> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ruber.me/llms.txt
> Use this file to discover all available pages before exploring further.
# Email endpoints
> Every host, port and DNS record needed to connect a mail client or move a domain onto Ruber — with the limits that apply and what to check when a connection fails.
Everything on this page is what the mail plane actually runs, not a template. If
a value here does not work, that is a bug in this page and
[we want to hear about it](https://ruber.me/contact).
## Connection settings
| | |
| ------------------ | -------------------------------------------- |
| **IMAP server** | `mx1.ruber.me` |
| **IMAP port** | `993` — SSL/TLS |
| **SMTP server** | `mx1.ruber.me` |
| **SMTP port** | `465` — SSL/TLS |
| **Username** | your full address, e.g. `you@yourdomain.com` |
| **Password** | your **mailbox** password |
| **Authentication** | normal password |
| Port | Protocol | Encryption | Who uses it |
| ----- | --------------- | ----------------------- | ---------------------------------------------------------- |
| `25` | SMTP | STARTTLS, opportunistic | Other mail servers delivering to you. **Not** for sending. |
| `465` | SMTP submission | Implicit TLS | Your mail client, sending |
| `993` | IMAP | Implicit TLS | Your mail client, reading |
Nothing else is open. There is no `587`, no plaintext IMAP on `143`, and no
POP3 on `110` or `995`.
**Submission is 465, not 587.** Most guides on the internet say 587 with
STARTTLS. Ruber does not listen on 587 — a client configured for it will sit
there and time out. Choose **SSL/TLS**, not STARTTLS, wherever your client
offers the choice.
465 uses implicit TLS: the connection is encrypted before anything is sent, so
there is no cleartext phase for an attacker to strip. RFC 8314 §3.3 prefers it
for exactly that reason.
### Your mailbox password is not your Ruber password
Two separate credentials, deliberately.
Signing into the Ruber web app proves nothing about a mailbox. Your account
password is for the dashboard; the **mailbox password** is what IMAP and SMTP
clients use, and the dashboard never sees it. Set or reset it under
**Settings → Mailboxes**.
**Private mailboxes cannot use a mail client.** Their contents are encrypted to
a key held by your browser, so there is nothing an IMAP client could decrypt.
Private is webmail only. Smart mailboxes work with any client.
### What the server enforces on send
You may only send as an address your account owns — a mailbox, or an alias that
delivers into one. This is checked by the mail server itself, not just the app,
so a client configured with someone else's `From` is refused at submission time
with a sender-login mismatch.
## Setting up a client
**Settings → Mailboxes → your address → Mailbox password.** This is the one
the client wants, not your account password.
Choose "Other" or "IMAP account" rather than letting the client guess.
Autodiscovery will look for `autoconfig.yourdomain.com` and
`_autodiscover._tcp`, find nothing, and often fall back to 587 — which does
not answer.
`mx1.ruber.me`, port `993`, **SSL/TLS**. Username is your full address.
`mx1.ruber.me`, port `465`, **SSL/TLS**. Authentication on, same username
and password as incoming.
It proves both directions at once. If it arrives, the account is correct.
### Client-specific notes
Add Account → **Other Mail Account**. Apple will fail to find the settings
automatically and then show the manual form — that is expected, continue
through it.
Under **Outgoing Mail Server**, make sure "Automatically manage connection
settings" is **off**, then set port `465` and TLS on. Left on, Apple retries
587 and reports the server as unavailable.
Advanced setup → **IMAP**. Outlook accepts the settings but sometimes stores
the outgoing port as 587 anyway; check under **Account settings → Server
settings → Outgoing mail** after adding it.
Set encryption to **SSL/TLS**, not "Auto".
Manual configuration. Thunderbird's autoconfig probe will suggest STARTTLS
on 587 — change both the port and the connection security before clicking
Done, or re-test and it will fail.
Add a **Other / IMAP** account, not a Gmail or Exchange one. Both platforms
hide the outgoing port until you tap through to Advanced or SMTP settings;
set 465 with SSL there.
## Bringing your own domain
Add the domain under **Settings → Domains** and publish these records at your
DNS provider. Ruber re-checks every fifteen minutes and the domain will not
accept mail until the records verify — that check is what stops somebody
claiming a domain they do not own.
| Purpose | Name | Type | Value | Priority | Needed for |
| --------- | -------------------- | ----- | --------------------------------------------------- | -------- | -------------- |
| Ownership | `_ruber-challenge` | TXT | `ruber-verify=` | | Verification |
| Receiving | `@` | MX | `mx1.ruber.me` | `10` | Receiving mail |
| SPF | `@` | TXT | `v=spf1 include:amazonses.com ~all` | | Sending |
| DKIM | `._domainkey` | CNAME | `.dkim.amazonses.com` | | Sending |
| DMARC | `_dmarc` | TXT | `v=DMARC1; p=quarantine; rua=mailto:dmarc@ruber.me` | | Recommended |
Your ownership token and your three DKIM tokens are generated per domain and
shown on the domain's page — the values above are the shape, not the literal
strings to paste.
**Three DKIM records, not one.** They are CNAMEs rather than TXT records, which
means the signing keys can be rotated without you touching DNS again. Publish
all three; DKIM will not validate with two.
**If you already have an SPF record, merge — do not add a second.** A domain
with two `v=spf1` TXT records fails SPF outright, which is worse than having
none. Add `include:amazonses.com` to the record you have, before its `~all` or
`-all`.
### Address format
A mailbox name may contain lowercase letters, digits, dots, hyphens and
underscores. It must start and end with a letter or digit, may not contain two
dots in a row, and is at most 64 characters.
Capitals are folded to lowercase. `+` is not allowed in a mailbox name.
## Limits
### Message size
| | |
| ----------------------- | --------------------------------------------------------- |
| Maximum message | **10 MB** (10,240,000 bytes), including encoding overhead |
| Attachments via webmail | **10 files, 8 MB total** |
| Malware scanning | messages above **25 MB** pass unscanned |
Attachments are base64-encoded in transit, which costs roughly a third in size —
a 7 MB file is about 9.4 MB on the wire. A message over the limit is refused
during the SMTP conversation, so the sender is told rather than left guessing.
### Sending rate
| Limit | Window | Scope |
| -------------- | -------------- | ------------- |
| 50 messages | per hour | per mailbox |
| 5 messages | per 10 seconds | per mailbox |
| 1,500 messages | per hour | platform-wide |
These are burst controls and are the same on every plan. Your **daily
allowance** is the plan's, and it is separate:
| Plan | Mailboxes | Domains | Storage | Sends per day |
| -------- | --------- | ------- | ------- | ------------- |
| Personal | 5 | 1 | 10 GB | 100 |
| Pro | 20 | 5 | 50 GB | 500 |
| Business | 100 | 25 | 100 GB | 2,000 |
The daily allowance resets at midnight UTC.
### Authentication throttling
After **five** failed password attempts, an address is locked out for a period
that doubles with each further failure, up to a minute. Successful sign-in
clears it.
**Repeated failures get your IP banned, not just throttled.** The mail host runs
fail2ban, and roughly six authentication failures will block the address you are
connecting from for a week — across all ports, including ones that were working.
The usual cause is a device left configured with an old password, retrying in
the background. If a working client suddenly cannot connect from one network,
this is the first thing to check.
## When something does not connect
Almost always port 587. Change the outgoing port to **465** and connection
security to **SSL/TLS**.
You are probably using your Ruber account password. The client wants the
**mailbox** password, set under Settings → Mailboxes.
Likely a fail2ban block from a stale client retrying. Wait, or connect from
another network to confirm, then fix the device holding the old password.
The certificate is issued for `mx1.ruber.me`. If your client is set to
`imap.yourdomain.com` or similar, it will not match — use `mx1.ruber.me` as
the server name.
Check SPF and DKIM verified on the domain's page. Sending before DKIM
validates is the common cause.
Check MX resolves to `mx1.ruber.me` and the domain shows verified. Mail is
refused for unverified domains rather than queued.