Understand Mailbox DNS before changing your infrastructure.
This guide explains packages, domain onboarding, authoritative DNS, mail configuration, DNSSEC, client settings, API access, backups and security in practical language. Exact hostnames and values for your organization are shown in your signed-in control panel.
Packages & limits
A package combines a monthly price with real resource limits. These numbers are not advertising estimates: the control plane uses them when deciding whether an organization may create another mailbox, onboard another domain, allocate more mailbox storage or create another API key.
Mailboxes
One mailbox is one individual email account. Examples are info@company.co.ls, accounts@company.co.ls or an employee address. A 50-mailbox package allows up to 50 such accounts across the organization.
Hosted domains
A hosted domain is a separate domain managed under the same subscription. A limit of 10 means the organization can onboard up to 10 different domains for DNS and/or mail services.
Allocated storage
Storage is the organization's shared allocated mailbox quota pool. For example, 250 GB is shared across the organization; it is not automatically 250 GB for every mailbox.
API keys
API keys are credentials used by applications, scripts and integrations to automate approved platform operations. A 10-key limit means up to 10 active integration credentials.
Authoritative DNS + DNSSEC
Mailbox DNS can become the official DNS authority for customer domains using PowerDNS. DNSSEC adds cryptographic signatures so resolvers can detect forged DNS answers.
Webmail + IMAP/SMTP
Users can read and send mail in the browser and can also connect Outlook, Thunderbird, Apple Mail, Android/iOS clients and other standards-based applications.
SPF, DKIM & DMARC tooling
SPF declares permitted senders, DKIM cryptographically signs outgoing messages, and DMARC tells receiving servers how to treat messages that fail authentication. Together they improve trust, anti-spoofing and deliverability.
Encrypted backups + monitoring
Platform data is covered by encrypted backup workflows and operational monitoring. Monitoring watches service health and alerts operators; backup retention and recovery targets are operational policies, not extra mailbox storage.
Important: A package storage limit describes allocated mailbox quota. Actual disk capacity, backup storage and retention are separate platform-operational concerns.
Getting started
The normal customer flow is: choose a package → create the organization account → add a domain → prove domain ownership → configure or delegate DNS → create mailboxes → configure mail clients and security.
Choose a package that covers expected users, domains and storage.
Add the domain in the control panel and publish the ownership-verification record shown there.
For Mailbox DNS authoritative hosting, register/delegate the nameservers shown by the platform at your registrar.
Wait for verification, then create mailboxes and publish the mail-authentication records shown in the panel.
DNS records
A/AAAA records point hostnames to IPv4/IPv6 addresses. CNAME aliases one hostname to another. MX specifies mail servers. TXT carries verification and authentication data such as SPF and DKIM. CAA restricts certificate authorities. SRV publishes service host/port information. NS identifies authoritative nameservers.
TTL (Time To Live) controls how long resolvers cache a record. Lower TTLs can make planned migrations converge faster, but they also create more DNS query traffic. Do not change records simply to “make propagation faster” unless you understand the existing cache window.
Nameservers & glue records
Delegation is configured at the domain registrar. It tells the parent registry which authoritative nameservers answer for the domain. When a nameserver is inside the same domain it serves—for example ns1.example.co.ls serving example.co.ls—the registrar/registry also needs a glue (private/child nameserver) record containing the nameserver's IP address to avoid a circular lookup.
Always create and test the authoritative zone before changing delegation. The control panel shows the exact nameserver hostnames assigned to your domain.
DNSSEC
DNSSEC signs authoritative zone data. A complete deployment needs keys/signatures on the authoritative DNS service and the correct DS information published at the parent/registrar. Enabling only one side can make the domain fail validation, so follow the control-panel DNSSEC state and registrar instructions as one coordinated operation.
Mail routing, SPF, DKIM & DMARC
The domain's MX record directs incoming mail to the platform mail hostname. SPF defines which systems may send on behalf of the domain. DKIM publishes a public key in DNS while outgoing messages are signed using the corresponding private key. DMARC evaluates SPF/DKIM alignment and publishes the domain owner's policy.
Use the exact MX, SPF, DKIM selector/value and DMARC recommendations generated for your domain. Do not copy another customer's DKIM record or private key.
Webmail & email-client configuration
Webmail requires only a browser and the mailbox credentials. For standards-based clients, use the mail hostname shown in the control panel, the full email address as username, IMAPS on port 993 with TLS, and authenticated SMTP submission on port 587 with STARTTLS/TLS as instructed by the platform.
Do not use public SMTP port 25 as a normal end-user submission port. Port 25 is primarily for server-to-server mail transport.
API access
API keys are intended for automation and integrations. Give each integration its own key, use the narrowest available scopes, store keys in a secret manager or protected environment variable, and revoke keys that are no longer needed. Never embed a secret API key in browser JavaScript or public source code.
Encrypted backups & monitoring
Mailbox DNS includes operational backup and monitoring capabilities. Backups protect recoverable platform data and are encrypted using platform-controlled secrets. Monitoring covers application/mail/DNS service health and feeds operational dashboards and alerts. Backups are not a substitute for mailbox retention policies or a customer archive product unless a separate archive feature is explicitly enabled.
Security practices
Use MFA for privileged accounts, unique passwords, least-privilege tenant roles and scoped API keys. Keep devices and email clients updated, use TLS-enabled client settings, review active sessions and audit logs, and investigate unexpected DNS/mail changes immediately.
DNS, mail and account security are connected: a compromised registrar, nameserver account or platform-owner account can affect an entire domain. Protect registrar and platform access with the same care as banking/admin credentials.
Platform-owner package configuration
The platform owner can create and edit commercial packages under Business → Packages & pricing. Package price, mailbox limit, domain limit, storage allocation and API-key limit feed the public catalog and the same billing-entitlement system used during provisioning.
Existing package codes are permanent identifiers used by signup/subscription flows. Change customer-facing names/pricing/limits carefully. The platform blocks deactivation of a package that is still assigned to a tenant; move those subscriptions first.
Troubleshooting checklist
Use the panel for exact values.
This manual explains how the system works. Your signed-in domain, DNS and mail screens remain the source of truth for generated verification tokens, nameserver targets, DKIM selectors, hostnames and other account-specific configuration.
Sign in to configure resources