MailForward

Administrator accounts

Only the primary administrator can manage these accounts. The primary account is protected from editing, disabling and deletion here. Assign an access profile per administrator. Read-only allows viewing; none hides the area and denies API access. Only the primary administrator can change accounts or permissions. Existing secondary administrators retain their earlier access until edited; new accounts start with no access.

Create administrator

Emergency mail controls

Shared alerts for all administrators. Refreshes every 30 seconds while this page is open. No emails are sent.

Incidents

Clear hides an active alert for one hour; it reopens if the problem persists. Investigate later keeps it in the shared investigation list. Three healthy samples resolve an active condition. Historical actions are retained.

Unverified account retention

Delete pending self-registered accounts after a chosen number of days from creation. Administrator-created accounts, verified accounts, accounts that have signed in and accounts with domains are excluded. Deletions are permanent and audited.

Default: off, 24 hours (1 day). Once enabled, eligible accounts are removed in batches of up to 25 per minute by the monitoring worker. Automatic deletion is disabled after any restore until reviewed.

Bot protection · ALTCHA

Self-hosted proof of work protects sign-in and registration. No third-party account is needed. Changes apply to the next submission. Existing sessions continue.

Browsers need JavaScript and HTTPS. Authentication rate limits remain active with either switch off. SSH recovery instructions are in the operator guide.

System Security

Automatically sign out inactive sessions. Keyboard, pointer and touch activity keeps an authenticated session active; background status polling does not. Limits also apply on the server. Changes apply to existing sessions on their next authenticated request.

Log Archives

Archive audit and email records as open JSON Lines, and original Postfix logs as text. Files are gzip-compressed and stored in a private Backblaze B2 or Cloudflare R2 Standard bucket. Mail queues and message bodies are excluded.

Save settings before testing. Re-enter the administrator password above to test or run. Connection testing explicitly writes and verifies a small test object, even while automatic archiving is off. Archive now requires archiving to be enabled.

Pending files use a private, bounded 256 MiB local buffer. Upload failures retain data and show an error. The local server is still a single point of loss until upload succeeds; choose a suitable period and monitor errors. Re-enabling seeds retained database records again; analysts should deduplicate structured records by source identity and record version.