Discovery files (.well-known)
Mail apps, browsers and security researchers look for files at fixed paths. Zappocity serves these today:
| Path | What it is for |
|---|---|
/.well-known/jmap | JMAP session discovery (RFC 8620) |
/.well-known/caldav and /.well-known/carddav | Where calendar and contacts apps find your calendars and address books (RFC 6764); see Calendar and contacts apps |
/.well-known/autoconfig/mail/config-v1.1.xml and autoconfig.<domain>/mail/config-v1.1.xml | Mail-app setup for Thunderbird, Thunderbird for Android (K-9), Evolution and others. Answers only for hosted domains |
/.well-known/security.txt | How to report a security problem (RFC 9116). Served when the operator sets CORPSUITE_SECURITY_CONTACT |
/.well-known/webfinger | WebFinger (RFC 7033): for acct: addresses on hosted domains, the OpenID Connect issuer, so apps find where to sign in. Every address of a hosted domain gets the same answer, so it does not reveal who has a mailbox |
/.well-known/openid-configuration and /.well-known/oauth-authorization-server | Sign-in metadata for OpenID Connect and OAuth (RFC 8414) |
/.well-known/change-password | Sends password managers to where you change your password: the Zappocity account page on its host, webmail's settings elsewhere |
/.well-known/passkey-endpoints | Where passkeys are added and managed (the account page) |
POST /autodiscover/autodiscover.xml on autodiscover.<domain> | Outlook's mail setup: IMAP and SMTP settings, for hosted domains |
/robots.txt | Lets search engines index the homepage but not the APIs |
/.well-known/acme-challenge/ | Certificate validation, answered automatically |
Setting up a mail app
Add a CNAME for autoconfig.<your-domain> pointing at the Mailocity mail host (see Set up DNS for your domain). Then enter your email address and password in the app; it finds the IMAP and sending servers by itself.
MTA-STS policy
https://mta-sts.<domain>/.well-known/mta-sts.txt serves each hosted domain's MTA-STS policy, as set by its mtaStsMode and mtaStsMaxAge settings. Other host names get 404, and so does a domain whose mode is none. See MTA-STS.
Planned
- The IETF PACC mail configuration format, once its paths settle.
matrix/server,matrix/clientandmatrix/supporton each tenant domain (M3). See the chat plan in docs/IDEAS.md.apple-app-site-associationandassetlinks.jsonif mobile apps are built.
OpenPGP Web Key Directory
/.well-known/openpgpkey/<domain>/hu/<hash> on openpgpkey.<domain> (and /.well-known/openpgpkey/hu/<hash> on the domain itself) serve the public keys users publish, with the policy files. See OpenPGP.