What is MxCentral for iRedMail?

MxCentral is a Laravel-based admin panel for existing iRedMail SQL installations. It manages the iRedMail databases and selected service configuration points without replacing the underlying mail stack.

Which iRedMail areas can MxCentral manage?

MxCentral manages domains, users, aliases, mailing lists, admin ownership, quarantine, throttling, white and blacklists, DKIM, DNS checks, SOGo branding, mail metadata, exports, and optional Fail2ban unban actions.

Does MxCentral replace SOGo or the mail server?

No. MxCentral is an admin control panel for an existing iRedMail host. It links to SOGo for webmail and keeps Postfix, Dovecot, Amavisd, iRedAPD, and the existing iRedMail databases in place.

How can operators test mail settings after changes?

Operators can use MXToolbox to send a real test message to a one-time recipient address and inspect SPF, DKIM, DMARC, BIMI, DNS trace, MIME structure, safe HTML preview, raw source redaction, and SMTP evidence.

MxCentral for iRedMail

Admin portal

Manage the iRedMail pieces admins touch every week.

MxCentral works with the existing iRedMail databases directly: vmail for accounts and domains, iredadmin for sessions, settings, audit logs, and deleted mailbox path logs, amavisd for quarantine and policy data, iredapd for throttling, and optional fail2ban integration for blocked IPs.

View feature tour

Domains and DNS

Create domains, tune limits and transport, enable Backup MX, manage alias domains, configure catch-all destinations, and run MX, SPF, DKIM, and DMARC checks from the domain screen.

Users and access

Create mailboxes, update quota and passwords, toggle per-user services, delete users with mailbox path logging, assign domain admins, and keep mailbox self-service separate from global controls.

Aliases and lists

Manage aliases and mailing lists with members, owners, policies, descriptions, max message sizes, and active status using the same control surface as domains and users.

Quarantine workflow

View quarantined messages, inspect raw mail safely, delete selected messages, send Amavisd release requests, and run scheduled recipient notifications for newly quarantined mail.

Policy controls

Set throttling, manage Amavisd white and blacklists, allow selected sender mismatch accounts, approve unauthenticated senders or networks, and silently discard selected recipients through Postfix maps.

Operational visibility

Search accounts, review sent and received metadata, inspect global-admin audit logs, export managed accounts and admin statistics, inspect setup health, expose JSON read surfaces, and optionally unban Fail2ban IPs.

Built for real hosts

Local auth, narrow server permissions, visible file ownership.

The app does not need to own the whole server. It uses local iRedMail accounts for login, applies global-admin/domain-admin/self-service scoping, and brokers privileged service changes through a root-owned helper with fixed paths and command arrays.

DKIM management

Generate per-domain DKIM keys, write a marked MxCentral block into the Amavisd config, keep private keys on disk, show DNS records, and test the result.

System settings

Edit iRedAPD, Postfix, and SOGo-related settings through global-only screens, while root-owned helper operations validate managed blocks, apply related writes under one lock, and record applied or failed state.

SOGo connection

Link users to webmail and optionally manage the SOGo root page logo override so the webmail entry point matches the hosted brand.

Deployment model

Mount under a subdirectory such as /mxcentral, keep the remote .env on the server, and deploy without overwriting live storage or host-specific credentials.

Companion tool

Use MXToolbox to test the server from the outside.

After changing DNS, DKIM, SPF, DMARC, policy, or delivery settings in MxCentral, send a real message to MXToolbox. It creates an anonymous token session, gives you a one-time recipient address, waits for the message, and builds a report from the captured email and related DNS evidence.

SPF DKIM DMARC BIMI DNS trace MIME structure Safe HTML preview SMTP evidence

Open MXToolbox

MXToolbox email inspection preview — Anonymous email inspection with token-based reports and short-retention evidence.

Install path

Add a focused control panel to an existing iRedMail server.

MxCentral is deployed from a workstation checkout to the mail server. Configure an ignored per-server profile, keep the production .env and SQL grants outside the repository, run make deploy, then wire in least-privilege database users, the root privileged helper, nginx, cron, and production checks.

Read install guide Open GitHub

paul@mxcentral.net:~$ git clone git@github.com:TerminalAddict/mxcentral-for-iRedmail.git
paul@mxcentral.net:~$ cd mxcentral-for-iRedmail

paul@mxcentral.net:~/mxcentral-for-iRedmail$ cat > Makefile.local <<'EOF'
HOSTNAME := mail
DEPLOY_HOST := $(HOSTNAME)
DEPLOY_PATH := /opt/www/mxcentral-for-iRedmail
APP_USER := www-data
APP_GROUP := www-data
SERVER_ENV_FILE := $(HOME)/.config/mxcentral/$(HOSTNAME).env
DATABASE_GRANTS_FILE := $(HOME)/.config/mxcentral/$(HOSTNAME).sql
EOF

paul@mxcentral.net:~/mxcentral-for-iRedmail$ make deploy

Deploy targetThe current deploy creates runtime directories, rsyncs the app, installs the root-owned helper and sudo policy, locks application code to root, and runs production health checks.

Database accessUse docs/database-grants.sql as the grant template, create separate users for vmail, iredadmin, amavisd, iredapd, and fail2ban, including SELECT, INSERT on iredadmin.log.

Privileged changesPostfix, Amavisd, DKIM, iRedAPD, SOGo, service reloads, postmap, and Fail2ban actions are brokered through /usr/local/sbin/mxcentral-privileged.