nextxch Documentation
Cleanly organized reference manual covering installation, DNS, security, groupware, CLI automation, and operations: every focused guide documents exact Default Values and production Best Practices.
Getting Started
From a fresh Windows, Linux, or Docker host to the perimeter port matrix.
Guided Installation (8 Steps)
Interactive pre-flight checklist, Windows (.msi), Linux (systemd) & Docker tutorials plus symptom troubleshooting.
Architecture & Port Matrix
nextxch unifies ESMTP, IMAP4rev2, POP3, JMAP, CalDAV/CardDAV, WBXML Mobile Push, ManageSieve, Webmail PWA, and GoBD WORM archiving in a single nati...
Networking, DNS & Crypto
10/10 deliverability with FCrDNS/PTR, Dual-DKIM, IPv6, pfSense & Let's Encrypt DANE.
DNS (10/10), PTR & Autodiscover
Major receivers such as Gmail, Microsoft 365, and Deutsche Telekom evaluate sender reputation heavily on DNS alignment. Under TLS & DNS Advisor (#p...
Dual-Stack IPv6 & Happy-Eyeballs
All protocol listeners (ESMTP 25/465/587, IMAP 143/993, ManageSieve 4190) and Kestrel bind in native Dual-Stack mode ([::] with DualMode = true). A...
pfSense, OPNsense & SSL Gateways
Many enterprise deployments run their web server and nextxch in internal VLANs behind a shared perimeter firewall (pfSense, OPNsense, Sophos) or an...
Let's Encrypt, MTA-STS, DANE & BIMI
nextxch automates X.509 certificate issuance and renewal via Let's Encrypt ACME v2, hot-swapping renewed certificates in 0 ms across HTTPS, SMTPS,...
Mail Transport & Defense
SMTP queue, live MX diagnostics, SpamGuard ML, greylisting, ClamAV, Fail2Ban & a mail gateway in front.
SMTP Queue, Smart-Host & MX Tester
The outbound delivery engine resolves MX records, enforces MTA-STS and DANE TLSA policies, supports RFC 7435 opportunistic STARTTLS for shared-host...
SpamGuard, Greylisting & ClamAV
nextxch's inbound defense combines protocol-level checks (SPF, DKIM, DMARC, FCrDNS, DNSBL, Smart Greylisting) with MIME heuristics, an online FTRL...
AI in Sieve rules
Inbox rules and the system Sieve can ask a language model and then move, flag or forward depending on the answer. Two forms: a free yes/no question...
Reputation Shield, ESMTP Limits & Fail2Ban
Two threats face every internet-facing mail server: external credential-stuffing bots and damaged outbound IP/domain reputation (caused by repeated...
Proxmox Mail Gateway in front
A mail gateway in front accepts all mail from the internet, checks it with a second, independent anti-spam and antivirus engine and forwards only c...
Milters & MTA Hooks
Existing filters plug straight into the SMTP dialogue: milters speak the Sendmail milter protocol version 6 (Rspamd through its milter proxy, ClamA...
Clients, Groupware & CLI
Messenger-safe iPhone setup, Outlook for Windows, Webmail calendar & contacts, API keys & CLI.
iPhone, Mobile & WhatsApp Setup
Users should be able to provision Mail, Calendar, Contacts, and Notes on iOS and macOS in under 30 seconds without typing ports or exposing their m...
Webmail, Calendar (CalDAV) & Contacts
Unlike protocol-only mail backends, nextxch ships with a fast, installable Webmail PWA (/mail/) featuring a full groupware Calendar (Month, Week, D...
Set up Outlook for Windows
Microsoft Outlook for Windows connects to nextxch via IMAP (incoming) and SMTP (outgoing). This applies to classic Outlook (Microsoft 365 Apps, Out...
nextxch-cli: Commands, Queries & IaC
With nextxch-cli, you manage domains, mailboxes, distribution lists, aliases, scoped API keys, outbound SMTP routes (incl. TLS overrides), IP warmi...
Configuration as code (GitOps)
The whole server state as YAML files in Git: tenants, domains (DKIM selectors, MTA-STS, routing), mailboxes with aliases, forwarding and out-of-off...
API & CLI Object Schema (All Fields)
This reference documents every JSON property, data type, enum value, default setting, and minimum RBAC role across all 12 management objects (/api/...
API Keys, Send API & SSO
Web apps, ticketing tools, ERP systems, and CI/CD pipelines should never share human mailbox passwords. Under API Keys, SSO & Rules (#pApiAuth), mi...
LDAP, AD, Entra ID & SSO
Under Admin > Identity sources you connect a tenant or single domains to Active Directory or LDAP (sign-in by bind, sync of users, nested groups an...
Kerberos SSO (Windows sign-in)
With Kerberos, Windows PCs on the company network sign in without a password prompt: webmail and admin through SPNEGO ("Sign in with Windows"), Out...
OAuth for Thunderbird, Outlook & CLI
nextxch is its own OAuth 2.1 authorization server: mail apps sign in in the browser through the normal webmail login (including 2FA and passkeys),...
Compliance, Storage & Ops
Message Trace, GoBD WORM archive, SQLite / SQL Server / PostgreSQL 18 & updates.
Message Trace & GoBD WORM Archive
When a customer asks 'Where is our invoice?', you need an instant factual answer. Message Trace (#pMessageTrace) records exact timestamps, remote I...
Storage Engines, Cluster & Updates
nextxch cleanly separates structured metadata and full-text indexes from SHA-256 deduplicated, Zstandard-compressed MIME blobs (-62% disk footprint...
Operations Dashboard & Alerts
The operations dashboard (#pOps) shows live and as a 24-hour history: mails per minute in and out, deferred and bounced mail, spam rate, failed sig...
Quick Reference: The 5 Required Inbound Ports
Additionally, outbound TCP Port 25 must be open to the internet for direct MX delivery.
TCP 25ESMTP MX Inbound & OutboundTCP 443HTTPS: Webmail, Admin, DAV, PushTCP 465SMTPS Client Submission (TLS)TCP 587Submission (STARTTLS)TCP 993IMAPS Mailbox & IDLE PushFrequently Asked Operational Questions
Which firewall ports are strictly required for nextxch?
Full mail, Webmail PWA, Mobile Push, and CalDAV/CardDAV operation requires 5 inbound TCP ports: 25 (ESMTP MX inbound), 443 (HTTPS for Webmail, Admin, JMAP, CalDAV/CardDAV & Mobile Push), 465 (SMTPS implicit TLS), 587 (Submission STARTTLS), and 993 (IMAPS). Optional ports are 80 (Let's Encrypt HTTP-01), 143 (IMAP STARTTLS), 4190 (ManageSieve), and 995 (POP3S) / 110 (POP3 STLS) if POP3 is enabled, plus outbound TCP port 25 to the internet.
Why can an external port check time out when both servers sit behind the same pfSense or SSL gateway?
When a web server and mail server share a firewall (such as pfSense, OPNsense, or HAProxy) without Hairpin NAT (NAT Reflection), packets addressed from inside the gateway to your own public WAN IP are dropped. Starting in v1.2.4, nextxch automatically detects co-hosted gateway topologies via split-path probing. For LAN clients, configuring Split-DNS host overrides or Pure NAT Reflection is recommended.
How do I safely share an iPhone or smartphone setup profile via WhatsApp or Microsoft Teams?
In Accounts & Lists -> Device Setup inside /admin/ (or inside Webmail settings), nextxch generates a 24-hour setup page link (/onboarding/setup/{token}) backed by a dedicated per-device App Password. Preview crawlers from WhatsApp, Teams, Telegram, or Slack never consume the token, and in-app WebViews display a clean Safari handoff prompt so iOS installs the signed .mobileconfig profile cleanly.
What are the recommended SpamGuard thresholds for production?
Keep JunkThreshold at 4.5 (routes suspicious mail to Junk) and RejectThreshold at 9.0 (hard 550 SMTP reject for clear spam), paired with Smart Greylisting (240 seconds on IPv4 /24 and IPv6 /64 prefixes). Legitimate MTAs pass greylisting automatically on retry and are cached for 30 days, preventing false-positive data loss.
Which database engine should I pick: SQLite WAL, Microsoft SQL Server, or PostgreSQL 18?
Up to ~250 active mailboxes on a single host, embedded SQLite WAL delivers sub-millisecond reads with zero DBA maintenance. Windows shops with existing Microsoft SQL Server (2019-2025, Express, or Azure SQL) get native multi-node clustering and search out of the box, while Linux high-availability clusters benefit from PostgreSQL 18 LISTEN/NOTIFY.