Control Panel Pages

Control Panel Pages

This page began as a chapter of the 6.2.10 manual and has been corrected against the 6.2.28 source. The Control Panel's pages are grouped differently now, so the paths below use today's groups; the TLS ports 465, 993 and 995 exist only after you create them on the TCP/IP ports page (a fresh install seeds 25, 587, 110 and 143); and everything added since 6.2.10 is in Changes-Since-6210. Where a value here disagrees with the Settings Reference, which is generated from the code, the reference is right.

There are 55 pages in eight groups. The tree is only ever two levels deep: a heading and a click, never a heading, a sub-heading and a click.

flowchart LR
    ROOT(["hMailServer Control Panel<br/>55 pages, 8 groups"])
    ROOT --- TOP["Top level<br/>Welcome<br/>Dashboard<br/>About"]
    ROOT --- M["Monitoring and troubleshooting<br/>Server status<br/>Delivery queue<br/>Diagnosing stalled mail<br/>Message trace<br/>Live logs<br/>Diagnostics<br/>MX query<br/>External setup<br/>DNS records<br/>Logging<br/>API and monitoring<br/>REST API keys"]
    ROOT --- A["Accounts and domains<br/>Domains<br/>Public folders<br/>Groups"]
    ROOT --- F["Mail flow and delivery<br/>Delivery of e-mail<br/>Routes<br/>Incoming relays<br/>Rules<br/>Server messages<br/>Server sendout"]
    ROOT --- S["Spam and virus filtering<br/>Spam filtering overview<br/>Quarantine<br/>Anti-spam settings<br/>SURBL servers<br/>DNS blacklists<br/>White list<br/>Blocked senders<br/>Greylisting white list<br/>Virus scanning overview<br/>Anti-virus settings<br/>Blocked attachments"]
    ROOT --- C["Connections and protocols<br/>Protocols<br/>TCP/IP ports<br/>Web services and autoconfiguration<br/>DNS resolver"]
    ROOT --- L["TLS and certificates<br/>SSL certificates<br/>Certificates, ACME<br/>Transport encryption overview<br/>SSL/TLS<br/>Transport security"]
    ROOT --- P["Access and abuse protection<br/>Authentication<br/>Directory authentication, LDAP<br/>Directory synchronisation<br/>Administrative access<br/>Auto-ban<br/>IP ranges"]
    ROOT --- W["Maintenance<br/>Backup and restore<br/>Performance<br/>Advanced<br/>Event scripts<br/>Server limits and expert settings"]

Loading

The eight group names carry an ampersand on screen — "Monitoring & troubleshooting" — spelled out here so the diagram renders everywhere.

The three top-level pages sit outside the groups. Every group heading is expanded by default and carries a Fluent icon; hovering any node shows "Title — purpose". The order is the order an administrator meets these subjects: first "is it working", then the things they were asked to change, then the things they configure once.

Every page

The Key column is the page's internal navigation key. It appears in the automation id (nav-<key>), it is what the Welcome tiles and the palette navigate by, and it never changes when a page is renamed — which is why old links keep working.

Where the settings live decides how a change takes effect, and whether it can be made at all from a Control Panel connected to another machine. See Control Panel Reference section 6 for the mechanism.

Page	Key	What it is for	Settings live in	Takes effect
Welcome	welcome	Twelve outcome-shaped starting points, then six area tiles	—	—
Dashboard	dashboard	Live counters and charts for processed mail, spam, viruses and sessions — Live, 24 hours, 7 days or 30 days — and a summary of what still needs doing outside the server	—	—
Monitoring & troubleshooting → Server status	status	Version, state (Pause/Resume), uptime, database, session and message counters, configuration warnings; new in 6.2.28, the update check, download and install buttons	actions only	at once
Monitoring & troubleshooting → Delivery queue	queue	Outbound mail waiting; view the source, retry or delete individual messages	actions only	at once
Monitoring & troubleshooting → Diagnosing stalled mail	stalledmail	Which half stalled (accepting or delivering), debug logging on and off, the settings that bound a session	COM Logging.*	at once
Monitoring & troubleshooting → Message trace	messagetrace	What happened to one message, by sender or recipient (needs MessageTraceEnabled)	actions only	at once
Monitoring & troubleshooting → Live logs	logs	Real-time colour-coded log tail — local server only	—	—
Monitoring & troubleshooting → Diagnostics	diagnostics	Built-in self-test, plus the last message-store consistency scan	—	—
Monitoring & troubleshooting → MX query	mxquery	Look up any domain's MX records using the server's own resolver	—	—
Monitoring & troubleshooting → External setup	externalsetup	Everything this server needs done outside it — DNS records, key files, trusted lists — and the state of each	read-only	—
Monitoring & troubleshooting → DNS records	dnsrecords	The SPF, DKIM, DMARC, MTA-STS and TLS-RPT records each domain should publish, with a live check	read-only	—
Monitoring & troubleshooting → Logging	logging	Log level, format, retention, JSON output, message trace	COM Logging.* + INI	COM at once; INI needs a restart
Monitoring & troubleshooting → API & monitoring	api	REST API and the browser Control Deck, Prometheus/OpenTelemetry monitoring and metric history, Windows Event Log, ManageSieve, shutdown drain; new in 6.2.28, the live-update settings and, beside the feed URL, the HttpProxy forward proxy every web request the server makes goes through	hMailServer.INI [Settings]	restart, and the page offers one
Monitoring & troubleshooting → REST API keys	apikeys	Scoped, expiring credentials for the REST API — local server only	hMailServerApiKeys.ini	at once; the server re-reads it per request
Accounts & domains → Domains (on-screen "Domains & accounts")	domains	Domains, accounts, aliases, distribution lists, domain aliases, DKIM	COM Domains	at once
Accounts & domains → Public folders	publicfolders	Shared IMAP folders and their permissions	COM Settings.PublicFolders	at once
Accounts & domains → Groups	groups	Account groups, used for public-folder permissions	COM Settings.Groups	at once
Mail flow & delivery → Delivery of e-mail	delivery	Retry schedule and delivery limits, the smart-host relayer and its OAuth2, rule loop limit; new editors in 6.2.28 for PIPELINING, CHUNKING and hard-linked local copies, which the server itself has done since 6.2.25	COM Settings + INI	COM at once; INI needs a restart
Mail flow & delivery → Routes	routes	Per-domain delivery overrides	COM Settings.Routes	at once
Mail flow & delivery → Incoming relays	relays	Upstream gateways (spam filters, load balancers) whose IP addresses should not count as the connecting client in anti-spam host checks	COM Settings.IncomingRelays	at once
Mail flow & delivery → Rules (on-screen "Global rules")	rules	Server-wide mail rules, evaluated top to bottom	COM Application.Rules	at once
Mail flow & delivery → Server messages	servermessages	The text of bounces and system messages	COM Settings.ServerMessages	at once
Mail flow & delivery → Server sendout	sendout	Send a message to every account (maintenance notices)	action only	at once
Spam & virus filtering → Spam filtering overview	spamoverview	Read-only judgement of the whole spam pipeline, each row linking to its page	read-only	—
Spam & virus filtering → Quarantine	quarantine	Messages held as suspected spam: release, delete, expire (needs QuarantineEnabled)	actions only	at once
Spam & virus filtering → Anti-spam settings	antispam	Thresholds, quarantine, SPF/DKIM/DMARC/ARC, host checks, greylisting, SpamAssassin, external filter engine, recipient tarpit	COM Settings.AntiSpam + INI	COM at once; INI needs a restart
Spam & virus filtering → SURBL servers	surbl	URL blocklists checked against message bodies	COM collection	at once
Spam & virus filtering → DNS blacklists	dnsbl	IP blocklists checked against connecting servers	COM collection	at once
Spam & virus filtering → White list	spamwhitelist	Senders exempt from spam checking	COM collection	at once
Spam & virus filtering → Blocked senders	blockedsenders	Claimed sender addresses and domains refused with a score	COM collection	at once
Spam & virus filtering → Greylisting white list	greylistwhitelist	Senders exempt from greylisting only	COM collection	at once
Spam & virus filtering → Virus scanning overview	virusoverview	Read-only judgement of whether the configured scanners can actually run	read-only	—
Spam & virus filtering → Anti-virus settings	antivirus	ClamAV, ClamWin or a custom scanner; action on detection; what to do when a scanner cannot run	COM Settings.AntiVirus + INI	COM at once; INI needs a restart
Spam & virus filtering → Blocked attachments	blockedattachments	Attachment-name wildcards (*.exe) to strip — only when attachment blocking is on in Anti-virus settings	COM collection	at once
Connections & protocols → Protocols	protocols	Enable/disable SMTP, IMAP, POP3 and their behaviour, plus every idle timeout	COM Settings + INI	COM at once; INI needs a restart
Connections & protocols → TCP/IP ports	ports	Listening ports, their SSL bindings and a live "Listening" badge	COM Settings.TCPIPPorts	at once
Connections & protocols → Web services & autoconfiguration	webservices	The HTTP/HTTPS listener for Thunderbird/Outlook autoconfiguration and MTA-STS policy hosting	hMailServer.INI [Settings]	restart, and the page offers one
Connections & protocols → DNS resolver	dns	Name servers, the Windows DNS cache, when DNSBL checks run	hMailServer.INI [Settings]	restart, and the page offers one
TLS & certificates → SSL certificates	certs	Certificates available to TLS ports, with parse/expiry/key-match state	COM Settings.SSLCertificates	at once
TLS & certificates → Certificates (ACME)	acme	Automatic Let's Encrypt issuance and renewal	hMailServer.INI [Settings]	restart, and the page offers one
TLS & certificates → Transport encryption overview	tlsoverview	Read-only judgement of TLS versions, ciphers, ports and certificates together	read-only	—
TLS & certificates → SSL/TLS	tls	TLS versions, ciphers, key-exchange groups, session resumption	COM Settings + INI	COM at once; INI needs a restart
TLS & certificates → Transport security	security	MTA-STS, DANE, DNSSEC, ARC, TLS-RPT, DMARC rua, SRS and BATV	hMailServer.INI [Settings]	restart, and the page offers one
Access & abuse protection → Authentication	authentication	OAuth2/XOAUTH2 token authentication, password hashing and pepper, ports without AUTH	hMailServer.INI [Settings]	restart, and the page offers one
Access & abuse protection → Directory authentication (LDAP)	ldap	Authenticate mailbox passwords against a directory	hMailServer.INI [LDAP]	within two seconds — no restart
Access & abuse protection → Directory synchronisation	directorysync	Provision mailboxes from the directory, preview then apply	hMailServer.INI [LDAP] + COM actions	preview and apply run inside the server on demand
Access & abuse protection → Administrative access	adminaccess	Administrator password, mailbox password policy, two-factor authentication	COM + INI	COM at once; INI needs a restart
Access & abuse protection → Auto-ban	autoban	Failed-logon banning, per-name lockout, logon tarpit	COM Settings + INI	COM at once; INI needs a restart
Access & abuse protection → IP ranges	ipranges	Who may connect, authenticate and relay	COM Settings.SecurityRanges	at once
Maintenance → Backup & restore	backup	Backup contents, destination, schedule, verification and restore	COM Settings.Backup + INI	COM at once; INI needs a restart
Maintenance → Performance	performance	Caching, connection and thread tuning, message indexing, database connections	COM + INI + [Database]	COM at once; INI needs a restart
Maintenance → Advanced	advanced	Default domain, IPv6 preference, mirroring and archiving, disk-space limits, the scripting engine	COM + INI	COM at once; INI needs a restart; the script engine reloads on Save
Maintenance → Event scripts	scripts	VBScript/JScript event handlers — local server only	the script file on disk	"Save & reload" reloads the engine
Maintenance → Server limits & expert settings	hardening	DPAPI secrets, fsync, consistency checking, proxies, sending limits, ceilings	hMailServer.INI [Settings], [SendingLimits], [SendingLimitsOverrides]	restart, except the sending limits, which are re-read within seconds
About	about	Version, licence, build information	—	—

The three overview pages are deliberately read-only

Spam filtering overview, Virus scanning overview and Transport encryption overview change nothing. They exist because the interesting states only appear in the combination of several pages, and no editor can show a combination:

• a virus scanner that is switched on but cannot run reports an error on every message, and the server treats "every scanner errored" as no virus found — so infected mail is delivered as though it had been examined;
• a TLS port with no certificate does not fall back to plaintext, it fails to start;
• the AEAD-ONLY cipher preset leaves TLS 1.0 and 1.1 advertised with no suite they can use;
• the one control that refuses a plaintext password lives on the IP ranges page, three groups away from anything called TLS.

Every row on the three pages links to the page that owns the setting, which is also what stops them becoming a second place to change the same value.

The collection editors

Eight pages are the same editor pointed at a different COM collection: an inline "add" row, an editable grid, and Delete.

Page	COM collection	Columns	Default worth knowing
SURBL servers	AntiSpam.SURBLServers	Active, DNS host, Reject message, Score	Score 5
DNS blacklists	AntiSpam.DNSBlackLists	Active, DNS host, Expected result, Reject message, Score	Score 5
White list	AntiSpam.WhiteListAddresses	Lower IP, Upper IP, E-mail address, Description	—
Blocked senders	AntiSpam.BlockedSenders	Address or domain, Score, Description	Score 100 — above the delete threshold, so the message is refused during the SMTP conversation
Greylisting white list	AntiSpam.GreyListingWhiteAddresses	IP address, Description	—
Blocked attachments	AntiVirus.BlockedAttachments	Wildcard, Description	*.exe; inert unless attachment blocking is on
Groups	Settings.Groups	Group name, plus a Members… button	—
Server messages	Settings.ServerMessages	Name, Text	a fixed set — you may edit the text, not the list

An entry on Blocked senders with an @ is one exact address; without one it is a whole domain and its subdomains. It matches the address the sender claims, so it stops a correspondent who keeps using one address and stops nothing that rotates them.

Pages not pictured above

The remaining pages are shown here for completeness. The screenshots were captured from a 6.2.10 build: the sidebar they show is the older tree, and the page pictured as "Advanced and scripting" is now titled "Advanced". Today's tree is the one in Control Panel Reference, section 5.

Connections & protocols → Protocols — five tabs (Services, SMTP, IMAP, POP3, Timeouts) enabling or disabling the three protocol servers and tuning their behaviour:

6.2.10. Since then the IMAP tab has gained search limits, a change-history size and a "Recalculate folder UID counters" repair button, the POP3 tab a minimum login interval, and the Timeouts tab all eight of the protocol timeouts.

Maintenance → Performance — four tabs (Threads, Cache, Indexing, Database):

6.2.10. The Cache tab now also shows a live hit-rate and memory read-out, and the Indexing tab the full-text index with "Index now" and "Discard and rebuild" buttons.

Maintenance → Advanced — default domain, mirroring and archiving, disk-space limits, the scripting engine:

6.2.10, when the page was called "Advanced & scripting". It is now "Advanced", the old name survives as a search alias, and the scripting card names Event scripts as the place the script itself is edited.

Mail flow & delivery → Server messages — the text of bounces and system messages:

Accounts & domains → Groups — account groups, used for public-folder permissions:

6.2.10, before the group member editor existed — at that point a group granted folder rights to nobody. Today each group has a Members… button.

Mail flow & delivery → Server sendout — send a message to every account, for maintenance notices:

About — version, licence and build information:

6.2.10. Today the page reports the .NET runtime version alongside the Control Panel's, and names the connected server as "hMailServer {version} @ {host}".

The dialogs

Several pages open a modal dialog rather than editing in place. These are the ones worth recognising.

Domain properties — opened with Properties on the Domains page. Seven tabs today: General, Names, Limits, Signature, Relay, Out of office, DKIM.

6.2.10, with five tabs. Relay (a per-domain smart host) and Out of office were added later, and the Limits tab now also carries a message-retention policy for the domain's mailboxes.

Domain → DKIM — generate a key pair, choose the selector, canonicalisation and signing algorithm.

Once a key exists the tab prints the exact TXT record to publish, with a Copy DNS value button:

The same record, checked against live DNS, is on Monitoring & troubleshooting → DNS records, alongside SPF, DMARC, MTA-STS and TLS-RPT.

Account properties — opened with Edit on the Domains page, or by double-clicking an account. Twelve tabs today: General, Forwarding, Auto-reply, Spam, Signature, Sieve, External, App passwords, Two-factor, Rules, Folders, Directory.

6.2.10, with seven tabs. General has since gained a per-account message-retention box and a password-strength meter, and the Spam, App passwords, Two-factor, Folders and Directory tabs are all new.

The Sieve tab holds the account's active script. Several named scripts per account are managed over ManageSieve, which is switched on under API & monitoring.

Distribution list properties — opened with Properties in the Distribution lists panel.

6.2.10. Today the dialog also carries a moderator address (empty = no moderation), a bounce address, and a note explaining that "anyone in the domain" only means the sender claims a hosted address unless authentication is also required.

Port binding — opened with Edit on the TCP/IP ports page.

6.2.10. The dialog now also carries the inbound client-certificate policy and its CA bundle, for mutual TLS.

Two more dialogs follow the same shape and have no picture here: Route (General, Delivery, Addresses, Security, Authentication) and IP range (General, Connections, Relaying, Require auth, Protection). Both are documented field by field in Control Panel Reference, sections 7.3 and 7.7.

---