Create and manage mailboxes

A mailbox is an address with its own storage, such as alex@example.com, that people sign in to with webmail or a mail app. Each Mail Hosting plan allows a number of mailboxes and a pool of storage they share. This page covers creating mailboxes and looking after them.

• A Mail Hosting service with a domain whose ownership you have proved. See Add a domain to Mail Hosting.
• Room on the plan. The Mailboxes card shows how many the plan allows, such as 3 of 5 on this plan.

1. In the dashboard, go to Mail Services, open the Mail Hosting service, then the Mailboxes tab.
2. Select Create mailbox…. The Create a mailbox page opens. It has an Address, a Person and a Password section, and a This mailbox summary beside them.
3. In Address, enter the part before the @ in Name, such as alex. The hint under the field shows the full address.
4. In Domain, choose the domain. The list holds every domain whose ownership you have proved. A domain whose other DNS records are not in place yet is marked not fully set up: you can create the mailbox, but its mail may land in spam or not arrive until you finish the domain, and the mailbox's row says Domain not fully set up until then.
5. In Person, optionally enter a Display name, such as Alex Morgan.
6. In Quota (GB), set the mailbox's storage. The field starts at an equal share of the plan's storage, and its hint says how much the plan includes per mailbox, such as Your plan includes 1 GB per mailbox. A mailbox can have more if another has less.
7. In Password, choose Generate a strong password, or Set one now and enter it in New password (at least 12 characters).
8. Select Create mailbox.

If we refuse the request, the page keeps everything you entered and shows the reason above the buttons. Select Cancel, or the back link All mailboxes, to leave without creating anything.

The page then says Mailbox created and lists the Address, the Password if we generated it, and the IMAP, SMTP and Webmail settings. Copy the password now: we show a generated password once and cannot show it again. Select I have saved it to return to the list. It is the only way off the page until you do.

The mailbox appears in the list, with its Security, Quota, Password set and Enabled columns. To open it in webmail with its address filled in, open the menu at the end of its row and select Open webmail. To set up a mail app, see Connect a mail app to Mail Hosting.

Select a mailbox's address in the list, or open the menu at the end of its row and select Open mailbox. The mailbox's page has a card for each thing you can do with it: Password, Two-factor sign-in, App passwords, Webmail sessions, Quota, Bring mail in and Delete mailbox. The heading shows the address, and under it the display name, the quota, whether two-factor sign-in is on and when the password was set. The back link All mailboxes returns to the list. The other items in the row menu open the same page at the card they name.

1. On the Mailboxes tab, open the mailbox: select its address, or open the menu at the end of its row and select Reset password….
2. On the Password card, choose Generate a strong password, or Set one now and enter the new password.
3. Select Reset password.

The page then shows the new password once, with the mailbox's mail server settings. Select I have saved it to return to the mailbox's cards. The old password stops working within a minute. Resetting the password signs the mailbox out of webmail everywhere, and its app passwords keep working. Update the password in every mail app that uses it.

1. On the Mailboxes tab, open the mailbox: select its address, or open the menu at the end of its row and select Change quota….
2. On the Quota card, select Change quota.
3. In Quota (GB), enter the new size. The hint shows the current quota and how much the plan includes per mailbox.
4. Select Save quota, or Cancel to keep the old size.

The toast confirms the new quota. A quota is at least 100 MB, and all the mailboxes' quotas together cannot exceed the plan's storage. To give one mailbox more, shrink another first or move to a bigger plan.

On the Mailboxes tab, use the switch in the mailbox's Enabled column.

A mailbox you turn off is signed out of webmail at once, and within a minute it cannot sign in, send or receive mail. Its stored mail stays, and turning it back on restores everything. A mailbox that is off still counts towards the plan.

1. On the Mailboxes tab, open the mailbox: select its address, or open the menu at the end of its row and select Delete mailbox….
2. On the Delete mailbox card, select Delete mailbox….
3. Type the mailbox's address to confirm, then select Delete mailbox.

You return to the list. The mailbox is gone from it, and its place and storage go back to the plan.

Create mailbox… is greyed out

The plan's mailboxes are all in use, or the service is not active. A bookmarked Create a mailbox page then says Every mailbox on this plan is in use, or This service is not ready yet, instead of the form. A full plan shows This plan allows 5 mailboxes. Delete one or change the plan to add another. Delete a mailbox, or move to a bigger plan.

On the Mail Hosting your account plan includes, the tab reads This email has all 5 mailboxes your plan includes. above two offers, each with its price. Extra Mailbox adds mailboxes to this service: select Add…, set Quantity on the page that opens, then select the button, "Pay $X and add" (Add-ons). The other offer is the next account plan, such as Pro plan, and its button, such as Upgrade to Pro, opens the page that orders that plan (Change your account plan).

A dialog titled Your plan allows 5 mailboxes opens

The account plan's limit refused the mailbox or the quota. The dialog offers what raises the limit, such as Extra Mailbox with Add…, or the next plan with its upgrade button. Each opens its own page and returns you here, and you repeat what you were doing by hand. The page you were on keeps what you entered. Select Not now to close the dialog.

Prove you own a domain first

No domain on the service has its ownership proved yet, so the Create a mailbox page has nothing to offer. Publish the domain's ownership record, shown on the Domains tab, then check the domain.

Use only letters, digits, dots, dashes, plus signs and underscores.

The name has another character, or starts or ends with a dot, dash, plus sign or underscore. Names are at most 64 characters and are stored in lower case.

That address already exists

The address is already a mailbox or an alias. Choose another name, or delete the alias first.

Not enough storage left on this plan for another mailbox of that size

The other mailboxes' quotas leave too little room. Enter a smaller Quota (GB), shrink another mailbox, or move to a bigger plan.

That would exceed the plan's total storage

The new quota does not fit beside the others. Shrink another mailbox first.

The domain is not registered in the mail engine yet; check the domain again in a minute

The domain was verified moments ago and its setup is not finished. Select Verify now on the domain's page, then try again.

The address shows a warning and the mailbox is off

We turn a mailbox off by ourselves when it suddenly sends to far more people than it usually does, which is what a stolen password looks like. Every two minutes we compare each hour with the mailbox's own week before. A mailbox that sent nothing in that week is turned off when it sends to 50 people or more in an hour, and one less than a day old when it sends to more than 300. The warning under the address says what we saw. We email the account owner once for all the addresses we turned off together. Reset the password, then turn the mailbox back on. The warning stays under the address after that.

• Secure a mailbox
• Connect a mail app to Mail Hosting
• Move existing mail into a mailbox
• Forward addresses with aliases

Create a mailbox with a generated password:

curl -X POST https://api.coritan.com/api/v1/client/mail/4812/mailboxes \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain_id": 311, "local_part": "alex", "display_name": "Alex Morgan", "quota_bytes": 5368709120}'

The body takes these fields:

domain_id

The domain, from GET /client/mail/{service_id}/domains. The API accepts a domain as soon as its ownership check has passed, before it is verified. See Move a domain that already receives mail.

local_part

The part before the @, 1–64 characters: letters, digits and . _ + -, starting and ending with a letter or digit.

password

Optional, 12–128 characters. Leave it out and we generate a 24-character password.

display_name

Optional, up to 255 characters.

quota_bytes

Optional, at least 104857600 (100 MB). Leave it out for an equal share of the plan's storage.

The answer is 201 with the mailbox. password holds the generated password, shown this once, or null when you set one:

{
  "id": 5120,
  "tenant_id": 902,
  "domain_id": 311,
  "kind": "mailbox",
  "address": "alex@example.com",
  "local_part": "alex",
  "display_name": "Alex Morgan",
  "quota_bytes": 5368709120,
  "targets": [],
  "status": "active",
  "password_set_at": "2026-09-16T10:52:03.418207+00:00",
  "created_at": "2026-09-16T10:52:03.418207+00:00",
  "totp_enabled": false,
  "app_passwords": 0,
  "frozen_reason": null,
  "user_id": null,
  "password": "q7!Rk2mV9x#Tz4pLw8=Hs3Nd"
}

The other operations:

A refused request answers 400 with one of the messages in Troubleshooting, or with This plan allows 5 mailboxes, Domain not found on this service or Prove you own example.com first: publish the ownership record shown under Domains, then check the domain. A value outside a field's range answers 422, an id that is not a mailbox on the service answers 404 Not found, and a failure on our side answers 502 with a message that starts Mail engine error:.

A relay has no mailboxes, but the same paths exist under /client/smtp-relay/{service_id}/mailboxes:

• GET answers {"items": []}, and POST answers 400 Mailboxes are only available on Mail Hosting services.
• .../{account_id}/password and .../{account_id}/enabled accept an SMTP credential's id and act on the credential. password is the only way to give a credential a password you choose; see Send over SMTP with credentials.
• Every other path under .../mailboxes/{account_id} answers 404 Not found.