Webmail Access

Webmail Access opens Roundcube for an account mailbox. SHM supports a panel sign-in handoff, the friendly webmail subdomain, compatibility paths and ports, and direct mailbox-password login when policy allows it.

Where to find it: Account > Email Accounts > Email Accounts, then use Open Webmail for the required mailbox. Direct addresses are listed below.

Available to: The account user for their own mailboxes, plus root or the owning reseller inside that account. Direct Roundcube login is available to the mailbox owner and is still subject to mailbox status and security policy.

What this page does

Use this page to choose the correct way into Roundcube and to understand which credential and security checks apply. Opening Webmail does not create a mailbox or repair DNS; it signs in to an existing mailbox whose mail services are available.

Before you start

Exim, Dovecot, and Roundcube must be installed and healthy. The mailbox must exist and its login must not be suspended. For the clean webmail.example.com address, that hostname must resolve to this SHM server and the active certificate must cover it.

Every supported access method

Method	Address or action	What happens	Recommended use
Panel handoff	Email Accounts > Open Webmail	SHM verifies the selected account and mailbox, creates a signed time-limited SSO handoff, and opens Roundcube in a new tab. No mailbox password is copied into the URL.	Best choice when you are already signed in to SHM.
Webmail subdomain	`https://webmail.example.com/`	The public HTTPS vhost proxies to the local Roundcube service. Sign in with the full email address and mailbox password; Protected Mail may add an authenticator-code step.	Best direct address to bookmark or give to a mailbox owner.
Website shortcut	`https://example.com/webmail`	The hosted-domain vhost redirects to the corresponding Roundcube service. The final address may use `webmail.example.com` or port `883`, according to the active web stack and generated vhost.	Useful as a memorable compatibility shortcut.
Panel-host shortcut	`https://shm.example.com/webmail`	The SHM vhost redirects to `https://webmail.example.com/` when that hostname is configured.	Useful when users begin from the branded panel hostname.
Direct Roundcube port	`https://example.com:883/` or `https://webmail.example.com:883/`	Connects directly to the SHM Roundcube HTTPS service.	Fallback and diagnostics. Prefer the port-443 webmail subdomain for normal use.
Legacy webmail port	`https://example.com:2096/` or `https://webmail.example.com:2096/`	Compatibility listener redirects the browser to the Roundcube service on port `883`.	Use only for an existing integration or familiar legacy bookmark.
Panel fallback	`https://<panel-host>:883/`	When the mailbox webmail hostname cannot be selected safely, the panel SSO workflow can use the trusted panel host on port `883`.	Fallback for the signed SHM handoff, not the preferred public bookmark.

Credentials and security checks

Login type	Credential	Security behavior
Panel SSO	An active authorized SHM session and the Open Webmail action.	The mailbox is checked against the selected account. SSO does not turn an unauthorized panel session into mailbox access.
Direct Roundcube	The complete mailbox address, such as `alex@example.com`, plus that mailbox's password.	Direct-login IP policy, rate limiting, login suspension, and Protected Mail rules are enforced.
Protected Mail	Mailbox password followed by the configured authenticator code when required.	A missing or invalid 2FA setup blocks the protected direct login instead of silently weakening it.
Default system mailbox	Panel SSO only.	The account's default collector is passwordless, read-only in Email Accounts, and intentionally cannot use ordinary password login.

DNS, TLS, and ports

A locally managed SHM zone creates an address record for webmail.example.com. If DNS is hosted elsewhere, add the equivalent record there.
AutoSSL includes the webmail hostname when SHM controls the zone or the hostname resolves to the server. Do not ignore a certificate warning simply because the inbox appears underneath it.
Port 443 is used by the preferred webmail subdomain. Direct 883 and compatibility 2096 access also require those ports to be reachable through upstream and local firewalls.
The Roundcube runtime remains local to SHM; public vhosts proxy to it rather than exposing mailbox storage as website files.

Direct-login access policy

Account Security Settings can set Direct Webmail login to No IP restriction, Use Account IP Access list, or Use custom IP list. A mailbox may inherit that default or choose Unrestricted, Restricted to Account IP Access list, or Restricted to custom IP list. These choices apply to direct password login. Mail-app IMAP, POP3, and SMTP restrictions are configured separately.

What is available after sign-in

Roundcube provides mail, folders, search, compose and attachments, address-book contacts, identities, password change, filters, and SHM Webmail Security. Calendar and contacts synchronization features appear only when their SHM/Radicale backend reports ready. A hidden Calendar entry is therefore a service-state result, not a treasure hunt.

If Webmail does not open

Confirm the exact mailbox in Email Accounts and check whether login is suspended.
Try Open Webmail from SHM. If SSO works but direct login does not, inspect the direct Webmail IP policy, password, Protected Mail state, and rate-limit message.
Resolve webmail.example.com and confirm it points to this server.
Check the certificate SANs and expiry for the webmail hostname.
Confirm Roundcube and Dovecot are healthy, then inspect bounded Roundcube and mail-auth logs.
Use port 883 only as a diagnostic fallback; a working port does not repair missing DNS or TLS on the preferred hostname.

How to use it

Choose the mailbox in Email Accounts.
For the safest panel workflow, click Open Webmail and allow the new tab.
For direct access, open https://webmail.example.com/ and use the full email address.
Complete Protected Mail 2FA if requested.
Send a controlled message, receive a reply, and confirm both events in Delivery Reports when operational proof is required.

Result and next check

Roundcube opens as the intended account-owned mailbox, and a real send-and-receive test succeeds. If only a compatibility URL works, repair the preferred webmail DNS and certificate path instead of asking users to remember another port forever.

Theme color