Guide CyberPanel Email Setup: Mailbox, DKIM, SPF, DMARC (and a DKIM Signing Bug Fix)

Guide CyberPanel Email Setup: Mailbox, DKIM, SPF, DMARC (and a DKIM Signing Bug Fix) - Printable Version

+- AdminsForum (https://adminsforum.com)
+-- Forum: Free & open-source control panels (https://adminsforum.com/Forum-free-open-source-control-panels)
+--- Forum: CyberPanel (https://adminsforum.com/Forum-cyberpanel)
+---- Forum: CyberPanel Guides & Tutorials (https://adminsforum.com/Forum-cyberpanel-guides-tutorials)
+----- Forum: CyberPanel Email Guides (https://adminsforum.com/Forum-cyberpanel-email-guides)
+----- Thread: Guide CyberPanel Email Setup: Mailbox, DKIM, SPF, DMARC (and a DKIM Signing Bug Fix) (/Thread-guide-cyberpanel-email-setup-mailbox-dkim-spf-dmarc-and-a-dkim-signing-bug-fix)

CyberPanel Email Setup: Mailbox, DKIM, SPF, DMARC (and a DKIM Signing Bug Fix) - JAY - 10-25-2026

CyberPanel Email Setup: Mailbox, DKIM, SPF, DMARC (and a DKIM Signing Bug Fix)

CyberPanel ships a full mail server: Postfix to send and receive, Dovecot for IMAP/POP3, and OpenDKIM to sign outgoing mail. Creating a mailbox takes ten seconds. Getting mail into inboxes instead of spam folders takes DNS records, and on our test server one config fix that CyberPanel didn't do for us.

Watch it: Part 8 of the CyberPanel course, Email Accounts & Webmail

This is Part 8 of 10 in our free CyberPanel Full Course. The written steps below go into more detail.

We set up [email protected] on a fresh CyberPanel 3.0 server. DNS for the domain is at Cloudflare.

Before you start: can your server send mail at all?
Many VPS providers block outgoing port 25 to stop spam. Test it:

Code:

timeout 6 bash -c '</dev/tcp/gmail-smtp-in.l.google.com/25' && echo PORT25_OPEN || echo PORT25_BLOCKED

Ours printed

Code:

PORT25_OPEN

. If yours is blocked, ask your provider to open it, or send through an SMTP relay. Also set the reverse DNS (PTR) of your server IP to your mail hostname (for example

Code:

mail.yourdomain.com

) in your provider's panel. Big mailbox providers check it.

Step 1: The mail domain and DNS basics
When you create a website with Create Mail Domain ticked, CyberPanel prepares mail for that domain (see creating a website). Then make sure these records exist at your DNS provider:

A record
Code:
mail.yourdomain.com
pointing to your server IP.
MX record for
Code:
yourdomain.com
pointing to
Code:
mail.yourdomain.com
, priority 10.

On Cloudflare, mail records must be DNS only (grey cloud). Cloudflare's proxy doesn't carry mail.

Step 2: Create the mailbox
Open Email > Create Email, pick the website, type the name before the @ and click Generate for a password:
[Image: attachment.php?aid=465]

Click Use This Password, save it in your password manager, then Create Email Account. You get the message "Mailbox with username [email protected] has been successfully created". Manage existing mailboxes under Email > Email Accounts; change a password under Email > Change Password.

Step 3: DKIM
DKIM signs every outgoing message with a private key on your server; receivers check the signature with the public key in your DNS. CyberPanel had already created a key for our domain when we created the website.
Open Email > DKIM Manager and pick the website. The right column is the public key you publish in DNS:
[Image: attachment.php?aid=466]

The middle column is the private key. We hid it in the screenshot: never post it or share it.

Add a TXT record at your DNS provider:

Name:
Code:
default._domainkey
(for a subdomain like ours:
Code:
default._domainkey.cyber
).
Code:
default
is the selector CyberPanel uses.
Content: the whole public key text, starting with
Code:
v=DKIM1;
. Paste it as one line.

Cloudflare accepted the long key in one field and split it automatically.

Step 4: SPF
SPF lists which servers may send mail for your domain. Add a TXT record on the domain itself:

Code:

v=spf1 a mx ~all

Here is the SPF record in Cloudflare for our subdomain (Type TXT, Name

Code:

cyber

Code:

a

and

Code:

mx

allow the server your domain and MX point to. If you also send through another service (Google Workspace, a newsletter tool), add its include, for example

Code:

include:_spf.google.com

. Only one SPF record per name: two records break SPF.

Step 5: DMARC
DMARC tells receivers what to do when SPF/DKIM fail, and sends you reports. Start in monitoring mode:

Code:

Name: _dmarc   (ours: _dmarc.cyber)
Content: v=DMARC1; p=none; rua=mailto:[email protected]

After a few weeks of clean reports, move to

Code:

p=quarantine

, later

Code:

p=reject

.

Check all three from any Linux machine:

Code:

dig +short TXT cyber.adminslab.com
dig +short TXT _dmarc.cyber.adminslab.com
dig +short TXT default._domainkey.cyber.adminslab.com

Step 6: Check DKIM on the server
Check the DKIM record matches the key on the server:
[Image: attachment.php?aid=544]

Code:

opendkim-testkey -d cyber.adminslab.com -s default -vvv

key OK means the DNS record matches the private key. "key not secure" only means your domain doesn't use DNSSEC; you can ignore it.

Step 7: The bug: mail from the server itself wasn't signed
"key OK" doesn't prove messages are actually signed. We sent a test message from the server:

Code:

apt install -y swaks
swaks -s 127.0.0.1 -f [email protected] -t [email protected]

and checked the log:

Code:

journalctl -t opendkim --since "-5min" --no-pager

Nothing. No "DKIM-Signature field added" line. The reason was in

Code:

/etc/opendkim/TrustedHosts

. OpenDKIM signs mail from the hosts in that list (it's used as InternalHosts), and CyberPanel had written only:

Code:

cyber.adminslab.com
localhost.localdomain

Code:

127.0.0.1

. Everything that sends from the server itself (PHP

Code:

mail()

from WordPress and contact forms, cron jobs, local scripts) went out unsigned. The fix:

Code:

printf '127.0.0.1\n::1\n' >> /etc/opendkim/TrustedHosts
systemctl restart opendkim

After the fix, the log shows every message being signed:
[Image: attachment.php?aid=545]

Code:

DKIM-Signature field added (s=default, d=cyber.adminslab.com)

The file says "CyberPanel Generated File", so CyberPanel may rewrite it when you add another mail domain. After adding domains, check it again with

Code:

cat /etc/opendkim/TrustedHosts

.

Step 8: Send a real test
Send a message from the mailbox to a deliverability tester or your own Gmail account, open the original message, and look for SPF: PASS, DKIM: PASS and DMARC: PASS. If one fails, the header usually says why.

Mail apps (Outlook, Thunderbird, phone)

Incoming (IMAP):
Code:
mail.yourdomain.com
, port 993, SSL/TLS.
Outgoing (SMTP):
Code:
mail.yourdomain.com
, port 587 STARTTLS (or 465 SSL/TLS), with authentication.
Username: the full email address.

If the app warns about the certificate, issue one for the mail server on the Issue SSL For MailServer page (

Code:

https://YOUR-SERVER-IP:8090/manageSSL/sslForMailServer

). Webmail is under Email > Webmail.

Common problems

Mail lands in spam: check SPF/DKIM/DMARC pass, reverse DNS, and that your server IP isn't on a blocklist. New IPs need some time and low volume to build a reputation.
Outgoing mail stuck: port 25 blocked by the provider. See the queue with
Code:
postqueue -p
.
Can't receive: MX record missing or proxied, or ports 25/587/993 closed. See the CyberPanel firewall guide.
Mail services stopped:
Code:
systemctl is-active postfix dovecot opendkim
. See checking CyberPanel services.
Logs: Ubuntu 24.04 had no
Code:
/var/log/mail.log
on our server. Use
Code:
journalctl -t postfix/smtp -t opendkim -n 50
.

More CyberPanel guides

Tested on CyberPanel 3.0 (build 8, OpenLiteSpeed edition) on Ubuntu 24.04, October 2026. Menu names can change slightly between versions.