Mailing Lists

A mailing list receives a post at one address and distributes it to its members. A member can be any address, including one outside your domains, unlike a group, whose members must be domain users.

Why a list reaches a third party reliably

The panel rewrites each outgoing copy so it authenticates as mail from your domain. A plain forwarder passes the original on, which fails SPF alignment at the destination; a list's copies pass.

Not on every server

Your provider can leave mailing lists out of a small server. The panel then shows neither the Mailing Lists page nor the Mailing List type, and the API and the MCP server have no mailing list operations.

You create a list under Domain Accounts, with the type Mailing List; its address has at most 15 characters. You manage it on the Mailing Lists page, where a list has six areas: General Information, Policy, Messages, Archive, Members, and Posts.

General Information also shows two of the list's addresses:

Address	What it does
<list>+owner	Reaches the people who run the list. See The owner address.
<list>+unsubscribe	A member who writes to it gets a link to leave the list. See Leaving the list.

Members

Add Members takes one address per line, at most 1,000 at a time, and ignores an address that is already a member. A list has at most 10,000 members. Your provider can set other values; see Mailing list limits.

Each member has a role and a status:

Roles
Subscriber	The default.
Moderator	Can moderate by email.
Owner	Can moderate by email.

The role decides the posting policy below and the right to moderate. You can always moderate in the panel, whatever your role on the list.

The member tabs divide the list by status into Active, Bouncing, and Opted Out. Posts go only to the active members.

A member is Opted Out when they leave the list themselves (see Leaving the list) or when you set the status. Their page shows when and how they left, e.g. "Unsubscribed with one-click unsubscribe". To take them back, open their page and select Reactivate.

There is no address to subscribe by email

Membership is managed here, by you and the people you share the panel with; a request to join is a request to you. That's deliberate: the operator of the list decides who is a member, not whoever writes to a special address.

Bounces

The panel records every delivery failure of every member. Some failures make the member Bounced:

Failure	Result
A hard bounce: the address doesn't exist, or the server refuses it permanently.	Bounced immediately.
A soft bounce, e.g. a full mailbox or an unavailable server.	One soft bounce changes nothing. Three in seven days make the member Bounced.

A Bounced member gets nothing, so an address that stopped working can't damage the list's sending reputation.

The panel never removes a member

A Bounced member stays on the list. When the address works again, open their page and select Reactivate: the member is active again, and the earlier soft bounces no longer count.

The posting policy

The settings in the Policy section control what happens when mail arrives at the list address:

Setting	What it does	Default
Allowed to Post	The minimum role a member needs to post. Roles count upwards, so Moderator accepts a moderator and an owner; Any member accepts every member.	Owner: only the list's owners can post.
Post Confirmation	Whether the sender must confirm their post, by replying to an automatic confirmation message.	If Not Possible: the list asks only when it can't verify the sender automatically. See below.
Moderator Approval	Whether a moderator must approve a post: Never, Always, or If Unconfirmed. See below.	Always: a new list holds every post for review until you decide otherwise.
Tell the sender when a post waits for a moderator	Whether the sender gets a short message saying their post is waiting.	On.

The largest post

A post larger than the list's size limit is refused. The default is 10 MB, shown in General Information as Largest Post. When the sending server announces the size first, the mail server refuses the post before it is sent.

A person who is not a member cannot post

The list accepts posts only from its members, whatever Allowed to Post says. A post from a non-member, or from a member below the minimum role, is refused while the sender's server is still connected, so that server tells the sender. The panel never sends a bounce to an address that can be forged.

Post Confirmation

A confirmation proves the post comes from the person at the sender address: the list sends them a message from its +owner address, and they confirm by replying to it or opening the link in it.

The link opens a page that shows the post and asks. Only a button on that page acts, so a program that opens links in mail, e.g. a link scanner, can't confirm a post.

Button	Result
Yes, I sent it	The post continues to moderation, or to the members.
No, I did not send it	The post's status becomes Verification Failed, and it is never sent.

With If Not Possible, the list first checks the authentication results this server wrote when the post arrived. It doesn't ask for a confirmation if one of these holds for the domain of the sender address:

• The post passes DMARC.
• The post has a valid DKIM signature of that domain.
• The post passes SPF for the sender address.
• The sender sent the post through this server, logged in as the sender address.

If no check passes, the list asks for a confirmation, as with Always.

Moderator Approval: If Unconfirmed

With If Unconfirmed, a moderator must approve only a post the list couldn't verify. A post is verified when its authentication results pass one of the checks in Post Confirmation, or when the sender confirmed it, with a reply or with the link.

So If Unconfirmed holds posts only when Post Confirmation is Never:

Post Confirmation	Result with If Unconfirmed
Never	A post that passes the checks goes to the members. Every other post waits for a moderator.
If Not Possible	A post that passes the checks goes to the members. For every other post, the list asks the sender; after the confirmation, the post goes to the members.
Always	The list asks every sender; after the confirmation, the post goes to the members.

Use If Unconfirmed with Never

Your members can then post through their own mail servers without a confirmation step, and a moderator sees only the posts the list can't connect to the sender.

Moderation

A held post appears under Posts → In Moderation, and the list's page shows how many are waiting. Select the posts, then accept or refuse them together.

The list also sends a notice to every active moderator and owner, with the sender, subject, and time of the post. A moderator can decide by email or by link:

To	Do this
Approve the post	Reply to the notice, or open the Approve link.
Refuse the post	Open the Refuse link, or send a message to the refuse address in the notice.

Each link opens a page that asks; only the button on that page acts.

The first decision counts, whether from a moderator, an owner, or you in the panel. A later reply gets a refusal from the mail server saying the post was already decided; a later link shows the same.

What the sender is told

The list sends the sender a short message from the +owner address in these cases:

Case	Message
The post waits for a moderator.	"Your post … waits for a moderator". Only if Tell the sender when a post waits for a moderator is on.
A moderator refuses the post.	"Your post … was refused".
The post waits for a moderator for seven days and expires.	"Your post … expired".

No messages to forged addresses

These messages go only to a member, at the member's address; the mail server already refused a post from anyone else. The list never answers automatic mail such as an auto-reply or a delivery report, and one address gets at most 10 of these messages from one list in 24 hours.

A post that expires before its sender confirms it gets no message; the sender already has the confirmation request.

Each notice belongs to one moderator

The addresses and the links in a notice work only for the member who got it, and only while that member is an active moderator or owner. If you change a moderator's role to Subscriber, their old notices stop working.

A post that waits expires

A post that waits for a confirmation or for a moderator for seven days expires. Its status becomes Expired, and it is never sent.

All Posts shows the full history. Each member's page shows their posts and their deliveries, and the list keeps a member's posts when you remove them.

Messages

The Messages section controls how each copy looks. Select Edit to change it.

Setting	What it does	Default
Replies Go To	Where a reply to a copy goes. The author: to the person who wrote the post. The list: to all members.	The author
Subject Prefix	Text before the subject of each copy, e.g. [news]. A reply that already has the prefix doesn't get it again.	None
Footer	Plain text at the end of each copy. The member's unsubscribe link goes below it.	None

With The author, a member can still reply to the whole list with the Reply to list or Reply all command of their mail program.

The archive

A list can keep every post it sends to its members. The archive is off for a new list; to turn it on, select Edit in the list's Archive area.

Setting	What it does	Default
Keep an archive of the posts	The list keeps every post it sends, with its attachments.	Off
Keep Posts For (Days)	An archived post older than this is deleted. From 1 to 3,650 days.	365 days
Publish the archive on the web	Anyone with the link can read the archive. See The public archive.	Off

The archive keeps only the posts the members got: not a post that a moderator refused, that the sender didn't confirm, or that expired, and not a post from before you turned the archive on.

Archived Posts in the Archive area opens the archive, in two views:

View	Shows
By Thread	One line per conversation, with the number of posts, most recent conversation first. A reply goes into the thread of the post it answers.
By Date	Every post, most recent first.

A post's page shows its text. Download Message gives you the full message, which you can open in a mail program, and each attachment is a download.

The panel never shows a post as HTML

The panel shows the text part of a post, and converts a post that has only an HTML part to plain text. So no script, style, or remote image from a post runs in the panel, and an attachment is always a download, never opened in the browser.

The archive counts against your storage

The archive is kept outside your home directory but counts against your account's storage, like a database. A large list with attachments can use a lot of space; set a retention that fits. See Resource Usage.

When you turn the archive off, the list stops adding posts; the ones it has stay until they pass the retention. To delete them now, open the archive and select Delete the Archive. Deleting the list deletes its archive too.

The API and the AI assistant can also read the archive: the list of posts, and one post with its text. See API.

The public archive

With Publish the archive on the web, the list publishes a read-only copy of its archive on your domain's mail access host, at https://<mail access host>/list/<list id>/archive. The Archive area shows the link, and each copy of a post then carries it in its List-Archive header.

The public archive differs from the one in the panel:

	In the panel	Public
Who can read it	You, and the people you share the panel with	Anyone with the link
Email addresses	Shown	Hidden. The page shows the first letters of the address and its domain, e.g. al…@example.com. The author's name stays.
Attachments	Downloads	Only the name, the type, and the size
The full message	A download	Not available

There is no archive for members only

The members of a list have no account in the panel, so the archive is either for you only or public. A member can't sign in to read it.

How delivery works

For each post the list accepts, it sends an individual copy to each active member. In each copy:

• From is the list's address with the author's name, Alice Example via News <[email protected]>, or, if the author has no name, the part of their address before the @: alice via News <[email protected]>. The name never holds an address, because spam filters refuse a message whose name shows an address of another domain. The author's full address is in an X-Original-From header;
• Reply-To is the author or the list, as Replies Go To says;
• To is the member;
• Message-ID, In-Reply-To, and References are kept from the post, so replies stay in the same conversation in mail programs. A post without a correct Message-ID gets one from the list, the same in each copy;
• the original sender's authentication headers, and the spam results this server added on arrival, are removed. The copy is a new message from your domain: the panel signs it, checks it again, and it aligns with your SPF like every other message you send;
• the list attaches a unique, signed bounce address, which is how a failure is attributed to the right member for the bounce handling above.

Each copy has the standard list headers:

Header	Value
List-Id	The list's name and address, e.g. News <news.example.com>. Mail programs use it to sort and filter list mail.
List-Post	The list's address. NO for a member whose role can't post.
List-Help, List-Owner	The +owner address.
List-Unsubscribe, List-Unsubscribe-Post	The member's unsubscribe link and address, with one-click unsubscribe.
List-Archive	The link to the public archive, only when the list publishes it. See The archive.
Precedence	list, so that auto-replies stay quiet.

Administrative mail from the list comes from the +owner address, each message from its own signed bounce address, so a delivery failure of an administrative message never reaches a person.

Two results of this

• A recipient sees the author's name and the list in the address. Mail from the author's domain doesn't pass DMARC when another server sends it; mail from your domain does.
• Each copy is tracked separately, so a delivery problem at one member never affects the others.

Leaving the list

A member can leave the list without your help, in three ways:

Way	How it works
One-click unsubscribe	Mail programs such as Gmail and Yahoo Mail show an Unsubscribe button for a copy with List-Unsubscribe. The member is out at once.
The unsubscribe link	In the List-Unsubscribe header and in the footer, if the list has one. The link opens a page that asks; the member is out when they select Leave the mailing list.
Mail	The member writes to <list>+unsubscribe. The list sends a message with the link to the member's address, and the member opens the link or replies to the message.

The link and the reply address belong to one member and need no password.

A member who leaves becomes Opted Out and gets nothing more. To take them back, open their page and select Reactivate.

A message to +unsubscribe from another person does nothing

The list sends the link only to the member's own address, so a person who writes to +unsubscribe with a member's address can't remove that member.

The owner address

Mail to <list>+owner reaches the people who run the list: every active member with the role Owner, or your account's system mailbox if the list has no owner. Anyone can write to it.

Each person gets a copy from <list>+owner, with the writer's name and the writer as Reply-To, so a reply goes to the writer.

The list doesn't pass on:

• delivery reports, and other mail with an empty sender;
• automatic mail, e.g. auto-replies;
• a copy that came back to the list.

One sender can send at most 10 messages to the owner address in one hour, and all senders together 50. After that, the mail server asks the sender's server to try again later.