All help articles

Passwords: changing, recovery address and resets

Every Mailocity account has one password, used by webmail and by mail apps (IMAP, SMTP submission, JMAP, ManageSieve). This article covers changing it yourself, the recovery address that lets you reset a forgotten password, and what administrators can do.

Change your password

In webmail, open Settings (the gear at the top right), then Password. Give your current password and the new one twice. A password is 12 to 1,024 characters; a few unrelated words make a good one.

When it changes:

• Every other browser is signed out, and mail apps stop working within about 15 seconds until you give them the new password.
• This browser stays signed in.
• If you have a recovery address, it gets a notice saying the password was changed, so you hear about it if it was not you.

Set a recovery address

A recovery address is an address outside this account, such as a personal one, where Mailocity can send a reset link if you forget your password. Without one, only an administrator can set a new password for you.

In webmail Settings, under Recovery address, enter the address and your current password, then Save. We send a confirmation link to that address; it takes over only once you open the link (within 24 hours). Until then any earlier recovery address keeps working. To remove the address, leave the field empty and save with your password.

Webmail shows the current recovery address at the top of that section.

Forgot your password?

1. On the webmail sign-in page, choose Forgot your password?
2. Enter your email address and press Send a reset link.
3. Open the link in the message that arrives at your recovery address, and choose a new password.

The answer on screen is the same whether or not the account exists or has a recovery address, so nobody can use the page to find out who has an account. The link:

• works once, for an hour;
• goes only to the confirmed recovery address, never to the account itself;
• stops working if the password changes another way, the recovery address changes, or the account is suspended.

Every device is signed out after a reset; sign in with the new password. The recovery address gets a notice that the password was reset.

At most 3 reset links, and 3 confirmation links, go to an account in an hour, and each source address may ask 10 times an hour.

The messages come from no-reply@ your own domain and are signed with your domain's DKIM key, so they pass SPF, DKIM and DMARC checks once your DNS is set up. Check the spam folder if one does not arrive.

For administrators

• Set a new password for a user in the admin panel (tenant page, Users, Edit) or with PATCH /v1/tenants/{id}/accounts/{accountId} and {"password": "..."}. This also ends the user's sessions and any reset links still waiting.
• Set or clear a user's recovery address in the same place, or with {"recoveryEmail": "name@example.net"} ("" removes it). An address set by an administrator counts as confirmed at once.
• recoveryEmail is returned with each account.
• Generate beside any password field makes a strong random password (20 characters) and shows it, with Copy, so you can pass it on.
• Temporary (ticked by default when you set a user's password): the user signs in to webmail and must choose a new password before anything else; mail apps refuse the temporary one with "Your password is temporary: sign in to webmail and choose a new one first". In the API: "temporary": true. Any password set without it, including the user's own new one, is not temporary.
• Email the password sends it to the user's recovery address (or, when adding a user, to the address you give, which becomes their recovery address): "emailPassword": true or "emailTo": "...". An emailed password is always temporary, so it is useless once used, and it is never sent to the mailbox it opens. Notice mail must be set up.
• Temporary and emailed passwords are for mailboxes; staff and Zappocity account passwords get the generator only.

The webmail endpoints are in api/webmail.yaml: POST /api/mail/password, POST /api/mail/recovery, POST /api/mail/recovery/verify, POST /api/mail/password-reset and POST /api/mail/password-reset/confirm.

How the links are protected

• The token is 256 random bits, only its SHA-256 is stored, and it sits in the URL fragment (#reset=...), which browsers do not send to servers or in a Referer. Webmail removes it from the address bar as soon as the page opens.
• The link's host comes from the platform settings (the webmail host, or the public URL), never from the request, so a forged Host header cannot redirect it.
• Changing the password or recovery address needs the current password and the session's CSRF token; failed attempts share the sign-in throttle.

Not covered yet: two-factor sign-in (planned next), and resetting a forgotten password for an account without a recovery address other than through an administrator.