Onboarding a domain in the admin panel

Before you start

This guide takes a brand-new domain from scratch to a working first mailbox. Each step tells you what to do, shows the real panel screen and explains how to check that it worked.

The screenshots and the video were made with test domains, such as demo-padaria-estrela.test, and a fictional company (Padaria Estrela). For your own setup, use your company's domain instead.

• An admin panel user with permission to create domains (the customer's administrator, or the Lua team).
• Access to the domain's DNS, wherever it is today (registro.br, Cloudflare, your hosting provider). With the TXT record, you create records there; when bringing your DNS, you only change the name servers at the registrar.
• Licenses purchased. Each mailbox uses one license from the plan. With no license available, the panel creates the mailbox as No license: it stays deactivated and does not receive email until you buy a license and assign it to the mailbox (see Mailboxes without a license).

1. Create the domain and prove you own it

A domain only becomes your company's after you prove that you control it. The panel offers two paths: publish a TXT record in the DNS where the domain already is, or bring the domain's DNS to Edgium by changing the name servers at the registrar.

On the request screen, the two paths appear side by side, with Bring my DNS to Lua marked as recommended; the Learn more link on each card leads to this page.

TXT record or bringing your DNS: which to choose

Path A: validate ownership with the TXT record

1. In Domains, click Add domain, type the domain and, if you like, a description. While you type, the panel tells you whether the domain is new to the platform.
2. Click Continue. On the next screen, in the TXT record card, the panel shows the record: the name (_lua-admin-verify.yourdomain) and the value (lua-admin-verify= followed by a code), each with a Copy button.
3. In the domain's DNS panel, create a TXT record with that name and value (see the example screen in step 2).
4. Go back to the panel and click Check now. If the TXT record has not shown up yet, the screen says so and keeps checking on its own every few minutes.
5. When the TXT record appears, the domain becomes active right away and the bell notifies you. The verification TXT record can then be removed from DNS. You set up the email records in step 2.

Path B: bring your DNS to Edgium

This is for those who are fine with moving the domain's DNS to Edgium. Email and your website keep working as they do today: the panel copies the records the domain already has before the change. You must already be a registered Edgium customer; if the option does not appear on the request, use path A or contact support.

1. Under Domains, click Add domain, type the domain and click Continue.
2. In the Bring my DNS to Lua card, click Bring my DNS to Lua and confirm. The panel creates the domain on Edgium without changing anything that is live.
3. The panel shows the two name servers (NS) reserved for your domain. Click Copy next to each one. Each domain may have a different pair: always use the ones shown on the screen.
4. On the site where the domain was registered (for example, registro.br, under Alterar servidores DNS), replace the current servers with the two from the panel and save.
5. Go back to the panel and wait. The screen shows Waiting for the name server change and checks by itself every few minutes. If you are in a hurry, use Check now.

See also the full step-by-step in Bring my DNS to Lua.

What happens after the name servers change

When the panel detects the change, ownership of the domain is proven, the domain becomes active and the bell notifies you. Then the panel sets up the email records by itself in Edgium's DNS. This also applies if you validated with the TXT record and changed the name servers afterward:

• SPF: Lua's is merged with the one that already exists. Nothing you were sending today stops being valid.
• DKIM and Autodiscover (the SRV record): are created. Outlook and phones then set themselves up automatically.
• Automatic email setup (autodiscover.yourdomain and autoconfig.yourdomain): the panel writes the two A records to the zone and, once the names start answering, turns on the address, the certificate and HTTPS. You do not have to do anything. Follow along in Automatic email setup.
• DMARC: becomes Lua's recommended default, with the quarantine policy and the reports received by Lua. If the domain already had a DMARC, Lua's default replaces it.
• MX: if the domain has an active mailbox at Lua, the MX moves to Lua along with the rest, and email starts arriving at Lua. The MX is not changed automatically when the domain does not have an active mailbox yet, when an email migration is in progress or when the domain's External MX option was set manually. In those cases, the panel says that only the MX is missing, and you change it when you want, as described below.
• A domain with Lua Shield (antispam only) never has its MX changed.

If Domain health still shows a problem

1. Open the domain, go to Overview → Domain health and click Check now. With DNS on Edgium, the result appears as soon as the record is applied, without waiting for DNS propagation. There is an interval of a few minutes between one manual check and the next; if the panel warns you, wait and try again.
2. If the only item with a problem is the MX, click Fix problems. The panel opens the Email records window, with a preview of what will be created or adjusted. There is only one button: Apply.
3. When the preview changes the MX, the window itself warns that email will start arriving at Lua and asks for your confirmation before continuing. Confirm that the mailboxes already exist and that SPF and DKIM are active, check the confirmation box and click Apply and switch the MX.
4. If the domain's DNS stays with another provider (path A), Domain health shows, under How to fix, each record you still need to create there. Step 2 explains this.

To go deeper in the admin panel manual:

• Adding the domain (chapter 3)
• A domain that is already at Lua under another account
• "The TXT record has not appeared in the domain's DNS yet"

2. Set up SPF, DKIM, DMARC and Autodiscover

For the domain to receive and send well, the DNS needs MX, SPF, DKIM and DMARC. For Outlook and phones to set themselves up automatically, it also needs Autodiscover and the two addresses of the automatic email setup (autodiscover.yourdomain and autoconfig.yourdomain). The panel generates the values and checks whether they are published.

With the domain active, open Authentication on its page. That is where the panel shows each record the domain needs, ready to copy, and checks whether it is already in DNS.

SPF, MX and Autodiscover

In Authentication → Validate DNS, before you create any record, the panel shows in red what is missing and, for each item, the exact record to copy.

Autodiscover (SRV): so Outlook and phones set themselves up

Create one SRV record in the domain's DNS, with these fields:

• Some panels have separate fields (service, protocol, priority, weight, port, target); others ask for the full name and the value 0 0 443 autodiscover.lua.email. It is the same record.
• Whether the target has a trailing dot depends on the panel: Cloudflare and most panels accept it without the dot.
• A single record works for Outlook, iPhone and Android. There is no separate record for the phone.
• If the domain came from Microsoft 365 or Google Workspace, delete their old Autodiscover (the SRV or the autodiscover CNAME) when you switch the MX. Otherwise the phone tries to sign in to the previous provider.
• If your DNS is at Cloudflare: the SRV does not have the orange cloud (an SRV record is always "DNS only"), so there is nothing to adjust in it. The two A records of the automatic email setup (autodiscover.yourdomain and autoconfig.yourdomain) must stay as "DNS only" (gray cloud), so the name answers with the value the panel shows; only then can Lua activate them.

If it is not ready: first check the Automatic email setup, in Authentication → Validate DNS. If it still does not work, the person sets up the device by hand. In the phone's Exchange account, the server is sync.lua.email, the username is the full email address and the password is the webmail one (Domain field left blank). Details in the Exchange account chapter of the webmail manual.

Automatic email setup: autodiscover and autoconfig

Phones (Android with an Exchange account, Gmail or Samsung) and email programs find the server on their own, with just the email address and password, when the domain has two addresses: autodiscover.yourdomain and autoconfig.yourdomain. Everything is in one place, in Authentication → Validate DNS, inside the Autodiscover (automatic setup) card, in this order: the explanation and the _autodiscover._tcp SRV record; Contacts and calendar (the _carddavs and _caldavs SRV records); and the autodiscover. and autoconfig. addresses, in the Automatic email setup block (marked Optional). Each record appears in a card, with its fields and the Copy button.

The first time, the screen may show Preparing the records. This takes about a minute; the screen refreshes on its own, or use Check now, in the card header. Nothing is created until the name answers for Edgium. If the DNS stops pointing along the way, the block goes back to Waiting for DNS.

• Waiting for DNS: the screen shows the table with Type, Name, Value, TTL (s) and What the DNS answers today. When the DNS of a name already points to Lua, the record disappears from the list and Record found in DNS appears. The Copy all button copies only what is still missing.
• Activating: we are setting up the address and the security certificate. It is automatic and usually takes a few minutes.
• Completed: phones and email programs find the server on their own.

The Activate button: it only appears when the domain has no active mailbox or has an email migration in progress. The screen explains this: This domain is not set up automatically (it needs an active mailbox and no email migration in progress). Click Activate when you are ready.

In Domain health there is no large block: just one line in the DNS alert list, Automatic setup pending (yellow), Automatic setup in progress or Automatic setup with a problem (red). The How to fix button (or View progress) leads to the card in the Validate DNS tab. The line disappears when the setup is Completed.

If it is not ready: email keeps working. Just enter the server by hand (in the phone's Exchange account, sync.lua.email).

DKIM

1. In Authentication → DKIM, click Set up DKIM. Leave the automatic signing option on and confirm.
2. The panel creates the key and shows the record: name luadkim._domainkey.yourdomain, type TXT, and the value that starts with v=DKIM1. Copy the whole value.

DMARC

The domain starts out with Lua's recommended default DMARC: quarantine policy (a message that fails verification goes to the recipient's spam folder) and the reports received by Lua. Under Authentication → DMARC you see the current setup; under Edit configuration you change the policy, the percentage and the reports, and the panel shows the TXT record for _dmarc.yourdomain already built. If the domain already had a DMARC with a different policy (for example, monitoring only, with p=none) and DNS is on Edgium, Lua's default replaces it when the panel sets up email. With DNS at another provider, the panel changes nothing: it suggests the record, and you decide. If other systems send email through your domain, first check that their SPF and DKIM are correct.

In your provider's DNS panel

For each record, the DNS panel asks for the type, the name, the value and the TTL. The screen below is an illustrative, unbranded example: your provider's panel looks different but asks for the same information. In many panels, the name goes without the domain at the end (use just _dmarc instead of _dmarc.yourdomain). Some ask you to split the long DKIM value into parts: that is normal.

Validate again

After saving in DNS, go back to Authentication → Validate DNS and click Test again. The change can take from a few minutes to a few hours to take effect.

To go deeper in the admin panel manual:

• DNS: DKIM, DMARC and Autodiscover (chapter 4)
• DKIM
• DMARC
• Validate DNS
• Autodiscover
• Full list of records, in the webmail manual

3. Create accounts (mailboxes)

Each mailbox uses one license from the plan you subscribed to. The license sets the mailbox size.

1. On the domain page, open Email → Mailboxes and click Add mailbox.
2. Type the part before the @ (the panel shows the full address) and the person's full name.
3. Type a password or click Generate, which creates a strong one. The panel requires at least 8 characters, with an uppercase letter, a lowercase letter, a number and a special character, and shows the password strength as you type.
4. Choose the license. The list shows how many seats are left in each plan, and the mailbox size comes from it: there is no quota field. If no license is available, the panel warns that the mailbox only works after you assign a license to it.
5. Click Create mailbox. With a license, the mailbox can receive email and sign in to the webmail right away. Without a license, it is created deactivated and only starts working when you assign a license to it; paying for a new license does not activate the mailbox. The step by step for buying is in Subscribe to more mailboxes and add-ons.

To create many mailboxes at once, use Import CSV: the panel shows a preview and only creates them after you confirm.

To go deeper in the admin panel manual:

• Creating mailboxes (chapter 5)
• Creating many mailboxes at once
• Mailbox "No license" or no licenses available

4. Create an alias

An alias lets you receive at a team address without creating another mailbox (and without using a license).

An alias is an address that has no mailbox of its own and delivers to other mailboxes: sales@ for two people, contact@ for the front desk.

1. Under Email → Aliases, click New alias.
2. In From, type the part before the @. In Name, something to recognize the alias in the list.
3. In To (participants), one address per line. The panel shows the status of each one: Mailbox, Alias, Outside the domain, Mailbox disabled or Does not exist.
4. If you like, restrict who can write to the alias and click Create.

Every domain starts with a few default addresses (such as postmaster@), which appear in the alias list. Addresses that start with grp- are reserved.

To go deeper in the admin panel manual:

• Aliases (chapter 7)
• Editing an alias
• Alias with a destination that does not receive
• The panel rejects the address or the name

5. Service groups: what they are and how to create one

A group brings mailboxes together so you can apply rules to all of them at once, instead of one by one.

A service group brings together a company's mailboxes, such as support or the field crew, for four things: the hours when access is blocked, the browser session length, an address book that also becomes a group in Colabora, and an email address that delivers to everyone in the group. Every domain has the Default group, with all mailboxes and no rules.

1. In Email → Service groups, click New group.
2. Give it a name and, if you like, a description, and click Create group. The name cannot match the address of a mailbox or an alias in the domain: with the mailbox support@, a group called "Support" is rejected, which is why the example uses "Support team".
3. Open the group and, on the Mailboxes tab, type part of the name or address, choose the mailboxes and click Add.
4. If you like, turn on the access hours, the web session, the address book and the group email on the other tabs.
5. On the Access security tab, you can require two-step verification, a password change at the next sign-in, and receiving mail only from senders in the same domain, all at once for every mailbox in the group. When you edit each mailbox, whatever comes from the group appears locked, with the group's name.

To go deeper in the admin panel manual:

• Service groups (chapter 9)
• Creating a group
• Address book and group in Colabora
• Group email
• Requiring 2FA and a password change, per mailbox or per group

6. Edit an account

Everything that changes after the mailbox is created lives on its page.

Click the mailbox address to see everything about it (status, space, messages, devices, groups and aliases) and Edit mailbox to change:

• Full name and phone.
• License: this is where you change the plan and, with it, the mailbox size.
• Only senders from the same domain: the mailbox only receives from people in the domain.
• Access to webmail and Colabora: require two-step verification and a password change at the next sign-in. When the requirement comes from a service group, the option is locked on the mailbox and says which group it comes from.
• Talk and Tasks: turn on or off, when the mailbox's license includes these features.
• Forwarding (copy): addresses that get a copy of everything that arrives.
• Status: disabling blocks access and delivery, but the mailbox still takes up the license.

To change the webmail password, use Change password on the mailbox page.

To go deeper in the admin panel manual:

• Editing a mailbox (chapter 6)
• Changing the plan (license)
• Changing the mailbox password
• Removing a mailbox

7. Enable email apps: IMAP, POP, SMTP and ActiveSync

To use the mailbox in Outlook, Thunderbird or on a phone, the panel controls app access and generates a dedicated password for them.

In the panel, app access is a single control for IMAP, POP and SMTP, on the mailbox page, under App access. There is no button per protocol.

1. On the mailbox page, check the status under Settings: App access (IMAP, POP, SMTP): Enabled. To block use in apps and phones while keeping webmail, click Block app access; to turn it back on, Allow app access.
2. Email apps use their own password, separate from the webmail one. Click Generate new app password and confirm.
3. The password appears only once. Give it to the person right away; after that, you can only generate another, and generating another invalidates the previous one.

And phones with Exchange (ActiveSync)?

ActiveSync has no on/off switch in the panel. The person adds the mailbox as an Exchange account on the device, with the full email address and the webmail password (not the app password), and the device then appears in Email → Devices and in the mailbox's Connected devices box, where an administrator can remove the device (and, if the feature is on, wipe it remotely). The screen lock password and the wipe after wrong passwords are set on the service group's Mobile tab (admin panel manual). The phone walkthrough is in the webmail manual.

To go deeper in the admin panel manual:

• App password (chapter 6)
• Requiring 2FA and a password change
• Exchange account on the phone (webmail manual)
• Outlook, iPhone and Mac (webmail manual)

Final check

If a step does not pass, see Common problems in the admin panel manual. To migrate emails from an old provider to the new mailboxes, see Migrating emails from another provider.