Company email you manage yourself

01Quick start

Once your domain is registered, Trivapost sends an onboarding summary with the domain administrator username, an initial password (sent only once), your plan (mailboxes, quota, sending limit) and the DNS records to add.

1. Sign in to the domain panel. Open mx1.trivapost.com/domainadmin/ and sign in with the tp-… username and the initial password.
2. Change the password. On the panel home page, open Change password. Use at least 14 characters and keep it in your company password manager.
3. Turn on two-factor authentication (2FA). On the same page choose Two-factor authentication›Time-based OTP, scan the QR code with Google Authenticator, Authy or 1Password, and enter the 6-digit code.
4. Add the DNS records at your domain's DNS provider (see section 2).
5. Create mailboxes for staff and one no-reply@ address for OTP (see section 3).
6. Move existing email if you have any, then point MX to Trivapost (see section 4).

Three addresses to remember

What you can and cannot change in the panel

02Connect your domain (DNS)

Add the records below at your domain's DNS provider (Cloudflare, your registrar, or an internal DNS server). The DKIM value is unique to your domain — copy it exactly from the onboarding summary or from the panel: E-Mail›Configuration›Domains›DNS.

Checking your records

The easiest way: in the panel open E-Mail›Configuration›Domains and click the DNS button next to your domain. Correct records are marked green. DNS changes usually show up within 5–60 minutes.

From a terminal:

dig +short MX yourcompany.com
dig +short TXT yourcompany.com
dig +short TXT dkim._domainkey.yourcompany.com
dig +short TXT _dmarc.yourcompany.com

nslookup -type=mx yourcompany.com 1.1.1.1
nslookup -type=txt dkim._domainkey.yourcompany.com 1.1.1.1

Tightening DMARC step by step

1. Weeks 1–4: p=none — monitoring only. Reports go to the rua address; create a postmaster@ mailbox or alias so they are not rejected.
2. Once every legitimate sender passes SPF/DKIM: p=quarantine — forged mail lands in the recipient's spam folder.
3. Final stage: p=reject — forged mail using your domain is refused. This matters for payment companies, whose names are popular with phishers.

03Mailboxes & aliases

Creating a mailbox

1. Open E-Mail›Configuration›Mailboxes and click Add mailbox.
2. Enter the Username (the part before @, e.g. jane), choose the domain, and fill in Full name.
3. Set the Quota (up to your plan, e.g. 10240 MiB = 10 GB).
4. Set a strong password or use the generator icon. Hand it to the employee over a secure channel, not by email to the same mailbox.
5. Click Add. The mailbox works in webmail and email apps right away.

If you have reached your plan's mailbox count, the panel refuses new mailboxes. Remove unused ones or contact us to upgrade.

Everyday tasks

04Move from an old server

This works for CyberPanel, cPanel, Plesk or any other IMAP server. Existing mail is copied with a sync job; nothing is deleted on the old server.

1. One day before: lower the TTL. Set the TTL of the domain's MX record to 300 seconds (5 minutes) so the switch takes effect quickly.
2. Create mailboxes in Trivapost with exactly the same addresses as on the old server.
3. Add a temporary SPF that allows both servers during the transition:
   TXT @ (temporary)Copy

   v=spf1 include:_spf.trivapost.com ip4:OLD_SERVER_IP ~all

   Use ip6:OLD_SERVER_IPV6 as well if the old server has IPv6. Also add DKIM (dkim._domainkey), autodiscover and autoconfig. The Trivapost DKIM selector is dkim, so it does not clash with the old server's DKIM (usually default) — keep both during the move.
4. Create a sync job for each mailbox: E-Mail›Configuration›Sync jobs›Add sync job.

   Field	Value
   Username	Destination mailbox in Trivapost
   Host	Old server name, e.g. mail.yourcompany.com, or its IP
   Port / Encryption	993 / SSL
   Username & password (source)	Full email address and password on the old server
   Interval (min)	20 during the transition
   Delete from source when completed	Leave unchecked
   Exclude objects (regex)	Keep the default (spam/junk folders are skipped)

   The first sync can take a few hours for large mailboxes. Watch progress with the Logs button on the sync job.
5. Switch day: change MX to mx1.trivapost.com (priority 10) and remove the old MX. Mail that still reaches the old server is copied by the sync job.
6. Set up staff devices with the new settings (see section 5).
7. Day 3 to day 7: finish. Confirm new mail arrives in Trivapost, turn off the sync jobs, change SPF to the final v=spf1 include:_spf.trivapost.com -all, and disable email on the old server. If your website or app still sends email from its own server (for example OTP codes), keep that server's ip4:/ip6: in SPF and keep its DKIM record.

05Set up email apps

Outlook and Thunderbird usually configure themselves from just the email address and password (once the autodiscover/autoconfig records exist). For manual setup:

The username is always the full email address ([email protected]). Authentication: normal password. SMTP requires sign-in.

06Send OTP from your app

For automated email (login OTP, password reset, PIN change) use one dedicated mailbox, such as [email protected]. Do not use a staff mailbox.

Preparation

1. Create the no-reply@ mailbox (section 3).
2. Sign in to mx1.trivapost.com as no-reply@, open App passwords›Create app password. Name it after the application (e.g. api-production) and tick only SMTP.
3. Store the app password in a secret manager or server environment variable — never in the code repository.
4. Create separate app passwords for staging and production, so one can be revoked without affecting the other.

Code samples

MAIL_MAILER=smtp
MAIL_HOST=mx1.trivapost.com
MAIL_PORT=465
MAIL_SCHEME=smtps          # Laravel 10 and older: MAIL_ENCRYPTION=ssl
[email protected]
MAIL_PASSWORD=your-app-password
[email protected]
MAIL_FROM_NAME="Your Company"

use PHPMailer\PHPMailer\PHPMailer;

$mail = new PHPMailer(true);
$mail->isSMTP();
$mail->Host       = 'mx1.trivapost.com';
$mail->Port       = 465;
$mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS;
$mail->SMTPAuth   = true;
$mail->Username   = '[email protected]';
$mail->Password   = getenv('MAIL_PASSWORD');
$mail->CharSet    = 'UTF-8';
$mail->Timeout    = 20;

$mail->setFrom('[email protected]', 'Your Company');
$mail->addReplyTo('[email protected]');
$mail->addAddress($userEmail);
$mail->Subject = 'Your verification code';
$mail->isHTML(true);
$mail->Body    = "<p>Verification code: <b>{$code}</b></p><p>Valid for 5 minutes. Never share this code.</p>";
$mail->AltBody = "Verification code: {$code}\nValid for 5 minutes. Never share this code.";
$mail->send();

const nodemailer = require('nodemailer');

// Create once at startup and reuse for every message
const transporter = nodemailer.createTransport({
  host: 'mx1.trivapost.com',
  port: 465,
  secure: true,
  pool: true,
  maxConnections: 3,
  auth: { user: '[email protected]', pass: process.env.MAIL_PASSWORD },
});

await transporter.sendMail({
  from: '"Your Company" <[email protected]>',
  replyTo: '[email protected]',
  to: userEmail,
  subject: 'Your verification code',
  text: `Verification code: ${code}\nValid for 5 minutes. Never share this code.`,
  html: `<p>Verification code: <b>${code}</b></p><p>Valid for 5 minutes.</p>`,
});

import os, ssl, smtplib
from email.message import EmailMessage
from email.utils import formatdate, make_msgid

msg = EmailMessage()
msg["From"] = "Your Company <[email protected]>"
msg["To"] = user_email
msg["Reply-To"] = "[email protected]"
msg["Date"] = formatdate(localtime=True)
msg["Message-ID"] = make_msgid(domain="yourcompany.com")
msg["Subject"] = "Your verification code"
msg.set_content(f"Verification code: {code}\nValid for 5 minutes. Never share this code.")
msg.add_alternative(f"<p>Verification code: <b>{code}</b></p><p>Valid for 5 minutes.</p>", subtype="html")

with smtplib.SMTP_SSL("mx1.trivapost.com", 465, context=ssl.create_default_context(), timeout=20) as s:
    s.login("[email protected]", os.environ["MAIL_PASSWORD"])
    s.send_message(msg)

package mail

import (
	"crypto/tls"
	"fmt"
	"net/smtp"
	"os"
	"time"
)

func SendOTP(to, code string) error {
	const host, from = "mx1.trivapost.com", "[email protected]"
	conn, err := tls.Dial("tcp", host+":465", &tls.Config{ServerName: host})
	if err != nil {
		return err
	}
	c, err := smtp.NewClient(conn, host)
	if err != nil {
		return err
	}
	defer c.Close()
	if err = c.Auth(smtp.PlainAuth("", from, os.Getenv("MAIL_PASSWORD"), host)); err != nil {
		return err
	}
	if err = c.Mail(from); err != nil {
		return err
	}
	if err = c.Rcpt(to); err != nil {
		return err
	}
	w, err := c.Data()
	if err != nil {
		return err
	}
	fmt.Fprintf(w, "From: Your Company <%s>\r\nTo: %s\r\nSubject: Your verification code\r\nDate: %s\r\nMessage-ID: <%[email protected]>\r\n"+
		"MIME-Version: 1.0\r\nContent-Type: text/plain; charset=UTF-8\r\n\r\nVerification code: %s\r\nValid for 5 minutes.\r\n",
		from, to, time.Now().Format(time.RFC1123Z), time.Now().UnixNano(), code)
	if err = w.Close(); err != nil {
		return err
	}
	return c.Quit()
}

# Cargo.toml
[dependencies]
lettre = { version = "0.11", default-features = false, features = ["builder", "smtp-transport", "rustls-tls", "hostname"] }
uuid = { version = "1", features = ["v4"] }

// src/mail.rs
use lettre::message::{header::ContentType, MultiPart, SinglePart};
use lettre::transport::smtp::authentication::Credentials;
use lettre::{Message, SmtpTransport, Transport};

pub fn send_otp(to: &str, code: &str) -> Result<(), Box<dyn std::error::Error>> {
    let email = Message::builder()
        .from("Your Company <[email protected]>".parse()?)
        .reply_to("[email protected]".parse()?)
        .to(to.parse()?)
        .subject("Your verification code")
        .date_now() // Date header
        .message_id(Some(format!("<{}@yourcompany.com>", uuid::Uuid::new_v4()))) // Message-ID with your own domain (lettre would otherwise use the machine hostname)
        .multipart(
            // text + HTML; MIME-Version is added automatically
            MultiPart::alternative()
                .singlepart(SinglePart::builder().header(ContentType::TEXT_PLAIN)
                    .body(format!("Verification code: {code}\nValid for 5 minutes. Never share this code.")))
                .singlepart(SinglePart::builder().header(ContentType::TEXT_HTML)
                    .body(format!("<p>Verification code: <b>{code}</b></p><p>Valid for 5 minutes.</p>"))),
        )?;

    // async (tokio): AsyncSmtpTransport::<Tokio1Executor>::relay(...) with features "tokio1" and "tokio1-rustls-tls"
    let mailer = SmtpTransport::relay("mx1.trivapost.com")? // port 465, SSL/TLS
        .credentials(Credentials::new(
            "[email protected]".to_owned(),
            std::env::var("MAIL_PASSWORD")?,
        ))
        .build();

    mailer.send(&email)?;
    Ok(())
}

Test the connection from your app server

# 1. Is the port reachable? (should say "succeeded" / "open")
nc -vz mx1.trivapost.com 465

# 2. Send a test message (swaks package: apt install swaks)
swaks --server mx1.trivapost.com:465 --tls-on-connect \
  --auth LOGIN --auth-user [email protected] --auth-password 'your-app-password' \
  --from [email protected] --to [email protected] \
  --header "Subject: Trivapost test"

Best practices for OTP deliverability

• Short and consistent. Same subject every time (Your verification code), the code in the body. No large images or many links.
• Send both text and HTML parts (as in the samples above).
• Always include Message-ID, Date and MIME-Version headers. Gmail puts messages without a Message-ID in spam or rejects them. Laravel, PHPMailer and Nodemailer add them for you (for Rust lettre set message_id with your domain as in the sample); with raw SMTP code (Python smtplib, Go net/smtp, scripts) add them yourself as in the samples.
• No link shorteners (bit.ly and similar) — they are a strong phishing signal.
• Throttle resend requests in your app, e.g. at most 1 code per 60 seconds and 5 per hour per user. This stops abuse from burning your sending limit.
• Send from a queue, not inside the user's request. On a 4xx reply retry after 1, 5 and 15 minutes. A 5xx reply is a permanent failure — do not retry.
• Reuse connections (pooling) when sending many messages in a row.
• Check the no-reply@ mailbox weekly in webmail: wrong user addresses bounce back there. Flag those addresses in your app so they are not mailed again.
• Transactional email only. Promotions, newsletters and mass announcements are not allowed on Trivapost (see section 8).

07Security

• 2FA is required for the domain admin account. Keep backup access safe; if a device is lost, contact support from the registered contact address.
• One app password per device or application. If a laptop is lost or a server is compromised, revoke just that app password.
• Limit unused protocols per mailbox (Mailboxes›Edit›Allowed protocols). For example, turn off POP3 everywhere if nobody uses it.
• Be wary of emails asking you to sign in. Trivapost never asks for passwords by email. The only official sign-in pages are mx1.trivapost.com and webmail.trivapost.com.
• Move DMARC to p=reject after the monitoring period (section 2) so your domain cannot be forged to deceive customers.
• Quarantine: suspicious mail is held back. Release it only when you are sure the sender is legitimate.
• All connections to the server (web, IMAP, SMTP) are TLS-encrypted. Mailboxes are stored on Trivapost servers and backed up regularly, encrypted, to a separate location.

08Limits & policies

Acceptable use

• Allowed: staff business email and transactional email (OTP, password resets, transaction notices, invoices).
• Not allowed: bulk marketing, newsletters to large lists, purchased address lists, spam, phishing or fraudulent content.
• Violations or unusual sending spikes may lead to temporary sending restrictions to protect the server's reputation for every customer. We will contact your registered contact person.

Need a higher sending limit, more mailboxes or more quota? Contact [email protected].

09Troubleshooting

10Support

Email [email protected] from your registered contact address. To get help faster, include:

• The domain and the affected email address
• When it happened, with time zone (e.g. 14:05 UTC+7)
• The full error message (copied text, not only a screenshot)
• For spam or delivery issues: the full message headers (Show original in Gmail)

We will never ask for your password. Do not send passwords or 2FA codes to anyone.