APP_PORT=3025
APP_BASE_URL=https://mailhub.example.com
ADMIN_USER=admin
ADMIN_EMAIL=admin@example.com
ADMIN_PASSWORD=change-this-admin-password
SESSION_SECRET=change-this-long-random-session-secret

# Legacy admin send token. New users should generate their own token in the web UI.
API_TOKEN=change-this-legacy-api-token
SUBMISSION_ENABLED=true
SUBMISSION_HOST=smtp.mailhub.example.com
SUBMISSION_BIND=0.0.0.0
SUBMISSION_PORTS=25:smtp,587:smtp,465:smtps,2525:smtp
SUBMISSION_ALT_PORT=2525
SUBMISSION_ALLOW_INSECURE_AUTH=false
SUBMISSION_TLS_CERT=/certs/mailhub.example.com.crt
SUBMISSION_TLS_KEY=/certs/mailhub.example.com.key
SUBMISSION_USERNAME=change-this-smtp-user
SUBMISSION_PASSWORD=change-this-smtp-password

IMAP_ENABLED=true
IMAP_BIND=0.0.0.0
IMAP_PORTS=143:imap,993:imaps
POP3_ENABLED=true
POP3_BIND=0.0.0.0
POP3_PORTS=110:pop3,995:pop3s
MAIL_ACCESS_ALLOW_INSECURE_AUTH=false

# Default outbound identity used in SPF, HELO, and Postfix myhostname.
MAIL_HOSTNAME=smtp.mailhub.example.com
SENDING_IP=203.0.113.10

# Extra SPF mechanisms to preserve coexistence with third-party senders.
# Examples: include:spf.mailjet.com include:_netblocks.m.feishu.cn
DEFAULT_SPF_MECHANISMS=
DNS_RESOLVERS=1.1.1.1,8.8.8.8
DNS_AUTO_CHECK_ENABLED=true
DNS_AUTO_CHECK_INTERVAL_MS=60000
DNS_AUTO_CHECK_LIMIT=25

# SMTP service used by the web API. In docker-compose this is the internal Postfix service.
SMTP_HOST=postfix
SMTP_PORT=25
SMTP_HELO=smtp.mailhub.example.com
SEND_REQUIRES_VERIFIED=false
DELIVERY_TRACKING_ENABLED=true
POSTFIX_LOG_POLL_INTERVAL_MS=5000

# Engagement tracking uses opaque public links and a stable encryption key.
TRACKING_SECRET=change-this-separate-long-random-tracking-secret
ENGAGEMENT_TRACKING_ENABLED=false
TRACKING_RETENTION_DAYS=180
TRUST_PROXY=true

# Optional deliverability headers. One-click should only be enabled when the URL accepts compliant unsubscribe POSTs.
LIST_UNSUBSCRIBE_MAILTO=
LIST_UNSUBSCRIBE_URL=
LIST_UNSUBSCRIBE_POST_ENABLED=false
FEEDBACK_ID_ENABLED=true
REPORT_ABUSE_TO=
CSA_COMPLAINTS_TO=

# Optional bounce envelope sender. Keep disabled until this mailbox/domain receives and processes bounces.
BOUNCE_ADDRESS=
BOUNCE_ENVELOPE_ENABLED=false

# DMARC defaults.
DMARC_POLICY=none
DMARC_RUA=