Hosted Email: Admin Panel

Overview/Logging In

The Zimbra domain administration console is the browser-based user interface used to centrally manage user accounts and most settings.

As a domain administrator, you will be able to create and maintain the following:

• Accounts
• Aliases
• Distribution lists
• Calendar resources

To login to the domain administration console, go to https://zimbraadmin.xmission.com/ and login with your administrative username and password.

About the Administrative Console

The area above the Content pane includes the Search and Help functions.

Search allows you to quickly find accounts, aliases, distribution lists and resources for editing.

Help utilizes Zimbra’s wiki, forums, and documentation. This is a powerful unified search to quickly find answers to common questions.

The Navigation pane on the left includes the following sections:

• Home: At any time, clicking here will return you to the administrative Home options.

• Manage: Clicking here will permit you to create and edit any accounts, aliases, distribution lists, and resources for your domain(s).

• Help: utilizes Zimbra’s wiki, forums, and documentation. This is a powerful unified search to quickly find answers to common questions.

Alternatively, you can also click on the arrow beside the "Home" button. This will give you the same options listed above, as well as recent searches and the options available under "Manage." In this example, the recent search was for "xdesign.com."

Clicking on "Manage" either way will permit you to make changes to your existing accounts, aliases, distribution lists, and resources.

• Accounts: Lists all accounts. In the Accounts folder, you create and manage end-user accounts, setting options, class of service, passwords and aliases for an account.

• Aliases: Lists all aliases that have been created in Accounts. You can use the Move Alias feature from the toolbar to move an alias from one account to another.

• Distribution Lists: Lists all distribution lists. You can create new distribution lists and add or delete members of a distribution list.

• Resources: Lists location or equipment that can be scheduled for a meeting. You can create new resources and set the scheduling policy for the resource.

Creating an Account

Select Manage and then Accounts section. Click on the gear icon and select New. This will open a dialogue asking for information about the email mailbox you are about to create. Enter the following required information:

• Account Name: This will be the mailbox account that you are about to create. In this example, we are creating "bobdobbs@xdesign.com."
• First Name: The first name of the email user.
• Last Name: The last name of the email user.

When creating a new mailbox account you will set the Class of Service (CoS) under General Information / Account Setup / Class of Service. Don't forget to deselect the "[ ] auto" box to enter the class type.

You may mix and match Class of Service (CoS) for mailbox accounts in your domain to maximize benefits for your organization. Details below.

Something to note, XMission identifies a billable Zimbra account as mailbox with a physical email Inbox and typically belonging to one person. So even if it is not "active" but still provisioned, it will count toward billing. Example, a mailbox set to "closed" or "maintenance" status remains billable.

Class of Service

To upgrade an existing account, or to change existing accounts, simply log in to the admin interface, click on "Manage" and select the user by double-clicking on the name. Inside the "General Information" pane you will see "Account Setup" in the middle of the page. In this area you will find "Class of Service" with an input box next to it and the "[x] auto" box checked. Deselect the "[ ] auto" box and type "xmpremium" or "xmbase" in the field and then hit "Save" towards the top right of the window. Your account is now set to the selected service level with all the features and storage associated with the account type.

Click the "Finish" button. You will be returned to the main admin screen, and the new account will have been created at the established service level.

NOTE: If the "Class of Service" field is not available to you, you may need to add your admin account's email address to the "admins" distribution list on your domain and wait up to fifteen minutes. Some older accounts do not have this setup automatically. See Granting Domain Administrator Access for more details.

Updating Account Information

To add, change, or remove information from an account, simply double-click the account you want to edit. Alternatively, you can right-click the account you wish to update and choose "Edit" from the pop-up menu.

Change Password

All Zimbra Domain Administrator should read this quick blog post on email security: https://xmission.com/blog/2017/10/17/best-practices-for-zimbra-email-security

Changing your end-user mailbox password through the Zimbra domain admin control panel is easy, but first let's review XMission password best practices.

XMission Zimbra Password requirements:

XMission recommends secure passphrases consisting of five to six words, with a few special characters and numbers, since they can be much easier to remember.

• Ideally it is best to use longer, more complex passphrases to properly protect your mailboxes, and your company, from hackers. Our Zimbra system supports passwords up to 64 characters. We advise using a minimum passphrase length of 12-15 characters with 25-28 characters providing very reasonable security.
• Shorter passwords require use of at least 1 of the following: UPPER CASE letter, lower case letter, special characters, and a numeral to meet minimum security requirements.
• Passwords expire after 1 year and must be changed at that time. Changing more frequently is advised.
• You cannot re-use your current password.
• Please allow 15 minutes for the new password to propagate through the system.
• Write credentials down in a secure place until you memorize it then destroy the note.
• Here is a quick and easy to understand visual tutorial on password security: | https://xkcd.com/936/

Three ways to change passwords from domain admin control panel:

• Inside the control panel main page click on "Manage" in left column. Right-mouse click on the mailbox name to reveal a drop down menu, select "Change password."
• Inside the control panel main page click on "Manage" in left column and highlight a mailbox. Now right-mouse click on the gear icon in the top right corner. Select "Change password".
• Inside the control panel main page click on "Manage" in left column and double click on the desired mailbox. When it opens the settings page of the mailbox use the "Password" area to change the password.

NOTE: XMission Zimbra servers will allow a password as short as 8 characters. Frankly, such short passwords are very poor security. Please take the time to protect your company email data buy using a passphrase in the 25-28 character length. Thank you for your consideration.

Password Expiration and Failed Login Attempts

Please note the following details about XMission's email password expiration and failed login attempts policy.

Should you ever have an end-user mailbox that is not allowing login there are two primary reasons for this.

• The password has expired.
• There have been too many failed login attempts to the account causing it to be temporarily suspended.

Expired Password

All XMission email passwords must be changed once yearly. XMission sends email notices to the user mailbox 2 (two) weeks before expiration. Please ask your mailbox owners to change their password in a timely manner.

Domain administrators are *not* emailed about the user mailbox need to change their password. Repeat, domain administrators are not emailed about password expirations.

Failed Login Attempt - Mailbox Access Suspension

Failed login attempt account suspension practices are a way to safeguard mailboxes from brute force attacks where a bad actor is trying to access the sensitive information inside. XMission protects customer mailboxes by temporarily suspending mail accounts with too many failed login attempts.

If you, or another entity, are trying to access the account with too many failed password attempts within the monitoring cycle, the system blocks access for a short period of time, after which you can again attempt to authenticate with correct credentials.

Failed login attempt definition: Improper entry of a password for a valid mailbox.

How failed login attempts are measured and enforced: When the first failed login attempt occurs, the monitoring cycle begins. Thereafter, each time a unique wrong password fails, that adds to the count.

It is important to note that when the same wrong password is used, from any number of IP addresses or devices, it only counts as one (1) failed login attempt.

During the monitoring cycle, if additional failed login attempts are made using a different password from the original attempt, it add to the failed login attempt total. IE: Bad password "A" activates monitoring period. A second unique password "B" is used bringing the total to two (2) failed attempts. If password "A" is used again, it counts as another new unique password totaling three (3) failed attempts.

Once the maximum number of failed attempts is reached, access to the mailbox is temporarily suspended.

Troubleshooting

Mailbox accounts having failed login issues appear to have the same symptoms as an expired password. The way to test is to access webmail, https://zimbra.xmission.com, with your credentials. If the password is expired it will prompt you to set a new password immediately. If the account is locked out, it will simply not validate with the credentials until the suspension period ends.

If an account is temporarily suspended for too many failed password attempts you need to either wait for the suspension period to pass, reset the mailbox status to active in the domain admin panel, or contact XMission Support to have the suspension manually removed.

Domain administrators can change mailbox status and passwords via the domain admin interface.

NOTE: Use of Two-Factor Authentication (2FA) does not prevent account suspension due to failed authentication attempts.

Creating an Alias

Select Manage and then Aliases section. Click on the gear icon and select New. This will open a dialogue asking for information about the email alias you wish to create. Enter the following required information:

• Alias: This is the aliased address you will create. In this example, we are adding "bob.dobbs@xdesign.com."
• Target Account: This is the actual email box that will receive any emails directed to the aliases address.

Click "Ok" to add your new alias.

Updating Alias Information

To add, change, or remove information from an alias, simply double-click the alias you want to edit. Alternatively, you can right-click the alias you wish to update and choose "Edit" from the pop-up menu.

Creating a Distribution List

Select Manage and then Distribution Lists section. Click on the gear icon and select New. This will open a dialogue asking for information about the distribution list you wish to create. Enter the following required information:

• List Name: This will be the email address for the mailing list.
• Display Name: This can be a descriptive name for the list.

To add email addresses to the list, scroll a bit to the right and you will see a "Search" button below the Add Members to this list section. If you want add email addresses that are withing your Zimbra package, search for the appropriate domain name(s). In this case, we searched for "xdesign.com." Highlight any results you would like to be added to the list.

Using the scroll bar on the right, scroll down and click the "Add Selected" button.

If you want to manually add addresses or need to add addresses that are not within Zimbra's search function, you can type the email addresses in the box pictured below. In this case, we are adding two email addresses to the list -- "bobdobbs@gmail.com" and "bigguyjake@xmission.com." Once you've typed in the email addresses you want added to your list, simply click the "Add" button below.

Notes:

You can make lists members of other lists. This is a handy way to create umbrella lists. For example, if you wanted a staff list, but had various departments, you could add your employees to the departmental list, and then subscribe the departmental lists to the staff lists. This way, an account is only entered once, rather than adding an account to each list individually.

Distribution Lists can also be used to forward domain based emails. For example, you may need to forward project@yourdomain.com to address@someotherdomain.com. This does not require a Zimbra account for the primary domain email address.

Updating Distribution List information

To add, change, or remove information from a list, simply double-click the list you want to edit. Alternatively, you can right-click the list you wish to update and choose "Edit" from the pop-up menu.

Forwarding Email to Another Address

If you wish to forward emails sent to your hosted email to another email address, first select Manage and then Accounts. Double-click the account you wish to edit or right-click and choose Edit from the pop-up menu.

To add a forward, click on the Forwarding section on the left-hand column.

Enter the following required information:

• User-specified forwarding address: This will be the email account that emails are forwarded to that the account owner is aware of. In the example below, we will be forwarding emails to "bob.dobbs@xmission.com."

Don't forget to choose "Save" near the upper right hand corner after you've added the forwarding address!

• Forwarding addresses hidden from the user: This can be a list of email accounts that emails are forwarded to that the account owner is unaware of. To do this, first click the "Add" button located below the Forwarding addresses hidden from the user box. It will prompt you to enter an email address. After you've done so, simply click "Ok." In the example below, we will be forwarding messages to "bobdobbs@xmission.com."

NOTE: You may also use Distribution Lists to forward domain based emails without needing an account for the specific address. For example, you may need to forward project@mydomain.com to johndoe@someotheremail.com. The advantage of using a Distribution List is that you eliminate the costs associated with maintaining an account just for forwarding.

Granting Domain Administrator Access

To grant an account administrative privileges to your domain, load their account in the admin interface and check the "Administrator" checkbox below "Class of Service". Once checked, a field will appear below, "Administrator role". Enter "admins@yourdomain.com", replacing yourdomain.com with the domain you are granting access to. This will add the user to a distribution list, "admins", on your domain, which grants the privileges.

Note that if the "Administrator" checkbox does not exist, you may need to add yourself to the "admins" distribution list manually and wait up to fifteen minutes.

Many older domains had their admin account rights assigned via a different method, with a different set of privileges that did not include access to the "Administrator" checkbox (along with adjusting mailbox quotas and, for many older domains, the ability to change classes of service).

Importing Accounts from Exchange

This article has moved: https://wiki.xmission.com/Zimbra_Migration:_Exchange_Import_Wizard

Deleting a Zimbra Mailbox

There are two fairly simple ways to properly delete a Zimbra mailbox from the XMission system.

• Log into the Zimbra Domain Admin panel and select the "Manage" area on the left. Once in the management area you simply highlight the mailbox and then right-mouse click to show the option menu. Select "Delete" and confirm the mailbox deletion request.

• From inside the Domain Admin panel you may also highlight the mailbox name and then click on the gear wheel in the top right corner of the browser screen to display an options menu. Inside this menu select "Delete" and confirm the deletion request.

Note: Changing an account status is not the same as deleting the account and will still be billed.