Mail Client Setup (IMAP, POP3, SMTP)

Once a mailbox exists in vPanel → Email Accounts, you connect to it from any mail app over IMAP, POP3 and SMTP. This page lists the exact hostnames, ports and encryption the server expects, and the two things that most often cause a mail app to refuse to connect.

Settings

Use mail. followed by your own domain — not the hostname you use to reach the panel. The Email Accounts page prints the value for your primary domain, and Download setup guide on that page gives you the same settings as a self-contained HTML file with per-device steps, already filled in with your domain.

Prefer IMAP unless you have a reason not to: it keeps every device in sync and leaves mail on the server, where webmail, filters and folders all keep working. POP3 downloads to one device.

Encryption is not optional

Dovecot is configured with disable_plaintext_auth = yes. The unencrypted ports still answer, but they will not accept your password until the connection is upgraded with STARTTLS. If a client is set to "None" or "No security" on port 143 or 110, authentication fails even though the password is correct. Set 993/995 with SSL/TLS and the question does not arise.

Outgoing mail always requires authentication. Ports 587 and 465 accept only authenticated senders, so "Require sign-in" (or the equivalent) must be on, with the same full address and password as the incoming server.

The certificate

A fresh install uses a self-signed certificate for mail, which makes clients warn about an untrusted server. The fix is on the administrator's side: vWHM → SSL / TLS → Sync trusted mail SSL now issues a single Let's Encrypt certificate named vanta-mail covering every mail.<domain> on the server that currently validates, points Dovecot and Postfix at it, and installs a renewal hook that reloads both services. New accounts are added to it automatically shortly after creation.

A domain is included only if both checks pass:

• mail.<domain> resolves to the server's public IP — on Cloudflare that means the record must be DNS only (grey cloud), and
• mail.<domain> answers over plain HTTP, so Let's Encrypt can complete the challenge.

Domains that fail either check are listed as skipped on the vWHM SSL page with the reason. Fix the DNS, then run the sync again.

The same sync opens the mail ports (25, 110, 143, 465, 587, 993, 995) in ufw when ufw is the active firewall, so a client that times out on a brand-new server usually just needs the sync to have run once.

If a client warns about the certificate after all of that, the server name in the client almost always does not match. It must be exactly mail.<domain> — a certificate issued for mail.example.com is not valid for example.com or for the server's hostname.

When mail does not arrive

Connecting successfully and receiving mail are different problems. If the client connects but the inbox stays empty:

• Check the domain has an MX record pointing at mail.<domain>. The one-click Set up mail DNS automatically button on the Email Accounts page creates it, along with SPF, DKIM and DMARC.
• Check you have not created a forwarder for the same address. A forwarder takes precedence over local delivery, so mail goes to the forwarding destination instead of the mailbox.
• If mail leaves your client but never reaches the recipient, the problem is deliverability rather than the client — see Email deliverability and, on the admin side, the mail queue.