VinzaPanel handles installation automatically via the Vinza Store. Make sure the panel agent has internet access to download dependencies.

1.3.4 — Webmail links on the panel use the page's own host again when it is the panel's domain or an IP, and the server domain only for another hostname (PANEL_PUBLIC_URL behind your own proxy). 1.3.3 always used the server domain, so a panel opened by IP whose domain does not resolve lost its webmail link. 1.3.3 — Webmail links on the panel open on its server domain, where the web-apps server serves the webmail path, so they work when the panel itself is opened through another hostname (PANEL_PUBLIC_URL behind your own proxy) instead of returning 404. 1.3.2 — Autoresponders: each mailbox can have an out-of-office reply (subject, message, optional start/end dates, how often the same sender is answered), set by the admin or by the tenant who owns the domain; it runs as a Sieve script (dovecot-sieve, installed on update) kept in the mailbox's home, so it moves with the mail server. ManageSieve (port 4190) can be turned on in Settings and is off by default. Sending limits: messages per hour and per day for every mailbox (an admin default plus per-mailbox overrides), enforced by a Postfix policy service at end of message — over the limit mail is deferred, the mailbox's owner and the admins get an alert, and the gauge button shows what each mailbox sent in the last hour and day. Mail clients configure themselves: Thunderbird autoconfig (autoconfig.<domain>, /.well-known/autoconfig) and Outlook autodiscover are answered on nginx, Apache and OpenLiteSpeed, and the DNS records (autoconfig/autodiscover CNAMEs, _imaps/_submission/_autodiscover SRV) are written with the other mail records (Regenerate DNS adds them to existing domains). IMAP import: copy a mailbox from another server with imapsync (installed from the upstream release, checksum-verified, where the OS has no package) as a background job with progress, log and cancel; the source password goes through a 0600 file that is deleted afterwards. 1.3.1 — Security: names shown in the page (from the server, its sites or its users) are passed to buttons safely; a quote in one could run script in the admin's browser. 1.3.0 — One mail server for the whole cluster: the mail server role can move from the panel host to a Vinza Server node (or back, or between nodes) from Settings → Mail server role. The move checks the target (public IP, port 25, rDNS hint, disk), installs the mail stack there, copies maildirs, mailboxes with their password hashes, aliases, quotas, DKIM keys, anti-spam and webmail settings, holds new mail in the queue during the final copy (nothing bounces), switches, points MX/SPF/DKIM/DMARC of every mail domain at the new server (records to copy for zones this panel does not serve) and lets the old server forward any stragglers; a failed move puts the old server back into service and can be retried. Mailboxes, webmail sign-in, client settings, anti-spam, the queue and quotas all follow the mail server. The outbound relay keeps its password encrypted in the panel (never shown again), suggests the SPF include of known providers (Mailgun, SES, SendGrid, Brevo, Postmark, Mailjet, SMTP2GO) and has a Send test email action. SPF records include the mail server's IP. Needs panel 1.3.60. 1.2.7 — Webmail stays on the PHP it already uses (or one the server runs) instead of following the system `php`, and a duplicate webmail pool in another PHP version is removed: two pools on one socket stopped that PHP-FPM from starting. 1.2.6 — Mail client settings list only the ports the firewall opens (IMAPS 993, POP3S 995, SMTP 587/465); 143 and 110 are blocked by UFW and timed out. Rspamd gets its own Redis ACL user once the Redis app protects Redis with a password, so Bayes learning and greylisting keep working (set up on update and when the anti-spam settings are applied). The shared web-apps server no longer writes a second `server_name _` on port 80 (nginx warned "conflicting server name" on every reload). 1.2.5 — Mailbox passwords must be at least 8 characters (a 1-character password was accepted). Changing the password or quota of a mailbox that does not exist now says so instead of reporting success. Alias destinations are checked and normalised (one per line or comma-separated; "not an email" was saved and mail went nowhere), and a second alias for an address that already has one is refused (edit it instead). A catch-all alias (@domain) no longer swallows mail for existing mailboxes. Port 25 no longer offers login before STARTTLS (smtpd_tls_auth_only). Roundcube one-click sign-in links work once, like SnappyMail's. Reverse-DNS and blocklist checks use the server's public IP, not a private NAT address. A fresh install sets the mail hostname to the panel's mail host when the system hostname is not a full domain name. 1.2.4 — One-click "Webmail" now signs in to SnappyMail too, without a password (until now it opened the SnappyMail login form). The panel's 60-second sign-in link is accepted once and logs in through the Dovecot master user, as Roundcube already did; an invalid, expired or reused link opens the normal login page. 1.2.2 — Aliases can be edited: a new Edit button on each alias opens a dialog that changes its destination address(es) in place (one per line or comma-separated); the source address stays fixed. Requires the updated root agent (mail.update_alias). 1.2.0 — Webmail address can be changed: admins pick the path (default /vinzamail/) on the Mail Server page with "Webmail address". The path is applied to nginx, Apache and OpenLiteSpeed, kept across updates, engine switches and web-server changes, and a rejected config is rolled back. Servers that used /webmail/ move to /vinzamail/ on this update and keep /webmail/ as a redirect, so old links and bookmarks still work (the redirect can be turned off). The "Open Webmail" and per-mailbox Webmail buttons follow the new address. Uninstalling now also removes the OpenLiteSpeed webmail context. 1.1.4 — Spam filtering can use DNS blocklists such as Spamhaus again: they refuse lookups that come through public resolvers (1.1.1.1, 8.8.8.8), so every check came back blocked. The spam filter now resolves through a private local resolver (unbound on a loopback port); the server's own DNS settings are not changed, an existing unbound you manage yourself is left alone, and uninstalling removes it again. The Deliverability Doctor checks Spamhaus the same way and no longer reports a failed lookup as "not listed" (needs panel 1.3.35). A blocklist that no longer answers (NiXSpam) is switched off. 1.1.3 — Enable TLS picks the certificate challenge from the panel's web server mode, so it no longer fails with "Cannot find Apache executable" on servers switched from Apache to nginx. Updating the plugin keeps the Let's Encrypt certificate already set up for SMTP instead of putting Postfix back on the self-signed one. The certificate now also reloads Postfix and Dovecot when it renews (needs panel 1.3.34). The Deliverability Doctor no longer reports "listed on Spamhaus" when Spamhaus only refused the lookup. 1.1.2 — Security tab: at most four cards per row, each wider. Opened from a website (?domain=), the page goes straight to Mailboxes and lists that domain's mailboxes and aliases, with "Show all domains" to widen it. 1.0.2 — Webmail stays reachable over HTTPS on the server's IP address. 1.0.1 — Mailbox quotas follow your hosting plan; queue actions limited to your own mail. 1.2.0 — Two webmail engines, with SnappyMail (lightweight, no database) as the new DEFAULT — installed alongside Roundcube and served through the same /webmail/ reverse proxy; admins flip the active engine from the Email Server header (a fast, reversible switch that repoints /webmail/ and reloads the web server). SnappyMail routes any mailbox to the local Dovecot/Postfix via a catch-all domain and uses manual login for now (passwordless per-mailbox SSO remains Roundcube-only). Restart Webmail now restarts whichever engine is active. 1.1.7 — Per-mailbox "Webmail" login opened a blank tab (window.open used 'noopener', which returns null so the reserved tab was never navigated) — fixed by severing opener manually after navigating. Send-test-mail now defaults the From address to the panel's identity domain (which has SPF/DKIM/DMARC set up) instead of an arbitrary first mail domain, so tests aren't rejected by Gmail as 5.7.26 'unauthenticated'; the From field also pre-fills with postmaster@<panel domain>. 1.1.6 — Webmail reverse-proxy detection now recognises the shared web-apps server (snippet layout), fixing the wrong Open-Webmail URL on nginx installs. The /webmail/ link and SSO now use HTTPS only when the proxy really serves TLS :443 (instead of blindly following the panel's scheme). New 'Enable trusted HTTPS' action serves /webmail/ with the panel domain's Let's Encrypt certificate via the shared web-apps TLS vhost (validated with nginx -t, rolled back on failure, guarded against shadowing a hosted website) — the same vhost also covers phpMyAdmin. The Deliverability Doctor field is now labelled 'Email domain' and pre-fills with a real mail domain (not the mail hostname) so SPF/DMARC/DKIM are checked on the right name; the Postfix · TLS Certificate field pre-fills with the recommended mail hostname, and the Doctor defaults to the panel's own domain. Enable-TLS now obtains the mail certificate without certbot --standalone (which fails when port 80 is already in use): on Apache it uses the webroot challenge served by the catch-all vhost (/var/www/html), which works for any domain whose A record reaches this server and never edits the web-server config; nginx uses its authenticator, else standalone. An existing cert is reused. 1.1.0 — Renamed from 'smtp-server'. Deliverability Doctor (rDNS/PTR, port 25, Spamhaus, live SPF/DKIM/DMARC), proactive reverse-DNS setup guidance, external-provider mode (Google Workspace / Microsoft 365 / Zoho — DNS only, no local mailboxes), and per-domain backup & restore/migrate. 1.0.1 — Fix webmail 'Forbidden': /webmail/ now lives on a shared nginx default server (no more server_name collision with phpMyAdmin) and works over HTTPS. 1.0.0 — Initial release: Postfix + Dovecot setup, mailbox management, DKIM/SPF/DMARC, SpamAssassin, Roundcube webmail.