mox serve
mox quickstart [-skipdial] [-existing-webserver] [-hostname host] $user@domain [$user | $uid]
mox stop
mox setaccountpassword $account
mox setadminpassword
mox loglevels [$level [$pkg]]
mox queue holdrules list
# ……（中间为 queue hold/unhold/schedule/transport/requiretls/fail 等系列，完整清单以不带参数运行 mox 的输出为准）
mox queue drop [filterflags]
mox queue dump $id
mox import maildir $accountname $mailboxname $maildir
mox export maildir [-single] $dstdir $accountpath [$mailbox]
mox localserve
mox help [$command ...]
mox backup $destdir
mox verifydata $datadir
mox licenses
mox config test
mox config dnscheck $domain
mox config dnsrecords $domain
mox config describe-domains >domains.conf
mox config describe-static >mox.conf
mox config account list
# ……（中间为 config account/addresses/domain/tlspubkey/alias 系列与 export/import，完整清单以不带参数运行 mox 的输出为准）
mox admin imapserve $preauthaddress
mox checkupdate
mox cid $cid
mox clientconfig $domain
mox dane dial $host:$port
mox dns lookup [ptr | mx | cname | ips | a | aaaa | ns | txt | srv | tlsa] $name
mox dkim genrsa >$selector._domainkey.$domain.rsa2048.privatekey.pkcs8.pem
mox dmarc lookup $domain
mox sendmail [-Fname] [ignoredflags] [-t] [< messagefile]
mox spf check $domain $ip
mox mtasts lookup $domain
mox version

cd /home/mox
./mox version

v0.0.17-go1.27.3
linux/amd64

./mox checkupdate

getting last known version: development version
latest version: v0.0.17
Changelog

./mox licenses 2>&1 | head -3

# github.com/mjl-/mox/LICENSE

Copyright 2021 Mechiel Lukkien <mechiel@ueber.net>

cd /home/mox
./mox stop
sleep 1
systemctl is-active mox

mox stopped
activating

systemctl start mox  # 若未配置自动重启则手动拉起
sleep 2
systemctl is-active mox

active

cd /home/mox
./mox loglevels

(default): debug

cd /home/mox
printf 'q1w2e3r4\nq1w2e3r4\n' | ./mox setadminpassword
printf 'q1w2e3r4\nq1w2e3r4\n' | ./mox setaccountpassword admin

Type new password. Password WILL echo.

WARNING: Bots will try to bruteforce your password. Connections with failed
authentication attempts will be rate limited but attackers WILL find passwords
reused at other services and weak passwords. If your account is compromised,
spammers are likely to abuse your system, spamming your address and the wider
internet in your name. So please pick a random, unguessable password, preferably
at least 12 characters.

password: 

cd /home/mox
./mox config account add jack jack@example.com
./mox config account list
./mox config account addresses jack
./mox config account rm jack

account added, set a password with "mox setaccountpassword jack"
admin
jack
jack@example.com
account removed

./mox config address add sales@example.com jack
./mox config address account sales@example.com
./mox config address rm sales@example.com

jack

cd /home/mox
./mox config domain add example.net admin
./mox config domain rm example.net

domain added, remember to add dns records, see:

mox config dnsrecords example.net
mox config dnscheck example.net
domain removed, remember to remove dns records for example.net

./mox config test

config OK

./mox config describe-static > /tmp/mox-static-reference.conf
./mox config describe-domains > /tmp/mox-domains-reference.conf
wc -l /tmp/mox-static-reference.conf /tmp/mox-domains-reference.conf

  1044 /tmp/mox-static-reference.conf
   743 /tmp/mox-domains-reference.conf

./mox config dnsrecords example.net
./mox config dnscheck example.net

# DNSSEC
warning: It looks like the DNS resolvers configured on your system do not verify DNSSEC, or aren't trusted (by having loopback IPs or through "options trust-ad" in /etc/resolv.conf).
# MX
error: MX records consists of explicit null mx record (".") indicating that domain does not accept email.
# DANE
warning: DANE is inactive because MX records are not DNSSEC-signed.
# SPF
error: IP "10.89.58.2" does not pass domain SPF evaluation, status not "pass" but "fail" (mechanism "-all", explanation "")
error: Looking up host SPF record: spf: no txt record for mail.example.com.
# DKIM
error: For selector "2026a", the public key in DKIM DNS TXT record does not match with configured private key.
error: For selector "2026b", the public key in DKIM DNS TXT record does not match with configured private key.
# DMARC
error: Configured DMARC reporting address is not present in record.
warning: It is recommended you specify you would like aggregate reports about delivery success in the DMARC record, see instructions.

cd /home/mox
./mox config describe-sendmail > /etc/moxsubmit.conf   # 首次生成提交配置骨架

printf "From: admin@example.com\nTo: admin@example.com\nSubject: mox cli test\n\nHello from mox CLI test.\n" > /tmp/msg.txt
./mox sendmail -t < /tmp/msg.txt
echo "sendmail exit=$?"

sendmail exit=0

./mox queue list

messages:
    5 2026-10-21T10:54:52Z from:admin@example.com to:test@nonexistent-domain-invalid.example next 7m30s last 3s error "dialing smtp server: looking up \"nonexistent-domain-invalid.example.\": lookup nonexistent-domain-invalid.example. on 127.0.0.1:53: no such host"

./mox queue dump 5 2>&1 | head -9

Received: from mail.example.com by mail.example.com ([10.89.58.2]) via tcp
        with ESMTPSA id jFGUnLP08G6zTmZcrn4NHA (TLS1.3 TLS_AES_128_GCM_SHA256) for
        <test@nonexistent-domain-invalid.example>; 21 Oct 2026 10:54:52 +0000
Message-Id: <RRCidiQ56yecaOTkCbDgPg@mail.example.com>
Date: 21 Oct 2026 10:54:52 +0000
DKIM-Signature: v=1; d=example.com; s=2026a; i=admin@example.com;
        a=rsa-sha256; t=1792580092; x=1792839292; h=From:To:Cc:Bcc:Reply-To:
        References:In-Reply-To:Subject:Date:Message-Id:Content-Type:From:To:

./mox queue hold -ids 5        # 挂起，暂停一切投递尝试
./mox queue unhold -ids 5      # 恢复
./mox queue schedule -ids 5 -now 5s   # 把下次尝试改到 5 秒后
./mox queue drop -ids 5        # 直接删除该消息（不可恢复）

1 messages changed
1 messages changed
1 message(s) rescheduled
1 message(s) dropped

./mox queue holdrules add -account admin
./mox queue holdrules list
./mox queue holdrules remove 1

hold rules:
(none)
hold rules:
id 1: account "admin"
(none)

cd /home/mox
./mox backup data/tmp/testupgrade
echo "backup exit=$?"
./mox verifydata data/tmp/testupgrade/data
echo "verify exit=$?"

backup exit=0
data/tmp/testupgrade/data: OK
verify exit=0

cd /home/mox
./mox export maildir -single /tmp/maildir-export data/accounts/admin
find /tmp/maildir-export -type f | head -6

/tmp/maildir-export/Rejects/cur/1792566227.3.mox:2,S
/tmp/maildir-export/Inbox/cur/1792566799.4.mox:2,S
/tmp/maildir-export/Inbox/new/1792580202.7.mox:2,
# ……（另有 Inbox/new 下第 6 封消息及 Rejects 等邮箱目录，输出节选至此）

{
        "BoundaryOffset": -1,
        "HeaderOffset": 0,
        "BodyOffset": 1100,
        "EndOffset": 1126,
        "RawLineCount": 1,
        "DecodedSize": 26,
        "Envelope": {
                "Date": "2026-10-21T10:56:42Z",
                "Subject": "mox cli test",
                "From": [

cd /home/mox
./mox dns lookup mx example.com
./mox dns lookup txt _dmarc.gmail.com

mx records (1, without dnssec):
- mail.example.com., preference 10
txt records (1, without dnssec):
- v=DMARC1; p=none; sp=quarantine; rua=mailto:mailauth-reports@google.com

./mox dmarc lookup gmail.com

dmarc record at domain gmail.com: v=DMARC1; p=none; sp=quarantine; rua=mailto:mailauth-reports@google.com
(without dnssec)

./mox mtasts lookup gmail.com

error: mtasts: cannot fetch policy: http get: Get "https://mta-sts.gmail.com/.well-known/mta-sts.txt": dial tcp 142.250.107.138:443: i/o timeout
DNS TXT record _mta-sts.gmail.com: v=STSv1; id=20190429T010101

./mox spf check example.com 10.89.58.2

error: spf: no txt record
status: none (without dnssec)

./mox dkim verify data/accounts/admin/msg/a/7

warning: missing DNS record
status "permerror", err dkim: no dkim dns record for selector and domain: dns name "2026a._domainkey.example.com."
record ""
header DKIM-Signature: v=1; d=example.com; s=2026a; i=admin@example.com;
        a=rsa-sha256; t=1792580202; x=1792839402; h=From:To:Cc:Bcc:Reply-To:
        References:In-Reply-To:Subject:Date:Message-Id:Content-Type:From:To:

./mox clientconfig example.com

Protocol             Host                            Port Listener        Note
Submission (SMTP)    mail.example.com                 465 public          with TLS
IMAP                 mail.example.com                 993 public          with TLS

To prevent authentication mechanism downgrade attempts that may result in
clients sending plain text passwords to a MitM, clients should always be
explicitly configured with the most secure authentication mechanism supported,
the first of: SCRAM-SHA-256-PLUS, SCRAM-SHA-1-PLUS, SCRAM-SHA-256, SCRAM-SHA-1,
CRAM-MD5.

cd /home/mox
./mox cid LcYX6KsWtVTcvAgzs1tf8A

1a15e092524

./mox help localserve

usage: mox localserve
  -dir string
        configuration storage directory (default "$userconfigdir/mox-localserve")
  -initonly
        write configuration files and exit
  -ip string
        serve on this ip instead of default 127.0.0.1 and ::1. only used when writing configuration, at first launch.

Start a local SMTP/IMAP server that accepts all messages, useful when testing/developing software that sends email.