Notification SMTP is separate from hosted mail
EPAdmin requires notifications:manage for /v1/mail-notification-smtp. This configures Panel notifications and recovery delivery, not a customer's Postfix/Dovecot service or mailbox password. Saving a basic installation contact does not verify or subscribe it.
Create a candidate
Choose either the protected registered local relay or external SMTP. The local option is available only when the installation explicitly registered its fixed loopback relay; it uses no mailbox password. External SMTP permits public destinations on port 587 with required STARTTLS or port 465 with implicit TLS, including certificate/hostname verification. Enter its username, private password/token and envelope sender. The UI sends a new write-only candidate to POST /v1/mail-notification-smtp/candidates. Never paste secrets into a ticket, URL or ordinary installation metadata. Candidate creation alone does not replace the active delivery configuration.
Select an authorized test recipient and explicitly run /candidates/{candidate_id}/test. The test performs bounded connection, TLS/authentication and recipient sending; it is a real email side effect, so use an inbox you control and check spam. Confirm actual receipt before selecting /activate for that tested candidate. A server accepting a message is not evidence of inbox delivery.
Verify your recovery address
In your own Security view, use /v1/mail-recovery-address to inspect status or begin verification and /confirm to complete it using the delivered code/token. This is identity-owned and grants no ability to edit another person's address or SMTP configuration. Check pending/verified state after completion. An account profile contact and installation administrator contact remain separate fields.
Request account recovery
The login page offers configured SMTP recovery or a one-use local recovery grant issued through the protected operator process. Use the correct Admin/Customer account login and then complete the supported recovery form with a new password. A request response alone does not prove email exists or was delivered; public responses must not become an account enumeration tool.
Verify and troubleshoot
Check SMTP hostname/TLS identity, port reachability, authentication, sender authorization, recipient ownership and actual inbox receipt. Keep the previous working candidate until the supported activation succeeds. On timeout, inspect candidate and delivery state before another send. If SMTP is unconfigured, use the authorized local recovery procedure; do not claim public recovery mail works, disable sign-in MFA, or expose private grant material to support.