How to use namailu.cz

Sign-in

A basic account can work with a password alone.

2FA applies to the portal and webmail together, and it is verified by the sign-in service id.namailu.cz. When you register yourself you can turn it on right on the last screen, or later under Security → Two-factor authentication. That is why the sign-in form only shows the code field once you expand the “I have two-factor authentication enabled” option.

If an administrator added you, you can set 2FA up in the single-use invite link. If company policy — or an already unlocked sensitive feature — requires it, the account sends you to set it up right after you enter your password.

Once it is on you get eight single-use backup codes. Store them away from this computer. Each can be used once at sign-in instead of the code from the app, and they are never shown again.

At sign-in you can tick Trust this device for 30 days. On that device an ordinary sign-in then asks for your password but not for the TOTP code. The password stays mandatory, and API keys, 2FA changes and user management ask for a fresh code again. You manage devices under Security.

On a new device, after clearing cookies, resetting your password or changing 2FA, the code is requested again.

Mailboxes

How many you can have, and where.

You can see the current state on the Overview, in the “Plan” panel. The gauge turns amber at 80 % and red once the limit is used up.

• On our domain @namailu.cz you get one personal mailbox — the one you registered. Further personal mailboxes belong on your own verified domain.
• Agent mailboxes (for bots and integrations) work on both. On @namailu.cz the name has to be at least 9 characters long and contain two hyphens or underscores — for example invoice-bot_01. Nobody can take short, pretty names there.

Aliases and forwarding

A second address, or mail somewhere else entirely.

You will find both under Mailboxes → mailbox detail.

An alias is another address whose mail lands in the same mailbox. Add info and mail to info@yourdomain.com arrives where you already read. You can also send from an alias — add it in webmail under Settings → Identity. The number of aliases is part of the plan and counts for the whole account.

Forwarding sends mail elsewhere, including outside namailu.cz.

Your own domain

Three steps to your own address.

1. Enter the domain under Domains → you get a list of DNS records.
2. Set them at your registrar. MX, SPF and DKIM are required; we recommend DMARC.
3. Press Check. Once everything is ✓, the domain moves to active and you can create mailboxes on it.

Handing the account over

Changing administrator? The domain does not move.

When a colleague leaves, or an agency hands the account to the client, the owner is swapped and nothing is migrated — domains, mailboxes, mail, the plan and the keys all stay where they are.

1. Under Users, invite the new person with the Owner role.
2. The new owner sets a password and a second factor, and signs in.
3. The new owner then deactivates the original one. That is deliberately their job: nobody can deactivate themselves or the last active owner, so the account is never left without an administrator.

Domain catch-all

Mail to a non-existent address need not bounce.

On the domain detail, pick a mailbox as the catch-all. Mail to a non-existent address on your domain is then delivered there instead of being rejected. It helps with typos (invioce@…) and when migrating from old mail.

Agent mailboxes

A bot may only write where you let it.

An agent mailbox has no webmail password — you work with it over the API using a key of the organisation.

The agent detail has Allowed recipients. The agent may only write to addresses on that list; an empty list means it sends nothing. You can enter a specific address (boss@company.com) or a whole domain (company.com). Freemail domains such as gmail.com or seznam.cz cannot be allowed as a whole — that would mean writing to anyone; a specific address on them can be added.

• Bulk import handles CSV as well as a plain list, with commas or semicolons. Whatever does not pass we list; the rest we save.
• Use Pause when you want to disable an address only temporarily.
• Lock stops the agent from changing its own list over the API — from then on only you manage it. We recommend it everywhere an agent runs in production: without the lock, a compromised key can add recipients by itself.

The mail journal on the mailbox detail shows what was sent and what arrived — it stays even if the agent deletes the message. We do not store message content, only these details, and for 90 days.

Sending limits

The stricter of two layers applies.

The plan defines what you bought — the number of mailboxes, agents and domains, and the monthly volume. Reputation (Tier) defines what is safe to let onto a shared IP address. A new account starts at the lowest reputation even on a paid plan: a large volume from a fresh IP would damage deliverability for everyone. Reputation grows with history.

The monthly quota is counted in weight units: an e-mail going out costs 2, an e-mail to a mailbox hosted here costs 1 — so internal mail lasts twice as long. The period runs from the payment date (from sign-up for free accounts), not by the calendar; you can see the renewal date on the Overview.

When you outgrow the plan

You get 14 days, and the portal shows a notice with the exact date. After that, sending stops for the whole account — incoming mail, mailboxes and webmail keep working. The system never disables a particular mailbox on its own, because it cannot know which one matters to you. You have three options:

• Put sending to sleep on a mailbox you do not need right now. It keeps receiving mail and you can read it, only nothing leaves it. You can bring it back once the plan is upgraded.
• Upgrade the plan.
• Delete a mailbox you do not use.

Export and deletion

Export first, delete second.

The bin keeps messages for at most 30 days. A disabled mailbox does not delete itself: it blocks sign-in but keeps receiving mail until you enable it again or delete it explicitly. Permanent deletion is therefore always a separate, confirmed step.

1. Synchronise a human mailbox over IMAP first and check that you can open messages from Inbox, Sent, Spam and Bin locally. An agent mailbox can be exported with GET /v1/messages/{message_id}/raw.
2. Disable the mailbox, and only then use Delete permanently.
3. The account and its mail disappear from the running service at once. Unreferenced objects are physically cleaned up by the next daily job; a shared de-duplicated object is not deleted while another message still uses it.

Contacts and calendar

Your address book on the phone, not just in the mailbox.

Contacts and calendars sync over CardDAV and CalDAV. You sign in with the same password as for mail, so there is no second password to set up.

iPhone and iPad

Contacts: Settings → Apps → Contacts → Accounts → Add Account → Other → Add CardDAV Account. The calendar works the same way through Apps → Calendar → … → Add CalDAV Account.

Android

Android has no built-in CardDAV, so the system settings alone will not do. Install DAVx⁵, add an account with “Login with URL and user name” and use the same values from the table above. Contacts and calendars then show up in the system apps.

Desktop

Thunderbird handles CardDAV on its own: Address Book → New Address Book → CardDAV Address Book. macOS and Windows use the same values as the phone.

Frequently asked

What you ask most often.

• Can I send under someone else’s address? No. In webmail you can add an identity only for an address that is yours — your own mailbox or its alias. The server refuses the rest.
• Will mail arrive while the mailbox is disabled? Yes, incoming mail keeps being delivered. A disabled mailbox only prevents signing in.
• Why can my agent not send? Most often the recipient is missing from the allowed list, or the limit is used up. The exact reason is in the API response and in the mail journal.
• Where do I see how much is left? On the Overview, in the “Plan” panel.