Email is the part of hosting customers notice most. A website can be slow for a minute and nobody complains; an invoice email that lands in spam, or a mailbox that stops receiving, generates a support ticket within the hour. For hosting providers, running email well is both a selling point and a constant source of work.
Unicorn Panel includes Hermes, its own mail suite, so email lives in the same panel as websites, databases and DNS. This guide explains what a hosting mail stack needs, how Hermes approaches it, and the practical steps that keep customer mail flowing and out of spam folders.
What a hosting mail stack has to do
A working mail setup for web hosting customers covers five jobs:
- Receive mail for customer domains over SMTP.
- Store and serve mail to customers' apps over IMAP, plus webmail in a browser.
- Send mail on customers' behalf through authenticated submission.
- Filter spam and viruses on the way in, and catch compromised accounts on the way out.
- Prove authenticity with SPF, DKIM and DMARC so other providers trust your mail.
Traditionally, that means stitching together several separate programs and keeping their configurations in sync.
Hermes: one mail server instead of four
Hermes replaces Postfix, Dovecot, rspamd and ClamAV with a single privilege-separated mail server written in C, handling SMTP, IMAP, anti-spam and antivirus in one suite. The documentation covers the setup in full. Roundcube webmail is bundled with the role.
Fewer moving parts means fewer things to patch, fewer configs to drift apart, and a much smaller memory footprint. That makes it practical to run mail even on modest Alpine Linux servers.
Mailboxes and routing
Hermes covers the everyday mail features customers expect. The email page has the full list; the essentials are:
- Mailboxes on any domain, on any host in your fleet, with a quota or none at all
- Aliases and forwarders, including forwarding to external addresses with or without keeping a copy
- Sub-addressing, so customers can hand out
name+tag@domainand filter on the tag - Catch-all per domain, rather than one server-wide setting
- Suspend without deleting, so a billing dispute never costs someone their mail
- Sieve rules, with a default set for everyone and per-user rules on top
- Sent and received sparklines per mailbox, so a mailbox that has gone quiet or suddenly busy stands out
Spam filtering you control per domain
Different addresses need different filtering. A support inbox should rarely lose a genuine customer message, while a contact-form address gets hammered by bots. Hermes lets you set a spam threshold per domain instead of one setting for the whole server, with allowlists at both domain and mailbox level.
Under the hood, Hermes scores each inbound message and takes one of three actions: deliver it, tag it with spam headers so a Sieve rule files it to Junk, or reject it outright. The checks you can enable include:
| Check | What it does |
|---|---|
| DNS blocklists (RBL) | Looks up the connecting IP in configured blocklists such as Spamhaus ZEN |
| URI blocklists | Checks domains in links inside the message body |
| Forward-confirmed reverse DNS | Adds to the score when the sender's PTR record does not resolve back to its IP |
| Bayesian filter | Learns from messages users move to Junk |
| Heuristic rules | Catches malformed headers, suspicious MIME and envelope mismatches |
| Upstream verdicts | Folds in a positive score from an upstream SpamAssassin or rspamd filter |
| SPF, DKIM, DMARC | Always evaluated and factored into the score |
Greylisting is available too, with a delay you choose. It temporarily defers mail from unproven senders; legitimate servers retry and get through, while most spam bots never do. Senders that pass SPF or DKIM, and allowlisted senders, skip greylisting entirely, so mail from large providers is not delayed.
One practical tip from the docs: query blocklists from your own recursive resolver or with a Spamhaus DQS key. Free public blocklist zones often refuse queries that arrive through large shared public resolvers.
Virus scanning without a memory-hungry daemon
Hermes scans attachments against ClamAV's official signature databases as hash signatures, without running the clamd daemon. The database loads once and is shared across listeners, so enabling scanning adds almost no extra memory. You choose to reject, quarantine or tag infected inbound mail, and outbound scanning always rejects infected messages so a compromised account cannot relay malware.
The documentation is upfront about the trade-off: hash-based scanning blocks exact known-bad files, while polymorphic and macro-based malware needs the full clamd engine.
Stopping compromised accounts
The biggest threat to your mail reputation is usually not inbound spam. It is a customer's password getting stolen and their mailbox being used to send thousands of spam messages, which can land your server's IP on blocklists.
Hermes handles this with outbound controls:
- Send limits per mailbox, in messages per hour and recipients per hour
- Outbound spam scanning in detect-only mode, scoring authenticated mail without blocking individual messages
- Auto-suspend when a mailbox sustains a burst of spammy messages, or exceeds its send limit by a multiplier you set
A mailbox that blows well past its limits is suspended rather than merely throttled, which stops the damage fast.
SPF, DKIM and DMARC, handled for you
Every domain gets its own DKIM signing key, generated automatically rather than shared across the server. If the domain's DNS is hosted on the panel, SPF and DMARC records are written into the zone for you too. That removes the most common reason new hosting customers' mail lands in spam: missing or broken authentication records. Running your own DNS makes this seamless; see our guide to private nameservers and authoritative DNS.
Deliverability checklist for web hosts
Software only gets you part of the way. For good deliverability from any mail server:
- Set reverse DNS (PTR) for each mail server IP to its mail hostname, through your server provider.
- Check your IPs are clean before putting mail on them, and choose providers with a good reputation for mail.
- Confirm port 25 is open. Many cloud providers restrict outbound port 25 by default and require a request to lift it.
- Publish SPF, DKIM and DMARC for every domain. Hermes and Heimdall do this for panel-managed domains.
- Set sensible send limits and enable auto-suspend to contain compromised accounts.
- Use a bulk provider for newsletters. Hermes is a mail server, not a bulk sender. For marketing campaigns or high-volume transactional mail, keep a provider built for it. Hermes can also route all outbound mail through a smarthost, requiring STARTTLS and verifying the relay's certificate before sending credentials.
Webmail, already signed in
Enable the mail role on a host and Roundcube webmail comes with it, with nothing extra to install or patch separately. Opening a mailbox from the panel lands the customer in Roundcube already signed in. Webmail for a mailbox on a Secondary server opens the same way as one on the Primary.
Branded mail for resellers
Each reseller can set their own mail hostname, used for IMAP and SMTP settings, webmail links and password-reset mail. One server can serve several reseller hostnames, each with its own certificate issued and renewed automatically. Customers never see your domain. Read more in how to start a white-label hosting reseller business.
Restoring mail without losing mail
Mailboxes back up on their own schedule, separately from websites. Restores merge by default: the backup's messages go back in, and everything received since stays where it is. You can restore a whole mailbox or just the folders you need, and passwords, quotas, aliases and forwarders are never touched. Our granular backup guide explains the full system.
Frequently asked questions
Do I need a separate mail server product? No. Hermes is a role you install from the panel on any server in your fleet.
Can I use Hermes for newsletters? It is not designed as a bulk sender. Use a dedicated provider for campaigns, or relay outbound mail through a smarthost.
Does it support DKIM, SPF and DMARC? Yes. DKIM keys are generated per domain, and SPF and DMARC records are written automatically when DNS is on the panel.
Which ports does the mail role use? 25, 143, 465, 587 and 993 over TCP.
Is email included on the free plan? Yes. Mailboxes are unlimited on every plan.
Bring email into the same panel as everything else
Hermes gives hosting providers a lean, integrated mail suite with per-domain control, strong outbound protection and restores that never lose new mail. Install Unicorn Panel free on two servers:
wget -qO- https://unicornpanel.com/install | shMore on Hermes, or try the demo. This is one piece of the multi-server platform described in our pillar guide.