2Command mox is a modern, secure, full-featured, open source mail server for
3low-maintenance self-hosted email.
5Mox is started with the "serve" subcommand, but mox also has many other
8Many of those commands talk to a running mox instance, through the ctl file in
9the data directory. Specify the configuration file (that holds the path to the
10data directory) through the -config flag or MOXCONF environment variable.
12Commands that don't talk to a running mox instance are often for
13testing/debugging email functionality. For example for parsing an email message,
14or looking up SPF/DKIM/DMARC records.
16Below is the usage information as printed by the command when started without
17any parameters. Followed by the help and usage information for each command.
21 mox [-config config/mox.conf] [-pedantic] ...
23 mox quickstart [-skipdial] [-existing-webserver] [-hostname host] $user@domain [$user | $uid]
25 mox setaccountpassword $account
27 mox loglevels [$level [$pkg]]
28 mox queue holdrules list
29 mox queue holdrules add [ruleflags]
30 mox queue holdrules remove $ruleid
31 mox queue list [filtersortflags]
32 mox queue hold [filterflags]
33 mox queue unhold [filterflags]
34 mox queue schedule [filterflags] [-now] $duration
35 mox queue transport [filterflags] $transport
36 mox queue requiretls [filterflags] {yes | no | default}
37 mox queue fail [filterflags]
38 mox queue drop [filterflags]
40 mox queue retired list [filtersortflags]
41 mox queue retired print $id
42 mox queue suppress list [-account account]
43 mox queue suppress add $account $address
44 mox queue suppress remove $account $address
45 mox queue suppress lookup [-account account] $address
46 mox queue webhook list [filtersortflags]
47 mox queue webhook schedule [filterflags] $duration
48 mox queue webhook cancel [filterflags]
49 mox queue webhook print $id
50 mox queue webhook retired list [filtersortflags]
51 mox queue webhook retired print $id
52 mox import maildir $accountname $mailboxname $maildir
53 mox import mbox $accountname $mailboxname $mbox
54 mox export maildir [-single] $dstdir $accountpath [$mailbox]
55 mox export mbox [-single] $dstdir $accountpath [$mailbox]
57 mox help [$command ...]
59 mox verifydata $datadir
62 mox config dnscheck $domain
63 mox config dnsrecords $domain
64 mox config describe-domains >domains.conf
65 mox config describe-static >mox.conf
66 mox config account list
67 mox config account addresses $account
68 mox config account add $account $address
69 mox config account rm $account
70 mox config account disable $account $message
71 mox config account enable $account
72 mox config address add $address $account
73 mox config address rm $address
74 mox config address account $address
75 mox config domain add [-disabled] $domain $account [$localpart]
76 mox config domain rm $domain
77 mox config domain disable $domain
78 mox config domain enable $domain
79 mox config tlspubkey list [$account]
80 mox config tlspubkey get $fingerprint
81 mox config tlspubkey add $address [$name] < cert.pem
82 mox config tlspubkey rm $fingerprint
83 mox config tlspubkey gen $stem
84 mox config alias list $domain
85 mox config alias print $alias
86 mox config alias add $alias@domain $rcpt1@domain ...
87 mox config alias update $alias@domain [-postpublic false|true -listmembers false|true -allowmsgfrom false|true]
88 mox config alias rm $alias@domain
89 mox config alias addaddr $alias@domain $rcpt1@domain ...
90 mox config alias rmaddr $alias@domain $rcpt1@domain ...
91 mox config describe-sendmail >/etc/moxsubmit.conf
92 mox config printservice >mox.service
93 mox config ensureacmehostprivatekeys
94 mox config example [$name]
95 mox admin imapserve $preauthaddress
98 mox clientconfig $domain
99 mox dane dial $host:$port
100 mox dane dialmx $domain [$desthost]
101 mox dane makerecord $usage $selector $matchtype [certificate.pem | publickey.pem | privatekey.pem]
102 mox dns lookup [ptr | mx | cname | ips | a | aaaa | ns | txt | srv | tlsa] $name
103 mox dkim gened25519 >$selector._domainkey.$domain.ed25519.privatekey.pkcs8.pem
104 mox dkim genrsa >$selector._domainkey.$domain.rsa2048.privatekey.pkcs8.pem
105 mox dkim lookup $selector $domain
106 mox dkim txt <$selector._domainkey.$domain.key.pkcs8.pem
107 mox dkim verify $messagefile
108 mox dkim sign $messagefile
109 mox dmarc lookup $domain
110 mox dmarc parsereportmsg $messagefile ...
111 mox dmarc verify $remoteip $mailfromaddress $helodomain < messagefile
112 mox dmarc checkreportaddrs $domain
113 mox dnsbl check $zone $ip
114 mox dnsbl checkhealth $zone
115 mox mtasts lookup $domain
116 mox rdap domainage $domain
117 mox retrain [$accountname]
118 mox sendmail [-Fname] [ignoredflags] [-t] [< messagefile]
119 mox smtp dial $host[:$port]
120 mox spf check $domain $ip
121 mox spf lookup $domain
122 mox spf parse $txtrecord
123 mox tlsrpt lookup $domain
124 mox tlsrpt parsereportmsg $messagefile ...
126 mox webapi [$method [$baseurl-with-credentials]
128 mox bumpuidvalidity $account [$mailbox]
129 mox reassignuids $account [$mailboxid]
130 mox fixuidmeta $account
131 mox fixmsgsize [$account]
132 mox reparse [$account]
133 mox ensureparsed $account
134 mox recalculatemailboxcounts $account
135 mox message parse $messagefile
136 mox reassignthreads [$account]
140Start mox, serving SMTP/IMAP/HTTPS.
142Incoming email is accepted over SMTP. Email can be retrieved by users using
143IMAP. HTTP listeners are started for the admin/account web interfaces, and for
144automated TLS configuration. Missing essential TLS certificates are immediately
145requested, other TLS certificates are requested on demand.
147Only implemented on unix systems, not Windows.
153Quickstart generates configuration files and prints instructions to quickly set up a mox instance.
155Quickstart writes configuration files, prints initial admin and account
156passwords, DNS records you should create. If you run it on Linux it writes a
157systemd service file and prints commands to enable and start mox as service.
159All output is written to quickstart.log for later reference.
161The user or uid is optional, defaults to "mox", and is the user or uid/gid mox
162will run as after initialization.
164Quickstart assumes mox will run on the machine you run quickstart on and uses
165its host name and public IPs. On many systems the hostname is not a fully
166qualified domain name, but only the first dns "label", e.g. "mail" in case of
167"mail.example.org". If so, quickstart does a reverse DNS lookup to find the
168hostname, and as fallback uses the label plus the domain of the email address
169you specified. Use flag -hostname to explicitly specify the hostname mox will
172Mox is by far easiest to operate if you let it listen on port 443 (HTTPS) and
17380 (HTTP). TLS will be fully automatic with ACME with Let's Encrypt.
175You can run mox along with an existing webserver, but because of MTA-STS and
176autoconfig, you'll need to forward HTTPS traffic for two domains to mox. Run
177"mox quickstart -existing-webserver ..." to generate configuration files and
178instructions for configuring mox along with an existing webserver.
180But please first consider configuring mox on port 443. It can itself serve
181domains with HTTP/HTTPS, including with automatic TLS with ACME, is easily
182configured through both configuration files and admin web interface, and can act
183as a reverse proxy (and static file server for that matter), so you can forward
184traffic to your existing backend applications. Look for "WebHandlers:" in the
185output of "mox config describe-domains" and see the output of
186"mox config example webhandlers".
188 usage: mox quickstart [-skipdial] [-existing-webserver] [-hostname host] $user@domain [$user | $uid]
190 use if a webserver is already running, so mox won't listen on port 80 and 443; you'll have to provide tls certificates/keys, and configure the existing webserver as reverse proxy, forwarding requests to mox.
192 hostname mox will run on, by default the hostname of the machine quickstart runs on; if specified, the IPs for the hostname are configured for the public listener
194 skip check for outgoing smtp (port 25) connectivity or for domain age with rdap
198Shut mox down, giving connections maximum 3 seconds to stop before closing them.
200While shutting down, new IMAP and SMTP connections will get a status response
201indicating temporary unavailability. Existing connections will get a 3 second
202period to finish their transaction and shut down. Under normal circumstances,
203only IMAP has long-living connections, with the IDLE command to get notified of
208# mox setaccountpassword
210Set new password an account.
212The password is read from stdin. Secrets derived from the password, but not the
213password itself, are stored in the account database. The stored secrets are for
214authentication with: scram-sha-256, scram-sha-1, cram-md5, plain text (bcrypt
217The parameter is an account name, as configured under Accounts in domains.conf
218and as present in the data/accounts/ directory, not a configured email address
221 usage: mox setaccountpassword $account
223# mox setadminpassword
225Set a new admin password, for the web interface.
227The password is read from stdin. Its bcrypt hash is stored in a file named
228"adminpasswd" in the configuration directory.
230 usage: mox setadminpassword
234Print the log levels, or set a new default log level, or a level for the given package.
236By default, a single log level applies to all logging in mox. But for each
237"pkg", an overriding log level can be configured. Examples of packages:
238smtpserver, smtpclient, queue, imapserver, spf, dkim, dmarc, junk, message,
241Specify a pkg and an empty level to clear the configured level for a package.
243Valid labels: error, info, debug, trace, traceauth, tracedata.
245 usage: mox loglevels [$level [$pkg]]
247# mox queue holdrules list
249List hold rules for the delivery queue.
251Messages submitted to the queue that match a hold rule will be marked as on hold
252and not scheduled for delivery.
254 usage: mox queue holdrules list
256# mox queue holdrules add
258Add hold rule for the delivery queue.
260Add a hold rule to mark matching newly submitted messages as on hold. Set the
261matching rules with the flags. Don't specify any flags to match all submitted
264 usage: mox queue holdrules add [ruleflags]
266 account submitting the message
272# mox queue holdrules remove
274Remove hold rule for the delivery queue.
276Remove a hold rule by its id.
278 usage: mox queue holdrules remove $ruleid
282List matching messages in the delivery queue.
284Prints the message with its ID, last and next delivery attempts, last error.
286 usage: mox queue list [filtersortflags]
288 account that queued the message
290 sort ascending instead of descending (default)
292 from address of message, use "@example.com" to match all messages for a domain
294 true or false, whether to match only messages that are (not) on hold
296 comma-separated list of message IDs
298 number of messages to return
300 filter by time of next delivery attempt relative to now, value must start with "<" (before now) or ">" (after now)
302 field to sort by, "nextattempt" (default) or "queued"
304 filter by time of submission relative to now, value must start with "<" (before now) or ">" (after now)
306 recipient address of message, use "@example.com" to match all messages for a domain
308 transport to use for messages, empty string sets the default behaviour
312Mark matching messages on hold.
314Messages that are on hold are not delivered until marked as off hold again, or
315otherwise handled by the admin.
317 usage: mox queue hold [filterflags]
319 account that queued the message
321 from address of message, use "@example.com" to match all messages for a domain
323 true or false, whether to match only messages that are (not) on hold
325 comma-separated list of message IDs
327 number of messages to return
329 filter by time of next delivery attempt relative to now, value must start with "<" (before now) or ">" (after now)
331 filter by time of submission relative to now, value must start with "<" (before now) or ">" (after now)
333 recipient address of message, use "@example.com" to match all messages for a domain
335 transport to use for messages, empty string sets the default behaviour
339Mark matching messages off hold.
341Once off hold, messages can be delivered according to their current next
342delivery attempt. See the "queue schedule" command.
344 usage: mox queue unhold [filterflags]
346 account that queued the message
348 from address of message, use "@example.com" to match all messages for a domain
350 true or false, whether to match only messages that are (not) on hold
352 comma-separated list of message IDs
354 number of messages to return
356 filter by time of next delivery attempt relative to now, value must start with "<" (before now) or ">" (after now)
358 filter by time of submission relative to now, value must start with "<" (before now) or ">" (after now)
360 recipient address of message, use "@example.com" to match all messages for a domain
362 transport to use for messages, empty string sets the default behaviour
366Change next delivery attempt for matching messages.
368The next delivery attempt is adjusted by the duration parameter. If the -now
369flag is set, the new delivery attempt is set to the duration added to the
370current time, instead of added to the current scheduled time.
372Schedule immediate delivery with "mox queue schedule -now 0".
374 usage: mox queue schedule [filterflags] [-now] $duration
376 account that queued the message
378 from address of message, use "@example.com" to match all messages for a domain
380 true or false, whether to match only messages that are (not) on hold
382 comma-separated list of message IDs
384 number of messages to return
386 filter by time of next delivery attempt relative to now, value must start with "<" (before now) or ">" (after now)
388 schedule for duration relative to current time instead of relative to current next delivery attempt for messages
390 filter by time of submission relative to now, value must start with "<" (before now) or ">" (after now)
392 recipient address of message, use "@example.com" to match all messages for a domain
394 transport to use for messages, empty string sets the default behaviour
398Set transport for matching messages.
400By default, the routing rules determine how a message is delivered. The default
401and common case is direct delivery with SMTP. Messages can get a previously
402configured transport assigned to use for delivery, e.g. using submission to
403another mail server or with connections over a SOCKS proxy.
405 usage: mox queue transport [filterflags] $transport
407 account that queued the message
409 from address of message, use "@example.com" to match all messages for a domain
411 true or false, whether to match only messages that are (not) on hold
413 comma-separated list of message IDs
415 number of messages to return
417 filter by time of next delivery attempt relative to now, value must start with "<" (before now) or ">" (after now)
419 filter by time of submission relative to now, value must start with "<" (before now) or ">" (after now)
421 recipient address of message, use "@example.com" to match all messages for a domain
423 transport to use for messages, empty string sets the default behaviour
425# mox queue requiretls
427Set TLS requirements for delivery of matching messages.
429Value "yes" is handled as if the RequireTLS extension was specified during
432Value "no" is handled as if the message has a header "TLS-Required: No". This
433header is not added by the queue. If messages without this header are relayed
434through other mail servers they will apply their own default TLS policy.
436Value "default" is the default behaviour, currently for unverified opportunistic
439 usage: mox queue requiretls [filterflags] {yes | no | default}
441 account that queued the message
443 from address of message, use "@example.com" to match all messages for a domain
445 true or false, whether to match only messages that are (not) on hold
447 comma-separated list of message IDs
449 number of messages to return
451 filter by time of next delivery attempt relative to now, value must start with "<" (before now) or ">" (after now)
453 filter by time of submission relative to now, value must start with "<" (before now) or ">" (after now)
455 recipient address of message, use "@example.com" to match all messages for a domain
457 transport to use for messages, empty string sets the default behaviour
461Fail delivery of matching messages, delivering DSNs.
463Failing a message is handled similar to how delivery is given up after all
464delivery attempts failed. The DSN (delivery status notification) message
465contains a line saying the message was canceled by the admin.
467 usage: mox queue fail [filterflags]
469 account that queued the message
471 from address of message, use "@example.com" to match all messages for a domain
473 true or false, whether to match only messages that are (not) on hold
475 comma-separated list of message IDs
477 number of messages to return
479 filter by time of next delivery attempt relative to now, value must start with "<" (before now) or ">" (after now)
481 filter by time of submission relative to now, value must start with "<" (before now) or ">" (after now)
483 recipient address of message, use "@example.com" to match all messages for a domain
485 transport to use for messages, empty string sets the default behaviour
489Remove matching messages from the queue.
491Dangerous operation, this completely removes the message. If you want to store
492the message, use "queue dump" before removing.
494 usage: mox queue drop [filterflags]
496 account that queued the message
498 from address of message, use "@example.com" to match all messages for a domain
500 true or false, whether to match only messages that are (not) on hold
502 comma-separated list of message IDs
504 number of messages to return
506 filter by time of next delivery attempt relative to now, value must start with "<" (before now) or ">" (after now)
508 filter by time of submission relative to now, value must start with "<" (before now) or ">" (after now)
510 recipient address of message, use "@example.com" to match all messages for a domain
512 transport to use for messages, empty string sets the default behaviour
516Dump a message from the queue.
518The message is printed to stdout and is in standard internet mail format.
520 usage: mox queue dump $id
522# mox queue retired list
524List matching messages in the retired queue.
526Prints messages with their ID and results.
528 usage: mox queue retired list [filtersortflags]
530 account that queued the message
532 sort ascending instead of descending (default)
534 from address of message, use "@example.com" to match all messages for a domain
536 comma-separated list of retired message IDs
538 filter by time of last activity relative to now, value must start with "<" (before now) or ">" (after now)
540 number of messages to return
542 "success" or "failure" as result of delivery
544 field to sort by, "lastactivity" (default) or "queued"
546 filter by time of submission relative to now, value must start with "<" (before now) or ">" (after now)
548 recipient address of message, use "@example.com" to match all messages for a domain
550 transport to use for messages, empty string sets the default behaviour
552# mox queue retired print
554Print a message from the retired queue.
556Prints a JSON representation of the information from the retired queue.
558 usage: mox queue retired print $id
560# mox queue suppress list
562Print addresses in suppression list.
564 usage: mox queue suppress list [-account account]
566 only show suppression list for this account
568# mox queue suppress add
570Add address to suppression list for account.
572 usage: mox queue suppress add $account $address
574# mox queue suppress remove
576Remove address from suppression list for account.
578 usage: mox queue suppress remove $account $address
580# mox queue suppress lookup
582Check if address is present in suppression list, for any or specific account.
584 usage: mox queue suppress lookup [-account account] $address
586 only check address in specified account
588# mox queue webhook list
590List matching webhooks in the queue.
592Prints list of webhooks, their IDs and basic information.
594 usage: mox queue webhook list [filtersortflags]
596 account that queued the message/webhook
598 sort ascending instead of descending (default)
600 event this webhook is about: incoming, delivered, suppressed, delayed, failed, relayed, expanded, canceled, unrecognized
602 comma-separated list of webhook IDs
604 number of webhooks to return
606 filter by time of next delivery attempt relative to now, value must start with "<" (before now) or ">" (after now)
608 field to sort by, "nextattempt" (default) or "queued"
610 filter by time of submission relative to now, value must start with "<" (before now) or ">" (after now)
612# mox queue webhook schedule
614Change next delivery attempt for matching webhooks.
616The next delivery attempt is adjusted by the duration parameter. If the -now
617flag is set, the new delivery attempt is set to the duration added to the
618current time, instead of added to the current scheduled time.
620Schedule immediate delivery with "mox queue schedule -now 0".
622 usage: mox queue webhook schedule [filterflags] $duration
624 account that queued the message/webhook
626 event this webhook is about: incoming, delivered, suppressed, delayed, failed, relayed, expanded, canceled, unrecognized
628 comma-separated list of webhook IDs
630 number of webhooks to return
632 filter by time of next delivery attempt relative to now, value must start with "<" (before now) or ">" (after now)
634 schedule for duration relative to current time instead of relative to current next delivery attempt for webhooks
636 filter by time of submission relative to now, value must start with "<" (before now) or ">" (after now)
638# mox queue webhook cancel
640Fail delivery of matching webhooks.
642 usage: mox queue webhook cancel [filterflags]
644 account that queued the message/webhook
646 event this webhook is about: incoming, delivered, suppressed, delayed, failed, relayed, expanded, canceled, unrecognized
648 comma-separated list of webhook IDs
650 number of webhooks to return
652 filter by time of next delivery attempt relative to now, value must start with "<" (before now) or ">" (after now)
654 filter by time of submission relative to now, value must start with "<" (before now) or ">" (after now)
656# mox queue webhook print
658Print details of a webhook from the queue.
660The webhook is printed to stdout as JSON.
662 usage: mox queue webhook print $id
664# mox queue webhook retired list
666List matching webhooks in the retired queue.
668Prints list of retired webhooks, their IDs and basic information.
670 usage: mox queue webhook retired list [filtersortflags]
672 account that queued the message/webhook
674 sort ascending instead of descending (default)
676 event this webhook is about: incoming, delivered, suppressed, delayed, failed, relayed, expanded, canceled, unrecognized
678 comma-separated list of retired webhook IDs
680 filter by time of last activity relative to now, value must start with "<" (before now) or ">" (after now)
682 number of webhooks to return
684 field to sort by, "lastactivity" (default) or "queued"
686 filter by time of submission relative to now, value must start with "<" (before now) or ">" (after now)
688# mox queue webhook retired print
690Print details of a webhook from the retired queue.
692The retired webhook is printed to stdout as JSON.
694 usage: mox queue webhook retired print $id
698Import a maildir into an account.
700The mbox/maildir archive is accessed and imported by the running mox process, so
701it must have access to the archive files. The default suggested systemd service
702file isolates mox from most of the file system, with only the "data/" directory
703accessible, so you may want to put the mbox/maildir archive files in a
704directory like "data/import/" to make it available to mox.
706By default, messages will train the junk filter based on their flags and, if
707"automatic junk flags" configuration is set, based on mailbox naming.
709If the destination mailbox is the Sent mailbox, the recipients of the messages
710are added to the message metadata, causing later incoming messages from these
711recipients to be accepted, unless other reputation signals prevent that.
713Users can also import mailboxes/messages through the account web page by
714uploading a zip or tgz file with mbox and/or maildirs.
716Messages are imported even if already present. Importing messages twice will
717result in duplicate messages.
719Mailbox flags, like "seen", "answered", will be imported. An optional
720dovecot-keywords file can specify additional flags, like Forwarded/Junk/NotJunk.
722 usage: mox import maildir $accountname $mailboxname $maildir
726Import an mbox into an account.
728Using mbox is not recommended, maildir is a better defined format.
730The mbox/maildir archive is accessed and imported by the running mox process, so
731it must have access to the archive files. The default suggested systemd service
732file isolates mox from most of the file system, with only the "data/" directory
733accessible, so you may want to put the mbox/maildir archive files in a
734directory like "data/import/" to make it available to mox.
736By default, messages will train the junk filter based on their flags and, if
737"automatic junk flags" configuration is set, based on mailbox naming.
739If the destination mailbox is the Sent mailbox, the recipients of the messages
740are added to the message metadata, causing later incoming messages from these
741recipients to be accepted, unless other reputation signals prevent that.
743Users can also import mailboxes/messages through the account web page by
744uploading a zip or tgz file with mbox and/or maildirs.
746Messages are imported even if already present. Importing messages twice will
747result in duplicate messages.
749 usage: mox import mbox $accountname $mailboxname $mbox
753Export one or all mailboxes from an account in maildir format.
755Export bypasses a running mox instance. It opens the account mailbox/message
756database file directly. This may block if a running mox instance also has the
757database open, e.g. for IMAP connections. To export from a running instance, use
758the accounts web page or webmail.
760 usage: mox export maildir [-single] $dstdir $accountpath [$mailbox]
762 export single mailbox, without any children. disabled if mailbox isn't specified.
766Export messages from one or all mailboxes in an account in mbox format.
768Using mbox is not recommended. Maildir is a better format.
770Export bypasses a running mox instance. It opens the account mailbox/message
771database file directly. This may block if a running mox instance also has the
772database open, e.g. for IMAP connections. To export from a running instance, use
773the accounts web page or webmail.
775For mbox export, "mboxrd" is used where message lines starting with the magic
776"From " string are escaped by prepending a >. All ">*From " are escaped,
777otherwise reconstructing the original could lose a ">".
779 usage: mox export mbox [-single] $dstdir $accountpath [$mailbox]
781 export single mailbox, without any children. disabled if mailbox isn't specified.
785Start a local SMTP/IMAP server that accepts all messages, useful when testing/developing software that sends email.
787Localserve starts mox with a configuration suitable for local email-related
788software development/testing. It listens for SMTP/Submission(s), IMAP(s) and
789HTTP(s), on the regular port numbers + 1000.
791Data is stored in the system user's configuration directory under
792"mox-localserve", e.g. $HOME/.config/mox-localserve/ on linux, but can be
793overridden with the -dir flag. If the directory does not yet exist, it is
794automatically initialized with configuration files, an account with email
795address mox@localhost and password moxmoxmox, and a newly generated self-signed
798Incoming messages are delivered as normal, falling back to accepting and
799delivering to the mox account for unknown addresses.
800Submitted messages are added to the queue, which delivers by ignoring the
801destination servers, always connecting to itself instead.
803Recipient addresses with the following localpart suffixes are handled specially:
805- "temperror": fail with a temporary error code
806- "permerror": fail with a permanent error code
807- [45][0-9][0-9]: fail with the specific error code
808- "timeout": no response (for an hour)
810If the localpart begins with "mailfrom" or "rcptto", the error is returned
811during those commands instead of during "data".
813 usage: mox localserve
815 configuration storage directory (default "$userconfigdir/mox-localserve")
817 write configuration files and exit
819 serve on this ip instead of default 127.0.0.1 and ::1. only used when writing configuration, at first launch.
823Prints help about matching commands.
825If multiple commands match, they are listed along with the first line of their help text.
826If a single command matches, its usage and full help text is printed.
828 usage: mox help [$command ...]
832Creates a backup of the config and data directory.
834Backup copies the config directory to <destdir>/config, and creates
835<destdir>/data with a consistent snapshot of the databases and message files
836and copies other files from the data directory. Empty directories are not
837copied. The backup can then be stored elsewhere for long-term storage, or used
838to fall back to should an upgrade fail. Simply copying files in the data
839directory while mox is running can result in unusable database files.
841Message files never change (they are read-only, though can be removed) and are
842hard-linked so they don't consume additional space. If hardlinking fails, for
843example when the backup destination directory is on a different file system, a
844regular copy is made. Using a destination directory like "data/tmp/backup"
845increases the odds hardlinking succeeds: the default systemd service file
846specifically mounts the data directory, causing attempts to hardlink outside it
847to fail with an error about cross-device linking.
849All files in the data directory that aren't recognized (i.e. other than known
850database files, message files, an acme directory, the "tmp" directory, etc),
851are stored, but with a warning.
853Remove files in the destination directory before doing another backup. The
854backup command will not overwrite files, but print and return errors.
856Exit code 0 indicates the backup was successful. A clean successful backup does
857not print any output, but may print warnings. Use the -verbose flag for
858details, including timing.
860To restore a backup, first shut down mox, move away the old data directory and
861move an earlier backed up directory in its place, run "mox verifydata
862<datadir>", possibly with the "-fix" option, and restart mox. After the
863restore, you may also want to run "mox bumpuidvalidity" for each account for
864which messages in a mailbox changed, to force IMAP clients to synchronize
867Before upgrading, to check if the upgrade will likely succeed, first make a
868backup, then use the new mox binary to run "mox verifydata <backupdir>/data".
869This can change the backup files (e.g. upgrade database files, move away
870unrecognized message files), so you should make a new backup before actually
873 usage: mox backup $destdir
879Verify the contents of a data directory, typically of a backup.
881Verifydata checks all database files to see if they are valid BoltDB/bstore
882databases. It checks that all messages in the database have a corresponding
883on-disk message file and there are no unrecognized files. If option -fix is
884specified, unrecognized message files are moved away. This may be needed after
885a restore, because messages enqueued or delivered in the future may get those
886message sequence numbers assigned and writing the message file would fail.
887Consistency of message/mailbox UID, UIDNEXT and UIDVALIDITY is verified as
890Because verifydata opens the database files, schema upgrades may automatically
891be applied. This can happen if you use a new mox release. It is useful to run
892"mox verifydata" with a new binary before attempting an upgrade, but only on a
893copy of the database files, as made with "mox backup". Before upgrading, make a
894new backup again since "mox verifydata" may have upgraded the database files,
895possibly making them potentially no longer readable by the previous version.
897 usage: mox verifydata $datadir
899 fix fixable problems, such as moving away message files not referenced by their database
901 skip the check for message size
905Print licenses of mox source code and dependencies.
911Parses and validates the configuration files.
913If valid, the command exits with status 0. If not valid, all errors encountered
916 usage: mox config test
920Check the DNS records with the configuration for the domain, and print any errors/warnings.
922 usage: mox config dnscheck $domain
924# mox config dnsrecords
926Prints annotated DNS records as zone file that should be created for the domain.
928The zone file can be imported into existing DNS software. You should review the
929DNS records, especially if your domain previously/currently has email
932 usage: mox config dnsrecords $domain
934# mox config describe-domains
936Prints an annotated empty configuration for use as domains.conf.
938The domains configuration file contains the domains and their configuration,
939and accounts and their configuration. This includes the configured email
940addresses. The mox admin web interface, and the mox command line interface, can
941make changes to this file. Mox automatically reloads this file when it changes.
943Like the static configuration, the example domains.conf printed by this command
944needs modifications to make it valid.
946 usage: mox config describe-domains >domains.conf
948# mox config describe-static
950Prints an annotated empty configuration for use as mox.conf.
952The static configuration file cannot be reloaded while mox is running. Mox has
953to be restarted for changes to the static configuration file to take effect.
955This configuration file needs modifications to make it valid. For example, it
956may contain unfinished list items.
958 usage: mox config describe-static >mox.conf
960# mox config account list
964Each account is printed on a line, with optional additional tab-separated
965information, such as "(disabled)".
967 usage: mox config account list
969# mox config account addresses
971List all addresses for an account.
973Each address is printed on a line.
974An address starting with an "@" indicate it is a catchall address for the domain.
976Does not check whether account is disabled.
978 usage: mox config account addresses $account
980# mox config account add
982Add an account with an email address and reload the configuration.
984Email can be delivered to this address/account. A password has to be configured
985explicitly, see the setaccountpassword command.
987 usage: mox config account add $account $address
989# mox config account rm
991Remove an account and reload the configuration.
993Email addresses for this account will also be removed, and incoming email for
994these addresses will be rejected.
996All data for the account will be removed.
998 usage: mox config account rm $account
1000# mox config account disable
1002Disable login for an account, showing message to users when they try to login.
1004Incoming email will still be accepted for the account, and queued email from the
1005account will still be delivered. No new login sessions are possible.
1007Message must be non-empty, ascii-only without control characters including
1008newline, and maximum 256 characters because it is used in SMTP/IMAP.
1010 usage: mox config account disable $account $message
1012# mox config account enable
1014Enable login again for an account.
1016Login attempts by the user no long result in an error message.
1018 usage: mox config account enable $account
1020# mox config address add
1022Adds an address to an account and reloads the configuration.
1024If address starts with a @ (i.e. a missing localpart), this is a catchall
1025address for the domain.
1027 usage: mox config address add $address $account
1029# mox config address rm
1031Remove an address and reload the configuration.
1033Incoming email for this address will be rejected after removing an address.
1035 usage: mox config address rm $address
1037# mox config address account
1039Print the account an address belongs to.
1041Catchall addresses and the account catch all separator are considered when
1042looking up the account.
1044Does not check whether account is disabled.
1046 usage: mox config address account $address
1048# mox config domain add
1050Adds a new domain to the configuration and reloads the configuration.
1052The account is used for the postmaster mailboxes the domain, including as DMARC and
1053TLS reporting. Localpart is the "username" at the domain for this account. If
1054must be set if and only if account does not yet exist.
1056The domain can be created in disabled mode, preventing automatically requesting
1057TLS certificates with ACME, and rejecting incoming/outgoing messages involving
1058the domain, but allowing further configuration of the domain.
1060 usage: mox config domain add [-disabled] $domain $account [$localpart]
1062 disable the new domain
1064# mox config domain rm
1066Remove a domain from the configuration and reload the configuration.
1068This is a dangerous operation. Incoming email delivery for this domain will be
1071 usage: mox config domain rm $domain
1073# mox config domain disable
1075Disable a domain and reload the configuration.
1077This is a dangerous operation. Incoming/outgoing messages involving this domain
1080 usage: mox config domain disable $domain
1082# mox config domain enable
1084Enable a domain and reload the configuration.
1086Incoming/outgoing messages involving this domain will be accepted again.
1088 usage: mox config domain enable $domain
1090# mox config tlspubkey list
1092List TLS public keys for TLS client certificate authentication.
1094If account is absent, the TLS public keys for all accounts are listed.
1096 usage: mox config tlspubkey list [$account]
1098# mox config tlspubkey get
1100Get a TLS public key for a fingerprint.
1102Prints the type, name, account and address for the key, and the certificate in
1105 usage: mox config tlspubkey get $fingerprint
1107# mox config tlspubkey add
1109Add a TLS public key to the account of the given address.
1111The public key is read from the certificate.
1113The optional name is a human-readable descriptive name of the key. If absent,
1114the CommonName from the certificate is used.
1116 usage: mox config tlspubkey add $address [$name] < cert.pem
1118 Don't automatically switch new IMAP connections authenticated with this key to "authenticated" state after the TLS handshake. For working around clients that ignore the untagged IMAP PREAUTH response and try to authenticate while already authenticated.
1120# mox config tlspubkey rm
1122Remove TLS public key for fingerprint.
1124 usage: mox config tlspubkey rm $fingerprint
1126# mox config tlspubkey gen
1128Generate an ed25519 private key and minimal certificate for use a TLS public key and write to files starting with stem.
1130The private key is written to $stem.$timestamp.ed25519privatekey.pkcs8.pem.
1131The certificate is written to $stem.$timestamp.certificate.pem.
1132The private key and certificate are also written to
1133$stem.$timestamp.ed25519privatekey-certificate.pem.
1135The certificate can be added to an account with "mox config account tlspubkey add".
1137The combined file can be used with "mox sendmail".
1139The private key is also written to standard error in raw-url-base64-encoded
1140form, also for use with "mox sendmail". The fingerprint is written to standard
1141error too, for reference.
1143 usage: mox config tlspubkey gen $stem
1145# mox config alias list
1147Show aliases (lists) for domain.
1149 usage: mox config alias list $domain
1151# mox config alias print
1153Print settings and members of alias (list).
1155 usage: mox config alias print $alias
1157# mox config alias add
1159Add new alias (list) with one or more addresses and public posting enabled.
1161An alias is used for delivering incoming email to multiple recipients. If you
1162want to add an address to an account, don't use an alias, just add the address
1165 usage: mox config alias add $alias@domain $rcpt1@domain ...
1167# mox config alias update
1169Update alias (list) configuration.
1171 usage: mox config alias update $alias@domain [-postpublic false|true -listmembers false|true -allowmsgfrom false|true]
1172 -allowmsgfrom string
1173 whether alias address can be used in message from header
1175 whether list members can list members
1177 whether anyone or only list members can post
1179# mox config alias rm
1183 usage: mox config alias rm $alias@domain
1185# mox config alias addaddr
1187Add addresses to alias (list).
1189 usage: mox config alias addaddr $alias@domain $rcpt1@domain ...
1191# mox config alias rmaddr
1193Remove addresses from alias (list).
1195 usage: mox config alias rmaddr $alias@domain $rcpt1@domain ...
1197# mox config describe-sendmail
1199Describe configuration for mox when invoked as sendmail.
1201 usage: mox config describe-sendmail >/etc/moxsubmit.conf
1203# mox config printservice
1205Prints a systemd unit service file for mox.
1207This is the same file as generated using quickstart. If the systemd service file
1208has changed with a newer version of mox, use this command to generate an up to
1211 usage: mox config printservice >mox.service
1213# mox config ensureacmehostprivatekeys
1215Ensure host private keys exist for TLS listeners with ACME.
1217In mox.conf, each listener can have TLS configured. Long-lived private key files
1218can be specified, which will be used when requesting ACME certificates.
1219Configuring these private keys makes it feasible to publish DANE TLSA records
1220for the corresponding public keys in DNS, protected with DNSSEC, allowing TLS
1221certificate verification without depending on a list of Certificate Authorities
1222(CAs). Previous versions of mox did not pre-generate private keys for use with
1223ACME certificates, but would generate private keys on-demand. By explicitly
1224configuring private keys, they will not change automatedly with new
1225certificates, and the DNS TLSA records stay valid.
1227This command looks for listeners in mox.conf with TLS with ACME configured. For
1228each missing host private key (of type rsa-2048 and ecdsa-p256) a key is written
1229to config/hostkeys/. If a certificate exists in the ACME "cache", its private
1230key is copied. Otherwise a new private key is generated. Snippets for manually
1231updating/editing mox.conf are printed.
1233After running this command, and updating mox.conf, run "mox config dnsrecords"
1234for a domain and create the TLSA DNS records it suggests to enable DANE.
1236 usage: mox config ensureacmehostprivatekeys
1240List available config examples, or print a specific example.
1242 usage: mox config example [$name]
1244# mox admin imapserve
1246Initiate a preauthenticated IMAP connection on file descriptor 0.
1248For use with tools that can do IMAP over tunneled connections, e.g. with SSH
1249during migrations. TLS is not possible on the connection, and authentication
1250does not require TLS.
1252 usage: mox admin imapserve $preauthaddress
1254 write IMAP to file descriptor 0 instead of stdout
1258Check if a newer version of mox is available.
1260A single DNS TXT lookup to _updates.xmox.nl tells if a new version is
1261available. If so, a changelog is fetched from https://updates.xmox.nl, and the
1262individual entries verified with a builtin public key. The changelog is
1265 usage: mox checkupdate
1269Turn an ID from a Received header into a cid, for looking up in logs.
1271A cid is essentially a connection counter initialized when mox starts. Each log
1272line contains a cid. Received headers added by mox contain a unique ID that can
1273be decrypted to a cid by admin of a mox instance only.
1279Print the configuration for email clients for a domain.
1281Sending email is typically not done on the SMTP port 25, but on submission
1282ports 465 (with TLS) and 587 (without initial TLS, but usually added to the
1283connection with STARTTLS). For IMAP, the port with TLS is 993 and without is
1286Without TLS/STARTTLS, passwords are sent in clear text, which should only be
1287configured over otherwise secured connections, like a VPN.
1289 usage: mox clientconfig $domain
1293Dial the address using TLS with certificate verification using DANE.
1295Data is copied between connection and stdin/stdout until either side closes the
1298 usage: mox dane dial $host:$port
1300 allowed usages for dane, comma-separated list (default "pkix-ta,pkix-ee,dane-ta,dane-ee")
1304Connect to MX server for domain using STARTTLS verified with DANE.
1306If no destination host is specified, regular delivery logic is used to find the
1307hosts to attempt delivery too. This involves following CNAMEs for the domain,
1308looking up MX records, and possibly falling back to the domain name itself as
1311If a destination host is specified, that is the only candidate host considered
1314With a list of destinations gathered, each is dialed until a successful SMTP
1315session verified with DANE has been initialized, including EHLO and STARTTLS
1318Once connected, data is copied between connection and stdin/stdout, until
1319either side closes the connection.
1321This command follows the same logic as delivery attempts made from the queue,
1322sharing most of its code.
1324 usage: mox dane dialmx $domain [$desthost]
1325 -ehlohostname string
1326 hostname to send in smtp ehlo command (default "localhost")
1328# mox dane makerecord
1330Print TLSA record for given certificate/key and parameters.
1333- usage: pkix-ta (0), pkix-ee (1), dane-ta (2), dane-ee (3)
1334- selector: cert (0), spki (1)
1335- matchtype: full (0), sha2-256 (1), sha2-512 (2)
1337Common DANE TLSA record parameters are: dane-ee spki sha2-256, or 3 1 1,
1338followed by a sha2-256 hash of the DER-encoded "SPKI" (subject public key info)
1339from the certificate. An example DNS zone file entry:
1341 _25._tcp.example.com. TLSA 3 1 1 133b919c9d65d8b1488157315327334ead8d83372db57465ecabf53ee5748aee
1343The first usable information from the pem file is used to compose the TLSA
1344record. In case of selector "cert", a certificate is required. Otherwise the
1345"subject public key info" (spki) of the first certificate or public or private
1346key (pkcs#8, pkcs#1 or ec private key) is used.
1348 usage: mox dane makerecord $usage $selector $matchtype [certificate.pem | publickey.pem | privatekey.pem]
1352Lookup DNS name of given type.
1354Lookup always prints whether the response was DNSSEC-protected.
1358mox dns lookup ptr 1.1.1.1
1359mox dns lookup mx xmox.nl
1360mox dns lookup txt _dmarc.xmox.nl.
1361mox dns lookup tlsa _25._tcp.xmox.nl
1363 usage: mox dns lookup [ptr | mx | cname | ips | a | aaaa | ns | txt | srv | tlsa] $name
1365# mox dkim gened25519
1367Generate a new ed25519 key for use with DKIM.
1369Ed25519 keys are much smaller than RSA keys of comparable cryptographic
1370strength. This is convenient because of maximum DNS message sizes. At the time
1371of writing, not many mail servers appear to support ed25519 DKIM keys though,
1372so it is recommended to sign messages with both RSA and ed25519 keys.
1374 usage: mox dkim gened25519 >$selector._domainkey.$domain.ed25519.privatekey.pkcs8.pem
1378Generate a new 2048 bit RSA private key for use with DKIM.
1380The generated file is in PEM format, and has a comment it is generated for use
1383 usage: mox dkim genrsa >$selector._domainkey.$domain.rsa2048.privatekey.pkcs8.pem
1387Lookup and print the DKIM record for the selector at the domain.
1389 usage: mox dkim lookup $selector $domain
1393Print a DKIM DNS TXT record with the public key derived from the private key read from stdin.
1395The DNS should be configured as a TXT record at $selector._domainkey.$domain.
1397 usage: mox dkim txt <$selector._domainkey.$domain.key.pkcs8.pem
1401Verify the DKIM signatures in a message and print the results.
1403The message is parsed, and the DKIM-Signature headers are validated. Validation
1404of older messages may fail because the DNS records have been removed or changed
1405by now, or because the signature header may have specified an expiration time
1408 usage: mox dkim verify $messagefile
1412Sign a message, adding DKIM-Signature headers based on the domain in the From header.
1414The message is parsed, the domain looked up in the configuration files, and
1415DKIM-Signature headers generated. The message is printed with the DKIM-Signature
1418 usage: mox dkim sign $messagefile
1422Lookup dmarc policy for domain, a DNS TXT record at _dmarc.<domain>, validate and print it.
1424 usage: mox dmarc lookup $domain
1426# mox dmarc parsereportmsg
1428Parse a DMARC report from an email message, and print its extracted details.
1430DMARC reports are periodically mailed, if requested in the DMARC DNS record of
1431a domain. Reports are sent by mail servers that received messages with our
1432domain in a From header. This may or may not be legatimate email. DMARC reports
1433contain summaries of evaluations of DMARC and DKIM/SPF, which can help
1434understand email deliverability problems.
1436 usage: mox dmarc parsereportmsg $messagefile ...
1440Parse an email message and evaluate it against the DMARC policy of the domain in the From-header.
1442mailfromaddress and helodomain are used for SPF validation. If both are empty,
1443SPF validation is skipped.
1445mailfromaddress should be the address used as MAIL FROM in the SMTP session.
1446For DSN messages, that address may be empty. The helo domain was specified at
1447the beginning of the SMTP transaction that delivered the message. These values
1448can be found in message headers.
1450 usage: mox dmarc verify $remoteip $mailfromaddress $helodomain < messagefile
1452# mox dmarc checkreportaddrs
1454For each reporting address in the domain's DMARC record, check if it has opted into receiving reports (if needed).
1456A DMARC record can request reports about DMARC evaluations to be sent to an
1457email/http address. If the organizational domains of that of the DMARC record
1458and that of the report destination address do not match, the destination
1459address must opt-in to receiving DMARC reports by creating a DMARC record at
1460<dmarcdomain>._report._dmarc.<reportdestdomain>.
1462 usage: mox dmarc checkreportaddrs $domain
1466Test if IP is in the DNS blocklist of the zone, e.g. bl.spamcop.net.
1468If the IP is in the blocklist, an explanation is printed. This is typically a
1469URL with more information.
1471 usage: mox dnsbl check $zone $ip
1473# mox dnsbl checkhealth
1475Check the health of the DNS blocklist represented by zone, e.g. bl.spamcop.net.
1477The health of a DNS blocklist can be checked by querying for 127.0.0.1 and
1478127.0.0.2. The second must and the first must not be present.
1480 usage: mox dnsbl checkhealth $zone
1484Lookup the MTASTS record and policy for the domain.
1486MTA-STS is a mechanism for a domain to specify if it requires TLS connections
1487for delivering email. If a domain has a valid MTA-STS DNS TXT record at
1488_mta-sts.<domain> it signals it implements MTA-STS. A policy can then be
1489fetched at https://mta-sts.<domain>/.well-known/mta-sts.txt. The policy
1490specifies the mode (enforce, testing, none), which MX servers support TLS and
1491should be used, and how long the policy can be cached.
1493 usage: mox mtasts lookup $domain
1497Lookup the age of domain in RDAP based on latest registration.
1499RDAP is the registration data access protocol. Registries run RDAP services for
1500their top level domains, providing information such as the registration date of
1501domains. This command looks up the "age" of a domain by looking at the most
1502recent "registration", "reregistration" or "reinstantiation" event.
1504Email messages from recently registered domains are often treated with
1505suspicion, and some mail systems are more likely to classify them as junk.
1507On each invocation, a bootstrap file with a list of registries (of top-level
1508domains) is retrieved, without caching. Do not run this command too often with
1511 usage: mox rdap domainage $domain
1515Recreate and retrain the junk filter for the account or all accounts.
1517Useful after having made changes to the junk filter configuration, or if the
1518implementation has changed.
1520 usage: mox retrain [$accountname]
1524Sendmail is a drop-in replacement for /usr/sbin/sendmail to deliver emails sent by unix processes like cron.
1526If invoked as "sendmail", it will act as sendmail for sending messages. Its
1527intention is to let processes like cron send emails. Messages are submitted to
1528an actual mail server over SMTP. The destination mail server and credentials are
1529configured in /etc/moxsubmit.conf, see mox config describe-sendmail. The From
1530message header is rewritten to the configured address. When the addressee
1531appears to be a local user, because without @, the message is sent to the
1532configured default address.
1534If submitting an email fails, it is added to a directory moxsubmit.failures in
1535the user's home directory.
1537Most flags are ignored to fake compatibility with other sendmail
1538implementations. A single recipient or the -t flag with a To-header is required.
1539With the -t flag, Cc and Bcc headers are not handled specially, so Bcc is not
1540removed and the addresses do not receive the email.
1542/etc/moxsubmit.conf should be group-readable and not readable by others and this
1543binary should be setgid that group:
1546 install -m 2755 -o root -g moxsubmit mox /usr/sbin/sendmail
1547 touch /etc/moxsubmit.conf
1548 chown root:moxsubmit /etc/moxsubmit.conf
1549 chmod 640 /etc/moxsubmit.conf
1550 # edit /etc/moxsubmit.conf
1553 usage: mox sendmail [-Fname] [ignoredflags] [-t] [< messagefile]
1557Dial the address, initialize the SMTP session, including using STARTTLS to enable TLS if the server supports it.
1559If no port is specified, SMTP port 25 is used.
1561Data is copied between connection and stdin/stdout until either side closes the
1564The flags influence the TLS configuration, useful for debugging interoperability
1567No MTA-STS or DANE verification is done.
1569Hint: Use "mox -loglevel trace smtp dial ..." to see the protocol messages
1570exchanged during connection set up.
1572 usage: mox smtp dial $host[:$port]
1573 -ehlohostname string
1574 our hostname to use during the SMTP EHLO command
1576 use TLS, even if remote SMTP server does not announce STARTTLS extension
1579 -remotehostname string
1580 remote hostname to use for TLS verification, if enabled; the hostname from the parameter is used by default
1582 path to root ca certificates in pem form, for verification
1583 -tlsciphersuites string
1584 ciphersuites to allow, comma-separated, order is ignored, only for TLS 1.2 and earlier, empty value uses TLS stack defaults; values: tls_ecdhe_ecdsa_with_aes_128_cbc_sha, tls_ecdhe_ecdsa_with_aes_128_gcm_sha256, tls_ecdhe_ecdsa_with_aes_256_cbc_sha, tls_ecdhe_ecdsa_with_aes_256_gcm_sha384, tls_ecdhe_ecdsa_with_chacha20_poly1305_sha256, tls_ecdhe_rsa_with_aes_128_cbc_sha, tls_ecdhe_rsa_with_aes_128_gcm_sha256, tls_ecdhe_rsa_with_aes_256_cbc_sha, tls_ecdhe_rsa_with_aes_256_gcm_sha384, tls_ecdhe_rsa_with_chacha20_poly1305_sha256, and insecure: tls_ecdhe_ecdsa_with_aes_128_cbc_sha256, tls_ecdhe_ecdsa_with_rc4_128_sha, tls_ecdhe_rsa_with_3des_ede_cbc_sha, tls_ecdhe_rsa_with_aes_128_cbc_sha256, tls_ecdhe_rsa_with_rc4_128_sha, tls_rsa_with_3des_ede_cbc_sha, tls_rsa_with_aes_128_cbc_sha, tls_rsa_with_aes_128_cbc_sha256, tls_rsa_with_aes_128_gcm_sha256, tls_rsa_with_aes_256_cbc_sha, tls_rsa_with_aes_256_gcm_sha384, tls_rsa_with_rc4_128_sha
1586 tls ecc key exchange mechanisms to allow, comma-separated, order is ignored, empty value uses TLS stack defaults; values: curvep256, curvep384, curvep521, x25519, x25519mlkem768
1587 -tlsnodynamicrecordsizing
1588 disable TLS dynamic record sizing
1589 -tlsnosessiontickets
1590 disable TLS session tickets
1591 -tlsrenegotiation string
1592 when to allow renegotiation; only applies to tls1.2 and earlier, not tls1.3; values: never, once, always (default "never")
1594 verify remote hostname during TLS
1595 -tlsversionmax string
1596 maximum TLS version, empty value uses TLS stack default; values: tls1.2, etc.
1597 -tlsversionmin string
1598 minimum TLS version, empty value uses TLS stack default; values: tls1.2, etc.
1602Check the status of IP for the policy published in DNS for the domain.
1604IPs may be allowed to send for a domain, or disallowed, and several shades in
1605between. If not allowed, an explanation may be provided by the policy. If so,
1606the explanation is printed. The SPF mechanism that matched (if any) is also
1609 usage: mox spf check $domain $ip
1613Lookup the SPF record for the domain and print it.
1615 usage: mox spf lookup $domain
1619Parse the record as SPF record. If valid, nothing is printed.
1621 usage: mox spf parse $txtrecord
1625Lookup the TLSRPT record for the domain.
1627A TLSRPT record typically contains an email address where reports about TLS
1628connectivity should be sent. Mail servers attempting delivery to our domain
1629should attempt to use TLS. TLSRPT lets them report how many connection
1630successfully used TLS, and how what kind of errors occurred otherwise.
1632 usage: mox tlsrpt lookup $domain
1634# mox tlsrpt parsereportmsg
1636Parse and print the TLSRPT in the message.
1638The report is printed in formatted JSON.
1640 usage: mox tlsrpt parsereportmsg $messagefile ...
1644Prints this mox version.
1650Lists available methods, prints request/response parameters for method, or calls a method with a request read from standard input.
1652 usage: mox webapi [$method [$baseurl-with-credentials]
1656List available examples, or print a specific example.
1658 usage: mox example [$name]
1660# mox bumpuidvalidity
1662Change the IMAP UID validity of the mailbox, causing IMAP clients to refetch messages.
1664This can be useful after manually repairing metadata about the account/mailbox.
1666Opens account database file directly. Ensure mox does not have the account
1667open, or is not running.
1669 usage: mox bumpuidvalidity $account [$mailbox]
1673Reassign UIDs in one mailbox or all mailboxes in an account and bump UID validity, causing IMAP clients to refetch messages.
1675Opens account database file directly. Ensure mox does not have the account
1676open, or is not running.
1678 usage: mox reassignuids $account [$mailboxid]
1682Fix inconsistent UIDVALIDITY and UIDNEXT in messages/mailboxes/account.
1684The next UID to use for a message in a mailbox should always be higher than any
1685existing message UID in the mailbox. If it is not, the mailbox UIDNEXT is
1688Each mailbox has a UIDVALIDITY sequence number, which should always be lower
1689than the per-account next UIDVALIDITY to use. If it is not, the account next
1690UIDVALIDITY is updated.
1692Opens account database file directly. Ensure mox does not have the account
1693open, or is not running.
1695 usage: mox fixuidmeta $account
1699Ensure message sizes in the database matching the sum of the message prefix length and on-disk file size.
1701Messages with an inconsistent size are also parsed again.
1703If an inconsistency is found, you should probably also run "mox
1704bumpuidvalidity" on the mailboxes or entire account to force IMAP clients to
1707 usage: mox fixmsgsize [$account]
1711Parse all messages in the account or all accounts again.
1713Can be useful after upgrading mox with improved message parsing. Messages are
1714parsed in batches, so other access to the mailboxes/messages are not blocked
1715while reparsing all messages.
1717 usage: mox reparse [$account]
1721Ensure messages in the database have a pre-parsed MIME form in the database.
1723 usage: mox ensureparsed $account
1725 store new parsed message for all messages
1727# mox recalculatemailboxcounts
1729Recalculate message counts for all mailboxes in the account, and total message size for quota.
1731When a message is added to/removed from a mailbox, or when message flags change,
1732the total, unread, unseen and deleted messages are accounted, the total size of
1733the mailbox, and the total message size for the account. In case of a bug in
1734this accounting, the numbers could become incorrect. This command will find, fix
1737 usage: mox recalculatemailboxcounts $account
1741Parse message, print JSON representation.
1743 usage: mox message parse $messagefile
1745 check if message needs smtputf8
1747# mox reassignthreads
1749Reassign message threads.
1751For all accounts, or optionally only the specified account.
1753Threading for all messages in an account is first reset, and new base subject
1754and normalized message-id saved with the message. Then all messages are
1755evaluated and matched against their parents/ancestors.
1757Messages are matched based on the References header, with a fall-back to an
1758In-Reply-To header, and if neither is present/valid, based only on base
1761A References header typically points to multiple previous messages in a
1762hierarchy. From oldest ancestor to most recent parent. An In-Reply-To header
1763would have only a message-id of the parent message.
1765A message is only linked to a parent/ancestor if their base subject is the
1766same. This ensures unrelated replies, with a new subject, are placed in their
1769The base subject is lower cased, has whitespace collapsed to a single
1770space, and some components removed: leading "Re:", "Fwd:", "Fw:", or bracketed
1771tag (that mailing lists often add, e.g. "[listname]"), trailing "(fwd)", or
1772enclosing "[fwd: ...]".
1774Messages are linked to all their ancestors. If an intermediate parent/ancestor
1775message is deleted in the future, the message can still be linked to the earlier
1776ancestors. If the direct parent already wasn't available while matching, this is
1777stored as the message having a "missing link" to its stored ancestors.
1779 usage: mox reassignthreads [$account]
1783// NOTE: DO NOT EDIT, this file is generated by gendoc.sh.