Email — User Guide

Electric Monk email is powered by Stalwart Mail Server with authentication through Authentik. Your email address is you@electricmonk.io.

Features

• Full email service — send and receive email with any standard client
• IMAP access on port 993 (SSL/TLS)
• SMTP submission on port 465 (SSL/TLS)
• JMAP — modern push-based email protocol (used by the webmail client)
• Web interface at mail.electricmonk.io
• Webmail at webmail.electricmonk.io (Bulwark — OAuth login)
• Sieve filters — server-side mail filtering rules (manageable via webmail)
• Autoconfig / Autodiscover — most desktop clients detect settings automatically
• Centralized login — uses your Authentik username and password

Quick Settings Reference

Setting Up Email on iPhone / iPad

1. Open Settings → Mail → Accounts → Add Account
2. Tap Other → Add Mail Account
3. Fill in:
   • Name: Your display name
   • Email: you@electricmonk.io
   • Password: Your Authentik password
   • Description: Electric Monk (or whatever you like)
4. Tap Next — iOS may try to auto-detect settings. If it fails:
5. Select IMAP (not POP)
6. Under Incoming Mail Server:
   • Host Name: mail.electricmonk.io
   • User Name: Your Authentik username
   • Password: Your Authentik password
7. Under Outgoing Mail Server:
   • Host Name: mail.electricmonk.io
   • User Name: Your Authentik username
   • Password: Your Authentik password
8. Tap Next — iOS will verify the settings
9. Toggle on Mail (and optionally Notes), then tap Save

Verifying SSL/TLS on iOS

After setup, go to Settings → Mail → Accounts → your account → Account → Advanced:

• Use SSL: ON (for both incoming and outgoing)
• IMAP port: 993
• SMTP port: 465
• Authentication: Password

Setting Up Email on macOS Mail

1. Open Mail → Settings → Accounts → click +
2. Select Other Mail Account → Continue
3. Enter your name, email (you@electricmonk.io), and Authentik password
4. macOS may auto-detect settings. If prompted for manual config:
   • Account Type: IMAP
   • Incoming: mail.electricmonk.io port 993 SSL
   • Outgoing: mail.electricmonk.io port 465 SSL

Setting Up Email on Thunderbird

1. Add Account → enter name, email, password
2. Thunderbird will try autoconfig — settings should be detected automatically
3. If manual config is needed, enter the settings from the Quick Reference above
4. Authentication method: Normal password

Setting Up Email on Android

1. Open your mail app (Gmail, K-9 Mail, FairEmail, etc.)
2. Add Account → Other / IMAP
3. Enter you@electricmonk.io and your Authentik password
4. Incoming: mail.electricmonk.io, port 993, security SSL/TLS
5. Outgoing: mail.electricmonk.io, port 465, security SSL/TLS

Using the Webmail

Two web interfaces are available:

• Stalwart Web UI: https://mail.electricmonk.io — log in with Authentik credentials
• Bulwark Webmail: https://webmail.electricmonk.io — uses OAuth (click "Sign in", authenticate with Authentik)

The Bulwark webmail supports Sieve filter management and password changes through Stalwart.

App Passwords

If a client or automation tool doesn't support your Authentik password directly (e.g., some older SMTP relay scripts), app-specific passwords can be created. Contact an administrator to generate one using the manage-app-passwords.sh script.

How Authentication Works

Your email credentials are your Authentik credentials — the same username and password you use for all Electric Monk services. Stalwart authenticates against Authentik's LDAP directory in real time:

1. You enter your username/email and password in your mail client
2. Stalwart searches the Authentik LDAP directory for your account
3. Stalwart verifies your password by binding to LDAP as you
4. If successful, you're authenticated — no separate email password needed

This means if you change your Authentik password, your email password changes too.

How Encryption Works (TLS)

All connections to mail.electricmonk.io are encrypted:

Your device (TLS) ──→ Traefik (terminates TLS) ──→ Stalwart (internal network)

• IMAP (port 993): TLS is established immediately on connection
• SMTP (port 465): TLS is established immediately on connection (implicit TLS)
• HTTPS/JMAP (port 443): Standard HTTPS

The TLS certificate is a wildcard cert for *.electricmonk.io managed by Let's Encrypt. You should never see certificate warnings.

Note: Do not use port 587 with STARTTLS — it is not exposed externally. Always use port 465 with implicit SSL/TLS.

Troubleshooting

"Authentication failed"

• Verify your Authentik credentials work at auth.electricmonk.io
• Make sure you're using your username, not your email, if they differ
• Check that your account is active in Authentik

"Cannot connect to server"

• Ensure you're using mail.electricmonk.io (not any other hostname)
• IMAP must be port 993 with SSL/TLS (not STARTTLS)
• SMTP must be port 465 with SSL/TLS (not port 587)

Emails not sending

• Confirm outgoing server is mail.electricmonk.io on port 465
• Verify authentication is enabled for the outgoing server
• Check that your "From" address matches your actual email address

Email Aliases

• We support email aliases, but they need to be managed by an administrator. Please reach out for support.