Load the owned domain tools
Open the selected mail domain's tools with an active eligible account and current permissions. GET /v1/mail-domains/{id}/tools returns domain/account identity, revision, status, configuration and DNS requirements. Saving uses the same route with the reviewed revision and complete structured configuration. Do not edit a stale record or borrow another account's mailbox ID.
Forwarders and aliases
Each route includes source_local_part, one or more destinations and enabled. Review whether the destination is local or external and test for loops. Catch-all is a separate enabled flag and destinations list for otherwise unmatched addresses. An optional catch-all increases accepted recipient scope; verify unintended/random recipients and abuse implications before enabling.
Autoresponders
Choose the local address/mailbox, enabled state, subject, plain-text response, optional start/end times and repeat interval in seconds. The stored shape is local_part, enabled, subject, text_body, optional start_at/end_at and interval_seconds. Use plain text, the correct timezone context and a bounded schedule. Test with an authorized external sender and verify repeat throttling rather than assuming one UI save sends a response.
Structured mail filters
A filter carries id, mailbox_id, priority, enabled state, a match {field, operator, value} and an action {kind, destination?, folder?}. Supported fields are from, to, subject; operators are contains, equals, starts_with, ends_with; actions are fileinto, keep, redirect, discard. Raw Sieve, shell commands and executable actions are rejected. Dovecot Sieve capability is required before filters/autoresponders can be changed. Review rule order, mailbox association, folder and forward destination. Global Email Filters means the domain-owned supported tool context; it is not a global Postfix administrator editor or arbitrary Sieve script runner.
Spam policy
Domain spam policy records enabled state, permissive, standard or aggressive filtering level, quarantine and antivirus choice. Rspamd and optional antivirus capabilities are checked separately; missing service/memory/package qualification keeps those controls disabled. Availability depends on the registered mail/filtering services, not a checkbox alone. Confirm the read-back and actual allowed/blocked/quarantined test messages before promising protection. Global mail-server spam-default tuning is not implemented.
Verify and recover
Reload the tools, compare the saved revision and test one change at a time using owned addresses. Preserve a sanitized prior configuration for rollback through the supported editor. If the revision changed, reload before resubmitting. On service capability or runtime failure, retain the task/correlation reference and inspect the real mail boundary; do not clear data or disable confinement. Mailing Lists is explicitly unavailable, and mail-filter configuration does not replace TLS, DNS authentication or relay restrictions.