Account types

Every address on your domains, e.g. something@example.com, is exactly one of seven types: Domain User, Group, Forwarder, Mailing List, Rejector, Send-Only Account, and Relayer.

All seven share one namespace per domain: once info@example.com exists as one type, no other type can use that name. The types behave very differently, so the right choice at the start saves work later.

Create an address

Open Email & Identity → Accounts, choose the domain, and select Create. Pick the type first; everything else follows from it.

An address name is the local part only, the text before the @:

• Lowercase letters, digits, dots, dashes, and underscores.
• At most 30 characters; 15 for a mailing list address.

Reserved names

• Your account's System Mailbox answers postmaster and abuse on every domain.
• Names that start with an underscore, e.g. _relay or _system, are kept for internal addresses.

Mail for several people

For your colleagues, use a Group. For third parties, use a Mailing List. Don't use a plain Forwarder: a message forwarded to an external address loses its SPF alignment, so the destination is more likely to treat it as spam.

The create page shows the same comparison table.

The seven types

Domain User (mailbox)

A real mailbox with storage, for a real person, with its own sign-in, webmail, and self-service portal. See Domain users. Use it whenever a person reads the mail. It's the only type that is a user; the other six are addresses, not people.

The form asks for a Username, an optional Name, and the Groups the user belongs to, then shows a welcome card once, with the link that sets up the credentials. See Invite a domain user.

Group

A shared identity: mail to the group reaches its members, and a member can send as the group address. Use it when a team should appear as one address in both directions, e.g. a support team or a shared role.

The form asks for a Group Address and an optional Group Name.

Members aren't set here

Membership belongs to each domain user: the Groups field when you create the user, or the Group Membership section when you edit them.

Groups covers delivery, sending as the group, delivery failures, and using a group as an audience for access control.

Forwarder

No storage, no sign-in. The server passes mail for the address to one or more Destination Addresses, one per line, up to ten. A destination can be anywhere, including outside your domains.

Use it to send info@ to two colleagues, or to route an old address to a new one.

Mailing List

A distribution list with memberships, moderation, and self-service subscription through an address such as list+subscribe@. It's deliberately more complex than a group. Use it for announcements or a discussion with an audience that changes over time.

The form asks for a Mailing List Address and an optional name. Members and policy come afterwards, on the Mailing Lists pages.

Rejector

Bounces mail with a message you choose. Without the address, a sender gets a standard refusal; with a rejector, a deliberate, informative one, e.g. for a retired address: "Nobody reads this address now. Write to …".

The form takes an optional Rejection Message of up to 255 characters, which the refusal includes.

Send-Only Account

The opposite of a forwarder: it can send and never receives. Mail to the address gets a permanent failure. It has no sign-in; an application authenticates to it with an app password.

Use it for no-reply@, notification senders, and anything automatic. A compromised script then can't read mail or sign in anywhere.

The form takes the address only.

Relayer

An address whose mailbox is on a mail server you run: an on-premises Exchange, a groupware appliance, a departmental application. The panel accepts the mail, filters and logs it, and passes it to your server. No storage, no sign-in, no webmail: nothing is kept here for a person to read.

The form takes the address only. The destination is set once for the whole domain, not per address.

Also turn relaying on for the domain

Until you do, a relayer accepts nothing: the server refuses mail to the address as if it didn't exist. See Relay to your own server.

A relayer or the domain-user checkbox

A relayer has no mailbox here. A domain user with Also relay to my own server keeps its mailbox here and sends a copy to your server. The same page covers both.

Choose quickly

You want…	Use
A person to read and send mail	A domain user
Mail to continue to an existing mailbox	A forwarder
A team address people can also send from	A group
Senders to get an explicit "this address is closed"	A rejector
An app to send notifications and never receive mail	A send-only account
Subscribers, archives, and moderation	A mailing list
The mailbox on a server you run	A relayer
The mailbox here and copied to your server	A domain user with Also relay to my own server

Two details:

• A forwarder's destinations can be any addresses. The members of a group must be domain users on the group's own domain.
• Only a domain user and a send-only account can authenticate to send mail. Nobody can send from a forwarder or a relayer, though the domain's collection credential can send for the addresses it relays.

One namespace for each domain

The seven types compete for the same local parts only within one domain. info@example.com and info@mail.example.com are separate addresses on separate domains: one can be a forwarder and the other a domain user, and they share nothing.

note

The two domains can be in the same DNS zone; a shared zone doesn't merge their addresses. Domains, zones, and services explains how a domain sits inside a zone.