Understand the current boundary
EmailaPanel implements Postfix/Dovecot mail models and account-owned mail tools, but repository fixtures do not certify a working public mail service. The baseline installer binds SMTP, submission and IMAPS to loopback. A configured public address used for diagnostics does not itself open a listener.
Public listeners, delivery/relay controls, DNS/PTR, signing, filtering, quotas and real-client acceptance must be reviewed on the test server before a hosting pilot. Do not publish customer mailbox settings merely because a configuration form exists.
Configure within the owning account
Use the account's Email workspace and its actual capability state. A local mail domain needs the corresponding owned DNS zone before mailboxes are created; a remote mail domain is not a local mailbox destination. Supply new mailbox passwords privately and use supported reset controls rather than asking the panel to reveal an existing password.
Check aliases, forwarders, catch-all and autoresponder rules for the correct domain. Review the impact of catch-all routing and externally forwarding mail before enabling it.
Test actual delivery
Use only the hostname, ports, TLS mode and capabilities reported by the reviewed service boundary. Verify a real client login, allowed and denied recipients/senders, inbound and outbound delivery, queue state and inbox receipt. Local configuration success does not prove deliverability.
Panel identity recovery uses its protected local grant process; do not assume a working SMTP password-recovery service is included.