# Create and manage mailboxes

> Create mailboxes on your domain, reset their passwords, change storage quotas, and turn off or delete a mailbox.

Source: https://www.coritan.com/docs/mail/mail-hosting/mailboxes/

In the dashboard:

- /dashboard/mail/…/mailboxes: https://www.coritan.com/dashboard/mail

A *mailbox* is an address with its own storage, such as `alex@example.com`, that people sign in to with webmail or a mail app. Each Mail Hosting plan allows a number of mailboxes and a pool of storage they share. This page covers creating mailboxes and looking after them.

## Before you begin

- A Mail Hosting service with a domain whose ownership you have proved. See [Add a domain to Mail Hosting](/docs/mail/mail-hosting/add-a-domain/).
- Room on the plan. The **Mailboxes** card shows how many the plan allows, such as `3 of 5 on this plan.`

## Create a mailbox

1. In the dashboard, go to [**Email**](https://www.coritan.com/dashboard/mail), open the Mail Hosting service, then the **Mailboxes** tab.
2. Select **Create mailbox…**.
3. In **Name**, enter the part before the @, such as `alex`. The hint under the field shows the full address.
4. In **Domain**, choose the domain. The list holds every domain whose ownership you have proved. A domain whose other DNS records are not in place yet is marked `not fully set up`: you can create the mailbox, but its mail may land in spam or not arrive until you finish the domain, and the mailbox's row says `Domain not fully set up` until then.
5. Optionally, enter a **Display name**, such as `Alex Morgan`.
6. In **Quota (GB)**, set the mailbox's storage. The field starts at an equal share of the plan's storage, and its hint shows the plan's total.
7. Under **Password**, choose **Generate a strong password**, or **Set one now** and enter it in **New password** (at least 12 characters).
8. Select **Create mailbox**.

A dialog shows the **Address**, the **Password** if we generated it, and the **IMAP**, **SMTP** and **Webmail** settings. Copy the password now: we show a generated password once and cannot show it again.

The mailbox appears in the list, with its **Security**, **Quota**, **Password set** and **Enabled** columns. To open it in webmail with its address filled in, open the menu at the end of its row and select **Open webmail**. To set up a mail app, see [Connect a mail app to Mail Hosting](/docs/mail/mail-hosting/connect-a-mail-app/).

## Reset a mailbox password

1. On the **Mailboxes** tab, open the menu at the end of the mailbox's row.
2. Select **Reset password…**.
3. Choose **Generate a strong password**, or **Set one now** and enter the new password.
4. Select **Reset password**.

The dialog that follows shows a generated password once. Resetting the password signs the mailbox out of webmail everywhere, and its app passwords keep working. Update the password in every mail app that uses it.

> [!NOTE]
> A generated password also turns off two-factor sign-in for the mailbox, because whoever holds the new password is taken to be its owner. A password you set yourself keeps two-factor sign-in on. The **Security** column shows the change after you reload the page.

## Change a mailbox's quota

1. On the **Mailboxes** tab, open the menu at the end of the mailbox's row.
2. Select **Change quota…**.
3. In **Quota (GB)**, enter the new size. The hint shows the current quota and the plan's total.
4. Select **Save quota**.

The toast confirms the new quota. A quota is at least 100 MB, and all the mailboxes' quotas together cannot exceed the plan's storage. To give one mailbox more, shrink another first or [move to a bigger plan](/docs/mail/billing/#move-to-a-bigger-or-smaller-plan).

## Turn a mailbox off or on

On the **Mailboxes** tab, use the switch in the mailbox's **Enabled** column.

A mailbox you turn off cannot sign in, send or receive mail, and is signed out of webmail. Its stored mail stays, and turning it back on restores everything. A mailbox that is off still counts towards the plan.

## Delete a mailbox

> [!CAUTION]
> Deleting a mailbox destroys every message in it, and you cannot get them back. Aliases that deliver to it deliver nowhere until you change them.

1. On the **Mailboxes** tab, open the menu at the end of the mailbox's row.
2. Select **Delete mailbox…**.
3. Type the mailbox's address to confirm, then select **Delete mailbox**.

The mailbox leaves the list, and its place and storage go back to the plan.

## Troubleshooting

**Create mailbox…** is greyed out
: The plan's mailboxes are all in use, or the service is not active. A full plan shows `This plan allows 5 mailboxes. Delete one or change the plan to add another.` Delete a mailbox, or [move to a bigger plan](/docs/mail/billing/#move-to-a-bigger-or-smaller-plan).

**Prove you own a domain first**
: No domain on the service has its ownership proved yet, so the form has nothing to offer. Publish the domain's ownership record, shown on the **Domains** tab, then [check the domain](/docs/mail/mail-hosting/add-a-domain/#verify-the-domain).

`Use only letters, digits, dots, dashes, plus signs and underscores.`
: The name has another character, or starts or ends with a dot, dash, plus sign or underscore. Names are at most 64 characters and are stored in lower case.

`That address already exists`
: The address is already a mailbox or an alias. Choose another name, or delete the alias first.

`Not enough storage left on this plan for another mailbox of that size`
: The other mailboxes' quotas leave too little room. Enter a smaller **Quota (GB)**, shrink another mailbox, or [move to a bigger plan](/docs/mail/billing/#move-to-a-bigger-or-smaller-plan).

`That would exceed the plan's total storage`
: The new quota does not fit beside the others. Shrink another mailbox first.

`The domain is not registered in the mail engine yet; check the domain again in a minute`
: The domain was verified moments ago and its setup is not finished. Select **Verify now** on the domain's page, then try again.

The address shows a warning and the mailbox is off
: We turn a mailbox off by ourselves when it suddenly sends far more than it usually does, which is what a stolen password looks like. The warning under the address says what we saw, and we email the account owner. [Reset the password](#reset-a-mailbox-password), then turn the mailbox back on. The warning stays under the address after that.

## Related

- [Secure a mailbox](/docs/mail/mail-hosting/mailbox-security/)
- [Connect a mail app to Mail Hosting](/docs/mail/mail-hosting/connect-a-mail-app/)
- [Move existing mail into a mailbox](/docs/mail/mail-hosting/move-mail-in/)
- [Forward addresses with aliases](/docs/mail/mail-hosting/aliases/)

## With the API

Create a mailbox with a generated password:

```bash
curl -X POST https://api.coritan.com/api/v1/client/mail/4812/mailboxes \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain_id": 311, "local_part": "alex", "display_name": "Alex Morgan", "quota_bytes": 5368709120}'
```

The body takes these fields:

`domain_id`
: The domain, from `GET /client/mail/{service_id}/domains`. The API accepts a domain as soon as its ownership check has passed, before it is verified. See [Move a domain that already receives mail](/docs/mail/mail-hosting/add-a-domain/#move-a-domain-that-already-receives-mail).

`local_part`
: The part before the @, 1–64 characters: letters, digits and `.` `_` `+` `-`, starting and ending with a letter or digit.

`password`
: Optional, 12–128 characters. Leave it out and we generate a 24-character password.

`display_name`
: Optional, up to 255 characters.

`quota_bytes`
: Optional, at least `104857600` (100 MB). Leave it out for an equal share of the plan's storage.

The answer is `201` with the mailbox. `password` holds the generated password, shown this once, or `null` when you set one:

```json
{
  "id": 5120,
  "tenant_id": 902,
  "domain_id": 311,
  "kind": "mailbox",
  "address": "alex@example.com",
  "local_part": "alex",
  "display_name": "Alex Morgan",
  "quota_bytes": 5368709120,
  "targets": [],
  "status": "active",
  "password_set_at": "2026-09-16T10:52:03.418207+00:00",
  "created_at": "2026-09-16T10:52:03.418207+00:00",
  "totp_enabled": false,
  "app_passwords": 0,
  "frozen_reason": null,
  "user_id": null,
  "password": "q7!Rk2mV9x#Tz4pLw8=Hs3Nd"
}
```

The other operations:

| Operation | Body | Answer |
| --- | --- | --- |
| `GET /client/mail/{service_id}/mailboxes` | | `{"items": [...]}`, each mailbox as above with `locked` (always `null` for a mailbox) in place of `password` |
| `POST /client/mail/{service_id}/mailboxes/{account_id}/password` | `{"password": "..."}`, or `{}` to generate one | `{"id", "address", "password"}` with the new password |
| `PATCH /client/mail/{service_id}/mailboxes/{account_id}/quota` | `{"quota_bytes": 10737418240}` | The mailbox |
| `PATCH /client/mail/{service_id}/mailboxes/{account_id}/enabled` | `{"enabled": false}` | The mailbox, with `status` `disabled` or `active` |
| `DELETE /client/mail/{service_id}/mailboxes/{account_id}` | | `{"ok": true}` |

A refused request answers `400` with one of the messages in [Troubleshooting](#troubleshooting), or with `This plan allows 5 mailboxes`, `Domain not found on this service` or `Prove you own example.com first: publish the ownership record shown under Domains, then check the domain`. A value outside a field's range answers `422`, an id that is not a mailbox on the service answers `404` `Not found`, and a failure on our side answers `502` with a message that starts `Mail engine error:`.

### On an SMTP Relay service

A relay has no mailboxes, but the same paths exist under `/client/smtp-relay/{service_id}/mailboxes`:

- `GET` answers `{"items": []}`, and `POST` answers `400` `Mailboxes are only available on Mail Hosting services`.
- `.../{account_id}/password` and `.../{account_id}/enabled` accept an SMTP credential's id and act on the credential. `password` is the only way to give a credential a password you choose; see [Send over SMTP with credentials](/docs/mail/smtp-relay/credentials/#with-the-api).
- Every other path under `.../mailboxes/{account_id}` answers `404` `Not found`.

## API

- `GET /api/v1/client/mail/{service_id}/mailboxes`: List mailboxes (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-get-api-v1-client-mail-service-id-mailboxes)
- `POST /api/v1/client/mail/{service_id}/mailboxes`: Create mailbox (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-post-api-v1-client-mail-service-id-mailboxes)
- `POST /api/v1/client/mail/{service_id}/mailboxes/{account_id}/password`: Mailbox password (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-post-api-v1-client-mail-service-id-mailboxes-account-id-password)
- `PATCH /api/v1/client/mail/{service_id}/mailboxes/{account_id}/quota`: Mailbox quota (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-patch-api-v1-client-mail-service-id-mailboxes-account-id-quota)
- `PATCH /api/v1/client/mail/{service_id}/mailboxes/{account_id}/enabled`: Mailbox enabled (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-patch-api-v1-client-mail-service-id-mailboxes-account-id-enabled)
- `DELETE /api/v1/client/mail/{service_id}/mailboxes/{account_id}`: Delete mailbox (https://www.coritan.com/docs/api/reference/client/mail/mail-mailboxes/#op-delete-api-v1-client-mail-service-id-mailboxes-account-id)
- `GET /api/v1/client/smtp-relay/{service_id}/mailboxes`: List mailboxes (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-get-api-v1-client-smtp-relay-service-id-mailboxes)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes`: Create mailbox (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes)
- `DELETE /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}`: Delete mailbox (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-delete-api-v1-client-smtp-relay-service-id-mailboxes-account-id)
- `GET /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/app-passwords`: Mailbox app passwords (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-get-api-v1-client-smtp-relay-service-id-mailboxes-account-id-app-passwords)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/app-passwords`: Mailbox app password create (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-app-passwords)
- `DELETE /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/app-passwords/{credential_id}`: Mailbox app password delete (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-delete-api-v1-client-smtp-relay-service-id-mailboxes-account-id-app-passwords-cr)
- `PATCH /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/enabled`: Mailbox enabled (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-patch-api-v1-client-smtp-relay-service-id-mailboxes-account-id-enabled)
- `GET /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/imports`: Mailbox imports (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-get-api-v1-client-smtp-relay-service-id-mailboxes-account-id-imports)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/imports`: Mailbox import start (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-imports)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/imports/oauth`: Mailbox import sign in (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-imports-oauth)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/imports/upload`: Mailbox import upload (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-imports-upload)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/imports/{import_id}/{action}`: Mailbox import steer (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-imports-import-id)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/password`: Mailbox password (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-password)
- `PATCH /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/quota`: Mailbox quota (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-patch-api-v1-client-smtp-relay-service-id-mailboxes-account-id-quota)
- `GET /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/sessions`: Mailbox sessions (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-get-api-v1-client-smtp-relay-service-id-mailboxes-account-id-sessions)
- `DELETE /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/sessions`: Mailbox sessions end (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-delete-api-v1-client-smtp-relay-service-id-mailboxes-account-id-sessions)
- `DELETE /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/sessions/{session_id}`: Mailbox session end (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-delete-api-v1-client-smtp-relay-service-id-mailboxes-account-id-sessions-session)
- `POST /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/totp`: Mailbox totp enable (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-post-api-v1-client-smtp-relay-service-id-mailboxes-account-id-totp)
- `DELETE /api/v1/client/smtp-relay/{service_id}/mailboxes/{account_id}/totp`: Mailbox totp disable (https://www.coritan.com/docs/api/reference/client/mail/smtp-relay-mailboxes/#op-delete-api-v1-client-smtp-relay-service-id-mailboxes-account-id-totp)