---
name: mail-server-operations
description: Inspect, configure, and troubleshoot mail domains, SMTP delivery, IMAP access, mail queues, aliases, mailboxes, quotas, bounces, spam controls, TLS, MX, SPF, DKIM, DMARC, reverse DNS, transactional email, and self-hosted mail clients. Use for lnxr-mail, lunexor-mailtools, PBX notifications, account verification, deliverability incidents, domain onboarding, and controlled mailbox lifecycle operations.
compatibility: Read-only queue, DNS, mailbox-usage, and delivery-trace access is preferred. Sending, retrying, deleting, mailbox creation, alias changes, credential resets, and DNS modifications require explicit authorization.
license: Apache-2.0
---

# Mail server operations

Separate mail infrastructure operations from reading or sending personal messages. This skill governs servers, domains, routing and deliverability; it does not authorize access to mailbox contents.

## Domain onboarding

1. Identify the sending and receiving domains, mail hosts and authoritative DNS provider.
2. Verify MX, A/AAAA, PTR, SPF, DKIM selector, DMARC, TLS certificate and SMTP banner consistency.
3. Confirm relay restrictions, authentication methods, rate limits, abuse contacts and postmaster addresses.
4. Generate a DNS plan with current and desired values, TTLs and propagation checks.
5. Apply changes only after domain ownership and authorization are established.
6. Send controlled test messages to representative providers.
7. Inspect SMTP responses, headers, authentication results and bounce events.
8. Record the final domain health state.

## Incident workflow

- determine whether failure affects submission, queueing, transport, receiving, IMAP sync or client storage;
- trace one message using safe identifiers without exposing body content;
- inspect queue age, status codes, retry schedule and destination patterns;
- verify DNS, TLS, reputation, blocklists, rate limits and remote-provider responses;
- distinguish permanent bounces from temporary deferrals;
- use the smallest mitigation and verify subsequent delivery.

## Security rules

- Never expose mailbox passwords, OAuth refresh tokens, DKIM private keys, message bodies or full recipient lists.
- Do not create an open relay or broad unauthenticated submission rule.
- Do not disable TLS validation to hide certificate problems.
- Do not retry an entire queue without understanding the failure class and volume.
- Do not send messages through an MCP merely because the tool exists; require explicit recipients, subject, purpose and authorization.

## Mailbox lifecycle

For create, suspend, reset, alias, quota or delete operations, verify the immutable account identifier, owning domain, retention policy and active dependencies. Deletion requires backup or retention evidence and exact confirmation.

## Client engineering

For IMAP/SMTP clients, validate encrypted credential storage, folder mapping, UID validity, incremental sync, deduplication, offline state, attachment limits, threading, archive/trash semantics and mobile background constraints.

## Output

Return affected domain or mailbox identifiers, DNS and server state, delivery evidence, queue impact, security findings, proposed or completed changes, propagation expectations, verification messages and remaining deliverability risk.