How to use namailu.cz

Sign-in

A basic account can work with a password alone.

2FA applies to the portal and webmail together, and it is verified by the sign-in service id.namailu.cz. When you register yourself you can turn it on right on the last screen, or later under Security → Two-factor authentication. That is why the sign-in form only shows the code field once you expand the “I have two-factor authentication enabled” option.

If an administrator added you, you can set 2FA up in the single-use invite link. If company policy — or an already unlocked sensitive feature — requires it, the account sends you to set it up right after you enter your password.

Once it is on you get eight single-use backup codes. Store them away from this computer. Each can be used once at sign-in instead of the code from the app, and they are never shown again.

At sign-in you can tick Trust this device for 30 days. On that device an ordinary sign-in then asks for your password but not for the TOTP code. The password stays mandatory, and API keys, 2FA changes and user management ask for a fresh code again. You manage devices under Security.

On a new device, after clearing cookies, resetting your password or changing 2FA, the code is requested again.

Mailboxes

How many you can have, and where.

You can see the current state on the Overview, in the “Plan” panel. The gauge turns amber at 80 % and red once the limit is used up.

• On our domain @namailu.cz you get one personal mailbox. If you did not create it when you signed up, you can create it any time later under Mailboxes. Further personal mailboxes belong on your own verified domain.
• A deleted personal mailbox keeps its place until it is permanently removed, so you cannot create a new one on @namailu.cz right after deleting.
• Agent mailboxes (for bots and integrations) work on both. On @namailu.cz the name has to be at least 9 characters long and contain two hyphens or underscores — for example invoice-bot_01. Nobody can take short, pretty names there.

Aliases and forwarding

A second address, or mail somewhere else entirely.

You will find both under Mailboxes → mailbox detail.

An alias is another address whose mail lands in the same mailbox. Add info and mail to info@yourdomain.com arrives where you already read. You can also send from an alias — add it in webmail under Settings → Identity. The number of aliases is part of the plan and counts for the whole account.

Forwarding sends mail elsewhere, including outside namailu.cz. Every forwarded message counts towards your sending limit, and so does forwarding set up by a filter in webmail. On the free plan, forwarding to an outside address starts once the owner of that address confirms it through a link we e-mail to them.

Your own domain

Three steps to your own address.

1. Enter the domain under Domains → you get a list of DNS records.
2. Set them at your registrar. MX, SPF and DKIM are required; we recommend DMARC.
3. Press Check. Once everything is ✓, the domain moves to active and you can create mailboxes on it.

A mailbox for a colleague

Create the mailbox, then give it a login.

You create a personal mailbox on your domain under Mailboxes. It comes into service only once you create a login for it on the detail page — the account your colleague uses for webmail, a mail app and the portal.

1. Type a password or let one be generated. It is shown once — hand it over together with the address. The alternative is a one-time link (72 hours) through which they set the password themselves; send it from one of your sending mailboxes, or copy it.
2. Choose the rights: a Member sees only their own mailboxes, an Admin also domains and the other mailboxes. An owner cannot be created here.
3. The contact e-mail is pre-filled with the mailbox address. If your colleague has an e-mail elsewhere, enter it: self-service “forgot password” goes there and cannot be delivered into the mailbox itself. Without it, you set a new password for them (mailbox detail → Account password).

The welcome message with the settings arrives in the mailbox the moment the login is created.

The mailbox login is separate: the username is the mailbox address and the password belongs to it alone. Your password does not open it, you never see your colleague's password and you do not read their mail unless they share it. As an admin you can still set a new password, revoke access or delete the mailbox.

Handing the account over

Changing administrator? The domain does not move.

When a colleague leaves, or an agency hands the account to the client, the owner is swapped and nothing is migrated — domains, mailboxes, mail, the plan and the keys all stay where they are.

1. Under Users, invite the new person with the Owner role.
2. The new owner sets a password and a second factor, and signs in.
3. The new owner then deactivates the original one. That is deliberately their job: nobody can deactivate themselves or the last active owner, so the account is never left without an administrator.

Domain catch-all

Mail to a non-existent address need not bounce.

On the domain detail, pick a mailbox as the catch-all. Mail to a non-existent address on your domain is then delivered there instead of being rejected. It helps with typos (invioce@…) and when migrating from old mail.

Agent mailboxes

A bot may only write where you let it.

An agent mailbox has no webmail password — you work with it over the API using a key of the organisation.

The agent detail has Allowed recipients. The agent may only write to addresses on that list; an empty list means it sends nothing. You can enter a specific address (boss@company.com) or a whole domain (company.com). Freemail domains such as gmail.com or seznam.cz cannot be allowed as a whole — that would mean writing to anyone; a specific address on them can be added.

If the agent should also write to people you don't know in advance, turn on Allow anyone. You confirm it with two-factor authentication. The agent can then write to at most 30 addresses outside the list an hour and 300 a day; addresses on the list don't count towards that, and plan limits still apply. We can raise the cap on request.

• Bulk import handles CSV as well as a plain list, with commas or semicolons. Whatever does not pass we list; the rest we save.
• Use Pause when you want to disable an address only temporarily.
• Lock stops the agent from changing its own list over the API — from then on only you manage it. We recommend it everywhere an agent runs in production: without the lock, a compromised key can add recipients by itself.

The mail journal on the mailbox detail shows what was sent and what arrived — it stays even if the agent deletes the message. We do not store message content, only these details, and for 90 days.

Sending limits

The stricter of two layers applies.

The plan defines what you bought — the number of mailboxes, agents and domains, and the monthly volume. Reputation (Tier) defines what is safe to let onto a shared IP address. A new account starts at the lowest reputation even on a paid plan: a large volume from a fresh IP would damage deliverability for everyone. Reputation grows with history.

The monthly quota is counted in weight units: an e-mail going out costs 2, an e-mail to a mailbox hosted here costs 1 — so internal mail lasts twice as long. The period runs from the payment date (from sign-up for free accounts), not by the calendar; you can see the renewal date on the Overview.

When you outgrow the plan

You get 14 days, and the portal shows a notice with the exact date. After that, sending stops for the whole account — incoming mail, mailboxes and webmail keep working. The system never disables a particular mailbox on its own, because it cannot know which one matters to you. You have three options:

• Put sending to sleep on a mailbox you do not need right now. It keeps receiving mail and you can read it, only nothing leaves it. You can bring it back once the plan is upgraded.
• Upgrade the plan.
• Delete a mailbox you do not use.

Export and deletion

Export first, delete second.

The bin keeps messages for at most 30 days. A disabled mailbox does not delete itself: it blocks sign-in but keeps receiving mail until you enable it again or delete it explicitly. Permanent deletion is therefore always a separate, confirmed step.

1. Synchronise a human mailbox over IMAP first and check that you can open messages from Inbox, Sent, Spam and Bin locally. An agent mailbox can be exported with GET /v1/messages/{message_id}/raw.
2. Disable the mailbox, and only then use Delete permanently.
3. The account and its mail disappear from the running service at once. Unreferenced objects are physically cleaned up by the next daily job; a shared de-duplicated object is not deleted while another message still uses it.

Contacts and calendar

Your address book on the phone, not just in the mailbox.

Contacts and calendars sync over CardDAV and CalDAV. You sign in with the same password as for mail, so there is no second password to set up.

iPhone and iPad

Contacts: Settings → Apps → Contacts → Accounts → Add Account → Other → Add CardDAV Account. The calendar works the same way through Apps → Calendar → … → Add CalDAV Account.

Android

Android has no built-in CardDAV, so the system settings alone will not do. Install DAVx⁵, add an account with “Login with URL and user name” and use the same values from the table above. Contacts and calendars then show up in the system apps.

Desktop

Thunderbird handles CardDAV on its own: Address Book → New Address Book → CardDAV Address Book. macOS and Windows use the same values as the phone.

Frequently asked

What you ask most often.

• Can I send under someone else’s address? No. In webmail you can add an identity only for an address that is yours — your own mailbox or its alias. The server refuses the rest.
• Will mail arrive while the mailbox is disabled? Yes, incoming mail keeps being delivered. A disabled mailbox only prevents signing in.
• Why can my agent not send? Most often the recipient is missing from the allowed list, or the limit is used up. The exact reason is in the API response and in the mail journal.
• Where do I see how much is left? On the Overview, in the “Plan” panel.
• My phone says “wrong password”, yet the same password then fetches mail. Why? Until 20 September 2026 the brute-force protection counted every sign-in, and a mail client makes many — it keeps several connections to one mailbox and re-authenticates all of them when the app starts. Today only failed sign-ins count, so ordinary use no longer trips it. Blocking happens after 10 different wrong passwords in 15 minutes, and until the window passes even the correct password is refused.
• Mail does not work at all from one network but works from another. Why? The server blocks addresses where it sees port scanning or a pile of failed sign-ins. The block expires on its own — after 90 minutes for sign-ins, a week for scanning; for an address that keeps coming back the time doubles, up to a week. It most often hits shared VPNs, where hundreds of people share one exit address and the scanning is done by somebody else entirely. If you would rather not wait, write to support@namailu.cz and include the address you connect from (any "what is my IP" page will tell you). We will unblock it by hand.
• I got an email saying I reached my sending limit. What now? Every plan limits how much can go out: per hour we count emails, per day and per month we count recipients (an address outside our domains counts twice, one of ours once). The limit is the same for webmail, mail programs and the API. We notify you at 80% of the daily or monthly limit and when you reach it. The hourly and daily limits reset on their own and your mail program will retry unsent messages. The free plan is meant for trying the service out — to send more, upgrade to a paid plan under Billing. Receiving mail is not limited.