Self-Hosted Email

Use Dashboard > Deploy > Email Hosting to manage mailboxes stored on a connected self-hosted VPS. Website containers remain isolated, while the VPS runs one secured mail service that can host separate domains and mailboxes for several tenants.

Email hosting is available after the self-hosted website is connected. If the VPS does not have the shared mail service, enter the VPS IP, SSH username and SSH password and select Install email system. DirectSale installs one isolated shared Mail Core per VPS and provisions the connected website's domain. The SSH password is used only for that installation request and is never stored.

If another DirectSale website on the same VPS already installed Mail Core, the installer verifies its host marker and adds only this tenant's domain. An existing domain without a matching ownership marker is not claimed or overwritten.

Installation availability

If the panel says Email installation is not available yet, contact platform support. The platform must enable its automatic mail-host DNS service first; entering different tenant DNS records or repeatedly supplying SSH credentials cannot enable that service. Once enabled, install Mail Core and publish the tenant-managed records displayed by the panel. Platform DNS credentials are configured by the administrator, not supplied by tenants.

Check the VPS provider's firewall as well as the server firewall: inbound SMTP 25 is needed for receiving, outbound TCP 25 for Direct MX delivery, and client access uses 993 plus the displayed submission port 465 or 587. Website ports 80/443 alone do not enable email. The VPS provider also controls reverse DNS.

DNS records

After installation, copy the exact records displayed in Required DNS records to the domain's DNS provider. Keep mail host records in DNS-only mode when the provider offers an HTTP proxy option. Select Check DNS to query public DNS again; each row shows its own verification state.

The usual record groups are:

• An A record for the displayed neutral mail hostname pointing to the VPS; DirectSale creates rows marked Automatic
• An MX record for the tenant domain pointing to that mail hostname, with its priority entered in the DNS provider's separate Priority field
• An SPF TXT record
• One or more DKIM TXT records generated for that domain
• A DMARC TXT record

Copy names and values exactly. For MX rows, the Value copy button copies only the mail hostname; enter the displayed number, such as 10, separately in the provider's Priority field. Do not add the priority number to the MX value. Do not reuse another tenant's DKIM value. Reverse DNS is configured by the VPS provider for the server IP and can name only one primary mail hostname; it does not replace the per-domain DNS records.

DirectSale creates the neutral shared mail hostname under the platform mail domain and points it to the VPS automatically. The tenant publishes only the displayed records that are not marked Automatic. Mailbox creation remains disabled until every required record is publicly verified.

DNS changes can take time to propagate. Mail may be received before every sender trusts new SPF, DKIM and DMARC records.

If checks disagree immediately after a DNS change, allow cached answers to expire and recheck. Compare the exact hostname, record type, MX priority and complete TXT value with your provider; TXT strings split for display must still represent one complete value. Never recreate DKIM keys solely because a cached check is pending. Copy controls show confirmation after a successful clipboard write; if copying is denied by the browser, copy the displayed value manually.

Create a mailbox

1. Open Email Hosting.
2. Enter the mailbox name, such as sales, and choose its quota in MiB.
3. Select Create.
4. Copy the generated password from the result dialog and save it in a password manager.

The password is displayed once and is not stored in the panel. The first mailbox also receives the required postmaster and abuse aliases where shown. These aliases help with mail operations and should remain reachable.

Connect an email application

After installation, Email app settings displays the exact server name, ports, encryption and username format for this VPS. The same settings work with Gmail mobile, Outlook, Apple Mail, Thunderbird and other standard IMAP clients:

• IMAP over TLS on port 993 for incoming mail
• SMTP submission on port 465 or 587 for outgoing mail
• The full email address as the username

In the Gmail mobile app, choose Add another account > Other > Personal (IMAP) and enter the displayed IMAP and SMTP values. Use this separate IMAP account for sending and receiving. Google's January 2027 changes retire third-party Send as and web POP fetching, while direct third-party account access in the mobile app remains supported. Gmail web is not a durable connection method for this mailbox. See Google's third-party account guidance.

Use TLS and certificate validation. Use the mailbox password shown during creation or password reset, not the DirectSale or VPS password. Port 25 is for server-to-server delivery and must not be used as an ordinary mailbox submission setting.

Passwords, quotas and deletion

Use Reset password when a password is lost or exposed. The new value is shown once; update every connected device afterward. Changing a mailbox password does not change SSH or dashboard credentials.

The quota chosen during creation limits stored mail for that mailbox. Change the MiB value beside an existing mailbox and select Save quota to update it. Check free VPS storage and backups before increasing quotas.

Deleting an individual mailbox permanently removes its stored messages. The ordinary mailbox Delete button prevents deletion of the final mailbox so required administrative aliases do not become unreachable. Create a replacement mailbox first. The separate SSH maintenance workflow below can deliberately clear all mailboxes after backup verification.

Disconnect, clear or remove email

Open Email connection & removal near the top of Email Hosting. Enter the website domain, numeric VPS IP, SSH username and password, then select Verify this installation. Use root or a full sudo account; the sudo password must be the same as the SSH password. SSH credentials are used for this session only. The connected website's signed ownership marker and pinned SSH host key must match the current tenant.

If Upgrade secure management appears, run that upgrade first. It updates the private host agent and does not erase mail or reinstall the website.

Choose the operation you need:

Button	Result
Disconnect email management	Disables this domain's panel mail management. Existing mailboxes, messages and mail delivery remain on the VPS. The website stays connected. To reconnect, use Install email system with verified SSH access; the installer attaches to the existing owned domain.
Delete all tenant mailboxes	Creates and verifies an encrypted backup, then deletes every user mailbox and its messages in this domain. The administrator, domain configuration, DKIM keys and mail server remain. Create new mailboxes from the panel afterward, or restore the downloaded mailbox backup.
Remove mail server	Removes a verified, exclusive DirectSale mail server, its active configuration, mail volumes, private network and mail route. It is blocked when another domain or unverified resource uses that server. Website files, website containers and the shared HTTPS gateway remain.

Type the exact domain and select the acknowledgment before running the operation. When deleting existing mailboxes, provide a backup password of at least 12 characters. A failed backup blocks deletion. Progress shows percentages and operation titles; failures show stable support codes, never raw SSH or Docker logs. If progress is interrupted, inspect again before retrying.

Download the verified .ds-mail-backup.gpg file and keep it outside the VPS with its backup password. Portable mailbox backups expire after 24 hours; download authorization lasts one hour and can be renewed by verifying the installation again. Downloads remain available in this maintenance section after full server removal while the backup file still exists.

Full server removal also creates a private server recovery archive on the VPS for operator recovery. That archive contains server secrets and is never downloadable through the tenant panel. It is not an off-site backup. Removing a shared mail server is intentionally unavailable; use the domain-scoped clear or disconnect options instead.

To reinstall after full removal, use Install email system on the same connected website. Publish the newly displayed MX and DKIM records, verify DNS, then recreate mailboxes or upload the portable backup and restore it in merge mode. New mailbox passwords are displayed once. Old DNS records are not automatically deleted, so replace obsolete mail records at your DNS provider. You do not need to reinstall the website.

Download and restore a backup

Open Encrypted email backups on the Email Hosting page. A backup is scoped to the selected mailboxes of the current domain; it never contains another tenant's mailbox or the shared mail server configuration.

To download a backup:

1. Select one or more mailboxes.
2. Enter and repeat a backup password of at least 12 characters.
3. Select Create encrypted backup and follow the progress shown on the page.
4. When the job is ready, select Download.

The password encrypts the file on the VPS and is never stored by DirectSale. It cannot be recovered. Save it in a password manager. Download links are short-lived and one-time, and temporary backup files are removed from the VPS after 24 hours.

To restore a backup, choose the downloaded .ds-mail-backup.gpg file, enter its password and select Upload and inspect. The browser uploads the file directly to the VPS. DirectSale first checks the password, domain, package paths and archive checksums. Restore safely (merge) appears only after the file passes inspection.

Restore is additive: existing messages remain and missing content is added. If a mailbox from the backup no longer exists, DirectSale recreates it and displays its new password once. Save every displayed password immediately. The panel does not offer a destructive exact-copy restore.

An older installation may show Secure mail backup upgrade. Enter the VPS IP and temporary SSH credentials there. The upgrade adds only the current management agent, encryption utility and restricted JMAP routes; it does not reinstall the website, mail service or existing messages. Change the SSH password afterward as usual.

Delivery and security

When direct delivery is available, the server sends mail to recipient MX servers over port 25. No third-party SMTP account is required for that mode. Successful submission only proves that the receiving server accepted the message; inbox placement still depends on DNS reputation, IP reputation and recipient filtering.

Each tenant has separate domain records, accounts and mailbox storage. Website and email services are separate, so a stopped website does not automatically delete mail. The VPS owner still controls the host and must maintain security updates, backups, disk capacity, reverse DNS and IP reputation.

If sending or receiving fails, refresh the status, verify every displayed DNS record, confirm the VPS provider allows the required mail ports, check storage and retry with a newly created test message. Never send mailbox, SSH or sync passwords in a support request.