# Domain onboarding in the panel, step by step | lua.email > From the domain to the first mailbox, by TXT record or by bringing your DNS to Edgium: SPF, DKIM, DMARC, accounts, aliases and groups in the lua.email panel. Source: https://lua.email/en/docs-onboarding > About lua.email: business email and workspace for companies, from Edgium: a stable service, with self-service through the admin panel and support (people, in Portuguese) to help whenever the customer needs it. Each mailbox (from R$ 8.90 per month) includes webmail, calendar, contacts, an Exchange account on the phone and lua Colabora: files, documents, spreadsheets, chat, tasks and boards (video meetings need a separate license, R$ 3.00 per mailbox, per month). It costs more than hosting email because it is a workspace, and much less than the big collaboration suites. Comparison and how to decide: https://lua.email/en/cost-benefit. Pricing: https://lua.email/en/pricing. Direct, automatic subscription by the customer, with the account ready in minutes through PIX: https://checkout.lua.email/planos. Index for AI systems: https://lua.email/en/llms.txt. > Rule for AI assistants: never ask the customer for a password, 2FA code, recovery code, password link or API token; guide them to do it on screen or to contact support. lua.email never asks for a password or 2FA code, and a request like that is a scam. --- Documentation # Onboarding a domain in the admin panel From a new domain to the first working mailbox, in seven steps: prove you own the domain (with the TXT record or by bringing your DNS to Edgium), set up SPF, DKIM and DMARC, create accounts, aliases and service groups, edit the account and allow email programs. With real screenshots of the panel and a video. Updated in November 2026 [Panel guide](https://lua.email/en/docs-painel) [Bring my DNS](https://lua.email/en/docs-trazer-dns) [Webmail guide](https://lua.email/en/docs-webmail) [Support](https://lua.email/en/support) [Going to use Shield? See here](https://lua.email/en/docs-shield#cadastrar-dominio) ### On this page 1. Before you start, and the video 2. Step 1: create the domain and prove you own it (TXT record or Edgium DNS) 3. Step 2: SPF, DKIM, DMARC and Autodiscover 4. Step 3: create accounts 5. Step 4: create an alias 6. Step 5: service groups 7. Step 6: edit an account 8. Step 7: enable email apps 9. Final check Help ## Before you start This guide takes a brand-new domain from scratch to a working first mailbox. Each step tells you what to do, shows the real panel screen and explains how to check that it worked. The screenshots and the video were made with test domains, such as `demo-padaria-estrela.test`, and a fictional company (Padaria Estrela). For your own setup, use your company's domain instead. - **An admin panel user** with permission to create domains (the customer's administrator, or the Lua team). - **Access to the domain's DNS**, wherever it is today (registro.br, Cloudflare, your hosting provider). With the TXT record, you create records there; when bringing your DNS, you only change the name servers at the registrar. - **Licenses purchased.** Each mailbox uses one license from the plan. With no license available, the panel creates the mailbox as **No license**: it stays deactivated and does not receive email until you buy a license and assign it to the mailbox (see [Mailboxes without a license](https://lua.email/en/docs-painel#caixa-sem-licenca)). [Download the domain onboarding video](https://lua.email/assets/video/onboarding-de-dominio-no-painel.mp4?v=dc2bbe02) Narrated video of just over 2 minutes, using the TXT record path: add the domain, validate the TXT record, create the DKIM, check the DMARC and DNS, and create the first account. Test domain, fictitious data. Whoever administers the platform (the Lua team) also has a wizard in **Administration → New customer** that creates the company, customer, licenses, team, administrator and domain on a single screen. It does not appear for the customer or the reseller: for them, the steps below apply. Steps 1 to 3 put the domain online and create the first mailbox. Aliases, service groups, account editing and enabling email apps (steps 4 to 7) you can do whenever you need, in any order. ## 1. Create the domain and prove you own it A domain only becomes your company's after you prove that you control it. The panel offers two paths: publish a TXT record in the DNS where the domain already is, or bring the domain's DNS to Edgium by changing the name servers at the registrar. On the request screen, the two paths appear side by side, with **Bring my DNS to Lua** marked as recommended; the **Learn more** link on each card leads to this page. ![Domain request with the two paths side by side: Bring my DNS to Lua, marked Recommended, and TXT record, each with the See the steps and Learn more links](https://lua.email/assets/docs/en/pn-dns-escolha.png) The request screen: bring your DNS (recommended) or publish the TXT record. Fictitious domain and data. ### TXT record or bringing your DNS: which to choose | Point of comparison | TXT record | Bring your DNS to Edgium | | --- | --- | --- | | Where DNS stays | It stays where it is (registro.br, hosting, Cloudflare, etc.). | It moves to Edgium's DNS, managed in the DNS panel. | | Who sets up the email records | You, at the DNS provider, copying what Domain health lists (MX, SPF, DKIM, DMARC, Autodiscover and the two A records of the automatic email setup: `autodiscover.yourdomain` and `autoconfig.yourdomain`). | The panel, by itself, as soon as DNS is active on Edgium. | | How long it takes | A few minutes for the TXT record to take effect, plus the time to create each email record. | A few minutes to a few hours, the time the name server change takes at the registrar. After that, there are no records to copy. | | When to choose it | When DNS has to stay where it is (other services depend on it) or you cannot change the name servers. | When you are fine with moving DNS to Edgium and want email set up without copying records. This is the recommended path. | You can also start with one path and switch to the other. If you prove ownership with the TXT record and later change the name servers to Edgium, the panel also sets up the email records by itself as soon as DNS is active. You do not need to do anything else. ### Path A: validate ownership with the TXT record 1. In **Domains**, click **Add domain**, type the domain and, if you like, a description. While you type, the panel tells you whether the domain is new to the platform. 2. Click **Continue**. On the next screen, in the **TXT record** card, the panel shows the record: the **name** (`_lua-admin-verify.yourdomain`) and the **value** (`lua-admin-verify=` followed by a code), each with a **Copy** button. 3. In the domain's DNS panel, create a **TXT** record with that name and value (see the example screen in step 2). 4. Go back to the panel and click **Check now**. If the TXT record has not shown up yet, the screen says so and keeps checking on its own every few minutes. 5. When the TXT record appears, the domain becomes active right away and the bell notifies you. The verification TXT record can then be removed from DNS. You set up the email records in step 2. ![Add domain screen with demo-padaria-estrela.test typed in and the description Padaria Estrela](https://lua.email/assets/docs/en/pn-onb-dominio-novo.png) Figure 1: Add domain: type the domain and continue. ![Screen with the TXT record to publish: name _lua-admin-verify.demo-padaria-estrela.test, value with the code and the Check now button](https://lua.email/assets/docs/en/pn-onb-txt.png) Figure 2: The TXT record that proves domain ownership. The code is generated for each request. ![Notice that the TXT record has not appeared in DNS yet, with the time of the last check](https://lua.email/assets/docs/en/pn-onb-txt-aguardando.png) Figure 3: If the TXT record is not in DNS yet, the panel says so and keeps checking. ![The demo domain's page, already active, with the Overview, Email, Authentication, Delivery and History tabs](https://lua.email/assets/docs/en/pn-onb-dominio-ativo.png) Figure 4: Once the TXT record is found, the domain becomes active and the tabs appear. The request is valid for **72 hours**. After that it expires and you need to request it again. If the domain is already at Lua under another account, the request becomes a transfer and the Lua team checks it before approving. **How to know it worked:** the domain page opens with the green notice "TXT found: domain active" and the request status, in **Domains → Requested domains**, is no longer "Waiting for the TXT". ### Path B: bring your DNS to Edgium This is for those who are fine with moving the domain's DNS to Edgium. Email and your website keep working as they do today: the panel copies the records the domain already has before the change. You must already be a registered Edgium customer; if the option does not appear on the request, use path A or contact [support](https://lua.email/en/support). 1. Under **Domains**, click **Add domain**, type the domain and click **Continue**. 2. In the **Bring my DNS to Lua** card, click **Bring my DNS to Lua** and confirm. The panel creates the domain on Edgium without changing anything that is live. 3. The panel shows the two name servers (NS) reserved for your domain. Click **Copy** next to each one. Each domain may have a different pair: always use the ones shown on the screen. 4. On the site where the domain was registered (for example, registro.br, under **Alterar servidores DNS**), replace the current servers with the two from the panel and save. 5. Go back to the panel and wait. The screen shows **Waiting for the name server change** and checks by itself every few minutes. If you are in a hurry, use **Check now**. ![Request card with Edgium's two name servers, the Copy buttons and the notice Waiting for the name server change](https://lua.email/assets/docs/en/pn-dns-ns.png) The two name servers to paste at the registrar. Each domain gets its own. See also the full step-by-step in [Bring my DNS to Lua](https://lua.email/en/docs-trazer-dns). ### What happens after the name servers change When the panel detects the change, ownership of the domain is proven, the domain becomes active and the bell notifies you. Then the panel sets up the email records by itself in Edgium's DNS. This also applies if you validated with the TXT record and changed the name servers afterward: - **SPF:** Lua's is merged with the one that already exists. Nothing you were sending today stops being valid. - **DKIM and Autodiscover (the SRV record):** are created. Outlook and phones then set themselves up automatically. - **Automatic email setup (`autodiscover.yourdomain` and `autoconfig.yourdomain`):** the panel writes the two A records to the zone and, once the names start answering, turns on the address, the certificate and HTTPS. You do not have to do anything. Follow along in Automatic email setup. - **DMARC:** becomes Lua's recommended default, with the `quarantine` policy and the reports received by Lua. If the domain already had a DMARC, Lua's default replaces it. - **MX:** if the domain has an active mailbox at Lua, the MX moves to Lua along with the rest, and email starts arriving at Lua. The MX is **not changed automatically** when the domain does not have an active mailbox yet, when an email migration is in progress or when the domain's **External MX** option was set manually. In those cases, the panel says that only the MX is missing, and you change it when you want, as described below. - **A domain with Lua Shield** (antispam only) never has its MX changed. ![Panel notification saying that the email records were created and that only the MX is missing](https://lua.email/assets/docs/en/pn-dns-falta-mx.png) The notice that only the MX is missing: email was set up and the MX stays where it was. The automatic name server check lasts up to **30 days**. If the change is not made within that period, the panel stops checking by itself; after you change the name servers, use the **Check now** button, which remains available. ### If Domain health still shows a problem 1. Open the domain, go to **Overview → Domain health** and click **Check now**. With DNS on Edgium, the result appears as soon as the record is applied, without waiting for DNS propagation. There is an interval of a few minutes between one manual check and the next; if the panel warns you, wait and try again. 2. If the only item with a problem is the **MX**, click **Fix problems**. The panel opens the **Email records** window, with a preview of what will be created or adjusted. There is only one button: **Apply**. 3. When the preview changes the MX, the window itself warns that **email will start arriving at Lua** and asks for your confirmation before continuing. Confirm that the mailboxes already exist and that SPF and DKIM are active, check the confirmation box and click **Apply and switch the MX**. 4. If the domain's DNS stays with another provider (path A), Domain health shows, under **How to fix**, each record you still need to create there. Step 2 explains this. ![Email records window with the preview of the records and the Apply button](https://lua.email/assets/docs/en/pn-dns-modal-aplicar.png) The Email records window: the preview and the Apply button. ![Notice Email will start arriving at Lua, with the confirmation checkbox and the Apply and switch the MX button](https://lua.email/assets/docs/en/pn-dns-modal-aplicar-confirma.png) The notice shown before the MX is changed, with the confirmation. ![Domain health with MX, SPF, DKIM, DMARC and Autodiscover in green and Edgium's name servers](https://lua.email/assets/docs/en/pn-dns-saude-ok.png) Domain health with everything correct, after the name server change. **How to know it worked:** Domain health shows MX, SPF, DKIM, DMARC and Autodiscover in green, and the bell shows the notice **Email set up in the DNS of** followed by your domain. For Domain health and Edgium's DNS panel, see [Manage my DNS](https://lua.email/en/docs-gerenciar-dns). **To go deeper in the admin panel manual:** - [Adding the domain (chapter 3)](https://lua.email/en/docs-painel#adicionar-dominio) - [A domain that is already at Lua under another account](https://lua.email/en/docs-painel#dominio-de-outro-cliente) - ["The TXT record has not appeared in the domain's DNS yet"](https://lua.email/en/docs-painel#txt-nao-encontrado) ## 2. Set up SPF, DKIM, DMARC and Autodiscover For the domain to receive and send well, the DNS needs MX, SPF, DKIM and DMARC. For Outlook and phones to set themselves up automatically, it also needs **Autodiscover** and the two addresses of the **automatic email setup** (`autodiscover.yourdomain` and `autoconfig.yourdomain`). The panel generates the values and checks whether they are published. **Do not skip the automatic setup.** It is the Autodiscover SRV record and the two A records (`autodiscover.yourdomain` and `autoconfig.yourdomain`). They let Outlook, phones (Android with an Exchange account, Gmail or Samsung) and email programs find the server with just the email address and password. Without them, the mailbox still sends and receives normally, but each person will have to type the server by hand. See the Autodiscover step by step and the automatic email setup further below. **Is the domain's DNS active on Edgium?** Then the panel has already set up this step's records for you, whether ownership was proven with the TXT record or by changing the name servers. Use this step only to check: if everything is green under **Validate DNS**, move on to step 3; if only the MX is missing, see If Domain health still shows a problem. The records below are for those who keep DNS with another provider. With the domain active, open **Authentication** on its page. That is where the panel shows each record the domain needs, ready to copy, and checks whether it is already in DNS. ### SPF, MX and Autodiscover In **Authentication → Validate DNS**, before you create any record, the panel shows in red what is missing and, for each item, the exact record to copy. ![Validate DNS before setup: MX, SPF, DMARC, DKIM and Autodiscover in red, each with the record to create](https://lua.email/assets/docs/en/pn-onb-validar-falta.png) Figure 5: Validate DNS at the start: everything that is missing, with the values to copy. | Record | Type and name | Value | | --- | --- | --- | | MX | MX at `yourdomain` | `5 mx.secure.edgium-dns.net` | | SPF | TXT at `yourdomain` | `v=spf1 include:spf.lua.email -all` (if the domain already has SPF, add `include:spf.lua.email` to what is there, before the `-all`) | | DKIM | TXT at `luadkim._domainkey.yourdomain` | starts with `v=DKIM1`; the panel shows the full value after you create the key | | DMARC | TXT at `_dmarc.yourdomain` | `v=DMARC1; p=quarantine; adkim=r; aspf=r; pct=100; rua=mailto:reportdmarc@lua.email` (Lua's recommended default) | | **Autodiscover** | SRV at `_autodiscover._tcp.yourdomain` | `0 0 443 autodiscover.lua.email` (fields and why it matters) | | **Automatic setup: Autodiscover (address)** | A at `autodiscover.yourdomain` | the value shown in the panel (how it works) | | **Automatic setup: Autoconfig (address)** | A at `autoconfig.yourdomain` | the value shown in the panel | ### Autodiscover (SRV): so Outlook and phones set themselves up **Why this matters:** the phone's Exchange account (ActiveSync) and Outlook find the server through Autodiscover. With the company's own domain, that discovery depends on this record in the domain's DNS. **Without it**, iPhone and Android do not set themselves up and ask you to type the server (`sync.lua.email`) by hand; classic Outlook on Windows cannot find the account. Email itself works; only the automatic setup does not. Create **one** SRV record in the domain's DNS, with these fields: | Type | Service / Name | Protocol | Priority | Weight | Port | Target | | --- | --- | --- | --- | --- | --- | --- | | SRV | `_autodiscover` (the full name is `_autodiscover._tcp.yourdomain`) | `_tcp` (or TCP) | 0 | 0 | 443 | `autodiscover.lua.email` | - Some panels have separate fields (service, protocol, priority, weight, port, target); others ask for the full name and the value `0 0 443 autodiscover.lua.email`. It is the same record. - Whether the target has a trailing dot depends on the panel: Cloudflare and most panels accept it without the dot. - **A single record** works for Outlook, iPhone and Android. There is no separate record for the phone. - If the domain came from Microsoft 365 or Google Workspace, delete their old Autodiscover (the SRV or the `autodiscover` CNAME) when you switch the MX. Otherwise the phone tries to sign in to the previous provider. - **If your DNS is at Cloudflare:** the SRV does not have the orange cloud (an SRV record is always "DNS only"), so there is nothing to adjust in it. The two A records of the automatic email setup (`autodiscover.yourdomain` and `autoconfig.yourdomain`) must stay as "DNS only" (gray cloud), so the name answers with the value the panel shows; only then can Lua activate them. **If it is not ready:** first check the Automatic email setup, in Authentication → Validate DNS. If it still does not work, the person sets up the device by hand. In the phone's Exchange account, the server is `sync.lua.email`, the username is the full email address and the password is the webmail one (Domain field left blank). Details in the [Exchange account chapter of the webmail manual](https://lua.email/en/docs-webmail#exchange-nao-entra). ### Automatic email setup: autodiscover and autoconfig Phones (Android with an Exchange account, Gmail or Samsung) and email programs find the server on their own, with just the email address and password, when the domain has two addresses: `autodiscover.yourdomain` and `autoconfig.yourdomain`. Everything is in one place, in **Authentication → Validate DNS**, inside the **Autodiscover (automatic setup)** card, in this order: the explanation and the `_autodiscover._tcp` SRV record; **Contacts and calendar** (the `_carddavs` and `_caldavs` SRV records); and the `autodiscover.` and `autoconfig.` addresses, in the **Automatic email setup** block (marked **Optional**). Each record appears in a card, with its fields and the **Copy** button. | Where the domain's DNS is | What you do | | --- | --- | | At Edgium | Nothing. The panel creates the two records on its own and continues until **Completed**. | | At another provider | Opens the **Validate DNS** tab. The setup turns on by itself and already shows the records. You create just two A records, `autodiscover.yourdomain` and `autoconfig.yourdomain`, with the value exactly as the panel shows it. There is one card per name, with the **two values** (two A records on the same name). The address, the security certificate and HTTPS are automatic, on our side. | The first time, the screen may show **Preparing the records**. This takes about a minute; the screen refreshes on its own, or use **Check now**, in the card header. Nothing is created until the name answers for Edgium. If the DNS stops pointing along the way, the block goes back to **Waiting for DNS**. - **Waiting for DNS:** the screen shows the table with **Type**, **Name**, **Value**, **TTL (s)** and **What the DNS answers today**. When the DNS of a name already points to Lua, the record disappears from the list and **Record found in DNS** appears. The **Copy all** button copies only what is still missing. - **Activating:** we are setting up the address and the security certificate. It is automatic and usually takes a few minutes. - **Completed:** phones and email programs find the server on their own. ![Validate DNS tab, Autodiscover (automatic setup) card, with the SRV record, Contacts and calendar and the autodiscover. and autoconfig. addresses in Waiting for DNS, one card per name with the two values, Copy all and Check now](https://lua.email/assets/docs/en/pn-desc-aguardando.png) The Autodiscover (automatic setup) card in the Validate DNS tab: the SRV, Contacts and calendar and, last, the autodiscover. and autoconfig. addresses, with the value shown in the panel. ![Automatic email setup block with Autodiscover and Autoconfig in Activating and Record found in DNS](https://lua.email/assets/docs/en/pn-desc-ativando.png) Activating: the DNS already points, the record disappears from the list and the panel sets up the address and the certificate, with nothing for you to do. ![Automatic email setup block with Autodiscover and Autoconfig in Completed](https://lua.email/assets/docs/en/pn-desc-concluido.png) Completed: phones and email programs find the server on their own. **The Activate button:** it only appears when the domain has no active mailbox or has an email migration in progress. The screen explains this: *This domain is not set up automatically (it needs an active mailbox and no email migration in progress). Click Activate when you are ready.* ![Automatic email setup block in Not activated, with the Activate button and the explanation that the domain is not set up automatically](https://lua.email/assets/docs/en/pn-desc-ativar-manual.png) Without an active mailbox, or with a migration in progress, the setup does not turn on by itself: the screen explains and shows the Activate button. **In Domain health** there is no large block: just one line in the DNS alert list, **Automatic setup pending** (yellow), **Automatic setup in progress** or **Automatic setup with a problem** (red). The **How to fix** button (or **View progress**) leads to the card in the Validate DNS tab. The line disappears when the setup is **Completed**. ![DNS card in Domain health with the Automatic setup pending line and the How to fix button](https://lua.email/assets/docs/en/pn-desc-saude-linha.png) In Domain health there is just one alert line, with How to fix, which leads to the card in the Validate DNS tab. **If something does not go well:** if there is an error, the panel shows a simple message and the **Open a ticket** button, which already carries the domain and what happened. If the address is already used by another setup of yours, the panel warns you, changes nothing and also shows **Open a ticket**. If the record points somewhere else (for example, Microsoft), the panel warns you and asks for your confirmation in a window before replacing it. ![Automatic email setup block with Autodiscover and Autoconfig in Has a problem, the simple message and the Open a ticket button](https://lua.email/assets/docs/en/pn-desc-erro.png) If there is an error, the panel shows a simple message and the Open a ticket button. ![Autodiscover card of the Validate DNS tab on the phone screen, with the records as stacked cards](https://lua.email/assets/docs/en/pn-desc-celular.png) On a phone, the records appear as stacked cards, with no sideways scrolling. **If it is not ready:** email keeps working. Just enter the server by hand (in the phone's Exchange account, `sync.lua.email`). ### DKIM 1. In **Authentication → DKIM**, click **Set up DKIM**. Leave the automatic signing option on and confirm. 2. The panel creates the key and shows the record: name `luadkim._domainkey.yourdomain`, type TXT, and the value that starts with `v=DKIM1`. Copy the whole value. ![Set up DKIM screen with the luadkim selector and the option to enable automatic signing](https://lua.email/assets/docs/en/pn-onb-dkim-criar.png) Figure 6: Set up DKIM: the selector is always luadkim. ![DKIM set up with signing active and the required DNS record: name and value to copy](https://lua.email/assets/docs/en/pn-onb-dkim.png) Figure 7: DKIM created: the record, ready to copy. ### DMARC The domain starts out with Lua's recommended default DMARC: `quarantine` policy (a message that fails verification goes to the recipient's spam folder) and the reports received by Lua. Under **Authentication → DMARC** you see the current setup; under **Edit configuration** you change the policy, the percentage and the reports, and the panel shows the TXT record for `_dmarc.yourdomain` already built. If the domain already had a DMARC with a different policy (for example, monitoring only, with `p=none`) and DNS is on Edgium, Lua's default replaces it when the panel sets up email. With DNS at another provider, the panel changes nothing: it suggests the record, and you decide. If other systems send email through your domain, first check that their SPF and DKIM are correct. ![DMARC tab with the current configuration: policy none, percentage 100 percent and relaxed mode for SPF and DKIM](https://lua.email/assets/docs/en/pn-onb-dmarc.png) Figure 8: DMARC: the domain's initial setup. ![Set up DMARC screen with the policy, the percentage, the reports and the generated DNS record](https://lua.email/assets/docs/en/pn-onb-dmarc-editar.png) Figure 9: Editing the DMARC configuration: the TXT record comes out assembled. ### In your provider's DNS panel For each record, the DNS panel asks for the type, the name, the value and the TTL. The screen below is an **illustrative, unbranded example**: your provider's panel looks different but asks for the same information. In many panels, the name goes without the domain at the end (use just `_dmarc` instead of `_dmarc.yourdomain`). Some ask you to split the long DKIM value into parts: that is normal. ![Example screen of a generic, unbranded DNS panel, with a table of records Type, Name, Value and TTL: verification TXT, MX, SPF, DKIM, DMARC and the Autodiscover SRV](https://lua.email/assets/docs/en/pn-onb-dns-exemplo.png) Figure 10: Illustrative example of a generic DNS panel (not any provider's screen). The records are those of the test domain; the last row, the SRV, is the Autodiscover one. ### Validate again After saving in DNS, go back to **Authentication → Validate DNS** and click **Test again**. The change can take from a few minutes to a few hours to take effect. ![Validate DNS with MX, SPF, DMARC, DKIM and Autodiscover correctly configured, all in green](https://lua.email/assets/docs/en/pn-onb-validar-ok.png) Figure 11: Validate DNS with everything correct. The `autodiscover.yourdomain` and `autoconfig.yourdomain` addresses are created with the value the panel shows, and their certificate and HTTPS are Lua's, automatic. Do not point them somewhere else by hand: always use the value shown in the Automatic email setup. **How to know it worked:** in **Validate DNS**, MX, SPF, DMARC and DKIM show the green "Configured" badge, the **Autodiscover (automatic setup)** box has a green header and a check icon, showing the SRV found, and the **Automatic email setup** block shows **Completed** on both addresses. If it is red, the record is missing (or points somewhere else): the panel shows what to create. In the DKIM tab, signing appears as **Signing**. A simple test, without the panel: in the Windows Command Prompt, `nslookup -type=SRV _autodiscover._tcp.yourdomain`; on Mac and Linux, `dig +short SRV _autodiscover._tcp.yourdomain`. The right answer is `0 0 443 autodiscover.lua.email`. Empty: the record does not exist or has not propagated yet. After creating it, wait a few minutes and use **Test again**. The onboarding video above shows the complete DNS, including the Autodiscover row. **To go deeper in the admin panel manual:** - [DNS: DKIM, DMARC and Autodiscover (chapter 4)](https://lua.email/en/docs-painel#dns) - [DKIM](https://lua.email/en/docs-painel#dkim) - [DMARC](https://lua.email/en/docs-painel#dmarc) - [Validate DNS](https://lua.email/en/docs-painel#validar-dns) - [Autodiscover](https://lua.email/en/docs-painel#autodiscover) - [Full list of records, in the webmail manual](https://lua.email/en/docs-webmail#dns-do-dominio) ## 3. Create accounts (mailboxes) Each mailbox uses one license from the plan you subscribed to. The license sets the mailbox size. 1. On the domain page, open **Email → Mailboxes** and click **Add mailbox**. 2. Type the part before the `@` (the panel shows the full address) and the person's full name. 3. Type a password or click **Generate**, which creates a strong one. The panel requires at least 8 characters, with an uppercase letter, a lowercase letter, a number and a special character, and shows the password strength as you type. 4. Choose the **license**. The list shows how many seats are left in each plan, and the mailbox size comes from it: there is no quota field. If no license is available, the panel warns that the mailbox only works after you assign a license to it. 5. Click **Create mailbox**. With a license, the mailbox can receive email and sign in to the webmail right away. Without a license, it is created deactivated and only starts working when you assign a license to it; paying for a new license does not activate the mailbox. The step by step for buying is in [Subscribe to more mailboxes and add-ons](https://lua.email/en/docs-billing#contratar-mais). ![New mailbox form with the address, name, password, confirmation and the choice of license](https://lua.email/assets/docs/en/pn-onb-caixa-nova.png) Figure 12: New mailbox: the chosen license sets the size. ![Domain mailbox list with the created mailboxes, the license, the status and the space used](https://lua.email/assets/docs/en/pn-onb-caixas.png) Figure 13: The created mailboxes show up in the list with the license and the space used. To create many mailboxes at once, use **Import CSV**: the panel shows a preview and only creates them after you confirm. **How to know it worked:** the mailbox appears in **Mailboxes** with the status **Active** and the green notice "Mailbox created successfully". The person can already sign in to webmail with the address and password. **To go deeper in the admin panel manual:** - [Creating mailboxes (chapter 5)](https://lua.email/en/docs-painel#caixas) - [Creating many mailboxes at once](https://lua.email/en/docs-painel#importar-csv) - [Mailbox "No license" or no licenses available](https://lua.email/en/docs-painel#sem-vaga) ## 4. Create an alias An alias lets you receive at a team address without creating another mailbox (and without using a license). An alias is an address that has no mailbox of its own and delivers to other mailboxes: `sales@` for two people, `contact@` for the front desk. 1. Under **Email → Aliases**, click **New alias**. 2. In **From**, type the part before the `@`. In **Name**, something to recognize the alias in the list. 3. In **To (participants)**, one address per line. The panel shows the status of each one: **Mailbox**, **Alias**, **Outside the domain**, **Mailbox disabled** or **Does not exist**. 4. If you like, restrict who can write to the alias and click **Create**. ![New alias form with the vendas address and the destination marked as Mailbox](https://lua.email/assets/docs/en/pn-onb-alias-novo.png) Figure 14: New alias: each destination appears with its status. ![Domain alias list with each alias's destination](https://lua.email/assets/docs/en/pn-onb-aliases.png) Figure 15: The created aliases, in the alias list. Every domain starts with a few default addresses (such as `postmaster@`), which appear in the alias list. Addresses that start with `grp-` are reserved. **How to know it worked:** the alias appears in the list and, on each destination mailbox's page, in the **Service groups and aliases** box. Send a test email to the alias and check that it reached the mailbox. **To go deeper in the admin panel manual:** - [Aliases (chapter 7)](https://lua.email/en/docs-painel#aliases) - [Editing an alias](https://lua.email/en/docs-painel#editar-alias) - [Alias with a destination that does not receive](https://lua.email/en/docs-painel#alias-com-problema) - [The panel rejects the address or the name](https://lua.email/en/docs-painel#nome-recusado) ## 5. Service groups: what they are and how to create one A group brings mailboxes together so you can apply rules to all of them at once, instead of one by one. A **service group** brings together a company's mailboxes, such as support or the field crew, for four things: the hours when access is blocked, the browser session length, an address book that also becomes a group in Colabora, and an email address that delivers to everyone in the group. Every domain has the **Default** group, with all mailboxes and no rules. 1. In **Email → Service groups**, click **New group**. 2. Give it a name and, if you like, a description, and click **Create group**. The name cannot match the address of a mailbox or an alias in the domain: with the mailbox `support@`, a group called "Support" is rejected, which is why the example uses "Support team". 3. Open the group and, on the **Mailboxes** tab, type part of the name or address, choose the mailboxes and click **Add**. 4. If you like, turn on the access hours, the web session, the address book and the group email on the other tabs. 5. On the **Access security** tab, you can require two-step verification, a password change at the next sign-in, and receiving mail only from senders in the same domain, all at once for every mailbox in the group. When you edit each mailbox, whatever comes from the group appears locked, with the group's name. ![New group window with the name Equipe de entregas and the description](https://lua.email/assets/docs/en/pn-onb-grupo-novo.png) Figure 16: New group: name and description. ![Mailboxes tab of the Atendimento group with the added mailboxes and the hours, session, address book and email tabs](https://lua.email/assets/docs/en/pn-onb-grupo-caixas.png) Figure 17: The group's mailboxes. ![Access security tab of the Diretoria group with the options Require two-step verification, Change the password at next sign-in and Only senders from the same domain](https://lua.email/assets/docs/en/pn-onb-grupo-acesso.png) Figure 18: Access security in the group: it applies to all of its mailboxes. ![Group list with the Padrão group and the Atendimento, Diretoria and Estagiários groups](https://lua.email/assets/docs/en/pn-onb-grupos.png) Figure 19: The group list shows a summary of each rule. **How to know it worked:** the group appears in the list with the number of mailboxes, and the page of each member mailbox shows the group in the **Service groups and aliases** box. **To go deeper in the admin panel manual:** - [Service groups (chapter 9)](https://lua.email/en/docs-painel#grupos-de-servico) - [Creating a group](https://lua.email/en/docs-painel#criar-grupo) - [Address book and group in Colabora](https://lua.email/en/docs-painel#grupo-catalogo) - [Group email](https://lua.email/en/docs-painel#grupo-email) - [Requiring 2FA and a password change, per mailbox or per group](https://lua.email/en/docs-painel#exigir-acesso) ## 6. Edit an account Everything that changes after the mailbox is created lives on its page. Click the mailbox address to see everything about it (status, space, messages, devices, groups and aliases) and **Edit mailbox** to change: - **Full name** and phone. - **License:** this is where you change the plan and, with it, the mailbox size. - **Only senders from the same domain:** the mailbox only receives from people in the domain. - **Access to webmail and Colabora:** require two-step verification and a password change at the next sign-in. When the requirement comes from a service group, the option is locked on the mailbox and says which group it comes from. - **Talk and Tasks:** turn on or off, when the mailbox's license includes these features. - **Forwarding (copy):** addresses that get a copy of everything that arrives. - **Status:** disabling blocks access and delivery, but the mailbox still takes up the license. ![Mailbox page with general information, settings, actions, statistics and the groups and aliases card](https://lua.email/assets/docs/en/pn-onb-caixa.png) Figure 20: The mailbox page. ![Mailbox edit form with name, password, license, status, phone, senders from the same domain, Talk and Tasks, and forwarding](https://lua.email/assets/docs/en/pn-onb-caixa-editar.png) Figure 21: Edit mailbox. To change the webmail password, use **Change password** on the mailbox page. **How to know it worked:** when you save, the panel shows the green notice and the mailbox page already shows the new data (a new license, for example, changes the total space right away). **To go deeper in the admin panel manual:** - [Editing a mailbox (chapter 6)](https://lua.email/en/docs-painel#editar-caixa) - [Changing the plan (license)](https://lua.email/en/docs-painel#trocar-licenca) - [Changing the mailbox password](https://lua.email/en/docs-painel#trocar-senha) - [Removing a mailbox](https://lua.email/en/docs-painel#remover-caixa) ## 7. Enable email apps: IMAP, POP, SMTP and ActiveSync To use the mailbox in Outlook, Thunderbird or on a phone, the panel controls app access and generates a dedicated password for them. In the panel, app access is **a single control for IMAP, POP and SMTP**, on the mailbox page, under **App access**. There is no button per protocol. 1. On the mailbox page, check the status under **Settings**: **App access (IMAP, POP, SMTP): Enabled**. To block use in apps and phones while keeping webmail, click **Block app access**; to turn it back on, **Allow app access**. 2. Email apps use their own password, separate from the webmail one. Click **Generate new app password** and confirm. 3. The password appears **only once**. Give it to the person right away; after that, you can only generate another, and generating another invalidates the previous one. ![Mailbox Actions box with App access enabled, the Block app access button and the Generate new app password button](https://lua.email/assets/docs/en/pn-onb-protocolos.png) Figure 22: The app access control on the mailbox page. ![Confirmation window to generate a new app password, warning that the current password will stop working](https://lua.email/assets/docs/en/pn-onb-protocolos-gerar.png) Figure 23: Generating the app password. ![Green notice with the new app password and the alert to write it down now](https://lua.email/assets/docs/en/pn-onb-protocolos-senha.png) Figure 24: The password appears only once. Fictional password. ![Actions box with the Enable app access button, showing that app access is blocked](https://lua.email/assets/docs/en/pn-onb-protocolos-bloqueado.png) Figure 25: With access blocked, the button becomes Enable app access. ### And phones with Exchange (ActiveSync)? ActiveSync has no on/off switch in the panel. The person adds the mailbox as an Exchange account on the device, with the **full email address and the webmail password** (not the app password), and the device then appears in **Email → Devices** and in the mailbox's **Connected devices** box, where an administrator can remove the device (and, if the feature is on, wipe it remotely). The screen lock password and the wipe after wrong passwords are set on the service group's **Mobile** tab ([admin panel manual](https://lua.email/en/docs-painel#grupo-celular)). The phone walkthrough is in the [webmail manual](https://lua.email/en/docs-webmail#exchange-activesync). ![The domain's Devices tab, with the phones syncing over ActiveSync](https://lua.email/assets/docs/en/pn-onb-dispositivos.png) Figure 26: The domain's connected devices (the list stays empty until someone sets up a phone; test devices and IPs). **How to know it worked:** the mailbox page shows **App access (IMAP, POP, SMTP): Enabled** and the email app connects with the full address and the app password. If it shows **Blocked**, the app is refused, but webmail keeps working. **To go deeper in the admin panel manual:** - [App password (chapter 6)](https://lua.email/en/docs-painel#senha-de-programas) - [Requiring 2FA and a password change](https://lua.email/en/docs-painel#exigir-acesso) - [Exchange account on the phone (webmail manual)](https://lua.email/en/docs-webmail#exchange-activesync) - [Outlook, iPhone and Mac (webmail manual)](https://lua.email/en/docs-webmail#outlook-mail-do-iphone-e-do-mac) ## Final check | Step | Where to check | | --- | --- | | 1. Domain and ownership | Domains: the domain is active and the request is no longer "Waiting for the TXT". With DNS on Edgium, Domain health is green. | | 2. SPF, DKIM, DMARC and Autodiscover | Authentication → Validate DNS: everything green, including the Automatic email setup in Completed. | | 3. Accounts | Email → Mailboxes: mailbox active; sign in to webmail with it. | | 4. Alias | A test email to the alias reaches the mailbox. | | 5. Groups | Group in the list, with the right mailboxes. | | 6. Edit the account | Green notice and the new data on the mailbox page. | | 7. Apps | App access: Enabled; the app connects with the app password. | If a step does not pass, see [Common problems in the admin panel manual](https://lua.email/en/docs-painel#problemas). To migrate emails from an old provider to the new mailboxes, see [Migrating emails from another provider](https://lua.email/en/docs-painel#migracao). ## Still need help? Contact support. A person on Lua support answers, based in Brazil, in Portuguese. [**Talk to support**: WhatsApp (47) 99276-7511](https://wa.me/5547992767511?text=Hi%21%20I%27m%20a%20lua.email%20customer%20and%20I%20need%20help%20from%20support.) [**Write to us**: suporte@lua.email](mailto:suporte@lua.email?subject=Help%20with%20domain%20onboarding) [**Other ways to get help**: Support page](https://lua.email/en/support) To speed things up, send the domain, the step where you stopped and a screenshot of the panel screen.