Skip to main content
Everything on this page is what the mail plane actually runs, not a template. If a value here does not work, that is a bug in this page and we want to hear about it.

​
Connection settings

Submission is 465, not 587. Most guides on the internet say 587 with STARTTLS. Ruber does not listen on 587 — a client configured for it will sit there and time out. Choose SSL/TLS, not STARTTLS, wherever your client offers the choice.465 uses implicit TLS: the connection is encrypted before anything is sent, so there is no cleartext phase for an attacker to strip. RFC 8314 §3.3 prefers it for exactly that reason.

​
Your mailbox password is not your Ruber password

Two separate credentials, deliberately. Signing into the Ruber web app proves nothing about a mailbox. Your account password is for the dashboard; the mailbox password is what IMAP and SMTP clients use, and the dashboard never sees it. Set or reset it under Settings → Mailboxes.
Private mailboxes cannot use a mail client. Their contents are encrypted to a key held by your browser, so there is nothing an IMAP client could decrypt. Private is webmail only. Smart mailboxes work with any client.

​
What the server enforces on send

You may only send as an address your account owns — a mailbox, or an alias that delivers into one. This is checked by the mail server itself, not just the app, so a client configured with someone else’s From is refused at submission time with a sender-login mismatch.

​
Setting up a client

1

Set the mailbox password

Settings → Mailboxes → your address → Mailbox password. This is the one the client wants, not your account password.
2

Add the account manually

Choose “Other” or “IMAP account” rather than letting the client guess. Autodiscovery will look for autoconfig.yourdomain.com and _autodiscover._tcp, find nothing, and often fall back to 587 — which does not answer.
3

Enter the incoming server

mx1.ruber.me, port 993, SSL/TLS. Username is your full address.
4

Enter the outgoing server

mx1.ruber.me, port 465, SSL/TLS. Authentication on, same username and password as incoming.
5

Send one message to yourself

It proves both directions at once. If it arrives, the account is correct.

​
Client-specific notes

Add Account → Other Mail Account. Apple will fail to find the settings automatically and then show the manual form — that is expected, continue through it.Under Outgoing Mail Server, make sure “Automatically manage connection settings” is off, then set port 465 and TLS on. Left on, Apple retries 587 and reports the server as unavailable.

​
Bringing your own domain

Add the domain under Settings → Domains and publish these records at your DNS provider. Ruber re-checks every fifteen minutes and the domain will not accept mail until the records verify — that check is what stops somebody claiming a domain they do not own. Your ownership token and your three DKIM tokens are generated per domain and shown on the domain’s page — the values above are the shape, not the literal strings to paste.
Three DKIM records, not one. They are CNAMEs rather than TXT records, which means the signing keys can be rotated without you touching DNS again. Publish all three; DKIM will not validate with two.
If you already have an SPF record, merge — do not add a second. A domain with two v=spf1 TXT records fails SPF outright, which is worse than having none. Add include:amazonses.com to the record you have, before its ~all or -all.

​
Address format

A mailbox name may contain lowercase letters, digits, dots, hyphens and underscores. It must start and end with a letter or digit, may not contain two dots in a row, and is at most 64 characters. Capitals are folded to lowercase. + is not allowed in a mailbox name.

​
Limits

​
Message size

Attachments are base64-encoded in transit, which costs roughly a third in size — a 7 MB file is about 9.4 MB on the wire. A message over the limit is refused during the SMTP conversation, so the sender is told rather than left guessing.

​
Sending rate

These are burst controls and are the same on every plan. Your daily allowance is the plan’s, and it is separate: The daily allowance resets at midnight UTC.

​
Authentication throttling

After five failed password attempts, an address is locked out for a period that doubles with each further failure, up to a minute. Successful sign-in clears it.
Repeated failures get your IP banned, not just throttled. The mail host runs fail2ban, and roughly six authentication failures will block the address you are connecting from for a week — across all ports, including ones that were working.The usual cause is a device left configured with an old password, retrying in the background. If a working client suddenly cannot connect from one network, this is the first thing to check.

​
When something does not connect

Times out on send

Almost always port 587. Change the outgoing port to 465 and connection security to SSL/TLS.

Password rejected

You are probably using your Ruber account password. The client wants the mailbox password, set under Settings → Mailboxes.

Worked, now refuses everything

Likely a fail2ban block from a stale client retrying. Wait, or connect from another network to confirm, then fix the device holding the old password.

Certificate warning

The certificate is issued for mx1.ruber.me. If your client is set to imap.yourdomain.com or similar, it will not match — use mx1.ruber.me as the server name.

Mail sends but lands in spam

Check SPF and DKIM verified on the domain’s page. Sending before DKIM validates is the common cause.

Nothing arrives at all

Check MX resolves to mx1.ruber.me and the domain shows verified. Mail is refused for unverified domains rather than queued.