nextxch Documentation
Cleanly organized reference manual covering installation, DNS, security, groupware, CLI automation, and operations: every focused guide documents exact Default Values and production Best Practices.
Getting Started
From a fresh Windows, Linux, or Docker host to the perimeter port matrix.
Guided Installation (8 Steps)
Interactive pre-flight checklist, Windows (.msi), Linux (systemd) & Docker tutorials plus symptom troubleshooting.
Architecture & Port Matrix
nextxch unifies ESMTP, IMAP4rev2, JMAP, CalDAV/CardDAV, WBXML Mobile Push, ManageSieve, Webmail PWA, and GoBD WORM archiving in a single native pro...
Networking, DNS & Crypto
10/10 deliverability with FCrDNS/PTR, Dual-DKIM, IPv6, pfSense & Let's Encrypt DANE.
DNS (10/10), PTR & Autodiscover
Major receivers such as Gmail, Microsoft 365, and Deutsche Telekom evaluate sender reputation heavily on DNS alignment. Under TLS & DNS Advisor (#p...
Dual-Stack IPv6 & Happy-Eyeballs
Starting in v1.2.4, all protocol listeners (ESMTP 25/465/587, IMAP 143/993, ManageSieve 4190) and Kestrel bind in native Dual-Stack mode ([::] with...
pfSense, OPNsense & SSL Gateways
Many enterprise deployments run their web server and nextxch in internal VLANs behind a shared perimeter firewall (pfSense, OPNsense, Sophos) or an...
Let's Encrypt, MTA-STS, DANE & BIMI
nextxch automates X.509 certificate issuance and renewal via Let's Encrypt ACME v2, hot-swapping renewed certificates in 0 ms across HTTPS, SMTPS,...
Mail Transport & Defense
SMTP queue, live MX diagnostics, SpamGuard ML, greylisting, ClamAV & Fail2Ban.
SMTP Queue, Smart-Host & MX Tester
The outbound delivery engine resolves MX records, enforces MTA-STS and DANE TLSA policies, supports RFC 7435 opportunistic STARTTLS for shared-host...
SpamGuard, Greylisting & ClamAV
nextxch's inbound defense combines protocol-level checks (SPF, DKIM, DMARC, FCrDNS, DNSBL, Smart Greylisting) with MIME heuristics, an online FTRL...
Reputation Shield, ESMTP Limits & Fail2Ban
Two threats face every internet-facing mail server: external credential-stuffing bots and damaged outbound IP/domain reputation (caused by repeated...
Clients, Groupware & CLI
Messenger-safe iPhone setup, Outlook-style Calendar & Contacts, API keys & CLI.
iPhone, Mobile & WhatsApp Setup
Users should be able to provision Mail, Calendar, Contacts, and Notes on iOS and macOS in under 30 seconds without typing ports or exposing their m...
Webmail, Calendar (CalDAV) & Contacts
Unlike protocol-only mail backends, nextxch ships with a fast, installable Webmail PWA (/mail/) featuring a full Outlook-style Calendar (Month, Wee...
nextxch-cli: Commands, Queries & IaC
With nextxch-cli, you manage domains, mailboxes, distribution lists, aliases, scoped API keys, outbound SMTP routes (incl. TLS overrides), IP warmi...
API & CLI Object Schema (All Fields)
This reference documents every JSON property, data type, enum value, default setting, and minimum RBAC role across all 12 management objects (/api/...
API Keys, Send API & SSO
Web apps, ticketing tools, ERP systems, and CI/CD pipelines should never share human mailbox passwords. Under API Keys, SSO & Rules (#pApiAuth), mi...
Compliance, Storage & Ops
Message Trace, GoBD WORM archive, SQLite / SQL Server / PostgreSQL 18 & updates.
Message Trace & GoBD WORM Archive
When a customer asks 'Where is our invoice?', you need an instant factual answer. Message Trace (#pMessageTrace) records exact timestamps, remote I...
Storage Engines, Cluster & Updates
nextxch cleanly separates structured metadata and full-text indexes from SHA-256 deduplicated, Zstandard-compressed MIME blobs (-62% disk footprint...
Quick Reference: The 5 Required Inbound Ports
Additionally, outbound TCP Port 25 must be open to the internet for direct MX delivery.
TCP 25ESMTP MX Inbound & OutboundTCP 443HTTPS: Webmail, Admin, DAV, PushTCP 465SMTPS Client Submission (TLS)TCP 587Submission (STARTTLS)TCP 993IMAPS Mailbox & IDLE PushFrequently Asked Operational Questions
Which firewall ports are strictly required for nextxch?
Full mail, Webmail PWA, Mobile Push, and CalDAV/CardDAV operation requires 5 inbound TCP ports: 25 (ESMTP MX inbound), 443 (HTTPS for Webmail, Admin, JMAP, CalDAV/CardDAV & Mobile Push), 465 (SMTPS implicit TLS), 587 (Submission STARTTLS), and 993 (IMAPS). Optional ports are 80 (Let's Encrypt HTTP-01), 143 (IMAP STARTTLS), and 4190 (ManageSieve), plus outbound TCP port 25 to the internet.
Why can an external port check time out when both servers sit behind the same pfSense or SSL gateway?
When a web server and mail server share a firewall (such as pfSense, OPNsense, or HAProxy) without Hairpin NAT (NAT Reflection), packets addressed from inside the gateway to your own public WAN IP are dropped. Starting in v1.2.4, nextxch automatically detects co-hosted gateway topologies via split-path probing. For LAN clients, configuring Split-DNS host overrides or Pure NAT Reflection is recommended.
How do I safely share an iPhone or smartphone setup profile via WhatsApp or Microsoft Teams?
In Accounts & Lists -> Device Setup inside /admin/ (or inside Webmail settings), nextxch generates a 24-hour setup page link (/onboarding/setup/{token}) backed by a dedicated per-device App Password. Preview crawlers from WhatsApp, Teams, Telegram, or Slack never consume the token, and in-app WebViews display a clean Safari handoff prompt so iOS installs the signed .mobileconfig profile cleanly.
What are the recommended SpamGuard thresholds for production?
Keep JunkThreshold at 4.5 (routes suspicious mail to Junk) and RejectThreshold at 9.0 (hard 550 SMTP reject for clear spam), paired with Smart Greylisting (240 seconds on IPv4 /24 and IPv6 /64 prefixes). Legitimate MTAs pass greylisting automatically on retry and are cached for 30 days, preventing false-positive data loss.
Which database engine should I pick: SQLite WAL, Microsoft SQL Server, or PostgreSQL 18?
Up to ~250 active mailboxes on a single host, embedded SQLite WAL delivers sub-millisecond reads with zero DBA maintenance. Windows shops with existing Microsoft SQL Server (2019-2025, Express, or Azure SQL) get native multi-node clustering and search out of the box, while Linux high-availability clusters benefit from PostgreSQL 18 LISTEN/NOTIFY.