailbox this browser can open in one list, however each one got there. [Open and share mailboxes in webmail](/docs/mail/webmail/mailboxes-and-sharing/) explains the list.
A mailbox from an organization's storefront opens in that organization's own webmail. Webmail cannot open a mailbox at another provider, but it can [import its mail](/docs/mail/webmail/import/).
## What each way of signing in can do
Reading, writing and every mailbox setting work the same whichever way you signed in. A few things depend on how you got in:
- Sharing a mailbox, answering an invitation and adding a mailbox to your account need your Coritan account. Being signed in on coritan.com counts, and so does signing in to webmail with your coritan.gg address and your Coritan password.
- Claiming a coritan.gg address needs you signed in on coritan.com.
- The **Sessions** list, which shows the browsers signed in to a mailbox, is there for a mailbox you signed in to with its address and password.
What you can change inside a mailbox depends on your role in it: its owner, someone it is shared with to read and send, or someone who can only read it. [Who sees each tab](/docs/mail/webmail/settings/#who-sees-each-tab) lists the settings each role reaches.
## What you can do in webmail
Get in:
- [Get a coritan.gg mailbox](/docs/mail/webmail/claim-a-mailbox/)
- [Sign in to webmail](/docs/mail/webmail/sign-in/)
- [Open and share mailboxes in webmail](/docs/mail/webmail/mailboxes-and-sharing/)
Work with mail:
- [Read and search mail in webmail](/docs/mail/webmail/read-and-search/)
- [Write and send email in webmail](/docs/mail/webmail/write-and-send/)
- [Keep an address book in webmail](/docs/mail/webmail/contacts/)
- [Webmail keyboard shortcuts](/docs/mail/webmail/keyboard-shortcuts/)
Set up the mailbox:
- [Sort mail with labels and filters](/docs/mail/webmail/labels-and-filters/)
- [Forward your mail to another address](/docs/mail/webmail/forwarding/)
- [Send an automatic reply while you are away](/docs/mail/webmail/out-of-office/)
- [Protect your webmail mailbox](/docs/mail/webmail/security/)
- [Set up mail apps and devices](/docs/mail/webmail/mail-apps/)
- [Import mail into webmail](/docs/mail/webmail/import/)
- [Change webmail settings](/docs/mail/webmail/settings/)
## Around the screen
The top bar holds the search, the status of new mail, the keyboard shortcuts button, **Settings**, the apps button and the account menu. The folders, your labels, the storage the mailbox uses, **Contacts** and **Settings** are down the left, under **Compose**.
New mail and changes made elsewhere appear on their own. While the status reads **Live**, they appear the moment they happen. When it reads **Every 30 s**, the live connection is down and webmail checks for new mail every 30 seconds.
The apps button, a grid beside your initials, links to the dashboard, its main sections and coritan.com.
## Cost
Webmail has no charge of its own. A Mail Hosting mailbox is part of its service's plan ([How Mail Hosting and SMTP Relay are billed](/docs/mail/billing/)), and claiming your coritan.gg mailbox takes no order.
# Sign in to webmail
> Open webmail with your Coritan account or a mailbox's address and password, enter a code when asked, keep several mailboxes open, and sign out.
Source: https://www.coritan.com/docs/mail/webmail/sign-in/
In the dashboard:
- /webmail: https://www.coritan.com/webmail
Webmail at [www.coritan.com/webmail](https://www.coritan.com/webmail) opens a mailbox in two ways: through your Coritan account, or with the mailbox's own address and password. This page covers both, the codes webmail can ask for, keeping several mailboxes open on one browser, and signing out.
## Before you begin
- To use your Coritan account, have its email and password, and your authenticator app if the account has two-factor authentication on.
- To use a mailbox's own sign-in, have its full address, such as `alex@example.com`, and its password:
- for your coritan.gg mailbox, that is your Coritan password, unless you gave the mailbox [a password of its own](/docs/mail/webmail/security/#change-the-mailbox-password);
- for a Mail Hosting mailbox, whoever manages the service sets the password and can [reset it](/docs/mail/mail-hosting/mailboxes/#reset-a-mailbox-password).
- If the mailbox has two-factor authentication on, have its authenticator app ready. A mailbox's code is separate from your Coritan account's.
## Sign in with your Coritan account
1. Go to [Webmail](https://www.coritan.com/webmail). If you are signed in on coritan.com, your mailboxes open now and you are done.
2. Under the sign-in form, select `Continue with your Coritan account`.
3. Sign in to Coritan. Its sign-in brings you back to the same webmail page.
Every mailbox your account can open is now in the account menu, your own coritan.gg mailbox first. When your account has no mailbox yet, webmail offers to [claim one](/docs/mail/webmail/claim-a-mailbox/) instead.
## Sign in with a mailbox's address
1. Go to [Webmail](https://www.coritan.com/webmail).
2. Enter the mailbox's address in **Email address** and its password in **Password**.
3. If a security check shows above the button, complete it.
4. Select **Sign in**.
5. If **Enter your code** opens, [enter the code](#enter-a-code).
The mailbox opens on its inbox. At the top right, the button with the mailbox's initials opens the *account menu*, where you add, switch and sign out of mailboxes.
Which password you use decides what opens:
- Your own coritan.gg address with your Coritan password opens every mailbox your account can open, as signing in on coritan.com does. It does not sign you in to the rest of coritan.com.
- A mailbox's own password, or one of its app passwords, opens that mailbox alone.
**Open webmail** in a Mail Hosting mailbox's menu opens this form with the address filled in, so you type only the password. When that mailbox is open on this browser already, it comes on screen instead. When another mailbox is open, webmail offers to [add it](#add-another-mailbox).
## Enter a code
After the password, webmail shows **Enter your code** when a code is needed. Codes change every 30 seconds.
*The mailbox's code*
: The mailbox has two-factor authentication on, and the card says `Two-factor sign-in is on for alex@example.com.` Type the code from the app you added the mailbox to in **Code**, then select **Sign in**.
*Your Coritan account's code*
: You signed in with your coritan.gg address and your Coritan password, and your account has two-factor authentication on. The card says `This is your Coritan account's mailbox.` Type the code from the authenticator app you use for Coritan in **Code**, then select **Sign in**.
On your account's code step, you can use a recovery code when you do not have your authenticator app. Select **Use a recovery code instead** and type one of your Coritan recovery codes in **Recovery code**. Each recovery code works once, and **Use my authenticator app instead** switches back. A mailbox has no recovery codes of its own.
To start again with another address or password, select **Back to the address and password**.
## Add another mailbox
One browser keeps up to five mailboxes signed in with their own address and password, and you switch between them without signing in again. Mailboxes that open through your Coritan account do not count towards the five.
1. Open the account menu and select **Add another mailbox**.
2. Enter the other mailbox's **Email address** and **Password**, then select **Sign in**. Enter a code if it asks for one.
The mailbox you added comes on screen, and a message says `alex@example.com added. Switch between mailboxes from the account menu.` To go back without adding one, select `Back to` followed by the address at the top of the card, or press Esc.
Before the form opens, webmail saves any message you are writing to Drafts, in the mailbox you wrote it in. If it cannot save the message, the message stays open and webmail says why.
## Switch between mailboxes
1. Open the account menu. When you can open more than one mailbox, it lists them all under **Mailboxes**, with the unread count of each.
2. Select the mailbox to open.
Webmail first saves any message you are writing to Drafts, as it does when you add a mailbox. You stay in the same folder, or go to the inbox if you had a conversation or a label open.
Each browser tab keeps the mailbox it shows, so two tabs can show two mailboxes, and a reload keeps the same one. While several mailboxes are signed in, each tab's title includes the address.
## Sign out
Open the account menu. It offers one way out for each way you signed in, and each item says what it ends:
`Sign out of alex@example.com`
: Ends the sign-in behind the mailbox on screen, when you signed in with an address and password. For a sign-in made with your Coritan password, the item names your coritan.gg address, and the mailboxes that sign-in opened close with it. Its second line says how many.
**Sign out of all mailboxes**
: Signs out of every mailbox signed in on this browser. It shows while you are not signed in on coritan.com and two or more mailboxes are signed in.
`Sign out of Coritan`
: Signs you out of Coritan on this browser, website included, and ends every sign-in made with your Coritan password. A mailbox signed in with its own password stays open.
**Sign out of everything**
: Ends your Coritan sign-in and every mailbox sign-in on this browser, and leaves the sign-in form empty. Use it on a computer other people use. It shows while you are signed in on coritan.com and a mailbox is signed in with its own password.
Webmail saves any message you are writing to Drafts first. When a mailbox stays open, it comes on screen. Otherwise the sign-in card says what ended, such as `You have signed out.` or `You have signed out of everything on this browser.`
**Sign out** on coritan.com also ends the webmail sign-ins made with your Coritan password. Signing out ends nothing on other browsers: to sign those out, use [the Sessions list](/docs/mail/webmail/security/#see-and-end-sessions).
## How long you stay signed in
Through your Coritan account, webmail stays open for as long as you stay signed in on coritan.com in this browser.
Each browser signed in to a mailbox with its address holds a *session*. A session lasts 30 days, and it ends sooner if you do not use it for 7 days. Closing the tab or the browser does not end it.
> [!NOTE]
> On a computer other people use, sign out when you finish.
A session also ends:
- when a sixth browser signs in to the same mailbox, which ends the one used longest ago;
- when the mailbox's password changes, or its two-factor authentication goes on or off, except in the webmail session that made the change;
- when someone signs the browser out from the **Sessions** list, or from the Mail Hosting service's **Webmail sessions…**;
- when the mailbox is turned off or deleted.
A session made with your coritan.gg address and your Coritan password also ends when your Coritan password changes, when your account turns on two-factor authentication after you signed in without a code, and when you sign out of Coritan on this browser.
If a session ends while the page is open, the sign-in card comes back. Sign in again, and you return to where you were.
## Troubleshooting
`That address and password do not match. Check both and try again.`
: The address or the password is wrong. Enter the whole address, such as `alex@example.com`, and check the password. We give the same answer for a mailbox that is turned off, and for a mailbox from an organization's storefront, which signs in on that organization's own webmail. When the address is not on coritan.gg, the message adds that your Coritan password works only with your own coritan.gg address.
`That code is not right, or it has expired. Enter the one your authenticator app shows now.`
: Enter the code the app shows now. On the mailbox's code step, use the code for the mailbox. On your account's code step, use the code you use for Coritan.
`That recovery code is not right, or you have used it already. Try another one.`
: Type another of your Coritan recovery codes. Dashes and spaces in it do not matter.
A message that starts `Too many attempts to sign in.`
: After 10 failed attempts at one address within 15 minutes, or 20 from one IP address within 5 minutes, we refuse sign-ins for a while. Every failed attempt counts, whoever makes it, including a wrong code. The message says when you can try again, and the form stays off until then.
`Five mailboxes are signed in on this browser, which is as many as it holds. Sign out of one to add another.`
: Switch to a mailbox you no longer need here, sign out of it, then add the new one.
`That mailbox is open here already. Switch to it from the account menu.`
: The mailbox is one of those this browser opens. Open the account menu and select it.
`Complete the security check first.` or `The security check did not pass. Complete it again, then sign in.`
: Complete the check above the button, then select **Sign in** again. A check covers one attempt only.
`The mail server did not answer, so you are not signed in yet. Try again in a moment.`
: The server that holds the mailbox did not respond. Wait a moment, then sign in again. If it keeps happening, [contact support](/docs/support/).
`The webmail could not reach its server`
: Webmail could not load at all. Check your connection, then select **Try again**.
A message that starts `Your session has ended.` or `The session for alex@example.com has ended.`
: The session ended for one of the reasons under [How long you stay signed in](#how-long-you-stay-signed-in). Sign in again. Mailboxes still open on this browser show under **Still signed in on this browser**, and you can select one to open it.
You forgot the password
: For your coritan.gg mailbox, try your Coritan password: it is the mailbox's password until you give the mailbox one of its own. If you did and forgot it, sign in on coritan.com and open webmail. The **Security** tab then sets a new mailbox password with your Coritan password alone, as [Change the mailbox password](/docs/mail/webmail/security/#change-the-mailbox-password) shows. For a Mail Hosting mailbox, ask whoever manages the service to [reset its password](/docs/mail/mail-hosting/mailboxes/#reset-a-mailbox-password).
## Related
- [How webmail works](/docs/mail/webmail/)
- [Open and share mailboxes in webmail](/docs/mail/webmail/mailboxes-and-sharing/)
- [Protect your webmail mailbox](/docs/mail/webmail/security/)
- [Connect a mail app to Mail Hosting](/docs/mail/mail-hosting/connect-a-mail-app/)
# Get a coritan.gg mailbox
> Take an address on coritan.gg when you create your Coritan account, or claim one later in webmail.
Source: https://www.coritan.com/docs/mail/webmail/claim-a-mailbox/
In the dashboard:
- /webmail: https://www.coritan.com/webmail
A Coritan account can have one mailbox of its own on `coritan.gg`, such as `alex@coritan.gg`. You take the address when you create your account, or you claim it later in [webmail](https://www.coritan.com/webmail). You read the mail in webmail, and in any mail app over IMAP.
This page covers claiming the mailbox later. To take one while you sign up, see [Sign up with a new mailbox](/docs/get-started/create-an-account/#sign-up-with-a-new-mailbox).
## Before you begin
- Be signed in on coritan.com. Webmail offers the address only to your Coritan sign-in, so a mailbox you opened with its own address and password cannot claim one.
- Have your Coritan password.
- Check that you have no mailbox yet. An account can claim one mailbox, and a mailbox you took at sign-up is that one.
## Choose a name
The name is the part before `@coritan.gg`. It must:
- be 3–40 characters long;
- use only letters, digits, dots, dashes and underscores, which webmail reads in lowercase;
- start and end with a letter or a digit;
- have no two dots in a row and no plus sign.
Some names are reserved, such as `support`, `billing` and `webmail`. A name is also taken when a Coritan account already signs in with that address.
## Claim your mailbox
1. Go to [Webmail](https://www.coritan.com/webmail). While your account has no mailbox, webmail shows `Claim your @coritan.gg address`.
2. Type a name in **Your address**, or select one of the ideas under the field. Webmail checks the name as you type, and the line under the field says `alex@coritan.gg is free.` when it is.
3. Enter your Coritan password in the field under it. It confirms that it is you, and it becomes the mailbox's password too.
4. Select **Create my mailbox**.
A message says `alex@coritan.gg is yours.`, and your new inbox opens. You go on signing in to Coritan with the email you use now. The new address is where your mail arrives.
The same page lists any invitation to a mailbox someone shared with you, with **Accept** and **Decline**. Under **Have a mailbox already?**, **Add a mailbox** adds one you manage to your account, as [Add a mailbox to your account](/docs/mail/webmail/mailboxes-and-sharing/#add-a-mailbox-to-your-account) describes.
## What the mailbox comes with
- 5 GB of storage by default. The line under the folder list shows how much you use.
- Up to 100 messages sent an hour by default.
- Sign-in from mail apps over IMAP and SMTP, with the mailbox's address and password. See [Set up mail apps and devices](/docs/mail/webmail/mail-apps/).
## The mailbox password
The mailbox password starts as your Coritan password. When you [change your account password](/docs/account/password/#change-your-password), the mailbox password changes with it, and mail apps need the new one.
You can give the mailbox a password of its own on the **Security** tab of webmail settings. From then on it stays as it is when your account password changes. See [Change the mailbox password](/docs/mail/webmail/security/#change-the-mailbox-password).
## Troubleshooting
`That address is already taken.`
: Someone has a mailbox with that name, or a Coritan account signs in with that address. Choose another name.
`That name is reserved.`
: We keep that name back. Choose another name.
`Pick at least 3 characters.`, `Keep it under 40 characters.`, `Two dots in a row are not allowed.` or a message about the characters to use
: The name breaks one of the [naming rules](#choose-a-name). Change it until the line under the field says it is free.
`Pick a free address first.`
: You selected **Create my mailbox** with no name in **Your address**. Type a name, and wait until the line under the field says it is free.
`Could not check that name just now. You can still try it.`
: We could not check the name. Select **Create my mailbox** anyway, or type the name again after a moment.
`Incorrect account password.`
: Enter the password you sign in to your Coritan account with.
`The mail service is not accepting new mailboxes right now. Try again in a moment.`
: We could not create the mailbox at that moment. Nothing was created, so try again later.
`This account already has a mailbox.`
: Your account has its mailbox already, and webmail opens it.
`No mailbox in your account yet`
: This site does not give out addresses, so the page offers only **Add a mailbox** and the invitations waiting for you. For mailboxes on a domain you own, see [Mail Hosting](/docs/mail/mail-hosting/).
A message that starts `Could not create the mailbox:` and says there were too many requests
: An account can try to claim a mailbox 5 times an hour. Wait, then try again.
`Your account could not be read`
: Webmail could not load what your account can claim. Select **Try again**.
## Related
- [Create an account](/docs/get-started/create-an-account/)
- [How webmail works](/docs/mail/webmail/)
- [Set up mail apps and devices](/docs/mail/webmail/mail-apps/)
## With the API
The claim itself happens in webmail only. The public API has the two checks that the sign-up form makes before an account exists. Neither needs authentication.
Ask whether the storefront offers a mailbox, and on which domain, with [`GET /auth/mailbox-domain`](/docs/api/reference/client/authentication/#op-get-api-v1-auth-mailbox-domain):
```bash
curl https://api.coritan.com/api/v1/auth/mailbox-domain
```
```json
{"enabled": true, "domain": "coritan.gg"}
```
Check a name with [`GET /auth/mailbox-availability`](/docs/api/reference/client/authentication/#op-get-api-v1-auth-mailbox-availability):
```bash
curl "https://api.coritan.com/api/v1/auth/mailbox-availability?local_part=alex"
```
```json
{"available": false, "reason": "taken", "detail": "That address is already taken", "address": "alex@coritan.gg"}
```
`reason` is `ok`, `invalid`, `reserved` or `taken`, and `detail` says why a name cannot be used. When the storefront offers no mailbox, the domain check answers `"enabled": false` and the availability check answers `404` `Mailboxes are not offered on this storefront`. One IP address can check up to 60 names a minute.
To create an account together with its mailbox, send `mailbox_local_part` to `POST /auth/register`, as [Create an account](/docs/get-started/create-an-account/#with-the-api) shows.
## API
- `GET /api/v1/auth/mailbox-domain`: Mailbox domain (https://www.coritan.com/docs/api/reference/client/authentication/#op-get-api-v1-auth-mailbox-domain)
- `GET /api/v1/auth/mailbox-availability`: Live check behind the sign-up form's username field (https://www.coritan.com/docs/api/reference/client/authentication/#op-get-api-v1-auth-mailbox-availability)
# Read and search mail in webmail
> Move between folders and labels, open a conversation, act on messages, and find mail with search operators in webmail.
Source: https://www.coritan.com/docs/mail/webmail/read-and-search/
In the dashboard:
- /webmail/…: https://www.coritan.com/webmail
- /webmail/…/…: https://www.coritan.com/webmail
Webmail groups a message with its replies into one *conversation*. You pick a folder or label in the sidebar, open a conversation from the list, and act on it from the toolbar above it. Each folder has its own address in webmail, such as `https://www.coritan.com/webmail/inbox`, and so does each conversation, so you can bookmark one or open it in another tab.
## Before you begin
- Open the mailbox in webmail. See [Sign in to webmail](/docs/mail/webmail/sign-in/).
- Someone who **Can only read** a shared mailbox can read and search it, but cannot move, label, delete or mark its mail.
## Folders
The sidebar lists the folders. In a narrow window it is hidden: select the menu button (**Folders**) at the top left to open it.
| Folder | What it holds |
| --- | --- |
| **Inbox** | New mail. The number beside it counts unread conversations. |
| **Starred** | Conversations you starred. |
| **Important** | Conversations marked important. |
| **Snoozed** | Conversations you snoozed, until they come back. |
| **Sent** | Messages you sent. |
| **Scheduled** | Messages waiting to be sent later. The number beside it counts them. |
| **Drafts** | Messages you have started and not sent. The number beside it counts them. |
| **Archive** | Conversations you archived. |
| **All mail** | Everything except Spam and Trash. |
| **Spam** | Mail the mail server thinks is spam, and mail you reported. The number beside it counts unread conversations. |
| **Trash** | Mail you deleted. |
Under **Labels** are your labels, each with its number of unread conversations. See [Sort mail with labels and filters](/docs/mail/webmail/labels-and-filters/). The foot of the sidebar shows how much of the mailbox's storage you use, with the way to **Contacts** and **Settings** below it.
New mail appears on its own. The status at the top right reads **Live** while new mail shows the moment it arrives. When that connection is down, webmail checks every 30 seconds and the status reads **Every 30 s**; it reads **Syncing** while it checks. To check now, select the arrows button (**Refresh**) above the list.
## The conversation list
Each row shows who wrote, the subject, a preview of the text and the date. A paperclip means the conversation has an attachment, and its labels show before the subject. A row can also say when a scheduled message goes or when a snoozed conversation comes back, and a crossed-out bell marks a muted conversation. With **Density** set to **Compact** in [settings](/docs/mail/webmail/settings/#reading-and-sending), rows leave out the preview.
The list shows 50 conversations at a time, newest first. Use the arrows at the top right (**Newer** and **Older**) to move between pages.
- To open a conversation, select its row.
- To star it, select the star at the start of the row. The bookmark beside the star marks it as important.
- To act on one conversation, point at its row. Buttons appear on the right to archive it, delete it, mark it read or unread, and snooze it.
- To act on several, tick the box at the start of each row, or the box above the list (**Select all**) to select the whole page. The toolbar then shows what you can do with them.
- To move conversations, drag them onto **Inbox**, **Archive**, **Spam** or **Trash** in the sidebar. Dropping them on a label adds that label.
## Open a conversation
The conversation opens with its messages oldest first. The newest message, any unread ones and any drafts are open, and the others show as one line each: select a line to open that message. Opening a conversation marks its messages as read.
- To see every address a message went to, with its date and subject, select the recipients line under the sender's name.
- Attachments are listed under the message. Select one to open it in a new tab, or its download button to save it.
- To answer, use **Reply**, **Reply all** or **Forward** under the newest message. **Reply all** shows when the message went to more than one person. See [Write and send email in webmail](/docs/mail/webmail/write-and-send/).
- To go to the next conversation in the list without going back, use **Newer** and **Older** at the top right.
- To go back to the list, select the arrow at the top left (**Back to the list**).
When you archive, delete or move the conversation you are reading, the next one in the list opens. On a phone, you go back to the list instead.
A line above the messages says when a snoozed conversation comes back, with **Unsnooze**, and when a muted one skips your inbox, with **Unmute**. For a message waiting in **Scheduled**, it says when the message goes, with **Cancel send**. See [Schedule a message](/docs/mail/webmail/write-and-send/#schedule-a-message). In **Spam**, it says the conversation is in Spam, with **Not spam**. See [Get mail out of Spam](#get-mail-out-of-spam).
### Images in a message
A message can load pictures from the web, which tells the sender when you read it. Unless the mailbox is set to show them, webmail hides them and says `Images are hidden so the sender cannot see when you read this.` above the message. Select **Show images** to see them in this message, or `Always show from` followed by the sender's name to show them from that sender every time. To change the default, see [Change webmail settings](/docs/mail/webmail/settings/#reading-and-sending).
## Act on conversations
These actions are in the toolbar of an open conversation, and in the toolbar above the list when you select conversations. Hover over a button to see its name.
| Action | What it does |
| --- | --- |
| **Archive** | Takes the conversation out of the Inbox. It stays in **Archive** and **All mail**. |
| **Report spam** | Moves it to Spam. In the Spam folder, **Not spam** moves it back to the Inbox and adds its senders to your contacts. See [Get mail out of Spam](#get-mail-out-of-spam). The mail server's spam filter learns from both. |
| **Delete** | Moves it to Trash. In Trash or Spam, the button reads **Delete forever** and removes the mail for good. |
| **Mark as read**, **Mark as unread** | Changes whether it counts as unread. In an open conversation, **Mark as unread** also takes you back to the list. |
| **Snooze** | Hides it until a time you choose. See [Snooze a conversation](#snooze-a-conversation). |
| **Mark as important** | Adds it to **Important**. On an important conversation, the button reads **Mark as not important**. |
| **Move to** | Moves it to Inbox, Archive, Spam, Trash or a label. |
| **Labels** | Adds or removes labels. |
The menu at the end of the toolbar (**More actions**) holds the rest: **Add star** and **Remove star**, **Mute** or **Unmute**, and **Move to Inbox** outside the Inbox. In an open conversation it also holds **Expand all** and **Print all**. On a phone, **Snooze…** and **Mark as important** move into this menu too.
After most actions, a bar at the bottom of the page says what happened, such as `2 conversations archived`. Select **Undo** within 8 seconds to reverse it, or press z. **Delete forever** cannot be undone.
In **Scheduled**, the toolbar offers **Cancel send** in place of moving or deleting a message.
## Act on one message
Each open message has its own menu: the three dots at its top right (**Message actions**). It holds:
- **Reply all** and **Forward**.
- **Mark as unread**, which also takes you back to the list.
- **Download original (.eml)**, which saves the whole message as a file.
- **Unsubscribe**, when the message is from a mailing list that offers it. It opens the sender's page for leaving the list, or starts an email that asks to leave.
- `Add` followed by the sender's name and `to contacts`, while the sender is not in your contacts. See [Keep an address book in webmail](/docs/mail/webmail/contacts/).
- **Filter messages like this**, and `Block` followed by the sender's name, for whoever manages the mailbox. See [Create a filter](/docs/mail/webmail/labels-and-filters/#create-a-filter) and [Block a sender](/docs/mail/webmail/labels-and-filters/#block-a-sender).
- **Report spam**, or **Not spam** in the Spam folder, which moves the message to the Inbox and adds its sender to your contacts.
- **Delete this message**, which moves only this message to Trash. In Trash or Spam it reads **Delete this message forever**.
A draft in a conversation has **Edit draft** and **Discard draft…** under it instead.
## Get mail out of Spam
The mail server files mail it takes for spam in **Spam**. To move a message you want to the Inbox, and let its sender's next messages through:
1. Open **Spam** and select the conversation. The line above it reads `This conversation is in Spam.` and says who **Not spam** adds to your contacts.
2. Select **Not spam** on that line. The same button is in the toolbar, in the message's menu (**Message actions**), and in the toolbar above the list when you select conversations there.
Webmail moves the conversation to the Inbox and adds each sender to your contacts, with the name their message shows. The bar at the bottom says who it added, such as `We added Alex to your contacts.` Select **Undo** within 8 seconds to move the conversation back to Spam and delete the contacts it added. Someone who **Can only read** the mailbox sees the line without **Not spam**.
Mail from a contact reaches your Inbox even when the spam filter takes it for spam, as long as it passes the DMARC check of the domain in its From address. A message that fails that check, such as one that only pretends to come from a contact, still goes to Spam. The mail server looks only at a contact's first email address, so webmail also adds a sender who is the second address of a contact, as a contact of their own. The spam filter learns from each **Not spam** and **Report spam** too.
To let the spam filter judge a sender's mail again, delete them from your contacts ([Change or delete a contact](/docs/mail/webmail/contacts/#change-or-delete-a-contact)). Mail from a [blocked sender](/docs/mail/webmail/labels-and-filters/#block-a-sender) goes to Spam even when they are a contact, until you unblock them.
## Snooze a conversation
Snoozing takes a conversation out of the Inbox until a time you choose.
1. Select the clock button (**Snooze**) on the conversation's row, in the toolbar after you select it, or in the open conversation. On a phone, select **Snooze…** in **More actions**.
2. Choose **Later today**, **Tomorrow**, **This weekend** or **Next week**. The menu shows the time each one means, in your device's time zone. **Later today** means 6 pm and shows until 5 pm. **Tomorrow**, **This weekend** and **Next week** mean 8 am on the next day, on Saturday and on Monday, and **This weekend** shows from Monday to Thursday.
3. For another time, select **Pick date and time…**, set **Date and time**, then select **Snooze**.
The conversation moves to **Snoozed**, and the bar at the bottom says until when. At that time, it comes back to the Inbox, with its newest message from someone else marked unread. This happens even when webmail is closed. The time must be at least a minute ahead and within a year.
To bring it back sooner, open it and select **Unsnooze**.
## Mute a conversation
Muting keeps a busy conversation out of your Inbox.
1. Open the conversation, or select it in the list.
2. Select **More actions**, then **Mute**.
The conversation moves to Archive, and new messages in it go to Archive instead of staying in the Inbox. The conversation shows `This conversation is muted, so new messages in it skip your inbox.` To stop, select **Unmute** there, or in the same menu. A mailbox can mute up to 500 conversations.
## Search your mail
1. Select the search box at the top.
2. Type words to look for, with any of the operators below, then press Enter.
While you type, the box suggests people you have mail from, operators, your recent searches, and the views **Unread**, **Starred** and **With attachments**.
Words on their own match the senders, the recipients, the subject and the text of each message. Results are listed newest first, under a heading that says where the search ran, such as `Results for “invoice” in all mail`. **Search all mail** widens a search to all mail, and **Clear search** ends it.
Where a search looks depends on where you start it:
- From **Inbox** or **All mail**, it looks through all mail except Spam and Trash.
- From another folder or a label, it looks only there.
- An `in:` or `label:` operator chooses the folder, wherever you start. `in:all` still leaves out Spam and Trash, so use `in:spam` or `in:trash` to search those.
To build a search without operators, select the sliders button (**Show search options**) in the search box. Fill in **From**, **To**, **Subject** or **Has the words**, set a **Size**, pick a day for **Date within**, choose where to look in **Search in**, and tick **Has attachment** or **Unread only**. Then select **Search**. **Date within** finds mail from that long before the day to that long after it. **Create filter** turns the same fields into a new filter; see [Create a filter](/docs/mail/webmail/labels-and-filters/#create-a-filter).
### Search operators
| Operator | Finds |
| --- | --- |
| `from:alex@example.com` | Mail from that sender. Part of an address or a name also works. |
| `to:`, `cc:`, `bcc:` | Mail sent to, copied to or blind copied to that address. |
| `subject:invoice` | Mail with that word in the subject. |
| `has:attachment` | Mail with an attachment. |
| `filename:report.pdf` or `attachment:report.pdf` | Mail with an attachment of that name. |
| `is:unread`, `is:read` | Unread mail, or mail you have read. |
| `is:starred` | Starred mail. |
| `is:important` | Mail marked important. |
| `is:draft` | Drafts. |
| `is:answered` | Mail you replied to. |
| `in:sent`, `label:receipts`, `folder:archive` | Mail in one folder or label. The words are `inbox`, `sent`, `drafts`, `archive`, `spam`, `trash`, `starred`, `important`, `unread` and `all`, or a label's name. `in:snoozed` and `in:scheduled` work once something is snoozed or scheduled. |
| `after:2026-01-01` or `since:2026-01-01` | Mail from that day or later. |
| `before:2026-01-31` | Mail from before that day. |
| `on:2026-01-15` | Mail from that day. |
| `larger:5M` or `size:5M` | Mail larger than that size. Use `k`, `m` or `g` for kilobytes, megabytes or gigabytes. |
| `smaller:500k` | Mail smaller than that size. |
- Write dates as `2026-01-31`. A day runs from midnight to midnight UTC.
- Put a phrase in quotes to find it whole, such as `"quarterly report"` or `subject:"quarterly report"`. A label name with spaces goes in quotes too: `label:"Travel plans"`.
- Put `-` before an operator to leave out what it finds, such as `-from:alex@example.com` or `-in:sent`.
- Webmail searches for an operator it does not know, or a value it cannot read, as ordinary words.
## Troubleshooting
`Could not load this folder` or `Could not open this conversation`
: Webmail could not reach the mail server. Select **Try again**. If it keeps happening, see [Troubleshoot mail](/docs/mail/troubleshooting/).
`We could not find this conversation`
: The conversation may have been deleted, or the link may be wrong. Select the button under the message to go back to the list.
A message that starts `No conversations match`
: Check which folder you started from, since a search from a folder or a label looks only there. Select **Search all mail**, or use fewer words.
The status reads **Every 30 s**
: The live connection to the mail server is down, so webmail checks for new mail every 30 seconds and keeps trying to reconnect. Mail still arrives. If you have many webmail tabs open, close the ones you do not need and reload the page.
Pictures in a message are missing
: Webmail hides pictures that load from the web. Select **Show images** above the message.
Mail from a sender you marked **Not spam** still goes to Spam
: The mail server lets a contact's mail past the spam filter only when the message passes the DMARC check of the domain in its From address, and only for the contact's first email address. A sender whose domain has no DMARC record, or who sends through a service that record does not cover, can still land in Spam, so ask them to fix their DMARC setup. Mail from a [blocked sender](/docs/mail/webmail/labels-and-filters/#block-a-sender) goes to Spam even when they are a contact: select **Unblock** beside them in **Blocked senders**.
`This message is too large to show in full.`
: Webmail shows the start of a very long message. Select **Download the original** to save the whole message.
A message that ends `you can read this mailbox but not change it.`
: The mailbox was shared with you so that you can only read it, and webmail could not move, label or mark its mail. It can show as you open unread mail, which webmail tries to mark as read. Ask the owner to let you send from it.
A message that ends `this mailbox's settings are its owner's to change.`
: You chose `Always show from` in a mailbox shared with you. Only whoever manages the mailbox chooses whose images always show. Select **Show images** instead.
`Pick a time at least a minute from now.` or `Pick a time within a year.`
: Choose a snooze time between one minute and one year from now.
A message that ends `a mailbox can mute 500 conversations; unmute some first.`
: Unmute conversations you no longer need muted, then try again.
A message that starts `Could not update` and ends `Refresh and try again.`
: Some of the messages changed on the mail server while you acted on them. Select **Refresh**, then try again.
## Related
- [Webmail keyboard shortcuts](/docs/mail/webmail/keyboard-shortcuts/)
- [Sort mail with labels and filters](/docs/mail/webmail/labels-and-filters/)
- [Write and send email in webmail](/docs/mail/webmail/write-and-send/)
# Write and send email in webmail
> Compose a message, reply or forward, attach files, use signatures and templates, schedule a message and undo a send in webmail.
Source: https://www.coritan.com/docs/mail/webmail/write-and-send/
In the dashboard:
- /webmail/…: https://www.coritan.com/webmail
Webmail writes each message in a compose window in the corner of the page. The window saves a draft while you type, and holds a sent message for a few seconds so you can take it back. You can also schedule a message to go later, start one from a template, and choose among the mailbox's signatures.
## Before you begin
- Open the mailbox in webmail at [www.coritan.com/webmail](https://www.coritan.com/webmail). [Sign in to webmail](/docs/mail/webmail/sign-in/) explains how.
- To send from a mailbox someone shared with you, you need **Can read, organize and send**. With **Can only read**, webmail still opens a compose window, but it cannot save or send the message.
## Write a new message
1. Select **Compose** at the top of the folder list, or press c.
2. Add the people you are writing to in **To**. [Add recipients](#add-recipients) explains how the box works.
3. Enter a **Subject**.
4. Write the message in the large box.
5. Select **Send**, or press Ctrl+Enter (⌘+Enter on a Mac).
If the subject is empty, webmail asks `Send without a subject?`. Select **Send anyway**, or **Add a subject** to go back and write one.
The window closes, and the message goes when the undo time runs out. See [Undo a send](#undo-a-send).
On a narrow screen, such as a phone or a tablet held upright, the window fills the screen. Its title bar has **Minimise**, which folds it down to its title, **Full screen** (**Exit full screen** once it fills the screen) and **Save and close**. A minimised window shows **Open** and **Save and close**. Esc minimises a window that does not fill the screen. You can have several messages open at once.
Selecting an email address that a message links to also starts a new message to that address.
## Add recipients
- Type an address, then press Enter, a comma or a semicolon, or move to another box. The address becomes a chip.
- As you type, webmail suggests people and groups from your address book first, then people the mailbox has written to or heard from. The first suggestion is highlighted, and Enter or Tab takes it. Use the arrow keys to pick another. When you have typed a whole address, it comes first, marked **Use this address**.
- Choosing a group from the address book adds each of its members.
- To add several addresses at once, paste them separated by commas, semicolons or new lines.
- To change an address, select its chip. To remove it, select the cross on the chip. Backspace in an empty box brings the last address back into the box to edit.
- To copy people in, select **Cc** or **Bcc** beside **To**. People in **Bcc** get the message, and the other recipients do not see their addresses.
Text that is not a whole address, such as a name with no domain, stays in the box with the reason under it, for example `“alex” is not an email address.` Webmail does not send until you correct it or delete it.
## Format the message
The toolbar under the message formats the text: bold, italic, underline, strikethrough, bulleted and numbered lists, quotes and links. **Remove formatting** clears the formatting of the selected text. Hover over a button to see its name. To hide or show the toolbar, select the T icon (**Formatting options**). Ctrl+B, Ctrl+I and Ctrl+U work too.
To add a link:
1. Select the text for it, then select **Insert link** or press Ctrl+K.
2. Enter the **Web or email address**, such as `example.com`. An email address becomes a link that starts a message to it.
3. With no text selected, also enter the **Text to show**, or leave it empty to show the address itself.
4. Select **Insert link**.
For a link that is already there, the box is called **Edit link** and offers **Save link** and **Remove link**.
A picture you paste or drop into the message is attached as a file. Text you paste keeps its structure, such as paragraphs, lists, tables and links. It loses the styling it had, such as fonts and colours.
## Attach files
1. Select the paperclip (**Attach files**) at the bottom of the window and choose one or more files. You can also drop files onto the window.
2. Wait while each file uploads. Its row shows how far it has got.
Each file can be up to 25 MB, unless your mailbox has another limit: **Largest attachment** on the **Mail apps** tab of settings shows it. To take a file off, or stop one that is uploading, select the cross beside it. You cannot send while a file is still uploading.
## Reply or forward
Open the conversation. Under its newest message, select one of these:
- **Reply** answers the sender, or the reply-to address the message names. For a message you sent, it goes to the people you sent it to.
- **Reply all** also copies everyone else in **To** and **Cc**, apart from you. Under the message, it shows only when the message went to more than one person.
- **Forward** sends the message on to people you add, with its attachments.
Each message also has a reply arrow (**Reply**) at its top right, and **Reply all** and **Forward** in its **Message actions** menu. In an open conversation, r, a and f reply, reply to all and forward.
The subject starts with `Re:` or `Fwd:`, and webmail quotes the original message under the space where you write.
## Choose the From address
When the mailbox can send from more than one address, the window has a **From** list. It holds the mailbox's own address and each alias that delivers to it. A new message starts from the mailbox's own address. A reply or forward starts from the address the message was sent to, or the one you sent it from, when the mailbox can send as that address.
The name and reply-to address that go with each address come from settings: see [Set your name and reply-to address](/docs/mail/webmail/settings/#set-your-name-and-reply-to-address).
## Use a signature
A new message starts with the signature that settings choose for new mail from its **From** address. A reply or forward starts with the one chosen for replies and forwards. The signature goes under a new message, and above the quoted text of a reply or forward.
- To use another one for this message, select the pen icon (**Signature**) and choose it, or choose **No signature**.
- **Manage signatures** minimises the window and opens settings, where you write and name them. Only people who manage the mailbox see it.
- Choosing another **From** address swaps in that address's signature, unless you have edited the signature in the message.
[Add a signature](/docs/mail/webmail/settings/#add-a-signature) explains how to set them up.
## Use a template
A *template* is a message you reuse, such as an answer you often send. A mailbox keeps up to 100. Webmail keeps them in a folder named Templates in the mailbox, so mail apps show them there as drafts.
- To save one, write the message, select the document icon (**Templates**), then **Save this message as a template**. The template keeps the subject, the text you wrote and the attachments. It leaves out the signature and any message you are replying to or forwarding. Webmail shows `Saved “Monthly report” as a template.`, with your subject.
- To use one, select **Templates** and choose it by its subject. Its text goes in where the cursor is, or at the top if you have not been in the message yet, and its attachments are added. When **Subject** is empty, the template's subject fills it.
- To delete one, select **Templates**, then the bin beside it (**Delete template**), and confirm with **Delete template**. Messages you already wrote from it stay as they are.
## Drafts
While you write, webmail saves the message to **Drafts** a few seconds after you stop typing. It starts once the message has a recipient, a subject, some text or an attachment. The bottom of the window shows `Saving…`, then `Draft saved`.
- To keep a message for later, select **Save and close**, the cross at the top right of the window. Webmail saves it and shows `Draft saved.`
- To throw a message away, select the bin (**Discard draft**), then select it again within 3 seconds, while it reads **Click again to discard**. That also deletes the saved draft.
To finish a saved draft, open it from **Drafts** and select **Edit draft**, under the message or at its top right. It opens in a compose window, and saving or sending it replaces the draft. To delete a saved draft, select **Discard draft…** and confirm with **Discard draft**. It is deleted for good, with its attachments.
When you switch to another mailbox, webmail saves each open message to **Drafts** in the mailbox you wrote it in, then closes the windows. A note says which mailbox holds them.
## Schedule a message
1. Write the message.
2. Select the arrow beside **Send** (**Schedule send**).
3. Choose **Tomorrow morning** (8 am), **Tomorrow afternoon** (1 pm) or **Monday morning** (8 am next Monday). The menu shows the date and time each one means, in your device's time zone. On a Sunday, **Monday morning** is the same as **Tomorrow morning**, so the menu leaves it out.
4. For another time, select **Pick date and time…**, set **Date and time**, then select **Schedule send**.
The window closes, and a bar at the bottom of the page says `Scheduled for` and the time. Select **Undo** within 8 seconds to cancel the send and open the message again.
The message waits in the **Scheduled** folder. It goes at the time you chose, or up to about a minute after, even when webmail is closed.
The time must be at least a minute ahead and at most 366 days ahead. A mailbox can have up to 200 messages waiting.
### Change or cancel a scheduled message
Webmail does not change a message while it waits, so cancel its send first:
- In **Scheduled**, point at the message's row and select **Cancel send**. To cancel several, select their rows, then **Cancel send** at the top of the list. Each message moves to **Drafts**, and webmail shows `Sending canceled. The message is in Drafts.`
- Open the message. The line above it says `We send this message on` and the time, with **Cancel send**. Under the message, **Cancel send and edit** opens it in a compose window. **Cancel send and delete…** deletes it for good once you confirm with **Cancel send and delete**, and **Keep it scheduled** leaves it waiting.
While the message is going out, the line says `We are sending this message now.` and you can no longer cancel it.
If someone deletes the message, or moves it out of **Scheduled**, in a mail app before its time, it is not sent.
### When a scheduled message is not sent
A scheduled message goes out as the person who scheduled it. It is not sent if that person can no longer send from the mailbox by then, for example because the owner removed their access or changed it to **Can only read**. If the mail server refuses the message, webmail tries twice more, two minutes apart, then gives up.
Either way, the message goes back to **Drafts**, marked `Not sent`. Its conversation says `We could not send this message:` and the reason. Select **Move to Drafts**, which makes it an ordinary draft again, then **Edit draft** to correct it and send it.
## Undo a send
When you select **Send**, the window closes, and a bar at the bottom of the page says `Sending…` with **Undo**. Select **Undo**, or press z, before the time runs out, and the message opens again in a compose window. **Dismiss**, the cross on the bar, hides the bar, and the message still goes.
You have 5 seconds unless you change it. To change it, go to **Undo send** under **Reading and sending** on the **General** tab of settings, and choose **Off**, **5 s**, **10 s**, **20 s** or **30 s**. With **Off**, a message goes at once and you cannot take it back. See [Reading and sending](/docs/mail/webmail/settings/#reading-and-sending).
The message waits in your browser until the time runs out. If you close or reload the tab before then, it is not sent. The last draft webmail saved before you selected **Send** stays in **Drafts**.
Once the message has gone, webmail shows `Message sent.`, and you cannot take it back. If you switched to another mailbox in the meantime, the message still goes from the mailbox you wrote it in, and webmail names that mailbox: `Message sent from` followed by its address.
## Troubleshooting
`Add at least one recipient before sending.`
: Add an address in **To**, **Cc** or **Bcc**.
A message such as `“alex” is not an email address.`
: What you typed in **To**, **Cc** or **Bcc** is not a whole address. Correct it, for example by adding the domain, or delete it.
`Wait for the attachments to finish uploading.`
: A file is still uploading. Wait for it to finish, or remove it.
A message that starts `Could not attach`
: The file did not upload, and its row says `Not attached`. If the message ends `is larger than 25 MB.`, the file is over the limit the message names, so share it with a link instead. Otherwise remove the file and attach it again.
A message that starts `Could not send the message:` or `Could not schedule the message:`
: The mail server refused the message. It opens again in a compose window with everything you wrote. Read the reason, correct what it names and try again. If you had switched to another mailbox, the message names that mailbox and does not open again: switch back, and look in its **Drafts** for the last copy webmail saved.
`Could not send the message: this mailbox cannot send as` followed by an address
: The **From** address is no longer one the mailbox can send from, for example because its alias was removed. Choose another **From** address and send again. The same words after `Could not schedule the message:` or `Could not save the draft:` mean the same.
A message that starts `Could not save the draft, so the window stays open`
: Webmail could not save the message when you closed the window. Read the reason, then try again.
A message with the words `can read this mailbox but not change it`
: You can only read this mailbox, so webmail cannot save or send a message from it. Ask its owner to give you **Can read, organize and send**.
`Pick a time at least a minute from now.` or `Pick a time within a year.`
: Choose a time between one minute and 366 days from now.
A message that says `A mailbox can have 200 messages waiting to be sent`
: Cancel a scheduled message you no longer need, or wait until some have gone.
`Could not cancel the send: it has already been sent.` or `Could not cancel the send: it is being sent right now.`
: The message went, or was going, before you cancelled it.
A message that ends `keeps 100 templates; delete one first.`
: Delete a template you no longer use, then save the new one.
`Write a subject or some text first: a template keeps both for your next message.`
: A template needs a subject or some text of your own. The signature and any quoted message do not count.
## Related
- [Change webmail settings](/docs/mail/webmail/settings/)
- [Keep an address book in webmail](/docs/mail/webmail/contacts/)
- [Read and search mail in webmail](/docs/mail/webmail/read-and-search/)
- [Open and share mailboxes in webmail](/docs/mail/webmail/mailboxes-and-sharing/)
- [Webmail keyboard shortcuts](/docs/mail/webmail/keyboard-shortcuts/)
# Keep an address book in webmail
> Add, find, group, import and export the contacts of a mailbox in webmail, and write to a contact or a whole group.
Source: https://www.coritan.com/docs/mail/webmail/contacts/
In the dashboard:
- /webmail/contacts: https://www.coritan.com/webmail/contacts
Each mailbox has an *address book*, kept on the mail server with the mailbox. Everyone who can open the mailbox sees the same contacts, and a new message suggests addresses from them. Phones and mail apps that sync contacts reach the same address book, as [Set up mail apps and devices](/docs/mail/webmail/mail-apps/) describes.
## Before you begin
- Open the mailbox in webmail. Each mailbox has its own contacts, so [switch to the right one](/docs/mail/webmail/sign-in/#switch-between-mailboxes) first.
- To add, change, import or delete contacts, you need to be able to send from the mailbox. Someone who **Can only read** it can search the contacts, open them and export them.
## Open your contacts
Select **Contacts** in the folder list, under your labels. On a narrow screen, open the folder list first with **Folders**, the menu button at the top left. The page is at [www.coritan.com/webmail/contacts](https://www.coritan.com/webmail/contacts) for the mailbox on screen.
The page lists each contact with its first email address and phone number. **All contacts** above the list shows everyone, and each group's button beside it shows only that group's members. The group you select is in the page's address, so a reload keeps it. To go back to your mail, select the arrow beside the **Contacts** heading.
## Add a contact
1. Select **New contact**.
2. Enter a **First name** and a **Last name**.
3. Under **Email**, enter an address and choose **Work**, **Home** or **Other** beside it. Select **Add an address** for another one.
4. Under **Phone**, enter a number and choose **Mobile**, **Work**, **Home** or **Other**. Select **Add a number** for another one.
5. Optionally, fill in **Company**, **Job title** and **Notes**. Under **Groups**, tick each group the contact belongs to. **Groups** shows once the address book has a group.
6. Select **Add contact**.
We show `Added` followed by the name and `to your contacts.` A contact needs at least a name, a company, an email address or a phone number, and holds up to 10 addresses and 10 numbers.
To add the sender of a message you are reading, open the message's menu, **Message actions** at its top right, and select `Add` followed by the sender's name and `to contacts`. The menu offers it only while the sender is not in the address book.
Mail from a contact's first email address reaches your Inbox even when the spam filter takes it for spam, as long as it passes the DMARC check of the sender's domain. That is why **Not spam** adds the sender to your contacts ([Get mail out of Spam](/docs/mail/webmail/read-and-search/#get-mail-out-of-spam)). Delete the contact to let the spam filter judge their mail again.
## Find a contact
Type in **Search contacts** above the list. The list keeps each contact that has every word you typed in its name, company, job title, email addresses or phone numbers. A phone number matches however it is spaced. To search one group only, select the group first. Esc clears the search.
A long list shows 200 contacts at first, and the button at its end shows the next ones.
## Change or delete a contact
1. Select the contact's row. **Edit contact** opens.
2. Change what you need and select **Save changes**.
To delete the contact, select **Delete contact** in the same dialog, then **Delete contact** again to confirm. Phones and mail apps that sync the address book lose it too.
If you close the dialog with changes you have not saved, webmail asks first. Select **Keep editing** to go back, or **Discard** to close it.
Someone who **Can only read** the mailbox sees the contact's details instead, with **Close**.
## Write to a contact
Select the envelope button at the end of a contact's row. A new message opens with the contact's first email address in **To**.
In any message, start typing a name or an address in **To**, **Cc** or **Bcc**, and pick a contact from the suggestions. When you type a group's name, the suggestions offer the group with the number of people in it, and picking it adds each of them. See [Add recipients](/docs/mail/webmail/write-and-send/#add-recipients).
## Sort contacts into groups
A *group* is a named list of contacts, such as your team. A contact can be in more than one.
1. Select **New group** after the group buttons.
2. Enter a **Name** for the group and select **Create group**. The new group opens, empty.
3. Open each contact that belongs in it, tick the group under **Groups**, and select **Save changes**.
A contact you add while a group is open starts in that group.
With a group open, these buttons sit beside its name:
- **Write to the group** opens a new message to every member that has an email address.
- **Rename** changes the group's name.
- **Delete group** removes the group after you confirm. Its contacts stay in the address book.
## Import contacts
1. Export your contacts from where they are now:
- in Google Contacts, choose Export, then Google CSV or vCard;
- in Outlook, export them as a CSV file;
- in Apple Contacts, export them as a vCard.
2. On the **Contacts** page, select **Import**, then **Choose a file**, and choose the file.
We add each contact whose email address is not in the address book yet, and skip the others. A contact with no email address is skipped when one with the same name is there already. The message then says how many came in, such as `Imported 12 contacts. 3 were already here or could not be read.` A label or category on an imported contact becomes a group of that name, or joins the group that has it already.
A file can be up to 5 MB, and we read at most 5,000 contacts from one file.
## Export contacts
1. Select **Export**.
2. Choose **vCard file (.vcf)**, for phones and Apple Contacts, or **CSV file (.csv)**, for Google, Outlook and spreadsheets.
The browser downloads `contacts.vcf` or `contacts.csv`. Both keep each contact's groups.
## Troubleshooting
`Could not import the contacts: import up to 5 MB of contacts at a time.`
: The file is larger than 5 MB. Split it into smaller files and import each one.
A message that ends `no contacts found: import a CSV from Google or Outlook, or a vCard file.`
: We could not read a contact in the file. Export the contacts again as a Google or Outlook CSV file or as a vCard file, and import that.
A message that starts `Imported no new contacts.`
: Every contact in the file was in the address book already, or could not be read.
`No address book for this mailbox`
: The mail server that holds this mailbox keeps no contacts, so there is nothing to show or import for it.
`Enter a name, an email address or a phone number.`
: A contact needs at least one of them. Fill one in, then save.
`Enter an email address such as name@example.com.`
: An address under **Email** is not complete. Correct it, or remove it with the cross beside it.
A message that starts `You have a group called`
: Another group has that name already. Choose another name.
There is no **New contact** or **Import** button
: You can only read this mailbox. Ask its owner to give you **Can read, organize and send**.
## Related
- [Write and send email in webmail](/docs/mail/webmail/write-and-send/)
- [Set up mail apps and devices](/docs/mail/webmail/mail-apps/)
- [How webmail works](/docs/mail/webmail/)
# Sort mail with labels and filters
> Create labels, write filters that sort new mail as it arrives, and block senders you never want to hear from in webmail.
Source: https://www.coritan.com/docs/mail/webmail/labels-and-filters/
In the dashboard:
- /webmail/settings/labels: https://www.coritan.com/webmail/settings/labels
- /webmail/settings/filters: https://www.coritan.com/webmail/settings/filters
Labels group your conversations. They work like folders, but one conversation can have more than one label. Filters sort new mail as it arrives: they can move a message, label it, star it, forward it or delete it. Labels are on the **Labels** tab of webmail settings, at [www.coritan.com/webmail/settings/labels](https://www.coritan.com/webmail/settings/labels). Filters are on the **Filters and blocked** tab, at [www.coritan.com/webmail/settings/filters](https://www.coritan.com/webmail/settings/filters), which also blocks senders and imports and exports filters.
Filters run on the mail server, so they sort mail while webmail is closed, and every app that reads the mailbox sees the result. Labels show in mail apps as folders.
## Before you begin
- To create, rename or delete a label, you need to own the mailbox or be able to send from it. Someone who **Can only read** the mailbox sees its labels but cannot change them.
- The **Filters and blocked** tab is for whoever manages the mailbox: its owner, or, for a mailbox that no Coritan account owns, everyone who can send from it. See [Who sees each tab](/docs/mail/webmail/settings/#who-sees-each-tab).
## Create a label
1. In the sidebar, under **Labels**, select **New label**.
2. Type a name of up to 200 characters, then press Enter. To stop, press Esc.
The label appears in the sidebar. You can also create one on the **Labels** tab: type the name in **New label**, then select **Create label**. We show `Label created.`
To open the **Labels** tab from the sidebar, select the gear beside **Labels** (**Manage labels**).
## Label a conversation
- Open a conversation, or select some in the list, then select the tag button (**Labels**). Type in **Search labels** to narrow the list, then select a label to add it. A tick means the label is on every conversation you selected; select that label again to take it off.
- Drag conversations from the list onto a label in the sidebar. This adds the label and leaves them where they are.
- Select the folder button (**Move to**), then a label. The messages leave the folder you are in, and any other label they had, for that label alone.
To take a label off an open conversation, select the X on the label's name above the first message. You can also press l to open the **Labels** menu, or v for **Move to**.
Select a label in the sidebar to see its conversations. To search within one, see [Read and search mail in webmail](/docs/mail/webmail/read-and-search/).
## Rename or delete a label
The **Labels** tab lists every label with the number of conversations it has. Select a label's name to open it.
- To rename a label, select the pencil button beside it, change the name, then select **Save**. We show `Label renamed.`
- To delete a label, select the bin button beside it, then confirm with **Delete label**. We show `Label deleted.`
Deleting a label leaves its conversations in your mail. A conversation that was only under that label moves to Archive.
> [!NOTE]
> Webmail keeps the messages you schedule, the conversations you snooze and your templates in folders named Scheduled, Snoozed and Templates. They are not labels, so the **Labels** tab does not list them, but mail apps show them as folders.
## Create a filter
A filter has conditions and actions. When a new message meets the conditions, the actions run on it. Filters run from the top of the list, and every filter a message matches acts on it, until one says **Stop here**. A filter acts only on mail that arrives after you save it.
1. On the **Filters and blocked** tab, select **Add filter…**.
2. In **Name**, type a name for the filter, such as `Invoices`.
3. Under **When a message matches**, choose **All conditions** or **Any condition**.
4. Fill in the first condition: what to look at, how to compare, and what to look for, such as **From**, **contains** and `billing@example.com`. Select **Add condition** for another one.
5. Under **Then**, choose the first action and, where it asks, a folder or an address. Select **Add action** for another one.
6. Select **Add filter**.
We show `Filter “Invoices” added.`, and the filter appears at the bottom of the list with a summary of what it does.
You can also start from mail you have:
- From a message you are reading, open its menu (**Message actions**) and select **Filter messages like this**. The editor opens with the conditions **From** **contains** the sender's address and **Subject** **contains** the message's subject.
- From a search, select **Show search options** in the search bar, fill in the fields, then select **Create filter**. The editor opens with a condition for each field you filled in.
### What a filter can look at
| Look at | How it compares |
| --- | --- |
| **From**, **To**, **Cc**, **Subject**, **Message text** | **contains**, **does not contain** or **is** the text you type |
| **Size** | **is larger than** or **is smaller than** a whole number of MB |
| **Attachments** | **At least one** or **None** |
### What a filter can do
| Action | What happens to the message |
| --- | --- |
| **Move to** | It goes to the folder or label you choose, and not to the Inbox. |
| **Copy to** | It gets the label you choose, and it still arrives in the Inbox. |
| **Mark as read** | It arrives marked as read. |
| **Star it** | It arrives starred. |
| **Mark it important** | It arrives marked as important. |
| **Forward to** | It goes on to one confirmed address. A copy stays here unless you clear **Keep a copy in this mailbox**. See [Forward your mail to another address](/docs/mail/webmail/forwarding/). |
| **Discard it** | It is deleted as it arrives and never reaches Trash. |
| **Stop here** | The filters below this one do not run on it. |
A filter files mail into Inbox, Archive, Spam, Trash or one of your labels.
## Change or turn off a filter
The tab lists your filters in the order they run. On each row:
- The switch at the start turns the filter off or on. A filter that is off reads **Off**, stays in the list and does nothing.
- The arrows move the filter up or down the list.
- The pencil button opens the filter. Change it, then select **Save filter**.
- The bin button deletes the filter once you confirm with **Delete filter**. Mail the filter sorted already stays where it is.
Blocked senders run before your filters, and so does forwarding all mail. When all mail is forwarded, the tab says so above the list, with a link to the **Forwarding** tab.
## Block a sender
New messages from a blocked address go straight to Spam, even when the sender is one of your contacts. No other filter runs on them, so they are not forwarded either.
1. On the **Filters and blocked** tab, under **Blocked senders**, type an address such as `alex@example.com` in **Address or @domain**. To block everyone at a domain, type `@example.com`.
2. Select **Block**.
We show `Mail from alex@example.com goes to Spam from now on.`, and the address joins the list.
To block the sender of a message you are reading, open the message's menu (**Message actions**), select `Block` followed by the sender's name, then confirm with **Block**.
Mail that arrived before you blocked the sender stays where it is. To unblock an address, select **Unblock** beside it in **Blocked senders**.
## Import and export filters
- **Export** downloads `filters.json`, with your filters and blocked senders. Forwarding all mail is not in it. The button appears once you have a filter.
- **Import…** reads a `filters.json` exported from this webmail, or the `mailFilters.xml` file that Gmail exports from its Filters and Blocked Addresses settings. Imported filters go after the ones you have.
When you import, each label a filter uses is matched by name, and a label that does not exist yet is created. A filter keeps a forward only to an address that has confirmed on the **Forwarding** tab. Gmail filters that look for something this webmail cannot match, or that only do something it cannot do, such as sorting into categories, are left out. After the import, we say how many filters came in and what was left out.
## Filters written as Sieve
A mailbox's filters are kept on the mail server as a script in the Sieve language. Webmail writes that script for you from your filters and blocked senders. You can also write it yourself.
1. On the **Filters and blocked** tab, select **Edit as Sieve**. The **Sieve script** box shows the script your filters make.
2. Change the script. To have the mail server check it, select **Validate script**.
3. Select **Save script**. We show `Sieve script saved.`
To leave without saving, select **Back to rules**. If you changed the script, confirm with **Discard changes**.
Once you save a script of your own, the tab shows the script instead of the list, and so it does when another app changes the script. Until the filters are rules again, you cannot add filters, block senders or forward all mail. To go back to rules, select **Replace with rules…** and confirm with **Replace script**. The script is deleted and you start again with no filters, so copy the script first if you want to keep it.
## Limits
- A mailbox holds up to 100 filters. Forwarding all mail takes one, and blocked senders take one for each group of up to ten addresses.
- A filter has up to 10 conditions and 10 actions, and forwards to one address.
- What a condition looks for is up to 256 characters. A size is 1–1000 MB.
- A filter's name is up to 120 characters, and a label's name up to 200.
- A script is up to 100,000 characters.
## Troubleshooting
A new filter did not sort the mail already in the mailbox
: Filters act on mail as it arrives. To sort older mail, search for it, select the conversations, then use **Labels** or **Move to**.
`Filters are not available on this mail server.`
: The mail server that holds this mailbox runs no filters, so it cannot block senders or forward mail either. Labels still work.
`The mail server is not running these filters at the moment, so new mail is not sorted by them.`
: The filters are saved, but the mail server is not using them. Another app may have switched it to a script of its own. Save any change to the filters, such as turning one off and on again, to make them run again.
`Give the filter a name.`
: Type a name in **Name**.
`Enter what to look for.`
: A condition has an empty box. Type what to look for, or remove the condition with its X.
`Enter a whole number of MB from 1 to 1000.`
: A **Size** condition takes whole megabytes, such as `10`.
`Choose a folder.`
: A **Move to** or **Copy to** action has no folder yet. Choose one.
A message that starts `A filter forwards to one address.`
: Keep one **Forward to** action. To forward to two addresses, make a second filter with the same conditions.
A message that ends `has not confirmed forwarding from this mailbox yet. Confirm it on the Forwarding tab first.`
: The filter forwards to an address that has not confirmed. [Add and confirm the address](/docs/mail/webmail/forwarding/#add-and-confirm-a-forwarding-address), then save the filter again.
`That folder no longer exists. Choose another.` or `The folder this filter files into no longer exists. Choose another.`
: Someone deleted the label the filter files mail into. In the list, the filter's summary reads `a folder that no longer exists`. Edit the filter and choose another folder.
A message that says another filter `files into a folder that no longer exists, so no change to the filters can be saved`
: No change saves while a filter that is on files into a deleted label. Edit the filter the message names, or turn it off, then try again.
`The mail server did not accept the filter` or `The script has an error`
: The mail server could not read the filter or the script. The message says what it found. Fix the script, or replace it with rules.
A warning that starts `These filters are a Sieve script, so blocking waits until they are rules again.`
: You tried to block a sender while the filters are a script. Add the block to the script, or [replace the script with rules](#filters-written-as-sieve).
`This mailbox has no Spam folder, so it cannot block anyone.`
: Blocked mail goes to Spam, and this mailbox has none. A filter with **From** **contains** the address can still move the sender's mail elsewhere or discard it.
`There is a label with that name already.`
: Two labels cannot share a name. Choose another name, or use the label you have.
A message that ends `you can read this mailbox but not change it.`
: The mailbox was shared with you so that you can only read it. Ask its owner to let you send from it.
There is no **Labels** tab or no **Filters and blocked** tab
: **Labels** is for everyone who can send from the mailbox. **Filters and blocked** is for whoever manages it. Ask the mailbox's owner to make the change.
## Related
- [Forward your mail to another address](/docs/mail/webmail/forwarding/)
- [Read and search mail in webmail](/docs/mail/webmail/read-and-search/)
- [Change webmail settings](/docs/mail/webmail/settings/)
- [Open and share mailboxes in webmail](/docs/mail/webmail/mailboxes-and-sharing/)
# Forward your mail to another address
> Confirm an address with a code, then send all new mail on to it from webmail, or forward only some of it with a filter.
Source: https://www.coritan.com/docs/mail/webmail/forwarding/
In the dashboard:
- /webmail/settings/forwarding: https://www.coritan.com/webmail/settings/forwarding
The **Forwarding** tab of webmail settings sends every new message the mailbox receives on to another address as well. It is at [www.coritan.com/webmail/settings/forwarding](https://www.coritan.com/webmail/settings/forwarding) for the mailbox on screen. To forward only some messages, a filter does it instead.
Either way, the address has to confirm first. We send it a code from the mailbox, and nothing goes there until someone who reads it enters the code in webmail. Forwarding runs on the mail server as mail arrives, so it works with webmail closed. Forwarded mail leaves from this mailbox's own address.
## Before you begin
- Open the mailbox as someone who manages it: its owner, or, for a mailbox that no Coritan account owns, someone who can send from it. Nobody else sees the tab ([Who sees each tab](/docs/mail/webmail/settings/#who-sees-each-tab)).
- Be able to read the mail of the address you forward to, so you can copy the code.
## Add and confirm a forwarding address
1. On the **Forwarding** tab, under **Forwarding addresses**, enter the address in **Address**, such as `alex@example.com`.
2. Select **Send a code**. We show `We sent a code to alex@example.com. Enter it here once it arrives.`
3. In the other mailbox, open the message `Confirm forwarding from` followed by your mailbox's address, and copy the 8-digit code in it.
4. Back in webmail, type the code in the address's row and select **Confirm**.
The row now reads **Confirmed**. Until then it reads **Waiting for the code we sent**, and nothing is forwarded there.
- The code works for two days, and for 5 tries.
- **Send again** sends a new code, and the one before stops working.
- A mailbox can have up to 5 forwarding addresses and can send up to 10 codes a day.
- The message with the code also shows in this mailbox's **Sent** folder, because the mailbox sends it.
## Forward all mail
1. On the **Forwarding** tab, under **Forward all mail**, choose `To` followed by a confirmed address in **Forward new mail**.
2. In **This mailbox's copy**, choose what happens to the message here:
- **Keep it in the inbox** leaves it where it arrives;
- **Keep it, marked as read** leaves it there, marked as read;
- **Archive it** moves it to Archive;
- **Move it to Trash** moves it to Trash.
3. Select **Save changes**.
We show `New mail goes to alex@example.com as well from now on.`, and the address's row reads **Confirmed. All mail goes here.**
Forwarding applies to mail that arrives from now on. Messages from [blocked senders](/docs/mail/webmail/labels-and-filters/#block-a-sender) go to Spam and are not forwarded. Your own filters still run on this mailbox's copy.
## Forward some mail with a filter
A filter can forward the messages that match it to one confirmed address. Add the **Forward to** action to the filter and type the address; the field suggests your confirmed addresses. The filter keeps a copy in this mailbox unless you clear **Keep a copy in this mailbox**. See [Create a filter](/docs/mail/webmail/labels-and-filters/#create-a-filter).
## Stop forwarding
Choose **Off** in **Forward new mail**, then select **Save changes**. We show `Forwarding all mail is off.` The address stays confirmed, so you can turn forwarding on again without a new code.
A filter that forwards stops when you turn it off or delete it on the **Filters and blocked** tab.
## Remove a forwarding address
1. Select the bin button at the end of the address's row.
2. Confirm with **Remove address**.
We show `alex@example.com removed.` Removing an address also takes it out of every filter that forwards there, and a filter that did nothing else is deleted. When all mail goes to the address, removing it turns forwarding all mail off as well.
## Troubleshooting
`A mailbox does not forward to itself.`
: You entered an address that this mailbox sends as. Enter an address somewhere else.
`Enter an email address such as name@example.com.`
: Enter a whole address, such as `alex@example.com`.
A message that ends `is on the list already.`
: The address is on the list. Enter its code, or select **Send again** for a new one.
`This mailbox has 5 addresses. Remove one to add another.`
: [Remove an address](#remove-a-forwarding-address) you no longer use, then add the new one.
No code arrives
: Look in the other mailbox's spam folder for the message `Confirm forwarding from` followed by your address. If it is not there, select **Send again**.
`Enter the 8 digits of the code.`
: The code has 8 digits. Copy it again from the message.
`That code is not the one we sent.`
: Type the code from the newest message. Each new code replaces the one before.
`That code no longer works; send a new one.`
: Two days have passed, or the code was typed wrong 5 times. Select **Send again**, then enter the new code.
A message that ends `has not confirmed forwarding from this mailbox yet.`
: A filter or **Forward new mail** names an address that has not confirmed. [Add and confirm](#add-and-confirm-a-forwarding-address) the address, then save again.
`The filters are a Sieve script, so forwarding all mail waits until they are rules again.`
: The mailbox's filters are a script written by hand, and forwarding all mail works only with rules. Select **Open the Filters tab**, then change the script or replace it with rules, as [Filters written as Sieve](/docs/mail/webmail/labels-and-filters/#filters-written-as-sieve) explains.
A message that ends `The filters are a Sieve script that forwards there; change the script first.`
: The script forwards to the address you want to remove. Take the address out of the script, then remove it.
`Could not save forwarding: a filter files into a folder that no longer exists. Change that filter on the Filters tab first.`
: A filter moves mail into a folder that was deleted. Edit that filter on the **Filters and blocked** tab to choose another folder, then save again.
`Forwarding all mail works through filters, which this mail server does not run.`
: The mail server that holds this mailbox runs no filters, so it cannot forward mail.
A message that starts `Could not send a code to` and says there were too many requests
: The mailbox has sent 10 codes in the last 24 hours. Wait, then select **Send again**.
There is no **Forwarding** tab
: Only whoever manages the mailbox sees it. For a mailbox shared with you, ask its owner.
## Related
- [Sort mail with labels and filters](/docs/mail/webmail/labels-and-filters/)
- [Send an automatic reply while you are away](/docs/mail/webmail/out-of-office/)
- [Forward addresses with aliases](/docs/mail/mail-hosting/aliases/)
- [Change webmail settings](/docs/mail/webmail/settings/)
# Send an automatic reply while you are away
> Turn on an out-of-office reply in webmail, choose the days it runs, and turn it off from your inbox when you are back.
Source: https://www.coritan.com/docs/mail/webmail/out-of-office/
In the dashboard:
- /webmail/settings/vacation: https://www.coritan.com/webmail/settings/vacation
While an automatic reply is on, the mailbox answers each person who writes to it with a message you set, such as the day you are back. You set it on the **Out of office** tab of webmail settings, at [www.coritan.com/webmail/settings/vacation](https://www.coritan.com/webmail/settings/vacation) for the mailbox on screen. The mail server sends the reply, so it goes out with webmail closed.
## Before you begin
- Open the mailbox in webmail as someone who manages it: its owner, or, for a mailbox that no Coritan account owns, someone who can send from it. Nobody else sees the tab ([Who sees each tab](/docs/mail/webmail/settings/#who-sees-each-tab)).
- Know the days you are away, if the reply should start or stop on its own.
## Turn on an automatic reply
1. Go to **Settings**, then the **Out of office** tab.
2. Turn on **Send an automatic reply**.
3. Enter a **Subject** and a **Message**, such as `I am away until 14 October and will reply when I am back.`
4. To start or stop the reply on its own, choose a **First day**, a **Last day**, or both.
5. Select **Save**.
We show `The automatic reply is on.` When the first day is still to come, we show `The automatic reply starts on` followed by that day.
The days run from the start of the first day to the end of the last day, in UTC. Without a first day, the reply starts at once. Without a last day, it goes on until you turn it off.
While the reply answers mail, a bar above your conversations says `Your automatic reply is on until` followed by the last day, or `Your automatic reply is on.` when it has none. Its **Settings** button opens the **Out of office** tab.
## Turn off the automatic reply
- In the bar above your conversations, select **Turn off**.
- Or, on the **Out of office** tab, turn off **Send an automatic reply** and select **Save**.
We show `The automatic reply is off.` The subject, message and days stay on the tab, so next time you only turn it back on.
After its last day, the reply stops on its own and the bar goes away. The switch on the tab stays on until you turn it off.
## Troubleshooting
There is no **Out of office** tab
: Only whoever manages the mailbox sees it. For a mailbox shared with you, ask its owner to set the reply.
`The last day is before the first.`
: Choose a **Last day** on or after the **First day**.
`Automatic replies are not available for this mailbox.`
: The mail server that holds this mailbox cannot send automatic replies for it at the moment. Reload the page later. If it stays, [contact support](/docs/support/).
A message that starts `Could not save the automatic reply`
: The mail server did not take the change, and the message says why. Try again in a moment.
The reply started or stopped a few hours from midnight
: The days count in UTC. For a reply that must start before you leave, choose a first day one day earlier.
## Related
- [Change webmail settings](/docs/mail/webmail/settings/)
- [Forward your mail to another address](/docs/mail/webmail/forwarding/)
- [Sort mail with labels and filters](/docs/mail/webmail/labels-and-filters/)
# Open and share mailboxes in webmail
> See the mailboxes webmail opens, add one to your Coritan account, accept an invitation, and share a mailbox with other people.
Source: https://www.coritan.com/docs/mail/webmail/mailboxes-and-sharing/
In the dashboard:
- /webmail/settings/accounts: https://www.coritan.com/webmail/settings/accounts
Webmail shows every mailbox this browser can open in one list. That is every mailbox your Coritan account opens (your own, the ones you added and the ones shared with you), and any mailbox signed in on this browser with its own password. The account menu at the top right lists them, and the **Mailboxes** tab of settings manages your account's list and who else can open your mailboxes. Each mailbox keeps its own folders, labels and settings.
## Before you begin
- The **Mailboxes** tab needs your Coritan account. Sign in on coritan.com, or sign in to webmail with your coritan.gg address and your Coritan password ([Sign in to webmail](/docs/mail/webmail/sign-in/)).
- To add a mailbox to your account, have its address and password, and its two-factor code if it asks for one.
- To share a mailbox, you must own it and know your Coritan password. The other person needs a Coritan account.
## What each mailbox is
The account menu and the **Mailboxes** tab describe each mailbox in the same words:
**Your mailbox**
: The mailbox you took with your account. It stays with your account, and you cannot remove it. See [Get a coritan.gg mailbox](/docs/mail/webmail/claim-a-mailbox/).
**Added to your account**
: A mailbox you added with its password, such as one on your Mail Hosting service. Your account owns it in webmail.
**Given to you**
: A mailbox an admin gave to your account. Only an admin can take it back.
**Shared with you**
: A mailbox its owner shared with you to read, organise and send from.
**View only**
: A mailbox shared with you to read, and nothing more.
**Staff mailbox**
: A mailbox shared with you as a member of Coritan staff, through your [staff link](/docs/account/staff-link/). It opens only while your Coritan account has two-factor authentication on.
**Only on this browser**
: A mailbox signed in here with its own address and password. Your Coritan account does not list it, so it does not open anywhere else.
On the **Mailboxes** tab, a mailbox that is turned off reads `Turned off by whoever manages it`, and one we cannot reach at the moment reads `Cannot be reached right now`. The account menu says `Disabled, so it cannot be opened` and `Not reachable right now`. Neither opens until that changes.
To open another mailbox, select it in the account menu, or select **Open** beside it on the **Mailboxes** tab. [Switch between mailboxes](/docs/mail/webmail/sign-in/#switch-between-mailboxes) says what happens to the message you are writing.
## Add a mailbox to your account
A mailbox you add to your account opens wherever you sign in to Coritan. You can add a mailbox that Coritan hosts on this site and that no other Coritan account owns, such as one on your Mail Hosting service.
1. Go to **Settings**, then the **Mailboxes** tab.
2. Select **Add a mailbox to your account**. For a mailbox signed in on this browser already, select **Add to your account…** beside it instead.
3. Enter the mailbox's **Email address** and **Password**, then select **Add mailbox**.
4. If the mailbox has two-factor sign-in on, enter the code from its authenticator app in **Two-factor code**, then select **Add mailbox** again.
A message says `alex@example.com is in your mailboxes now.`, and the list shows the mailbox as **Added to your account**. We check the password once and do not keep it.
To read a mailbox on this browser only, without adding it to your account, use **Add another mailbox** in the account menu instead ([Add another mailbox](/docs/mail/webmail/sign-in/#add-another-mailbox)).
## Accept or decline an invitation
When someone shares a mailbox with you, it waits for your answer. The account menu shows **An invitation is waiting**.
1. Select **An invitation is waiting** in the account menu, or go to the **Mailboxes** tab.
2. Under **Invitations**, read who shared the mailbox and the access they gave you.
3. Select **Accept** to add the mailbox to your list, or **Decline** to turn it down.
If your account has no mailbox yet, [Webmail](https://www.coritan.com/webmail) lists the invitations on its first page, each with **Accept** and **Decline**.
## Share a mailbox
Only the owner of a mailbox can share it. The people you share it with see it in their own webmail beside their mailboxes. Your password, two-factor authentication and app passwords stay yours.
1. Open the mailbox you want to share, then go to **Settings** and the **Mailboxes** tab.
2. Under **Sharing**, in **Invite someone**, enter the email the other person signs in to Coritan with.
3. In **Access**, choose what they can do:
- **Can read, organize and send**: they read, organise and send as the mailbox, and can set up their own mail apps for it.
- **Can only read**: they read the mail and change nothing.
4. Enter your Coritan password in the field under them.
5. Select **Share**.
A message says `We invited alex@example.com.` The person's row reads **Invited, has not accepted yet** until they accept, then **Has access**. Sharing again with someone already on the list changes their access to what you chose.
A mailbox can be shared with up to 50 people, and you can send up to 20 invitations an hour.
People you share with keep their own view settings, such as **Density** and **Undo send**. The mailbox's name, signatures, filters, forwarding and automatic reply stay yours to change ([Who sees each tab](/docs/mail/webmail/settings/#who-sees-each-tab)).
## Change or end someone's access
1. Open the mailbox, then go to the **Mailboxes** tab.
2. Under **Sharing**, find the person.
3. Choose another access in the list on their row. To end their access, select the bin button on the row, then **Remove access**, or **Withdraw invitation** for someone who has not accepted yet.
The change takes effect at once. When you remove someone, the devices they set up for the mailbox on the **Mail apps** tab stop signing in too.
Access given by an admin shows **Given by an admin** and has no controls, because only an admin can change it.
## Remove or leave a mailbox
1. Go to the **Mailboxes** tab.
2. Beside the mailbox, select **Remove…** for one you added, or **Leave…** for one shared with you.
3. Confirm with **Remove mailbox** or **Leave mailbox**.
A message says `alex@example.com is no longer in your mailboxes.` A mailbox you remove stays as it is, mail included, and you can add it again with its password. After you leave one, its owner can invite you again. Your own mailbox, a staff mailbox, and a mailbox or access an admin gave you have neither button.
If the mailbox is on screen, webmail opens another one first.
## Troubleshooting
`That address and password do not match a mailbox you can add.`
: The address or the password is wrong, or the mailbox is not one that can be added to a Coritan account. Check both and try again.
`That two-factor code is not right.`
: Enter the code the mailbox's authenticator app shows now. Codes change every 30 seconds.
`This mailbox belongs to another Coritan account. Ask its owner to share it with you.`
: Another account owns the mailbox. Its owner can share it with you from their **Mailboxes** tab.
`No Coritan account uses that email address.`
: The email you entered under **Invite someone** is not the sign-in email of a Coritan account. Ask the person which email they sign in with, or ask them to [create an account](/docs/get-started/create-an-account/) first.
`Incorrect account password.`
: Enter the password you sign in to your Coritan account with, not the mailbox's password.
`A mailbox can be shared with at most 50 people.`
: Remove someone who no longer needs access, then share again.
A mailbox you added to your account left your list
: Someone changed or reset its password other than through your Coritan account: from its Mail Hosting service, or on the **Security** tab while signed in with the mailbox's own password. The people you had shared it with lost their access too. Add the mailbox again with its new password, then share it again.
`Turn on two-factor for your Coritan account to open it`
: The mailbox is a staff mailbox. Select **Turn on two-factor** beside it, and turn on [two-factor authentication](/docs/account/two-factor-authentication/#turn-it-on) for your account. The mailbox then opens.
`Open another mailbox first, then remove alex@example.com.`
: The mailbox is on screen and webmail has no other mailbox to open. Add or open another mailbox, then try again.
A message that says there were too many requests
: Your account can add up to 10 mailboxes an hour and send up to 20 invitations an hour. Wait, then try again.
## Related
- [How webmail works](/docs/mail/webmail/)
- [Sign in to webmail](/docs/mail/webmail/sign-in/)
- [Set up mail apps and devices](/docs/mail/webmail/mail-apps/)
- [Protect your webmail mailbox](/docs/mail/webmail/security/)
# Protect your webmail mailbox
> Change a mailbox's password, turn two-factor authentication on or off, manage app passwords and end sessions from the Security tab in webmail.
Source: https://www.coritan.com/docs/mail/webmail/security/
In the dashboard:
- /webmail/settings/security: https://www.coritan.com/webmail/settings/security
The **Security** tab of webmail settings controls how people and mail apps sign in to a mailbox: its password, its two-factor authentication and its app passwords. For a mailbox you signed in to with its address, it also lists the browsers signed in to it. Open it from **Settings**, or go to [Security settings](https://www.coritan.com/webmail/settings/security) for the mailbox on screen.
Everything on the tab belongs to the mailbox. Your Coritan account has a password and two-factor authentication of its own, and the tab links to them when the mailbox opened through your account. For those, see [Turn on two-factor authentication](/docs/account/two-factor-authentication/).
## Before you begin
- Open the mailbox as its owner. The tab shows for your own coritan.gg mailbox, a mailbox you added to your account or an admin gave you, and any mailbox you signed in to with its own address and password. It does not show for a mailbox shared with you.
- Know the password the tab asks for:
- When the mailbox opened through your Coritan account, the tab asks for `Your Coritan password`. That covers being signed in on coritan.com, and a mailbox that your coritan.gg sign-in opened beside its own.
- When you signed in with this mailbox's own address, the tab asks for its **Current password**. For your coritan.gg mailbox, that is your Coritan password until you give the mailbox one of its own.
- For two-factor authentication, have an authenticator app on a phone or computer.
## Change the mailbox password
The section is called **Mailbox password** when the mailbox opened through your Coritan account, and **Password** when you signed in with its address.
1. On the **Security** tab, enter `Your Coritan password` or the **Current password**, whichever the form asks for.
2. Enter the new password in **New password**, and again in **Confirm the new password**. It must be 12–128 characters and differ from the current one.
3. If two-factor authentication is on, you can tick **Also turn off two-factor sign-in** to turn it off at the same time.
4. Select **Change password**.
We show `Password changed, and every other session signed out. Mail apps that sign in with the password need the new one.` From then on:
- enter the new password in each mail app that used the old one;
- app passwords keep working;
- every browser signed in to the mailbox with its address is signed out, except this one if you signed in that way.
The new password is for the mailbox alone. Your Coritan password stays as it is.
For your coritan.gg mailbox, the new password becomes the mailbox's own. Mail apps and the mailbox's own sign-in use it from then on, and changing your Coritan password no longer changes it. Signing in to webmail with your coritan.gg address and your Coritan password still works, and still opens every mailbox your account can open.
Through your Coritan account, the form never asks for the mailbox's old password. That makes it the way to set a new one when you have forgotten the mailbox's password.
If you change the password of a mailbox you added to your account while signed in with the mailbox's own password, the mailbox leaves your account, and so does the access you gave other people. Change it through your Coritan account to keep both.
## Turn on two-factor authentication
With two-factor authentication on, mail apps and the webmail sign-in form ask for a six-digit code from an authenticator app along with the mailbox's password. Opening the mailbox through your Coritan account never asks for it, because your account's own sign-in protects that. Signing in with your coritan.gg address and your Coritan password asks for your account's code instead, when your account has two-factor authentication on.
Mail apps cannot ask for a code. Before you turn it on, give each mail app that signs in with the password an [app password](#create-an-app-password) of its own, or it stops getting mail.
1. On the **Security** tab, under **Two-factor sign-in**, turn on **Ask for a code when signing in**.
2. In **Add this mailbox to your authenticator**, select **Open in authenticator** on the device that has the app. Or select **Copy key** and type the key into the app.
3. Select **Done**. You will not see the key again, so keep a copy somewhere safe.
Turning it on signs out every browser signed in to the mailbox with its address, except this one if you signed in that way. From then on, signing in with the mailbox's password shows **Enter your code** after it, as [Enter a code](/docs/mail/webmail/sign-in/#enter-a-code) describes.
## Turn off two-factor authentication
1. On the **Security** tab, turn off **Ask for a code when signing in**.
2. In **Turn off two-factor sign-in?**, enter `Your Coritan password`, or the mailbox's **Password** when you signed in with its address.
3. Select **Turn off two-factor**.
We show `Two-factor sign-in is off.` Every browser signed in to the mailbox with its address is signed out, except this one if you signed in that way.
When you signed in with the mailbox's address, its password stays as it is. Through your Coritan account, webmail sets the mailbox's password to your Coritan password as it turns two-factor authentication off:
- for your coritan.gg mailbox, that is its password already;
- for a mailbox you added or an admin gave you, your Coritan password becomes its password, so mail apps that used the old one need your Coritan password or an app password.
Once a mailbox's password has been changed on this tab, the switch cannot turn two-factor authentication off through your Coritan account. [Change the password](#change-the-mailbox-password) with **Also turn off two-factor sign-in** ticked instead.
## Create an app password
An app password signs one mail app in to the mailbox in place of its password, and it skips the two-factor code. Give each app its own, so you can revoke one without touching the others.
1. On the **Security** tab, under **App passwords**, type the app or device in **New app password for**, such as `Thunderbird`. It takes up to 64 characters.
2. Select **Create app password**.
3. Select **Copy password** and paste the password into the app. We show it once.
4. Select **Done**.
In the mail app, use the mailbox's address as the username and the app password as the password. [Set up mail apps and devices](/docs/mail/webmail/mail-apps/) lists the server settings.
The list also shows the passwords that webmail made for devices on the **Mail apps** tab, including those of the people you share the mailbox with. Their names end with the person's email in brackets.
The mail server keeps at most ten app passwords for a mailbox. Webmail may use one itself, and each browser signed in with the mailbox's address and each device set up on the **Mail apps** tab uses one, so you may be able to create fewer.
## Revoke an app password
1. On the **Security** tab, find the password under **App passwords** by its name.
2. Select **Revoke…** on its row, then **Revoke app password**.
We show `App password revoked.` The app or device that used it can no longer sign in, and gets no mail until you give it a new password.
## See and end sessions
A *session* is one browser signed in to the mailbox with its address and password. The **Sessions** list shows every session of the mailbox, and it is on the tab when you signed in to this mailbox with its address. Through your Coritan account there are no sessions to list.
Each row shows the browser and system, the IP address, when it signed in and when it was last used. The row for the browser you are using says **This device**.
- To sign out another browser, select **Revoke…** on its row, then **Revoke session**.
- To sign out every browser but this one, select **Sign out everywhere else…**, then **Sign out everywhere else**.
- To sign out this browser, select **Sign out…** on its row, then **Sign out**.
Ending a session does not change the password, so anyone who knows it can sign in again. To keep someone out, [change the password](#change-the-mailbox-password) as well.
Sessions also end on their own, as [How long you stay signed in](/docs/mail/webmail/sign-in/#how-long-you-stay-signed-in) explains. To sign out of Coritan on other browsers, see [Sign out and end sessions](/docs/account/sessions/). Whoever manages a Mail Hosting service can also [end a mailbox's webmail sessions](/docs/mail/mail-hosting/mailbox-security/#end-webmail-sessions) from its panel.
## Troubleshooting
There is no **Security** tab
: Only the mailbox's owner sees it. For a mailbox shared with you, ask its owner to make the change.
`That is not your Coritan password.`
: Enter the password you sign in to Coritan with, not the mailbox's password.
`That is not the current password.` or `That is not the password for this mailbox.`
: Enter the mailbox's own password. If you signed in with your coritan.gg address and your Coritan password after giving the mailbox a password of its own, the form wants the mailbox's own. To use your Coritan password instead, sign in on coritan.com and open webmail from there. Wrong passwords here count towards the same limit as signing in to the address, which [Sign in to webmail](/docs/mail/webmail/sign-in/#troubleshooting) explains, and past it the tab says there were too many requests.
`Use at least 12 characters.`
: A new password must be 12–128 characters.
`Choose a password different from the current one.`
: Type a new password that is not the one you entered first.
`The two new passwords do not match.`
: Type the same new password in both fields.
A message that starts `Could not turn it off: This mailbox has its own password`
: The mailbox's password has been changed on this tab, so the switch cannot turn two-factor authentication off through your Coritan account. [Change the password](#change-the-mailbox-password) with **Also turn off two-factor sign-in** ticked.
A mail app stopped signing in after two-factor authentication went on
: The app signs in with the mailbox's password, and it cannot send a code. [Create an app password](#create-an-app-password) and enter it in the app in place of the password.
A mail app stopped signing in after a password change
: Enter the new password in the app, or give the app an app password.
`Name the device or app it is for.`
: Type a name in **New app password for** first.
`Could not create the app password: that label is reserved.`
: The names `webmail` and `webmail session` belong to webmail. Choose another name.
A message that starts `Could not create the app password: mail engine error`
: The mail server refused the new password. The mailbox may hold ten already. Revoke one you no longer use, or end a session, then try again.
`The mail server did not return the password. Revoke this one and create another.`
: Revoke the new app password in the list, then create another.
You forgot the mailbox password
: Through your Coritan account, the form asks for your Coritan password only. Sign in on coritan.com, open webmail and [change the password](#change-the-mailbox-password). For a Mail Hosting mailbox that is not in your account, whoever manages the service can [reset its password](/docs/mail/mail-hosting/mailboxes/#reset-a-mailbox-password).
## Related
- [Sign in to webmail](/docs/mail/webmail/sign-in/)
- [Set up mail apps and devices](/docs/mail/webmail/mail-apps/)
- [Secure a mailbox](/docs/mail/mail-hosting/mailbox-security/)
- [Turn on two-factor authentication](/docs/account/two-factor-authentication/)
- [Sign out and end sessions](/docs/account/sessions/)
# Set up mail apps and devices
> Find the settings a mail app needs, set up an iPhone, iPad or Mac with a code, and remove a device from webmail.
Source: https://www.coritan.com/docs/mail/webmail/mail-apps/
In the dashboard:
- /webmail/settings/apps: https://www.coritan.com/webmail/settings/apps
The **Mail apps** tab of webmail settings has what a phone or desktop mail app needs to open the mailbox: its server settings, and a code that sets up an iPhone, iPad or Mac with a password made for that device. It is at [www.coritan.com/webmail/settings/apps](https://www.coritan.com/webmail/settings/apps) for the mailbox on screen. Mail apps read mail over IMAP and send it over SMTP.
## Before you begin
- Own the mailbox or be able to send from it. Someone who **Can only read** a mailbox has no **Mail apps** tab.
- A staff mailbox opens in webmail only, so it cannot be set up in a mail app.
- When two-factor authentication is on for the mailbox, a mail app cannot sign in with the mailbox's password, because it cannot send a code. Set the app up with a code, or give it an app password.
## Find the server settings
The tab lists these settings. The copy button beside a setting copies it. For a server, it copies the name alone.
**Email address** and **Username**
: The mailbox's full address, such as `alex@coritan.gg`.
**Password**
: What the app signs in with. The row names it:
- `Your Coritan password` for the mailbox your Coritan account came with, until it has a password of its own;
- `The mailbox's own password` for every other mailbox, and for that one once you [change its password](/docs/mail/webmail/security/#change-the-mailbox-password).
An app password works for any mailbox. The owner creates app passwords on the **Security** tab.
**Incoming mail (IMAP)**
: The server that apps read mail from, with port `993` and SSL/TLS.
**Outgoing mail (SMTP)**
: The server that apps send mail through, with port `587` and STARTTLS.
**JMAP**
: The address for an app that asks for a JMAP server. Most apps do not.
**Storage** and **Largest attachment**
: How much of its storage the mailbox uses, and the largest attachment webmail takes.
Many mail apps look these settings up from your address alone. When an app asks for them, [set it up by hand](/docs/mail/mail-hosting/connect-a-mail-app/#set-up-an-app-by-hand) with the names from this tab.
## Set up an iPhone, iPad or Mac
A code sets up the mailbox in Mail and its contacts in Contacts, with a password made for that device alone. It works for a mailbox shared with you too, so you never need the mailbox's password.
1. On the **Mail apps** tab, under **iPhone, iPad or Mac**, name the device in **Device**, or keep `iPhone`. A name can be up to 40 characters.
2. Select **Make a code**. A QR code appears.
3. Within 15 minutes, scan the code with the device's camera. On the device itself, you can select **Open the profile on this device** instead. The code works once.
4. Install the profile on the device. On an iPhone or iPad, the downloaded profile waits in the Settings app.
5. Select **Done** in webmail.
The password is made when the device opens the code. Until then, the device's row reads **Waiting for its code to be opened**. Once the device has opened it, the row reads **In use**, with the date it was set up.
## Set up another mail app
For Outlook, Thunderbird, Android and other apps:
1. Choose what the app signs in with. The owner can [create an app password](/docs/mail/webmail/security/#create-an-app-password) for it on the **Security** tab. Without two-factor authentication, the password the **Password** row names works too.
2. In the app, add an account with the [server settings](#find-the-server-settings) from the tab. Use the mailbox's address as the username.
For a mailbox shared with you, webmail sets up only an iPhone, iPad or Mac. For another app, ask the mailbox's owner for an app password.
## Remove a device
1. On the **Mail apps** tab, find the device under **iPhone, iPad or Mac**.
2. Select the bin button at the end of its row, then confirm with **Remove device**.
We show the device's name followed by `removed.` The device stops signing in to the mailbox at once.
Each person sees only the devices they set up. The mailbox's owner also finds every device's password under **App passwords** on the **Security** tab, where a device that someone the mailbox is shared with set up shows their email address after its name. A device also stops signing in when:
- the owner removes your access to a shared mailbox, or changes it to **Can only read**;
- the mailbox passes to a new owner, for the devices the previous owner set up.
## Limits
- Each person can have up to 20 devices on one mailbox.
- Each person can make up to 10 codes an hour for one mailbox.
- A mailbox holds at most ten app passwords, and each device's password is one of them. The mail server can refuse a new device before you reach 20.
## Troubleshooting
**Its code was not opened in time**
: Nobody opened the code within 15 minutes. Remove the row, then make a new code.
`This link has been used or has expired; make a new one in the webmail`
: Each code opens once, within 15 minutes. Make a new code.
The device warns that the profile is not signed
: We do not sign the profile. Check that it names your mailbox's address, then install it.
`The mail server made no password; make a new link in the webmail`
: The mailbox may already hold ten app passwords. Remove a device you no longer use, or ask the owner to revoke an app password on the **Security** tab. Then make a new code.
`The mail server cannot be reached; try again in a moment`
: Wait a minute, then open the code again. If 15 minutes have passed, make a new code.
**Make a code** is greyed out
: The **Device** field is empty, or you have 20 devices on this mailbox. Name the device, or remove one you no longer use.
A message that ends `too many requests for this action. Please wait and try again.`
: You made 10 codes for this mailbox within an hour. Wait, then try again.
A message that ends `which checks two-factor each time; a device could not.`
: This is a staff mailbox, which opens in webmail only. Read it in webmail.
`Your devices could not be loaded.`
: Reload the page. You can still make a code.
The app says the username or password is wrong
: Use the full address as the username. If two-factor authentication is on for the mailbox, the app needs an app password, or a code for an iPhone, iPad or Mac. For more causes, see [Connect a mail app to Mail Hosting](/docs/mail/mail-hosting/connect-a-mail-app/#troubleshooting).
## Related
- [Protect your webmail mailbox](/docs/mail/webmail/security/)
- [Connect a mail app to Mail Hosting](/docs/mail/mail-hosting/connect-a-mail-app/)
- [Open and share mailboxes in webmail](/docs/mail/webmail/mailboxes-and-sharing/)
# Import mail into webmail
> Bring your old mail into a webmail mailbox from another provider or a file, and follow each import until it finishes.
Source: https://www.coritan.com/docs/mail/webmail/import/
In the dashboard:
- /webmail/settings/import: https://www.coritan.com/webmail/settings/import
An *import* copies mail into the mailbox you have open, from another mail server or from a file. You start one on the **Import** tab of webmail settings, at [www.coritan.com/webmail/settings/import](https://www.coritan.com/webmail/settings/import). The import runs on our side, so it goes on after you close the page. Messages keep their folders, their read and flagged state and their own dates, and nothing changes on the other server.
The same imports can be started from the Mail Hosting panel, as [Move existing mail into a mailbox](/docs/mail/mail-hosting/move-mail-in/) describes.
## Before you begin
- Open the mailbox the mail should go into. With more than one mailbox, [switch to it](/docs/mail/webmail/sign-in/#switch-between-mailboxes) first.
- Own the mailbox or be able to send from it. Someone who **Can only read** the mailbox has no **Import** tab.
- Make sure the mailbox has room for the mail. An import pauses when the mailbox is full. The storage line at the foot of the sidebar shows how much is used.
- For another server, have the old mailbox's address and password, and turn on IMAP there. Many providers want an *app password* made in their own settings, and the hint under **Provider** says what each one needs.
- For a file, have the mail as an mbox file, a single `.eml` message, a zip or tar of mail or Maildir folders, or a cPanel backup.
## Open the Import tab
In webmail, select **Settings** at the foot of the sidebar, then the **Import** tab.
## Import from another mail server
1. Under **From another mail server**, choose where the mail is now in **Provider**, such as `Yahoo Mail` or `iCloud Mail`. For a server the list does not name, choose `Another IMAP server` or `cPanel`, then enter the server's name in **Server**.
2. In **Username**, enter the old mailbox's sign-in name, usually its full address. In **Password**, enter its password or app password.
3. To copy the old Trash or Spam folders too, turn on **Also bring Trash** or **Also bring Spam**.
4. Select **Start the import**.
We try the password first, so a wrong one fails straight away. When it works, we show `The import has started. It goes on with this tab closed.` and the import appears under **Imports**. The old server must offer IMAP over TLS on port `993`. We use the password for this import only, then forget it.
Webmail brings all of the old mailbox's mail. To bring only the mail from some dates, start the import [with the API](/docs/mail/mail-hosting/move-mail-in/#with-the-api) instead.
## Import from Gmail or Microsoft 365 by signing in
When **Provider** offers **Gmail: sign in with Google** or **Microsoft 365 or Outlook.com: sign in with Microsoft**, you can sign in on the provider's own page and give us no password. The access ends with the import.
1. In **Provider**, choose one of those two.
2. Optionally, turn on **Also bring Trash** or **Also bring Spam**.
3. Select `Continue with Google` or `Continue with Microsoft`, and sign in there.
You come back to the **Import** tab, and we show `Signed in. The import has started, and goes on with this tab closed.` If the sign-in did not work, the message says why. To import from Gmail without signing in, choose `Gmail with an app password` and make an app password in your Google account.
## Import from a file
1. Under **From a file**, choose the file in **File**.
2. In **Put its mail in**, name the folder for mail that the file keeps in no folder, such as an mbox or an `.eml`. It is `Imported` by default.
3. For a cPanel backup, enter the mailbox you want in **Mailbox in a cPanel backup**. Leave it empty to import the mailbox with this mailbox's own address.
4. To copy the file's Trash or Spam folders too, turn on **Also bring its Trash** or **Also bring its Spam**.
5. Select **Upload and import**. A bar shows how much has uploaded. Keep the page open until the upload finishes.
When the upload ends, we show the file's name followed by `is uploaded. Its mail is on its way in.` A file can be up to 2 GB by default. The note under **From a file** gives the limit that applies to your mailbox. [Move existing mail into a mailbox](/docs/mail/mail-hosting/move-mail-in/#import-from-a-file) lists the kinds of file we read and what we take from each.
## Follow an import
Each import under **Imports** names its source, shows its status and counts its messages: how many came in, how many were already here, how many were left out and how many the mailbox refused. The list updates by itself every 5 seconds while an import is waiting or running.
| Status | Meaning |
| --- | --- |
| **Waiting to start** | Queued to start. |
| **Importing** | Copying mail now. |
| **Paused** | Stopped for now. You paused it, the mailbox is full, or an error interrupted it. |
| **Done** | Every message has been copied. |
| **Stopped** | It failed. The row says why. |
| **Cancelled** | You cancelled it. |
We leave out messages marked deleted, messages larger than 50 MB and messages an earlier import already brought. [Where the mail goes](/docs/mail/mail-hosting/move-mail-in/#where-the-mail-goes) says which folder each old folder goes into.
## Pause, resume or cancel an import
- To pause an import that is waiting or running, select **Pause** on its row.
- To go on with a paused import, select **Resume**. It goes on from where it stopped.
- To stop an import for good, select the X at the end of its row, then confirm with **Cancel import**. The mail that has come in already stays in the mailbox.
Running the same import again is safe. Messages already copied count as already here and are not copied twice.
## Troubleshooting
`3 imports are under way into this mailbox; wait for one to end`
: A mailbox takes three imports at a time, counting waiting and paused ones. Wait for one to finish, or cancel one.
`Too many requests for this action. Please wait and try again.`
: A mailbox takes up to 20 import attempts a day, counting those the old server refused and those started from the Mail Hosting panel. Try again later.
`The mailbox is full. Make room in it, then resume the import.`
: An import stops when the mailbox reaches its quota. Delete mail you do not need, or ask whoever manages the mailbox for more room, then select **Resume**. For a Mail Hosting mailbox, see [Change a mailbox's quota](/docs/mail/mail-hosting/mailboxes/#change-a-mailbox-s-quota).
`The import stopped on an error. Resume it to go on from where it was.`
: Something interrupted the import, such as the old server closing the connection. Select **Resume**.
`Could not load the imports`
: Select **Try again**. If it keeps failing, reload the page.
There is no **Import** tab
: You can only read this mailbox. Ask its owner to change your access to **Can read, organize and send**.
The old server refused the sign-in, or a file was not read
: [Move existing mail into a mailbox](/docs/mail/mail-hosting/move-mail-in/#troubleshooting) explains each of those messages.
## Related
- [Move existing mail into a mailbox](/docs/mail/mail-hosting/move-mail-in/)
- [Import contacts](/docs/mail/webmail/contacts/#import-contacts)
- [Change webmail settings](/docs/mail/webmail/settings/)
# Change webmail settings
> Set the name people see, your signatures, how webmail shows mail and your notifications, and find every other tab of webmail settings.
Source: https://www.coritan.com/docs/mail/webmail/settings/
In the dashboard:
- /webmail/settings/general: https://www.coritan.com/webmail/settings/general
Webmail keeps the settings of the mailbox on screen in tabs. This page covers the **General** tab, where you set the name and signatures people see and how webmail shows mail to you. It also lists every tab, who sees it and the page that covers it.
## Before you begin
- Open the mailbox in webmail.
- The name, reply-to address and signatures of a mailbox belong to whoever manages it. Everyone else changes only their own view settings, as [Who sees each tab](#who-sees-each-tab) explains.
## Open settings
Select **Settings** at the bottom of the folder list, the gear at the top right, or **Settings** in the account menu. Settings open on the **General** tab, at [www.coritan.com/webmail/settings/general](https://www.coritan.com/webmail/settings/general) for the mailbox on screen.
Each tab has an address of its own under `/webmail/settings/`, so you can bookmark one. An address with a tab you do not see opens **General**. On a narrow screen, the tabs are one row that scrolls sideways.
To go back to your mail, select the arrow beside the **Settings** heading.
## Who sees each tab
Each person sees the tabs that their access to the mailbox allows.
| Tab | Address | Who sees it | Covered in |
| --- | --- | --- | --- |
| **General** | `/webmail/settings/general` | Everyone | This page |
| **Labels** | `/webmail/settings/labels` | Everyone who can send from the mailbox | [Sort mail with labels and filters](/docs/mail/webmail/labels-and-filters/) |
| **Filters and blocked** | `/webmail/settings/filters` | Whoever manages the mailbox | [Sort mail with labels and filters](/docs/mail/webmail/labels-and-filters/) |
| **Forwarding** | `/webmail/settings/forwarding` | Whoever manages the mailbox | [Forward your mail to another address](/docs/mail/webmail/forwarding/) |
| **Out of office** | `/webmail/settings/vacation` | Whoever manages the mailbox | [Send an automatic reply while you are away](/docs/mail/webmail/out-of-office/) |
| **Mailboxes** | `/webmail/settings/accounts` | Anyone using webmail through a Coritan account | [Open and share mailboxes in webmail](/docs/mail/webmail/mailboxes-and-sharing/) |
| **Security** | `/webmail/settings/security` | The owner | [Protect your webmail mailbox](/docs/mail/webmail/security/) |
| **Mail apps** | `/webmail/settings/apps` | Everyone who can send from the mailbox | [Set up mail apps and devices](/docs/mail/webmail/mail-apps/) |
| **Import** | `/webmail/settings/import` | Everyone who can send from the mailbox | [Import mail into webmail](/docs/mail/webmail/import/) |
*The owner*
: You own your coritan.gg mailbox, a mailbox you added to your account, a mailbox an admin gave you, and any mailbox you signed in to with its own password.
*Everyone who can send from the mailbox*
: The owner, and the people it is shared with who **Can read, organize and send**. People who **Can only read** it see **General** and **Mailboxes**.
*Whoever manages the mailbox*
: Its owner. For a mailbox that no Coritan account owns, everyone who can send from it.
*Anyone using webmail through a Coritan account*
: You are signed in on coritan.com, or signed in to webmail with your coritan.gg address and your Coritan password.
## Set your name and reply-to address
1. On the **General** tab, under **Identities**, select **Edit…** beside the address.
2. In **Name**, enter the name that the people you write to see.
3. In **Reply-to**, enter the address that replies should go to, such as `alex@example.com`. Leave it empty to get replies at the address itself.
4. Select **Save changes**.
We show `Identity saved.` The row then shows the name, and `Replies go to` followed by the address when you set one.
The mailbox sends as its own address and as each [alias](/docs/mail/mail-hosting/aliases/) that delivers to it. When it has more than one, **Identities** lists them all, the mailbox's own address marked **Primary**, and each keeps its own name and reply-to address. You pick the address for a message in its **From** list, as [Write and send email in webmail](/docs/mail/webmail/write-and-send/) explains.
People who do not manage the mailbox see the list without **Edit…**.
## Add a signature
A mailbox keeps up to 20 signatures. Each address starts new mail with one of them, and replies and forwards with another.
1. On the **General** tab, under **Signatures**, select **New signature**.
2. In **Name**, name the signature, such as `Work`, then write it in **Signature**.
3. Under **Starts with**, choose a signature for each address: one for **New mail** and one for **Replies and forwards**. Choose **No signature** for none.
4. Select **Save signatures**.
We show `Signatures saved.` To change a signature, select it in the list, edit it, then select **Save signatures**. To remove the one you have open, select **Delete this signature**, then **Save signatures**.
As you write a message, its **Signature** menu swaps in another signature for that message only.
People who do not manage the mailbox see which signatures it has but cannot change them. They pick one for each message from the **Signature** menu.
## Reading and sending
These settings sit under **Reading and sending** on the **General** tab.
**Undo send**
: How long you have to take back a sent message: **Off**, **5 s**, **10 s**, **20 s** or **30 s**. It is 5 seconds unless you change it. See [Undo a send](/docs/mail/webmail/write-and-send/#undo-a-send).
**Density**
: **Comfortable** or **Compact**, which fits more conversations on the screen. **Comfortable** is the default.
**Images in messages**
: **Ask first** hides the pictures that a message loads from the web until you choose to show them, which keeps senders from seeing when you open it. **Always show** shows them straight away. **Ask first** is the default.
**Desktop notifications**
: Tells you of new mail while the webmail tab is in the background. It is off until you turn it on, and the browser asks for your permission the first time.
**With the webmail closed**
: Tells you of this mailbox's new mail on this browser even when no webmail tab is open. It shows only in a browser that supports it, and you turn it on in each browser for each mailbox.
**Always show images from**
: The senders whose images you chose to show every time. Select the cross beside a sender to ask first again.
For a mailbox shared with you, **Undo send**, **Density** and **Desktop notifications** are your own, and the owner keeps theirs. **Images in messages** and **Always show images from** are the mailbox's, so only whoever manages it can change them.
## Troubleshooting
`Could not load your settings`
: Webmail could not read the mailbox's settings from the mail server. Select **Try again**.
There is no **Edit…** button, or no way to change the signatures
: You do not manage the mailbox. Ask its owner to make the change.
`Enter an email address such as name@example.com.`
: The **Reply-to** address is not complete. Enter a whole address, or leave the field empty.
`This mailbox can no longer send as alex@example.com, so these changes cannot be saved.`
: The alias behind that address no longer delivers to the mailbox. Whoever manages the Mail Hosting service can add it again. Select **Close**.
`This signature is too long to save. Shorten it, or take out an image or some formatting.`
: A signature holds about 20,000 characters, formatting included. Shorten it, then select **Save signatures** again.
**New signature** is greyed out
: The mailbox has 20 signatures, which is as many as it keeps. Delete one you no longer use, select **Save signatures**, then add the new one.
`The browser is blocking notifications for this page. Allow them in its site settings, then turn this on again.`
: Allow notifications for www.coritan.com in the browser's site settings, then turn **Desktop notifications** on again.
**Images in messages** goes back to **Ask first**
: The mailbox was shared with you, and only whoever manages it changes this setting.
## Related
- [How webmail works](/docs/mail/webmail/)
- [Write and send email in webmail](/docs/mail/webmail/write-and-send/)
- [Send an automatic reply while you are away](/docs/mail/webmail/out-of-office/)
- [Open and share mailboxes in webmail](/docs/mail/webmail/mailboxes-and-sharing/)
# Webmail keyboard shortcuts
> Every keyboard shortcut in webmail, for moving around, acting on conversations and writing mail.
Source: https://www.coritan.com/docs/mail/webmail/keyboard-shortcuts/
In the dashboard:
- /webmail/…: https://www.coritan.com/webmail
Webmail takes the keys that most mail apps use. To see the list while you work, press ?, select the keyboard button at the top of the page, or choose **Keyboard shortcuts** in the account menu.
## Navigation
| Keys | What it does |
| --- | --- |
| g then i | Go to Inbox |
| g then s | Go to Starred |
| g then t | Go to Sent |
| g then d | Go to Drafts |
| g then a | Go to All mail |
| / | Put the cursor in the search box |
| j or ↓ | In the list, move to the next conversation. While you read, j opens the next conversation in the list. |
| k or ↑ | In the list, move to the previous conversation. While you read, k opens the previous conversation in the list. |
| Enter or o | Open the conversation the list is on |
| u | Go back from a conversation to the list |
| n | While you read, open the next conversation in the list |
| p | While you read, open the previous conversation in the list |
| ? | Show or hide the list of shortcuts |
| Esc | Close a dialog, such as the list of shortcuts, or clear the selection |
The list shows the newest conversations first, so the next conversation is an older one.
## Actions
An action key works on the conversations you have selected. With nothing selected, it works on the conversation the list is on, or on the one you are reading.
| Keys | What it does |
| --- | --- |
| c | Open a new message |
| r | While you read, reply to the newest message that is not a draft |
| a | While you read, reply to everyone on that message |
| f | While you read, forward that message |
| e | Archive |
| # | Move to Trash. In Trash or Spam, delete forever. |
| ! | Report as spam |
| s | Add a star, or remove it |
| + or = | Mark as important |
| - | Mark as not important |
| b | Open the **Snooze until** menu |
| m | Mute |
| x | Select the conversation the list is on, or clear it |
| Shift+i | Mark as read |
| Shift+u | Mark as unread |
| l | Open the **Labels** menu |
| v | Open the **Move to** menu |
| z | Undo the last action, while the bar at the bottom of the page shows **Undo** |
In the list, b, l and v select the conversation the list is on when nothing is selected, then open the menu.
When you press e, #, !, m or Shift+u while you read a conversation, webmail goes back to the list.
In **Scheduled**, e, #, !, b and v do nothing. A message waiting there leaves only when you cancel its send, as [Change or cancel a scheduled message](/docs/mail/webmail/write-and-send/#change-or-cancel-a-scheduled-message) explains.
## Compose
These keys work inside a compose window. On a Mac, press ⌘ in place of Ctrl.
| Keys | What it does |
| --- | --- |
| Ctrl+Enter | Send the message |
| Ctrl+B | Bold |
| Ctrl+I | Italic |
| Ctrl+U | Underline |
| Ctrl+K | Insert a link |
| Esc | Minimise the window, unless it fills the screen |
In **To**, **Cc** or **Bcc**, Enter, a comma or a semicolon turns what you typed into a recipient. While suggestions show, Enter or Tab takes the highlighted one. See [Add recipients](/docs/mail/webmail/write-and-send/#add-recipients).
## When the keys work
- The keys work only while the cursor is outside any field. While you type in the search box, a form or a message, they type as usual.
- The keys in Navigation and Actions do nothing inside a compose window, while a dialog or a menu is open, or while Alt, Ctrl or ⌘ is held down.
- For a pair such as g then i, press the second key within 1.2 seconds of the first.
## Related
- [Read and search mail in webmail](/docs/mail/webmail/read-and-search/)
- [Write and send email in webmail](/docs/mail/webmail/write-and-send/)
- [How webmail works](/docs/mail/webmail/)
# Mail DNS records
> Every DNS record Mail Hosting and SMTP Relay ask for, what each one does, and when we publish them into your zone for you.
Source: https://www.coritan.com/docs/mail/dns-records/
In the dashboard:
- /dashboard/mail/…/domains: https://www.coritan.com/dashboard/mail
Each domain on a mail service has its own list of records. To see it, open the service from [**Email**](https://www.coritan.com/dashboard/mail), go to the **Domains** tab and select the domain. The **DNS records** card lists every record with the exact value for that domain. This page explains each one.
## Records by purpose
In the names and values below, `example.com` stands for your domain and `` for your service's mail host (see [Placeholders](#placeholders)).
| Record | Type | Name | Priority | Value | Service |
| --- | --- | --- | --- | --- | --- |
| Ownership | TXT | `_mailverify.example.com` | | `mail-verify=` | Both, unless we publish for you |
| Inbound mail | MX | `example.com` | `10` | `mx1.`, one record for each mail server listed | Mail Hosting |
| Standby inbound mail | MX | `example.com` | `20` | A standby host, when the dashboard lists one | Mail Hosting |
| SPF | TXT | `example.com` | | `v=spf1 include:_spf. -all` | Both |
| DKIM | TXT | `._domainkey.example.com` | | `v=DKIM1; k=rsa; h=sha256; p=`, and a second record with `k=ed25519` | Both |
| DMARC | TXT | `_dmarc.example.com` | | `v=DMARC1; p=none; adkim=r; aspf=r`, with the stage in `p=` | Both |
| Mail app setup | CNAME | `autoconfig.example.com` | | `autoconfig.` | Mail Hosting |
| Outlook setup | CNAME | `autodiscover.example.com` | | `autodiscover.` | Mail Hosting |
| Outlook setup | SRV | `_autodiscover._tcp.example.com` | `0` | `0 443 autodiscover.` | Mail Hosting |
| JMAP | SRV | `_jmap._tcp.example.com` | `0` | `1 443 jmap.` | Mail Hosting |
| CardDAV | SRV | `_carddavs._tcp.example.com` | `0` | `1 443 jmap.` | Mail Hosting |
| Sending from mail apps | SRV | `_submission._tcp.example.com` | `0` | `1 587 smtp.` | Mail Hosting |
| Reading in mail apps | SRV | `_imaps._tcp.example.com` | `0` | `1 993 imap.` | Mail Hosting |
| TLS reporting | TXT | `_smtp._tls.example.com` | | `v=TLSRPTv1;`, with a `rua=mailto:` report address when the service has one | Mail Hosting |
| MTA-STS | CNAME | `mta-sts.example.com` | | `mta-sts.` | Mail Hosting |
| MTA-STS | TXT | `_mta-sts.example.com` | | `v=STSv1; id=` | Mail Hosting |
Publish every record the card lists. Only some of them decide whether the domain is verified (see [When a domain is verified](#when-a-domain-is-verified)); the rest let mail apps set themselves up and tell other mail servers to use TLS.
An SMTP Relay domain gets only the ownership, SPF, DKIM and DMARC records. It gets no MX record, so the domain's inbox stays wherever it is now.
Some domains list one more DKIM record with the note *Signs the mail this domain sends through our outbound relay.* Publish it as shown; its SPF record then also carries a second `include:`.
## Placeholders
`example.com`
: Your domain, exactly as you added it. A subdomain such as `send.example.com` gets records under its own name, such as `_dmarc.send.example.com`.
``
: The mail host of your service's region, such as `mail-fra.coritan.com`. The **MX suffix** row on the service's **Overview** tab shows yours.
``
: A random value we make for the domain when you add it. It never changes while the domain is on the service.
``
: The name of a DKIM key, such as `cor202609r` for the RSA key and `cor202609e` for the Ed25519 key. Every domain has two keys, so it lists two DKIM records.
``
: The public half of the DKIM key. Copy the whole value from the dashboard.
``
: A label for the domain's MTA-STS policy. It changes when the policy does, and the dashboard shows the current one.
## What each check looks for
We ask your domain's own nameservers first, so a record counts as soon as your DNS provider serves it. A problem the check finds shows in the **Last problem** row of the domain's page, under the domain's name on the **Domains** tab, and in the toast after **Verify now**.
Ownership
: A TXT record at `_mailverify.example.com` whose value is exactly `mail-verify=`. A domain whose records we publish into your zone passes without it. Keep the record in place: a later check that cannot find it sets the domain back to pending.
MX
: At least one MX record at the domain names one of the `mx` hosts the dashboard lists. When the domain has MX records and none of them is ours, the check reports `MX points to` followed by the hosts it found.
SPF
: A TXT record at the domain that starts with `v=spf1` and contains `_spf.`. Other mechanisms in the same record are fine. Keep one SPF record per name: add the `include:` to the record you have rather than publishing a second one.
DKIM
: The TXT record at each selector contains the key the dashboard shows. A missing or different key reports `DKIM selector not published`. Until the keys exist, the check reports `No DKIM keys yet: the mail engine has not made them`.
DMARC
: A TXT record at `_dmarc.example.com` that starts with `v=DMARC1`, whose `p=` value is the domain's current stage. A different value reports `DMARC publishes p=none, expected p=quarantine` (with the values found). See [DMARC](/docs/mail/dmarc/) for the stages.
## When a domain is verified
| Service | Checks that must pass | Checks that are shown but not required |
| --- | --- | --- |
| Mail Hosting | Ownership, MX, SPF and DKIM | DMARC |
| SMTP Relay | Ownership, SPF and DKIM | DMARC |
A domain that has not passed is `pending`, and the **Domains** tab shows how many of its checks have passed, such as `Pending · 3/5`. We check pending domains again about every ten minutes. We do not re-check a verified domain on a timer; **Verify now** checks it on demand.
Until ownership passes, the list has no DKIM records. We make the domain's keys once we find the ownership record, and the DKIM records then appear on the card.
## The DNS records card
**Type**
: The record type.
**Name**
: The full name to create. Some DNS providers want only the part before your domain, such as `_dmarc` for `_dmarc.example.com`.
**Priority**
: The priority of an MX or SRV record.
**Value**
: What the record holds. An SRV value is its weight, port and target, in that order. A note under a value explains a record that needs something from you.
**Status**
: The result of the last check for that record: **Verified** or **Missing**. Only the ownership, inbound MX, SPF, DKIM and DMARC records get one. The others, a retiring DKIM key and the extra DKIM record for the outbound relay have none.
Name and value each have a copy button.
## DKIM key rotation
We replace each verified domain's two DKIM keys every 90 days.
| Stage | What happens | What the card shows |
| --- | --- | --- |
| New keys | We make two new keys. The old keys keep signing. | The new records, with the note *New DKIM key: publish now, the old one is retired after a week.* |
| Switch | Once the check sees every new key in your DNS, the new keys sign instead. | The old records, with the note *Retiring DKIM key: keep it one more week, then delete it.* and no status |
| Retire | Seven days after the switch, the old records leave the list. | Only the new records. Delete the old ones from your DNS. |
When we publish into your zone, we add and delete these records ourselves. When your DNS is elsewhere, the switch waits until you publish the new keys.
## Records we publish for you
When you add a domain whose DNS zone is on [Coritan DNS](/docs/websites/dns/manage-dns-records/) in the same account (the domain's own zone or a parent's), we write its records into the zone ourselves. Ownership passes at once, and the card reads *We publish these into your hosted zone and keep them up to date.*
- Each record we write has a TTL of 300 seconds and the comment `coritan-mail`, followed by its purpose, in the zone's record list.
- We update and delete only records with that comment.
- **Verify now** writes any missing records again before it checks.
- Removing the domain from the mail service deletes only our records.
A record already in your zone always wins over ours:
| Already in your zone | What we do |
| --- | --- |
| An SPF record at the domain | We add no SPF record. Add `include:_spf.` to yours, or the SPF check fails. |
| A DMARC record at `_dmarc` | We add none. The domain's DMARC stage takes your record's `p=` value and is held there. Change `p=` in your record to move it. |
| A TLS reporting or MTA-STS TXT record | We add none. |
| A record at a DKIM selector's name, or at a name where we would add a CNAME or SRV record | We add none at that name. |
| MX records that point somewhere else | We add no MX and no MTA-STS records. A Mail Hosting domain stays pending until you delete the old MX records. |
### Publish to your zone
When the domain is inside a zone on this account's DNS but we are not writing into it (for example, you created the zone after adding the domain), the domain's page shows a **Publish to your zone** card. Its button, which shows the number of records, creates them through your DNS with a TTL of 3600 seconds. A record that is already there counts as present rather than as a failure.
The card then reports how many records it created, how many were already present and how many it could not publish, with the reason for each. When all of them worked, it checks the domain a moment later. These records do not carry the `coritan-mail` comment, so we do not update them later: publish again after a DKIM rotation or a DMARC stage change.
A name you claimed under [coritan.gg](/docs/proxies/coritan-gg-names/) needs no step at all: we publish its records and check the domain when you add it.
## Related
- [Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/)
- [Add a sending domain to SMTP Relay](/docs/mail/smtp-relay/add-a-sending-domain/)
- [DMARC](/docs/mail/dmarc/)
- [Manage DNS records](/docs/websites/dns/manage-dns-records/)
- [Mail troubleshooting](/docs/mail/troubleshooting/)
## With the API
Get a domain's records and its last check:
```bash
curl https://api.coritan.com/api/v1/client/mail/4812/domains/311/records \
-H "Authorization: Bearer $CORITAN_TOKEN"
```
Use `/client/smtp-relay/` in the path for an SMTP Relay service. The response holds the domain and the records to publish:
```json
{
"domain": {
"id": 311,
"domain": "example.com",
"status": "pending",
"verification_method": "txt",
"checks": { "ownership": true, "mx": true, "spf": true, "dkim": false, "dmarc": true },
"dmarc_policy": "none",
"dmarc_pinned": false,
"last_checked_at": "2026-09-16T10:40:12Z",
"last_error": "DKIM selector cor202609r not published"
},
"records": [
{ "type": "TXT", "name": "_mailverify.example.com", "content": "mail-verify=3kP0vS8x", "purpose": "ownership" },
{ "type": "MX", "name": "example.com", "content": "mx1.mail-fra.coritan.com", "priority": 10, "purpose": "inbound" },
{ "type": "TXT", "name": "example.com", "content": "v=spf1 include:_spf.mail-fra.coritan.com -all", "purpose": "spf" },
{ "type": "TXT", "name": "cor202609r._domainkey.example.com", "content": "v=DKIM1; k=rsa; h=sha256; p=MIIBIjANBg...", "purpose": "dkim", "selector": "cor202609r" },
{ "type": "SRV", "name": "_imaps._tcp.example.com", "content": "imap.mail-fra.coritan.com", "priority": 0, "weight": 1, "port": 993, "purpose": "autoconfig" }
]
}
```
The example is shortened. Each record has these fields:
`type`, `name`, `content`
: The record to publish. `name` is always the full name.
`priority`, `weight`, `port`
: Present on MX and SRV records.
`purpose`
: What the record is for: `ownership`, `inbound`, `inbound_standby`, `spf`, `dkim`, `upstream_dkim`, `dmarc`, `autoconfig`, `autodiscover`, `jmap`, `carddav`, `tlsrpt` or `mta_sts`.
`selector`, `state`
: On DKIM records. `state` is `pending` for a new key to publish now and `retiring` for an old key to keep for one more week.
`domain.checks` holds the result of the last check for ownership, MX, SPF, DKIM and DMARC. To run a check, see [Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/#with-the-api). A domain that is not on the service answers `404` `Domain not found`.
## API
- `GET /api/v1/client/mail/{service_id}/domains/{domain_id}/records`: Domain records (https://www.coritan.com/docs/api/reference/client/mail/mail-domains/#op-get-api-v1-client-mail-service-id-domains-domain-id-records)
- `GET /api/v1/client/smtp-relay/{service_id}/domains/{domain_id}/records`: Domain records (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-domains/#op-get-api-v1-client-smtp-relay-service-id-domains-domain-id-records)
# How the DMARC stage ramp works
> How we move a domain's DMARC policy from none to quarantine to reject, and how to hold a stage or change it yourself.
Source: https://www.coritan.com/docs/mail/dmarc/
In the dashboard:
- /dashboard/mail/…/settings: https://www.coritan.com/dashboard/mail
- /dashboard/mail/…/domains: https://www.coritan.com/dashboard/mail
DMARC tells other mail servers what to do with a message that claims to come from your domain but fails SPF and DKIM. Every domain on a Mail Hosting or SMTP Relay service has a DMARC record. It starts at the gentlest *stage*, and we move it up as reports show that your real mail passes.
## The three stages
`p=none`
: Receivers deliver failing mail as usual, and send reports about it. Every new domain starts here.
`p=quarantine`
: Receivers treat failing mail as suspicious, which often means the spam folder.
`p=reject`
: Receivers refuse failing mail.
The stage is the `p=` value of the record at `_dmarc.example.com`, such as `v=DMARC1; p=quarantine; adkim=r; aspf=r`. The record uses *relaxed alignment* (`adkim=r; aspf=r`): a message passes when its SPF or DKIM domain shares its main domain with the From address, such as `send.example.com` for mail from `alex@example.com`. [Mail DNS records](/docs/mail/dns-records/) lists the full record and how we check it.
## When the stage moves up
Once a day we look at every verified domain that is not held and not yet at `p=reject`. A domain moves up one stage when all of these are true:
- It has been at its current stage for at least 14 days.
- The aggregate reports from receivers over the last 14 days cover at least 100 messages.
- At least 98% of those messages passed.
- No receiver sent a failure report in that time.
The ramp never moves a domain down. Moving down is always your choice, because a weaker policy also makes your domain easier to spoof.
Receivers send their reports to the `rua=mailto:` address in the record, when the record the dashboard shows has one. Keep that part of the record as it is: without reports, the stage stays where it is.
## What changes when the stage moves
When we publish your records into a zone on Coritan DNS, we replace our `_dmarc` record with the new value ourselves.
When your DNS is elsewhere, the **DNS records** card shows the new value, and the domain's **DMARC** check fails with `DMARC publishes p=none, expected p=quarantine` until you update the record at your DNS provider. We send no message about it: the **DMARC** column on the **Domains** tab shows each domain's current stage. DMARC does not count towards verification, so the domain keeps sending while the record catches up.
## Holding a stage or setting one yourself
Two places show a domain's stage and change it:
- The **DMARC policy** card on the domain's page: go to the **Domains** tab and select the domain. It has the **Stage** select and the **Hold this stage** switch, and says since when the domain has been at its stage.
- The **DMARC** card on the **Settings** tab, on Mail Hosting only. It lists every domain with a stage select and a **Hold stage** switch, and says for each whether it is held or ramps automatically.
Choosing a stage applies it at once and holds the domain there, so the ramp stops. Turning the hold off lets the ramp carry on from the stage you chose. Holding a stage without changing it stops the ramp where it is.
A change you make takes effect the same way as one the ramp makes: we update a record we publish, and you update a record you publish yourself.
## When your zone already has a DMARC record
When we publish into your zone on Coritan DNS and the zone already has a DMARC record that we did not add, your record stays and ours is never added. The domain's stage takes your record's `p=` value and is held there, and the ramp does not change it.
To move such a domain, change `p=` in your own record, then select **Verify now** on the domain's page so the stage follows it. Choosing a stage in the dashboard is refused with `The DMARC record for example.com in your DNS was not added by us. Change its p= value in the zone instead.`
## With the API
Set a stage and hold it:
```bash
curl -X PATCH https://api.coritan.com/api/v1/client/mail/4812/domains/311/dmarc \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"stage": "quarantine", "pinned": true}'
```
Use `/client/smtp-relay/` in the path for an SMTP Relay service. The body takes two optional fields:
`stage`
: `none`, `quarantine` or `reject`. Leave it out to keep the current stage. Any other value answers `422`.
`pinned`
: `true` holds the stage and `false` lets the ramp move it. Leave it out to keep the current setting. Unlike the dashboard, sending a `stage` alone does not hold it.
The response holds the updated domain, with `dmarc_policy`, `dmarc_pinned` and `dmarc_stage_since`, and its records to publish, in the same shape as [the records endpoint](/docs/mail/dns-records/#with-the-api). A stage change refused because of your own DMARC record answers `409` with the message above, and a domain that is not on the service answers `404` `Domain not found`.
## API
- `PATCH /api/v1/client/mail/{service_id}/domains/{domain_id}/dmarc`: Set DMARC (https://www.coritan.com/docs/api/reference/client/mail/mail-domains/#op-patch-api-v1-client-mail-service-id-domains-domain-id-dmarc)
- `PATCH /api/v1/client/smtp-relay/{service_id}/domains/{domain_id}/dmarc`: Set DMARC (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-domains/#op-patch-api-v1-client-smtp-relay-service-id-domains-domain-id-dmarc)
# How Mail Hosting and SMTP Relay are billed
> What a mail plan includes, what you pay for, how to get a bigger or smaller plan, and what the Billing tab shows and cancels.
Source: https://www.coritan.com/docs/mail/billing/
In the dashboard:
- /dashboard/mail/…/billing: https://www.coritan.com/dashboard/mail
Each Mail Hosting or SMTP Relay service is on one plan, and you pay that plan's price each billing cycle. The plan sets what the service may hold and send. Each service has a **Billing** tab, where you see the plan, follow its billing history and cancel it.
## What a plan includes
The [Mail page](https://www.coritan.com/solutions/mail) and the order pages list the plans, what each includes and its price.
Mail Hosting
: A number of mailboxes, storage for each mailbox and a number of domains. The storage is one pool for the whole service ([What the plan sets](/docs/mail/mail-hosting/#what-the-plan-sets)). Aliases do not count against the plan.
SMTP Relay
: A number of emails a month, a buffer over that number on paid plans, and a number of sending domains. Plans of 250,000 emails a month and more include a dedicated sending address ([How SMTP Relay sending limits work](/docs/mail/smtp-relay/sending-limits/)).
## What you pay
You pay the plan's price once each billing cycle. A Mail Hosting plan can have more than one billing cycle, and its order page offers the ones it has. Relay plans are billed monthly.
Nothing on a mail service is charged by use. A relay's buffer costs nothing extra, and there is no charge for mail over the allowance: once the allowance and its buffer are used up, the relay refuses mail until the 1st ([What happens near the allowance](/docs/mail/smtp-relay/sending-limits/#what-happens-near-the-allowance)).
The one extra charge is a dedicated IP add-on, which is a service of its own ([Dedicated IP add-ons](#dedicated-ip-add-ons)). You find and pay a mail service's invoices on the **Invoices** tab under **Billing**, as for any service ([Pay an invoice](/docs/billing/invoices/)).
## The Billing tab
In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the service, then the **Billing** tab. It works from the moment you order, before the service is set up.
The **Current plan** card shows:
**Product**
: The mail plan the service is on.
**Plan**
: The billing cycle you pay on.
**Price**
: What one billing cycle costs.
**Status**
: The service's status, such as `active` or `suspended`.
**Next renewal**
: The date the next invoice for the service is due.
**Set up**
: When the service was set up, or `Pending` until then.
**Service ID**
: The number to give support when you ask about the service.
**Change plan…** in the card's header moves the service to another billing cycle of the same plan ([Change a service's plan](/docs/billing/change-plan/)). A plan with one billing cycle shows `No other plan to switch to` in its place, and so does every relay plan.
The **Activity** table lists the service's billing history, such as its setup, renewals and plan changes. **By** says who or what made each change.
Two alerts can appear above the card. **Suspended** means an invoice is unpaid ([When a payment is late](#when-a-payment-is-late)). **Cancellation scheduled** gives the date the service ends. The **Cancel service** card at the bottom ends the service ([Cancel a mail service](#cancel-a-mail-service)).
## Move to a bigger or smaller plan
Each mail plan, such as a Mail Hosting plan with more mailboxes or a relay plan with more emails a month, is a product of its own in the catalogue. **Change plan…** moves a service only to another billing cycle of the same plan, so it cannot give a service more or less of anything.
Only our staff can change what an existing service allows. [Contact support](/docs/support/conversations/) with the **Service ID** and the plan you want. Before a move to a smaller plan, delete the mailboxes, SMTP credentials and domains that are over the smaller plan's numbers. On Mail Hosting, also shrink mailbox quotas until they fit in its storage. A change that would leave the service holding more than the plan allows is refused.
For a relay, you can instead order a relay on the plan you want, move your sending to it, and then cancel the old relay. The new relay starts with the starting hourly limit, however long the old one has been sending ([How the limit rises](/docs/mail/smtp-relay/sending-limits/#how-the-limit-rises)). A domain can be on one mail service at a time, and a relay removes a domain only after its SMTP credentials are deleted ([Remove a domain](/docs/mail/smtp-relay/add-a-sending-domain/#remove-a-domain)). So your applications cannot send from a domain while you move it. Giving the new relay a new sending domain, such as `mail.example.com`, avoids that gap.
## The free SMTP Relay plan
Each account can hold one free relay. The free plan has no buffer and stops at its allowance ([The monthly allowance](/docs/mail/smtp-relay/sending-limits/#the-monthly-allowance)). Ordering it needs the verification check on its order page ([Order Mail Hosting or SMTP Relay](/docs/mail/order-a-mail-service/)).
A free relay counts against that limit until it has ended, including one you have cancelled at the end of its term. While it counts, ordering another free relay fails with `You already have 1 free SMTP Relay. Upgrade or remove one to create another.`
To send more than the free plan allows, order a paid relay. Paid relays do not count against the limit, so you can keep the free one or cancel it once your applications use the new relay.
## Dedicated IP add-ons
A dedicated address you order from a relay's **Sending IPs** card is an *add-on*: a service of its own, with its own invoice and renewal date. The **Sending IPs** card and its order page show its price, and [Dedicated sending addresses](/docs/mail/smtp-relay/sending-limits/#dedicated-sending-addresses) explains what it does. The address that comes with a plan of 250,000 emails a month or more is part of the plan and has no service of its own.
An add-on does not appear in the **Email** list. To reach its billing, select **Services** in the sidebar, then the add-on, which is listed as an SMTP Relay service. Its page opens on a tab that shows **Could not load this service**; select the **Billing** tab, which works as on any mail service.
While an add-on's invoice is unpaid and the add-on is suspended, the relay stops sending from its address and the **Sending IPs** card shows **Disabled** beside it. The relay sends from its other addresses meanwhile. Paying the invoice turns the address back on. When you cancel an add-on and it ends, we release its address.
> [!WARNING]
> Cancelling a relay does not cancel its add-ons. When the relay ends, we release every address it holds, add-ons included, but each add-on keeps renewing and raising invoices until you cancel it. Cancel each add-on from its own **Billing** tab as well.
## When a payment is late
When a mail service's invoice stays unpaid, we suspend the service ([Failed payments and suspended services](/docs/billing/failed-payments/)). The service's status becomes `suspended`, and its **Billing** tab shows **Suspended** with the reason, or `Pay the open invoice to restore the service.`
While a service is suspended:
- Its mailboxes cannot sign in to webmail or a mail app, and cannot send or receive mail.
- The relay's SMTP credentials cannot sign in, and the send API answers `401` with `Invalid API key`.
Nothing is deleted while the service is suspended. Pay the open invoice to restore it as it was. A service left unpaid is later cancelled, and its mail is then deleted.
## Cancel a mail service
On the **Billing** tab, select **Cancel service…**. Under **When**, choose **At the end of the current term** to keep the service running until the date the dialog shows, or **Immediately** to end it now. Then type `cancel` and select **Cancel service**. [Cancel a service](/docs/billing/cancel-a-service/) describes each choice and what the dashboard shows afterwards. We do not refund unused time.
When the service ends:
- Its mailboxes, aliases and stored mail are deleted, and so are a relay's SMTP credentials. Its API keys stop working.
- Every webmail session of its mailboxes ends.
- Its domains stop working on it, and you can add them to another mail service. We delete the records we published in DNS zones you host with us. Records you added at another DNS provider stay there until you delete them ([Mail DNS records](/docs/mail/dns-records/)).
- A relay's dedicated addresses are released, add-ons included.
> [!CAUTION]
> You cannot restore a mail service or its mail once it has ended. Copy out the mail you want to keep first, for example with a mail app over IMAP.
## Related
- [Change a service's plan](/docs/billing/change-plan/)
- [Cancel a service](/docs/billing/cancel-a-service/)
- [How SMTP Relay sending limits work](/docs/mail/smtp-relay/sending-limits/)
- [Request a higher hourly limit](/docs/mail/smtp-relay/request-a-higher-limit/)
## With the API
A mail service is billed through the same endpoints as every service. [Change a service's plan](/docs/billing/change-plan/#with-the-api) previews and applies a switch to another billing cycle, and [Cancel a service](/docs/billing/cancel-a-service/#with-the-api) cancels it. Pass the service ID as `service_ref`.
# Internal mail tenants
> How the platform's own mail tenants appear on the owning account's dashboard, and what their owner and staff can each change.
Source: https://www.coritan.com/docs/mail/internal-tenants/
In the dashboard:
- /dashboard/mail/internal/…/overview: https://www.coritan.com/dashboard/mail/internal
- /dashboard/mail/internal/…/domains: https://www.coritan.com/dashboard/mail/internal
- /dashboard/mail/internal/…/mailboxes: https://www.coritan.com/dashboard/mail/internal
- /dashboard/mail/internal/…/aliases: https://www.coritan.com/dashboard/mail/internal
- /dashboard/mail/internal/…/settings: https://www.coritan.com/dashboard/mail/internal
- /dashboard/mail/internal/…/credentials: https://www.coritan.com/dashboard/mail/internal
- /dashboard/mail/internal/…/api-keys: https://www.coritan.com/dashboard/mail/internal
- /dashboard/mail/internal/…/webhooks: https://www.coritan.com/dashboard/mail/internal
- /dashboard/mail/internal/…/suppressions: https://www.coritan.com/dashboard/mail/internal
- /dashboard/mail/internal/…/events: https://www.coritan.com/dashboard/mail/internal
- /dashboard/mail/internal/…/send: https://www.coritan.com/dashboard/mail/internal
An *internal mail tenant* is a Mail Hosting or SMTP Relay setup that belongs to the platform itself, such as the relay that sends the platform's own emails or the team mailboxes on its own domains. The platform's seed file declares each one. An internal tenant has no order and no bill, so it is not a service.
Only the account that the platform's mail belongs to sees internal tenants. They appear on that account's **Email** page with its ordinary services. On any other account, a link to one opens the page-not-found screen.
## How an internal tenant appears
In the **Email** list, internal tenants come first. The line under each one's domain gives the tenant's name followed by `internal, no billing`. Select the row to open the tenant.
The tenant's page looks like a service's page, with these differences:
- The header shows an **Internal** badge beside the status and the product, and the tenant's number, such as `Tenant #12`, where a service shows its service number.
- A note below the header, **One of the platform's own tenants**, says that it has no order or bill, that staff set its limits, and that only staff can remove what the seed file declares.
- A Mail Hosting tenant has the tabs **Overview**, **Domains**, **Mailboxes**, **Aliases** and **Settings**. An SMTP Relay tenant has **Overview**, **Domains**, **Credentials**, **API keys**, **Webhooks**, **Suppressions**, **Events** and **Send**. Neither has a **Billing** tab.
- On the **Overview** tab, the **Tenant** card takes the place of the **Service** card. Its **Plan** reads `Internal, no billing`, it shows the **Tenant ID**, and it has no renewal date. The tab has no **Tags** card.
- An SMTP Relay tenant's **Overview** tab has no **Sending IPs** card. When the monthly allowance runs out, its warning says `We refuse further emails until the next month starts or staff raise the allowance.` and has no **Change plan** button.
**Open webmail** at the top of a Mail Hosting tenant opens webmail, as it does on a service. The **Sending is paused** and **Under review** notes appear on a tenant as they do on a service ([Sending reputation and deliverability](/docs/mail/smtp-relay/deliverability/)).
## What the owner can change
The owning account uses each tab as it would on a service of the same kind, within the tenant's limits:
- Add domains, publish and verify their records, and set their DMARC stage ([Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/), [Add a sending domain](/docs/mail/smtp-relay/add-a-sending-domain/)).
- Create and manage mailboxes and aliases ([Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/), [Forward addresses with aliases](/docs/mail/mail-hosting/aliases/)).
- Create credentials and send API keys, add webhooks, manage the suppression list, look up events and send a test message ([How SMTP Relay works](/docs/mail/smtp-relay/)).
- Set the tenant's default message category: on the **Settings** tab of a Mail Hosting tenant, and in the **Deliverability** card on the **Overview** tab of an SMTP Relay tenant ([Transactional and marketing mail](/docs/mail/smtp-relay/message-categories/)).
A mailbox that the platform created for a tenant starts with a password that nobody has seen. Set one with **Reset password…** in the mailbox's menu on the **Mailboxes** tab before anyone signs in ([Reset a mailbox password](/docs/mail/mail-hosting/mailboxes/#reset-a-mailbox-password)).
The seed file can also name a domain without adding it, so that the owning account decides when the domain's mail moves. Add it on the **Domains** tab when you are ready ([Move a domain that already receives mail](/docs/mail/mail-hosting/add-a-domain/#move-a-domain-that-already-receives-mail)).
We record every change the owning account makes to an internal tenant, from the dashboard or through the API, in the platform's audit log.
## What only staff can change
Staff make these changes from the admin console:
A domain that the seed file declares
: Only staff can remove it. The domain's page on the **Domains** tab shows `The platform's seed file declares this domain, so only staff can remove it, from the admin console.` under **Remove this domain**, and greys out **Remove domain…**. The **Remove domain…** button in the **Danger zone** card on the **Settings** tab is not greyed out, but the removal fails with the same message. Once you add a domain that the seed file names, it is locked in the same way.
The credential the platform sends its own mail with
: On an SMTP Relay tenant, the credential's row on the **Credentials** tab shows `The platform sends its own mail with this credential. You can rotate it, but only staff can disable or delete it.` Its **Enabled** switch is greyed out, and **Revoke credential…** shows **Staff only**. **Rotate password…** works: the platform's own mail uses the new password from its next message ([Rotate a password](/docs/mail/smtp-relay/credentials/#rotate-a-password)).
The tenant's limits
: Staff set how many domains, mailboxes and credentials a tenant may hold, the storage for each mailbox, the monthly allowance and the hourly limit. On the **Hourly limit** card, **Request limit increase…** is greyed out, with the note `Staff set the limits of an internal tenant, from the admin console.` The limits the seed file declares apply again each time the platform starts.
## With the API
The routes under `/api/v1/client/platform-mail/{tenant_id}` are the same as a mail service's under `/api/v1/client/mail/{service_id}` and `/api/v1/client/smtp-relay/{service_id}`. They take the tenant ID where a service's routes take the service ID, and each operation takes the same body and answers in the same shape as on a service. The pages linked above document each operation. As on a service, an operation that belongs to the other product answers with a message that says so, such as `Not an SMTP Relay service`.
There is no list under `platform-mail`. `GET /api/v1/client/mail/services` lists internal tenants first, each with `"internal": true`, `"service_id": null` and its `tenant_id` ([Email](/docs/mail/#with-the-api)).
`GET /api/v1/client/platform-mail/{tenant_id}` returns the tenant's summary, as the summary of a [Mail Hosting](/docs/mail/mail-hosting/#with-the-api) or [SMTP Relay](/docs/mail/smtp-relay/#with-the-api) service does. `kind` is `hosting` or `relay`, `label` is the tenant's name and `service` is `null`.
Set the default message category with `PATCH /api/v1/client/platform-mail/{tenant_id}/category`:
```bash
curl -X PATCH https://api.coritan.com/api/v1/client/platform-mail/12/category \
-H "Authorization: Bearer $CORITAN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"default_category": "marketing"}'
```
```json
{"default_category": "marketing"}
```
`default_category` is `transactional` or `marketing`, and any other value answers `422`.
In the answers to `GET /api/v1/client/platform-mail/{tenant_id}/domains` and `GET /api/v1/client/platform-mail/{tenant_id}/credentials`, each item carries `locked`. It holds the reason when only staff can remove the item, and `null` otherwise.
| Request | Status | `detail` |
| --- | --- | --- |
| `DELETE …/domains/{domain_id}` for a domain the seed file declares | `409` | `The platform's seed file declares this domain, so only staff can remove it, from the admin console.` |
| `PATCH …/credentials/{account_id}/enabled` with `"enabled": false`, or `DELETE …/credentials/{account_id}`, for the platform's sending credential | `409` | `The platform sends its own mail with this credential. You can rotate it, but only staff can disable or delete it.` |
| `POST …/limits/increase-request` | `409` | `Staff set the limits of an internal tenant, from the admin console.` |
| Any request with a tenant ID that is not an internal tenant of your account | `404` | `Mail service not found` |
## API
- `GET /api/v1/client/platform-mail/{tenant_id}`: Get summary (https://www.coritan.com/docs/api/reference/client/mail/platform-mail/#op-get-api-v1-client-platform-mail-tenant-id)
- `GET /api/v1/client/platform-mail/{tenant_id}/domains`: List domains (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-domains/#op-get-api-v1-client-platform-mail-tenant-id-domains)
- `POST /api/v1/client/platform-mail/{tenant_id}/domains`: Add domain (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-domains/#op-post-api-v1-client-platform-mail-tenant-id-domains)
- `DELETE /api/v1/client/platform-mail/{tenant_id}/domains/{domain_id}`: Remove domain (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-domains/#op-delete-api-v1-client-platform-mail-tenant-id-domains-domain-id)
- `PATCH /api/v1/client/platform-mail/{tenant_id}/domains/{domain_id}/dmarc`: Set DMARC (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-domains/#op-patch-api-v1-client-platform-mail-tenant-id-domains-domain-id-dmarc)
- `GET /api/v1/client/platform-mail/{tenant_id}/domains/{domain_id}/records`: Domain records (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-domains/#op-get-api-v1-client-platform-mail-tenant-id-domains-domain-id-records)
- `POST /api/v1/client/platform-mail/{tenant_id}/domains/{domain_id}/verify`: Verify domain (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-domains/#op-post-api-v1-client-platform-mail-tenant-id-domains-domain-id-verify)
- `PATCH /api/v1/client/platform-mail/{tenant_id}/category`: Set category (https://www.coritan.com/docs/api/reference/client/mail/platform-mail/#op-patch-api-v1-client-platform-mail-tenant-id-category)
- `GET /api/v1/client/platform-mail/{tenant_id}/mailboxes`: List mailboxes (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-get-api-v1-client-platform-mail-tenant-id-mailboxes)
- `POST /api/v1/client/platform-mail/{tenant_id}/mailboxes`: Create mailbox (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-post-api-v1-client-platform-mail-tenant-id-mailboxes)
- `DELETE /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}`: Delete mailbox (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-delete-api-v1-client-platform-mail-tenant-id-mailboxes-account-id)
- `GET /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/app-passwords`: Mailbox app passwords (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-get-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-app-passwords)
- `POST /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/app-passwords`: Mailbox app password create (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-post-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-app-passwords)
- `DELETE /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/app-passwords/{credential_id}`: Mailbox app password delete (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-delete-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-app-passwords)
- `PATCH /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/enabled`: Mailbox enabled (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-patch-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-enabled)
- `GET /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/imports`: Mailbox imports (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-get-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-imports)
- `POST /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/imports`: Mailbox import start (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-post-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-imports)
- `POST /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/imports/oauth`: Mailbox import sign in (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-post-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-imports-oauth)
- `POST /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/imports/upload`: Mailbox import upload (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-post-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-imports-upload)
- `POST /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/imports/{import_id}/{action}`: Mailbox import steer (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-post-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-imports-import-i)
- `POST /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/password`: Mailbox password (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-post-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-password)
- `PATCH /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/quota`: Mailbox quota (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-patch-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-quota)
- `GET /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/sessions`: Mailbox sessions (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-get-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-sessions)
- `DELETE /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/sessions`: Mailbox sessions end (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-delete-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-sessions)
- `DELETE /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/sessions/{session_id}`: Mailbox session end (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-delete-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-sessions-sessi)
- `POST /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/totp`: Mailbox totp enable (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-post-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-totp)
- `DELETE /api/v1/client/platform-mail/{tenant_id}/mailboxes/{account_id}/totp`: Mailbox totp disable (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-mailboxes/#op-delete-api-v1-client-platform-mail-tenant-id-mailboxes-account-id-totp)
- `GET /api/v1/client/platform-mail/{tenant_id}/aliases`: List aliases (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-aliases/#op-get-api-v1-client-platform-mail-tenant-id-aliases)
- `POST /api/v1/client/platform-mail/{tenant_id}/aliases`: Create alias (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-aliases/#op-post-api-v1-client-platform-mail-tenant-id-aliases)
- `DELETE /api/v1/client/platform-mail/{tenant_id}/aliases/{account_id}`: Delete alias (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-aliases/#op-delete-api-v1-client-platform-mail-tenant-id-aliases-account-id)
- `GET /api/v1/client/platform-mail/{tenant_id}/credentials`: List credentials (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-credentials/#op-get-api-v1-client-platform-mail-tenant-id-credentials)
- `POST /api/v1/client/platform-mail/{tenant_id}/credentials`: Create credential (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-credentials/#op-post-api-v1-client-platform-mail-tenant-id-credentials)
- `DELETE /api/v1/client/platform-mail/{tenant_id}/credentials/{account_id}`: Delete credential (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-credentials/#op-delete-api-v1-client-platform-mail-tenant-id-credentials-account-id)
- `PATCH /api/v1/client/platform-mail/{tenant_id}/credentials/{account_id}/enabled`: Credential enabled (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-credentials/#op-patch-api-v1-client-platform-mail-tenant-id-credentials-account-id-enabled)
- `POST /api/v1/client/platform-mail/{tenant_id}/credentials/{account_id}/rotate`: Rotate credential (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-credentials/#op-post-api-v1-client-platform-mail-tenant-id-credentials-account-id-rotate)
- `GET /api/v1/client/platform-mail/{tenant_id}/api-keys`: List API keys (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-api-keys/#op-get-api-v1-client-platform-mail-tenant-id-api-keys)
- `POST /api/v1/client/platform-mail/{tenant_id}/api-keys`: Create API key (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-api-keys/#op-post-api-v1-client-platform-mail-tenant-id-api-keys)
- `DELETE /api/v1/client/platform-mail/{tenant_id}/api-keys/{key_id}`: Revoke API key (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-api-keys/#op-delete-api-v1-client-platform-mail-tenant-id-api-keys-key-id)
- `GET /api/v1/client/platform-mail/{tenant_id}/suppressions`: List suppressions (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-suppressions/#op-get-api-v1-client-platform-mail-tenant-id-suppressions)
- `POST /api/v1/client/platform-mail/{tenant_id}/suppressions`: Add suppression (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-suppressions/#op-post-api-v1-client-platform-mail-tenant-id-suppressions)
- `DELETE /api/v1/client/platform-mail/{tenant_id}/suppressions/{suppression_id}`: Remove suppression (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-suppressions/#op-delete-api-v1-client-platform-mail-tenant-id-suppressions-suppression-id)
- `GET /api/v1/client/platform-mail/{tenant_id}/webhooks`: List webhooks (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-webhooks/#op-get-api-v1-client-platform-mail-tenant-id-webhooks)
- `POST /api/v1/client/platform-mail/{tenant_id}/webhooks`: Create webhook (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-webhooks/#op-post-api-v1-client-platform-mail-tenant-id-webhooks)
- `DELETE /api/v1/client/platform-mail/{tenant_id}/webhooks/{webhook_id}`: Delete webhook (https://www.coritan.com/docs/api/reference/client/mail/platform-mail-webhooks/#op-delete-api-v1-client-platform-mail-tenant-id-webhooks-webhook-id)
- `POST /api/v1/client/platform-mail/{tenant_id}/messages`: Send message (https://www.coritan.com/docs/api/reference/client/mail/platform-mail/#op-post-api-v1-client-platform-mail-tenant-id-messages)
- `GET /api/v1/client/platform-mail/{tenant_id}/events`: List events (https://www.coritan.com/docs/api/reference/client/mail/platform-mail/#op-get-api-v1-client-platform-mail-tenant-id-events)
- `GET /api/v1/client/platform-mail/{tenant_id}/usage`: Usage report (https://www.coritan.com/docs/api/reference/client/mail/platform-mail/#op-get-api-v1-client-platform-mail-tenant-id-usage)
- `GET /api/v1/client/platform-mail/{tenant_id}/reputation`: Reputation report (https://www.coritan.com/docs/api/reference/client/mail/platform-mail/#op-get-api-v1-client-platform-mail-tenant-id-reputation)
- `POST /api/v1/client/platform-mail/{tenant_id}/limits/increase-request`: Request limit increase (https://www.coritan.com/docs/api/reference/client/mail/platform-mail/#op-post-api-v1-client-platform-mail-tenant-id-limits-increase-request)
# Troubleshoot mail
> Fix the common problems with mail domains, mailboxes, mail apps, SMTP Relay sending and webmail, one symptom at a time.
Source: https://www.coritan.com/docs/mail/troubleshooting/
Find the symptom or the message you see, then follow the fix. Messages appear here exactly as the dashboard, webmail, your mail app or your application shows them. Each fix links to the page that covers the task in full, and that page's troubleshooting section lists the rest of its messages.
## A domain does not verify
After **Verify now**, the toast says `example.com is still pending:` followed by the first problem the check found. The domain's page shows the result of each check in the **Checks** row, and what the last check found in the **Last problem** row. A Mail Hosting domain needs **Ownership**, **MX**, **SPF** and **DKIM** to pass. An SMTP Relay domain needs **Ownership**, **SPF** and **DKIM** ([When a domain is verified](/docs/mail/dns-records/#when-a-domain-is-verified)).
`some records have not propagated yet`
: The check found a record missing or different, and has no message that names it. The record is the ownership record at `_mailverify.example.com`, the SPF record, or, on Mail Hosting, any MX record at all. A record you created moments ago may not be served yet, or it may hold a typing mistake. Compare each record at your DNS provider with the **DNS records** card, where the **Status** column shows **Missing** for each record the last check did not find. [What each check looks for](/docs/mail/dns-records/#what-each-check-looks-for) gives the rule for each record.
`MX points to` followed by other hosts
: On Mail Hosting, the domain's MX records name another provider, so the domain cannot verify. Replace them with the ones on the **DNS records** card. If the domain receives mail somewhere else today, follow [Move a domain that already receives mail](/docs/mail/mail-hosting/add-a-domain/#move-a-domain-that-already-receives-mail) first. On SMTP Relay, this is information only. The toast can still name it first while another check keeps the domain pending, so read the **Checks** row.
`DKIM selector cor202609r not published` or `No DKIM keys yet: the mail engine has not made them`
: We make the domain's two DKIM keys once the ownership check passes. Reload the domain's page to see the two DKIM records, then publish each value whole. When the keys do not exist yet, select **Verify now** again in a minute.
`DMARC publishes p=none, expected p=quarantine`
: The DMARC record holds a different stage from the one we expect. A domain verifies without DMARC, so this does not keep it pending. [How the DMARC stage ramp works](/docs/mail/dmarc/) explains how to bring the two in line.
A verified domain is pending again
: Selecting **Verify now** checks a verified domain again, and a required record that has gone, such as the ownership record, sets it back to `pending`. Put the record back, then select **Verify now**. Keep the ownership record in place for as long as the domain is on the service.
After you fix a record, select **Verify now** again. We ask your domain's own nameservers, so a record counts as soon as your DNS provider serves it. We also check pending domains about every ten minutes. The messages you can get while adding a domain, such as `That domain is already attached to a mail service`, are in [Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/#troubleshooting) and [Add a sending domain to SMTP Relay](/docs/mail/smtp-relay/add-a-sending-domain/#troubleshooting).
## Mail sent to your mailbox does not arrive
Check these in order. They apply to Mail Hosting mailboxes and to your coritan.gg mailbox, except where a cause names Mail Hosting.
The domain's MX records point to another provider
: Other servers deliver the domain's mail wherever its MX records point. On Mail Hosting, the domain then stays `pending` with `MX points to` followed by the other hosts, or, for an older domain, shows **Sending only**. Replace the MX records with the ones on the **DNS records** card. After the change, servers that already queued mail for the old hosts can still deliver it there for a while, so check the old mailboxes for a few days.
The address has no mailbox or alias
: Mail to an address on a Mail Hosting domain that is neither a mailbox nor an alias bounces back to the sender, unless the domain has a catch-all. Check the spelling with the sender, or create an alias for the address. An alias whose only mailbox was deleted delivers nowhere. [Forward addresses with aliases](/docs/mail/mail-hosting/aliases/) covers both.
The mailbox cannot receive mail
: A mailbox that is turned off cannot receive mail. Neither can the mailboxes of a Mail Hosting service that is suspended for an unpaid invoice, or whose sending we paused. The mailbox's **Enabled** switch on the **Mailboxes** tab and the **Status** on the service's **Service** card show which applies. See [Turn a mailbox off or on](/docs/mail/mail-hosting/mailboxes/#turn-a-mailbox-off-or-on), [When a payment is late](/docs/mail/billing/#when-a-payment-is-late) and [Sending paused](/docs/mail/smtp-relay/deliverability/#sending-paused).
The mailbox is full
: A mailbox cannot store more mail than its quota. The line at the bottom of the folder list in webmail shows how much of its storage the mailbox uses. Delete mail you no longer need. On Mail Hosting, you can also give the mailbox a larger quota ([Change a mailbox's quota](/docs/mail/mail-hosting/mailboxes/#change-a-mailbox-s-quota)).
The message is in Spam, or a filter moved it
: The mail server files mail it takes for spam in **Spam**. Select **Not spam** to move a message back to the Inbox and add its sender to your contacts, whose mail passes the spam filter when it passes DMARC ([Get mail out of Spam](/docs/mail/webmail/read-and-search/#get-mail-out-of-spam)). Mail from a [blocked sender](/docs/mail/webmail/labels-and-filters/#block-a-sender) goes straight to Spam. A filter can move mail to another folder, forward it or discard it as it arrives ([What a filter can do](/docs/mail/webmail/labels-and-filters/#what-a-filter-can-do)). Forwarding all mail can archive or delete the copy in this mailbox ([Forward all mail](/docs/mail/webmail/forwarding/#forward-all-mail)). To search every folder except Spam and Trash, add `in:all` to the search.
## Mail you send does not arrive
Find out what happened to the message first. On SMTP Relay, the **Events** tab lists each step of each delivery, up to 90 days back ([Look up message events](/docs/mail/smtp-relay/events/)). On Mail Hosting, the **Recent activity** card on the **Overview** tab shows the latest eight events from the last seven days. Some bounces reach the sending mailbox only as an `Undelivered Mail Returned to Sender` message. The event says what to do next:
`rejected`, or no event at all
: We refused the message when it was sent, and the reply your application or mail app got says why. See [A message is refused when you send it](#a-message-is-refused-when-you-send-it). A message sent in the last minute or so may not have its events yet.
`accepted` with nothing after it
: The message is still in the queue, or the receiving server has not answered yet. Check again later.
`deferred`
: The receiving server refused the message for now, or a sending limit held it back. We try again later. **Response** shows the receiving server's reply, when it gave one. For a sending limit, see [Mail goes out slowly](#mail-goes-out-slowly).
`bounced`
: The message was not delivered, and we will not try again. **Response** shows the receiving server's reply, when it gave one. We also added the recipient to the suppression list, so we refuse further mail to it ([A recipient is suppressed](#a-recipient-is-suppressed)).
`delivered`
: The receiving server took the message. Ask the recipient to look in their spam folder, and see [Mail you send goes to spam](#mail-you-send-goes-to-spam).
## Mail you send goes to spam
Mail providers decide where a message goes from how it is signed and from how recipients treat your mail. On SMTP Relay, the **Deliverability** card on the **Overview** tab has a check for each of these except the message category and the shared addresses ([The checks](/docs/mail/smtp-relay/deliverability/#the-checks)).
The message fails SPF or DKIM
: Both pass only while the sending domain's records match the **DNS records** card. Keep one SPF record for the domain, with our `include:` in it, and publish both DKIM records whole ([What each check looks for](/docs/mail/dns-records/#what-each-check-looks-for)). On SMTP Relay, the **SPF and DKIM** check fails when a verified domain is missing either record.
The DMARC record is missing or out of date
: The **DMARC** check fails when a verified domain's DMARC record is missing or holds another stage. Publish the record that the **DNS records** card shows. [How the DMARC stage ramp works](/docs/mail/dmarc/) explains the stages.
Bulk mail goes out as transactional
: Gmail and Yahoo ask for one-click unsubscribe headers on bulk mail, and the relay adds them only to marketing mail. Send newsletters and campaigns as `marketing`. Over SMTP, the relay adds the headers only to a message with one recipient, so send bulk mail one message per recipient, or add your own `List-Unsubscribe` headers ([What marketing adds](/docs/mail/smtp-relay/message-categories/#what-marketing-adds)).
Recipients report your mail as spam, or it bounces
: The **Bounces and complaints** check warns from 2% bounces or 0.1% complaints, which is what Gmail asks of senders. The same rates decide whether we pause your sending ([When sending pauses](/docs/mail/smtp-relay/deliverability/#when-sending-pauses)). [Bring the rates down](/docs/mail/smtp-relay/deliverability/#bring-the-rates-down) lists what helps.
The addresses your mail leaves from have a poor reputation
: We manage the shared addresses and watch their reputation, so you have nothing to check there. If you think they are the cause, [contact support](/docs/support/conversations/). Mail from a [dedicated address](/docs/mail/smtp-relay/sending-limits/#dedicated-sending-addresses) depends on your own sending alone.
A Mail Hosting service has no **Deliverability** card. Its rates are in the reputation report of the API ([Sending reputation and deliverability](/docs/mail/smtp-relay/deliverability/#with-the-api)), and each domain's page shows its records on the **DNS records** card.
## A mail app cannot sign in
These apply to Mail Hosting mailboxes and to your coritan.gg mailbox. For an application that sends through SMTP Relay, see [Send over SMTP with credentials](/docs/mail/smtp-relay/credentials/#troubleshooting).
The username is not the whole address
: Use the mailbox's full address, such as `alex@example.com`, as the username for both servers.
Two-factor authentication is on for the mailbox
: A mail app cannot send a code, so it needs an app password in place of the mailbox's password. Whoever manages a Mail Hosting service can create one in the dashboard ([Create an app password](/docs/mail/mail-hosting/mailbox-security/#create-an-app-password)). The mailbox's user can create one in webmail ([Create an app password](/docs/mail/webmail/security/#create-an-app-password)).
The password changed
: After a password reset or a new mailbox password, enter the new password in every app that signs in with it. Apps that use an app password keep working. Your coritan.gg mailbox uses your Coritan account password until you give it one of its own, so changing your account password changes it too ([The mailbox password](/docs/mail/webmail/claim-a-mailbox/#the-mailbox-password)).
The mailbox cannot sign in at all
: A mailbox that is turned off cannot sign in. Neither can the mailboxes of a service that is suspended or whose sending we paused. Check the mailbox's **Enabled** switch on the **Mailboxes** tab, and the service's **Status**.
Too many failed sign-ins
: After 30 failed sign-ins in an hour from one IP address, the mail server refuses that address for 24 hours. Fix the password in every app that uses the mailbox, then wait for the block to end.
The app cannot connect, or warns about a certificate
: Copy the server names from the **Mail server addresses** card on the service's **Overview** tab, or from the **Mail apps** tab of webmail settings. IMAP uses port `993` with SSL/TLS. SMTP uses port `587` with STARTTLS, or port `465` with SSL/TLS. A name under your own domain, such as `imap.example.com`, does not match the certificate, and many networks block port `25`.
[Connect a mail app to Mail Hosting](/docs/mail/mail-hosting/connect-a-mail-app/#troubleshooting) and [Set up mail apps and devices](/docs/mail/webmail/mail-apps/#troubleshooting) cover the rest, such as a message too large to send.
## A message is refused when you send it
Over SMTP, a refusal is a reply that your application logs or your mail app shows. A mailbox gets the same replies as an SMTP Relay credential, apart from the monthly allowance, which only SMTP Relay has. [Send over SMTP with credentials](/docs/mail/smtp-relay/credentials/#troubleshooting) explains each reply in full.
`550 5.7.1 Sender domain example.org is not verified on this account`
: The envelope sender, the address in `MAIL FROM`, is not on a domain whose ownership the service has proved. Send from an address on one of the service's domains.
`550 5.7.1 From address must use a verified domain, not example.org`
: The `From` header is on a domain the service has not proved. Change the From address, or [add the domain](/docs/mail/smtp-relay/add-a-sending-domain/).
`550 5.7.1 Sending is not available for this account`
: The credential or the mailbox is turned off, or the service is not active. Turn it back on, or check the service's status on the **Overview** tab.
`550 5.7.1 Sending is paused for this account; contact support`
: We paused the service's sending. See [Sending is paused or under review](#sending-is-paused-or-under-review).
`550 5.7.1 Monthly allowance and its 12% buffer are used up; upgrade the plan to continue` or `550 5.7.1 Monthly sending allowance reached; upgrade the plan to continue`
: The relay has sent everything its plan allows this month. See [The relay stops sending for the month](#the-relay-stops-sending-for-the-month).
`550 5.1.1 Recipient alex@example.com is suppressed after a bounce or complaint`
: The recipient is on the service's suppression list. See [A recipient is suppressed](#a-recipient-is-suppressed).
`550 5.7.1 This login is not a mail account we know`
: The credential belongs to a relay that no longer exists. Create a credential on an active relay.
The send API answers the same causes with an HTTP status and a `detail`, such as `400` `example.org is not a domain on this service` or `400` `Sending is paused on this service; contact support`. [Send email over HTTPS](/docs/mail/smtp-relay/send-with-the-api/#troubleshooting) lists each one. In webmail, a refused message opens again in a compose window, with a message that starts `Could not send the message:` and the reason ([Write and send email in webmail](/docs/mail/webmail/write-and-send/#troubleshooting)).
## A recipient is suppressed
Over SMTP, we refuse the address with `550 5.1.1 Recipient alex@example.com is suppressed after a bounce or complaint` and accept the other recipients. The send API leaves the address out, sends to the others and lists the address in `suppressed` in its answer ([Read the answer](/docs/mail/smtp-relay/send-with-the-api/#read-the-answer)).
Cause
: We add an address to the service's suppression list when a message to it bounces, when its recipient reports a message as spam, and when they unsubscribe from marketing mail. You can add addresses too. The reply names a bounce or complaint whatever the reason.
Fix
: On the relay's **Suppressions** tab, find the address. Its **Reason** says how it got there ([Why an address is on the list](/docs/mail/smtp-relay/suppressions/#why-an-address-is-on-the-list)). Remove it with **Release…** only once the problem is fixed, or once someone who unsubscribed asks to hear from you again ([Remove an address](/docs/mail/smtp-relay/suppressions/#remove-an-address)). The tab lists only the 200 most recent entries. A Mail Hosting service has a suppression list too, which you manage through the API ([On a Mail Hosting service](/docs/mail/smtp-relay/suppressions/#on-a-mail-hosting-service)).
## The relay stops sending for the month
Over SMTP, the relay answers `550 5.7.1 Monthly allowance and its 12% buffer are used up; upgrade the plan to continue`, or `550 5.7.1 Monthly sending allowance reached; upgrade the plan to continue` on the free plan. The send API answers `429` with the same text. The **Overview** tab shows **Sending has stopped for this month**, and we email your account's address.
Cause
: The relay has used its monthly allowance, including the buffer on a paid plan. We check the count plus the recipients of the message in hand, so a message to many recipients can be refused while a message to one recipient still goes out.
Fix
: Sending starts again at 00:00 UTC on the 1st. To raise the allowance before then, [contact support](/docs/support/conversations/). **Change plan** on the alert opens the **Billing** tab, which cannot move a relay to a larger plan. On the free plan, you can order a paid relay instead ([The free SMTP Relay plan](/docs/mail/billing/#the-free-smtp-relay-plan)). [What happens near the allowance](/docs/mail/smtp-relay/sending-limits/#what-happens-near-the-allowance) lists the warnings we send before this point.
## Mail goes out slowly
Cause
: A relay sends at most its hourly limit in an hour. Mail over it waits in the queue and goes out in a later hour, and the **Events** tab can show `deferred` events for it meanwhile. Once six hours of mail at the hourly limit is waiting, we refuse new messages until the queue shrinks. A dedicated address in warm-up also has an hourly cap of its own, which can be lower than the relay's limit. A Mail Hosting service has an hourly limit too, and mail over it waits in the same way.
Fix
: Spread large sends over time. The **Hourly limit** card on the relay's **Overview** tab shows the **Current limit** and the **Next step**. The limit rises on its own as the relay sends clean mail ([How the limit rises](/docs/mail/smtp-relay/sending-limits/#how-the-limit-rises)). To go higher sooner, select **Request limit increase…** ([Request a higher hourly limit](/docs/mail/smtp-relay/request-a-higher-limit/)). Plan large sends from a dedicated address for after its [warm-up](/docs/mail/smtp-relay/sending-limits/#warm-up).
## Sending is paused or under review
Above the service's tabs, the **Under review** or **Sending is paused** alert shows the rates that set it off, such as `auto-frozen: 11.4% bounces, 0.08% complaints over 7d`. We do not email you about either.
Cause
: The service's bounce or complaint rate over the last seven days reached a line: 5% bounces or 0.1% complaints for a review, and 10% bounces or 0.5% complaints for a pause. Our staff can also pause a service by hand. Under review, sending carries on. While sending is paused, relay credentials cannot sign in, and the send API answers `400` `Sending is paused on this service; contact support`. On Mail Hosting, the mailboxes cannot sign in, send or receive mail.
Fix
: Find and fix what caused the bounces or complaints ([Bring the rates down](/docs/mail/smtp-relay/deliverability/#bring-the-rates-down)). Only our staff lift a pause or clear a review, so then [contact support](/docs/support/conversations/) and say what you changed. If the rates of the last seven days are still at a pause line when our staff lift the pause, the next check pauses sending again ([Sending paused](/docs/mail/smtp-relay/deliverability/#sending-paused)).
## Webmail does not open a mailbox
When webmail at [www.coritan.com/webmail](https://www.coritan.com/webmail) cannot open a mailbox, it shows `Could not open your mailbox`, the reason under it, and **Try again**.
`This mailbox is disabled.`
: The mailbox is turned off. Whoever manages a Mail Hosting service turns it back on with the mailbox's **Enabled** switch ([Turn a mailbox off or on](/docs/mail/mail-hosting/mailboxes/#turn-a-mailbox-off-or-on)). When we turned the mailbox off because it suddenly sent far more mail than usual, the reason gives how many messages it sent in an hour instead. Reset its password, then turn it back on ([Create and manage mailboxes](/docs/mail/mail-hosting/mailboxes/#troubleshooting)). For your coritan.gg mailbox, [contact support](/docs/support/conversations/).
`The mail service is not reachable right now.`
: The mail server that holds the mailbox did not answer. Select **Try again** after a moment, and [contact support](/docs/support/conversations/) if it keeps happening.
Another reason
: Select **Try again**. If the same reason comes back, contact support and quote it.
A mailbox in the account menu reads `Disabled, so it cannot be opened` or `Not reachable right now`
: The first is turned off, as above. We cannot reach the second at the moment. Neither opens until that changes ([What each mailbox is](/docs/mail/webmail/mailboxes-and-sharing/#what-each-mailbox-is)).
`Claim your @coritan.gg address` or `No mailbox in your account yet`
: Your Coritan account has no mailbox yet. Pick a name to get your coritan.gg mailbox ([Get a coritan.gg mailbox](/docs/mail/webmail/claim-a-mailbox/)). To read a mailbox you manage, such as one on Mail Hosting, select **Add a mailbox** and enter its address and password ([Add a mailbox to your account](/docs/mail/webmail/mailboxes-and-sharing/#add-a-mailbox-to-your-account)).
mail.coritan.com or webmail.coritan.com opens www.coritan.com/webmail
: Webmail lives at www.coritan.com/webmail, and both addresses send you there, to the same page the link named. Update your bookmarks to [www.coritan.com/webmail](https://www.coritan.com/webmail).
## You cannot sign in to webmail
`That address and password do not match. Check both and try again.`
: Enter the whole address, such as `alex@example.com`, and check the password. We give the same answer for a mailbox that is turned off. For your coritan.gg mailbox, the password is your Coritan account password until you give the mailbox one of its own.
A message that starts `Too many attempts to sign in.`
: After 10 failed attempts at one address within 15 minutes, or 20 from one IP address within 5 minutes, we refuse sign-ins for a while. The message says when you can try again.
[Sign in to webmail](/docs/mail/webmail/sign-in/#troubleshooting) lists the other messages, and what to do when you have forgotten the password.
## None of these match
[Contact support](/docs/support/conversations/) and include:
- The **Service ID** from the service's **Billing** tab, or the address of the mailbox involved.
- The domain, and the sender and the recipient of a message that went wrong.
- The whole message or SMTP reply, exactly as it appeared, and when it happened.
- For a message sent through the send API, the `message_id` from its answer.
Never send a password, an app password or an API key, to us or to anyone else.