Webmail

Webmail lets people read and send mail in a browser, with nothing to install. It works for accounts on your own domains and on shared domains such as free addresses.

It lives at https://<your-host>/mail, or at the root of its own host name (for example https://webmail.mailo.city) when the operator sets one. The Sign in button on the homepage always gets you there.

Signing in

Use your full email address and the password your administrator gave you (or chose at signup). Aliases and +tag addresses do not sign in; use the primary address.

Webmail is a plan feature (webmail). If your plan does not include it, signing in says so; mail apps over IMAP and SMTP may still work.

You stay signed in for up to 7 days, or until 24 hours pass without using it. Sign out from the button at the top right. Changing your password signs you out of webmail on every device, and so does an administrator suspending your account.

If you have several mailboxes, the picker at the top switches between them without signing in again. See Several mailboxes for one person.

After 10 wrong passwords for one address within 15 minutes, sign-in is paused for that address. Wait and try again; the same pause covers mail apps.

Finding your way around

Webmail is laid out like Zoho Mail:

The bar on the far left switches between Mail, Calendar, Contacts, Notes and Meetings (when your plan has them), with Help and Settings at the bottom, and Manage for people who run the team. On a phone it is a bar along the bottom. Notes can also stay open beside your mail (g p).
The tab strip above the messages starts with the app you are in. Messages you open in a tab of their own sit beside it (see Tabs).
At the top: your domain's logo (or Mailocity), the search box, light or dark, your mailbox picker and Sign out.

Webmail starts simple. Settings → General → Show advanced options adds Forums and Filters to the bar on the left, shows every message action as a button instead of under More, and shows the advanced settings (encryption, plus addressing, mailing lists, blocking rules, trusted image senders, calendar links and message buttons). It is kept in this browser.

Settings is in sections (General, Writing, Account and security, Addresses, Junk and blocking, Sharing, Mail apps and import, Filters and out of office, Keyboard shortcuts, and with advanced options Encryption); a card named below, such as Settings → Default From, is in one of them. Search settings at the top of Settings (or / there) finds a setting by name or by what it does: type signature, password, junk or keyboard, and choose a result to go straight to it. Search finds advanced settings too, and opens them even when advanced options are off.

Reading

The left column lists your folders with the number of unread messages (for Drafts, the number of drafts). On a phone, open it with the folder button at the top left.
The middle column lists the messages in the folder, newest first, 50 at a time; Load more shows older ones. Each sender has a round picture: their brand logo when it is verified (see Brand logos), otherwise their initials.
Search looks through the current folder: subjects, senders, recipients, the whole text of each message and attachment names. See Searching mail.
New mail appears within a few seconds without reloading the page, and the tab title shows the inbox's unread count. Desktop notifications are optional. See New mail without reloading.

Opening a message marks it read. Mark unread puts it back. Star flags it; mail apps show the same flag.

The message header and buttons

An open message starts with its header in a shaded panel of its own: the sender (name and address), the date on the right, then To, Cc, Bcc and Reply to, and links such as Add to contacts and Unsubscribe from this list. The message itself follows below the panel.

The buttons above a message are the everyday ones: Reply, Reply all and Forward, Archive and Delete, then Move to… and More (the … button). More holds the rest: Junk, Star, Mark unread, Snooze, Mute, Report spam, Report phishing, Block sender, Source and headers, Print, Open in tab and Open in new window. With Show advanced options on, they are all buttons, in one row: the groups that do not fit the width (the last ones first) go under More instead, and come back as the window or the message column widens. With Coloured icons on, the buttons' icons are coloured too; Archive, Delete, Junk and Not junk take their folders' colours. Point at a button to see what it does; screen readers read its name. To show each button's name beside its icon, turn on Settings → Message buttons → Show names on message buttons (an advanced option, kept in this browser).

Right-click a message in the list (or press the menu key) for Open in tab, Open in new window, Reply, Reply all, Forward, Mark as read or unread, Star, Archive, Move to Junk, Delete, and Mail from this sender or Mail with this subject, which narrow the list until you press Show all. The menu acts on the row's whole conversation, like the buttons.

Right-click a folder on the left (or press the menu key on it) for:

Open in new browser tab, with that folder showing.
Search in this folder: opens it and puts the cursor in the search box.
Mark all as read, with the number of unread messages beside it: every message in the folder, not only those on screen.
Empty Junk or Empty Trash (on those two only): deletes every message in it for good, after asking.
New folder, and for your own folders Rename and Delete folder (its messages go to Trash first).
Colour, icon and tags…: give the folder a colour of its own, one of a set of icons, and up to five tags. Folders with a tag are grouped under it below the standard folders (a folder with two tags is in both groups); click a group's name to fold it. Standard folders stay at the top. These are yours only, kept with your account and the same in every browser; mail apps and people you share the mailbox with do not see them.

Tabs

A message can open in a tab of its own, so you can keep it open while you go on reading: Open in tab in the right-click menu or under More, a double click on the message, or t. The tab shows the message across the whole width; the first tab goes back to the list as you left it. Close a tab with its ×, a middle click, or w. Up to 12 tabs stay open; they are kept until you close the browser tab. Open in new window opens the message in a browser window of its own.

Source and headers

Source and headers (the </> button above a message) shows the message as it arrived:

Headers: every header field, including the Received lines that trace its path between servers, Authentication-Results with its SPF, DKIM and DMARC results, and any spam scores. This is what a support desk usually asks for.
Full source: the whole raw message, headers and body, as plain text. Very large messages show their first 2 MB; download them for the rest.

Copy puts what is shown on the clipboard, and Download .eml saves the message as a file any mail app can open. Nothing in the source is run or loaded: it is shown as text. Back to message returns to the normal view.

Cc and Bcc

When writing, Cc / Bcc under the To field shows both fields. Bcc recipients get the message but nobody sees them: the Bcc line is taken out of every delivered copy and kept only in your Sent copy, where Bcc shows above the message.

HTML messages and remote images

Messages written in HTML are shown as their sender designed them, in a locked-down frame: scripts, forms and plugins never run, and links open in a new tab.

Images stored on other servers are not loaded. Senders often use them to learn when and where you opened a message, so webmail blocks them and says so above the message. Images sent inside the message (attached or inline) are not affected by this.

Press Load images to see them for that message. Webmail then fetches them through the server: the sender can tell the message was opened, but sees the server's address instead of yours, and never your browser or cookies. Only ordinary pictures (PNG, JPEG, GIF, WebP, AVIF, BMP, ICO) up to 10 MB are shown. Pictures used as backgrounds or in style sheets stay blocked. The choice is for that message only; the next message starts blocked again, unless you trust its sender.

Trusted senders

For senders you always want to see images from (your bank, a newsletter, Apple or Microsoft), choose Always from news@example.com or Always from example.com next to Load images. Their images then load at once, and the note above the message says why. A domain covers every address at exactly that domain (not its subdomains); an address covers its +tag versions too. See or remove them under Settings → Trusted senders for images, where you can also add one by hand.

So that a forged sender cannot use your list, images load at once only when the message is proven to come from that sender: it passed the sender domain's DMARC check, or it was sent by someone with a mailbox here. Mail that only claims the address still asks first, and nothing in Junk loads at once.

Writing and sending

Compose opens a new message. Reply, Reply all and Forward fill in the recipients, subject and quoted text; forwarding keeps the attachments.
Separate addresses with commas. You can write Name <name@example.com> or just the address.
From lists your address and your aliases. Replies start from the address the message was sent to when it is one of yours.
Attach adds files. Each message, attachments included, must fit your plan's message size limit.
Save draft keeps the message in Drafts. Open it from Drafts to carry on. Discard deletes the draft. While you write, the draft is also saved by itself every 15 seconds when something changed ("Saved 10:31").
Send waits 5 seconds with an Undo button, then puts the message in Sent and delivers it. Choose 0, 5, 10, 20 or 30 seconds under Settings → Writing (this browser only). The message is in Drafts while it waits.
Send later picks a time (later today, tomorrow morning, Monday morning, next week, or any date and time in the next year). The message waits in Drafts with a scheduled badge and is sent at that time, then moves to Sent. Open it from Drafts to see when, or Cancel sending to keep it as an ordinary draft you can edit again. Scheduled messages are sent by the server, so your browser can be closed.
Send puts the message in Sent and delivers it. If it cannot be sent (an unknown address on your own domain, a sending limit, a plan limit), you see why and the message stays in Drafts.

Blind copies (Bcc) are delivered without the Bcc line, so other recipients never see them. Your copy in Sent keeps it.

Mail sent from webmail goes through the same checks and limits as mail apps on ports 465 and 587: it can only come from your own addresses, it counts against your plan's sending limits, and mail to other domains is signed with your domain's DKIM key and queued. Mail-app sending (smtp_submission) does not need to be in your plan for webmail to send.

Organising

Archive moves a message to Archive, Junk to Junk, and Not junk back to the inbox.
Delete moves a message to Trash. Deleting from Trash removes it for good, and Empty in Trash removes everything there.
Move to… moves a message to any other folder. New folder in the left column adds one.
Several at once: tick the box at the start of each row, or, as in desktop mail apps, Ctrl-click (Cmd-click on a Mac) messages to add or remove them, and Shift-click one to select every message from the last one you picked (or the one open) down to it. The box at the top ticks every row shown. A bar then offers mark read or unread, star, archive, junk or not junk, delete and move, for all of them (whole conversations when they are grouped).
Drag and drop: drag a message, or the ticked ones, onto a folder on the left.
Your own folders can be renamed or deleted with the pencil and bin next to the folder's name above the list. Deleting a folder moves its messages to Trash first.
Block sender (on an open message) adds a filter that deletes their mail from now on, and moves the conversation to Trash. Undo it under Filters, where it is the rule "Blocked: …".
Unsubscribe from this list appears under the sender of mailing-list mail that offers it. The server unsubscribes you with one click when the list supports that (so the list never sees your browser), or opens an email or the list's page to do it. Use it only for mail you signed up for; for spam, use Junk or Block sender.
Report spam and Report phishing move a message to Junk and send a copy to your administrators.
Snooze (on an open message, or on ticked ones) hides mail until a time you pick. It moves to a Snoozed folder and comes back, unread, to the folder it came from at that time. Open it in Snoozed and choose Bring back now to wake it early.
Mute (on an open conversation) files new replies to it in Archive, already read, so a long thread stops filling your inbox. Unmute turns it back on. Muting applies to mail as it arrives, through either MX server.
Print prints just the open message.
Open next to an image or PDF attachment shows it in a new tab; other files download.
The bar at the bottom of the folder list shows how much of your storage you use.

Installing webmail as an app

Webmail can be installed like an app: in Chrome or Edge choose Install in the address bar (or the menu), on iPhone and iPad Share → Add to Home Screen, and on Android Add to Home screen. It opens in its own window with its own icon. The app keeps only webmail's own pages and scripts so it starts quickly; your mail is never stored on the device, so it still needs a connection.

Templates

In a message, Templates… → Save this message as a template keeps what you wrote (without your signature) in a Templates folder, named after the subject. Pick it from Templates… in any new message to insert it. Because templates are messages in a folder, they are the same in every browser and in mail apps; delete one there to remove it.

Team templates

A team can also keep templates for everyone on it: they are listed under Team in Templates…, the most used first. Picking one inserts it and gives a new message its subject.

Team admins, and members whose team role has Templates, add and change them in the team manager (Templates), or share the message they are writing with Templates… → Share this message with the team.

A team template is inserted with plain formatting only: bold, italics, lists, links and quotes are kept, and anything else (images, scripts, styles) is dropped. So nobody can slip something into a teammate's message through a template.

Keyboard shortcuts

Press ? to see them. They work whenever you are not typing in a field: j and k move through messages (in the list, a cursor), Enter opens, e archives, # deletes, v moves to a folder, z undoes the last move, c writes, Ctrl+Enter or ⌘+Enter sends, and g then i, t, d or a goes to a folder. Turn single-key shortcuts off under Settings → Keyboard shortcuts. Every key, also for the calendar and contacts, is in Keyboard shortcuts.

Light and dark

The half-circle button switches between light and dark. Webmail starts in your device's setting and remembers your choice in that browser.

Sizes and layout

To fit more mail on the screen, or make it easier to read:

Message list: the sliders button at the top of the message list (or Settings → General → Sizes and layout) switches between Comfortable (sender, subject and a preview line), Compact (no preview, less space) and One line (sender, subject and date side by side).
Text size: Small, Normal or Large, for all of webmail.
Column widths: drag the edge between the folders and the messages, or between the messages and the open message. Double-click an edge, or choose Usual column widths, to put it back. With the keyboard, Tab to an edge and use the left and right arrows (Shift for bigger steps, Home for the usual width).

These are kept in that browser, since each screen suits a different layout. On a phone the columns take the whole width and cannot be dragged.

Coloured icons

The apps down the left (Mail, Calendar, Contacts, Notes and the rest) and your folders show plain grey icons at first. Turn on Settings → General → Icons → Coloured icons to give each its own colour, so they are easier to tell apart at a glance. Each one's colour can be changed there with its colour box, and Reset puts the usual colour back; your own folders share one colour.

Your choice is kept with your account, so it follows you to every browser and device you sign in on, and stays yours in a mailbox shared with you. Nobody else sees it. Turning coloured icons off keeps your colours for the next time you turn them on.

For administrators and developers

Webmail is a client of the JMAP API at /jmap. It signs in through /api/mail/session (see api/webmail.yaml) and then sends the session cookie with a CSRF token instead of a password. Anything it does, a JMAP client can do with Basic authentication.
Writing formats and signatures are described in Writing mail. Names and signatures are JMAP Identity/set updates, stored per address.
Sending uses JMAP Identity/get, Email/set (create) and EmailSubmission/set, with onSuccessUpdateEmail to move the message from Drafts to Sent. A submission with sendAt (a time in the next year), or the SMTP HOLDUNTIL / HOLDFOR parameters in envelope.mailFrom.parameters (RFC 4865, advertised as maxDelayedSend), is kept with undoStatus: "pending" and sent at that time, when its onSuccessUpdateEmail patch is applied. EmailSubmission/get and /query list pending ones; set undoStatus to "canceled" (or destroy it) to cancel. Others are sent at once and not kept.
"REQUIRETLS": null in envelope.mailFrom.parameters (RFC 8689, advertised in submissionExtensions) asks that the message travel only over TLS with verified certificates, or come back undelivered. It cannot be combined with a later send time yet.
Snooze and mute are under /api/mail/later, /api/mail/snooze and /api/mail/mute (see api/webmail.yaml).
Email/set create takes from, to, cc, bcc, replyTo, subject, sentAt, inReplyTo, references, one text/plain and/or one text/html body from bodyValues, and attachments by blobId (uploaded blobs, or parts of stored messages). Other properties are refused; build anything richer yourself and use Email/import.
Email/query filters by inMailbox and text.
Its own host name. In the admin panel under Settings → Host names (or PATCH /v1/settings with webmailHost), set a name such as webmail.mailo.city. Before saving, point that name's DNS (A and AAAA, or a CNAME) at this server. Webmail is then served at the root of that host, and /mail on any other host (including the homepage's Sign in button) redirects there. With automatic certificates, one is issued for the name at its first visit; with a fixed certificate (CORPSUITE_TLS_CERT), the name must already be on it. JMAP and the sign-in API answer on every host, so mail apps are unaffected. The name must differ from the server's own host name, which keeps the homepage. Clear the field to put webmail back at /mail. A change takes effect at once on the server that saved it, and within 30 seconds on others.
Webmail on your customers' own host names (for example mail.customer.com) comes with the custom-domain certificates in M1.

Not there yet

See Contacts for address books and completion. Reading mail without a connection is not offered: the installed app keeps no mail on the device.