Chapter 01 Getting Started Admin: #pNetwork

System Architecture, Zero-Restart Hot-Reload & Port Matrix

SharpMailserver unifies ESMTP, IMAP4rev2, JMAP, CalDAV/CardDAV, WBXML Mobile Push, ManageSieve, Webmail PWA, and GoBD WORM archiving in a single native process (~40 MB idle RSS). Nearly all Admin Cockpit (/admin/) settings apply with zero service restart and propagate across cluster nodes automatically.

Operational Tip & Architecture Note

Expose only required ports at your perimeter firewall. Modern TLS-only deployments need just the 5 core ports (25, 443, 465, 587, 993). Keep port 143 disabled unless legacy internal appliances cannot use implicit TLS on port 993.

Perimeter Firewall Quick Setup (UFW & Windows PowerShell)

Opens the 5 required inbound TCP ports (25, 443, 465, 587, 993) plus Port 80 for Let's Encrypt HTTP-01.

Reference / Configuration

# Linux (UFW)
sudo ufw allow 25,80,443,465,587,993/tcp

# Windows Server (PowerShell als Administrator)
New-NetFirewallRule -DisplayName "SharpMailserver Core Ports" `
  -Direction Inbound -Protocol TCP -LocalPort 25,80,443,465,587,993 -Action Allow

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`ServerHostName (#pNetwork)`	Public FQDN advertised in ESMTP 220 greetings, outbound EHLO/HELO, Autodiscover responses, and TLS diagnostics. Applies in 0 ms without restart.	`mail.<DefaultDomain>`	Always use a dedicated host FQDN such as mail.company.com that matches your public IPv4/IPv6 Reverse-DNS (PTR) record 1:1.
`TCP 25 (ESMTP MX Inbound & Outbound)`	Server-to-server inbound MX reception and outbound MX delivery with opportunistic/enforced STARTTLS and RFC 3030 CHUNKING/BDAT.	`Aktiv (Pflicht) / Enabled`	Allow both inbound and outbound TCP 25 (verify ISP port 25 unblock). Plaintext AUTH on port 25 is disabled by default; keep it disabled.
`TCP 443 (HTTPS: Webmail, Admin, Push, DAV)`	Serves Webmail PWA (/mail/), Admin Cockpit (/admin/), JMAP, CalDAV/CardDAV (/dav/), Mobile Push (/Microsoft-Server-ActiveSync), and Send API.	`Aktiv (Pflicht) / Enabled`	Serve directly via Kestrel with built-in Let's Encrypt or behind HAProxy/Nginx/pfSense SSL gateway with X-Forwarded-For / PROXY protocol.
`TCP 465 (SMTPS) & TCP 587 (Submission)`	Authenticated client mail submission for desktop/mobile MUAs, scanners, and MFPs (465 implicit TLS per RFC 8314, 587 STARTTLS).	`Beide aktiv / Both enabled`	Prefer port 465 (implicit TLS from byte 0 per RFC 8314) for modern clients while keeping port 587 open for STARTTLS scanners and ERP systems.
`TCP 993 (IMAPS) & TCP 143 (IMAP)`	IMAP4rev2 mailbox access with sub-5 ms IDLE push and bidirectional Apple Notes sync (993 implicit TLS, 143 explicit STARTTLS).	`993 aktiv, 143 optional`	Keep port 993 open; close port 143 on public interfaces whenever possible so clients never attempt unencrypted connections.
`TCP 80 (ACME HTTP-01) & TCP 4190 (Sieve)`	Port 80 answers automated Let's Encrypt HTTP-01 challenges; port 4190 provides authenticated ManageSieve filter editing (Thunderbird/Roundcube).	`Optional / Optional`	Open port 80 if SharpMailserver handles Let's Encrypt HTTP-01 directly; expose port 4190 only if users manage Sieve scripts from desktop clients.