Account lock & block options

Questions
1

Your question

I’ve hit a situation where the account was setup for forwarding, but the destination mailbox changed/disappear, and now I have a bouncing/non-delivery (different issue w.r.t. the way PMG & Stalw.art interacted) situation for any and all incoming emails to that account and two things popped up:

Locked & Blocked status setting?

  • “Blocked” selector to prevent any incoming emails to that account with a delivery failure message if possible. User can still log in and fetch emails and fix SIEVE scripts for example.
    => A 4xx / 5xx choice and custom message (like contact support@…) would be great to

  • Locked selector, which would prevent the user from logging in, like non-payment, but still be able to receive emails if not Blocked

Blocked is “easy” to do with SIEVE, but not necessarily that intuitive… when dealing call centre agents for 600 emails…

Locked I have not seen a proper/simple method… but perhaps I missed it.

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

This confirms permission-based lockout is possible via disabledPermissions (e.g. removing authenticate, imap-authenticate, pop3-authenticate, etc.) but I should check if there’s a simpler dedicated “enabled/disabled account” toggle in the WebUI.

3

Neither flag exists as such today unfortunately.

The closest thing to Locked is to remove the authenticate permission from the account or from its role. It is checked in the login path, and changing it bumps the account’s credential version, which invalidates tokens already issued, so the user is out immediately rather than at next login. If you want a partial lock there are per-protocol versions (imap.authenticate, pop3.authenticate, managesieve.authenticate), so you can leave IMAP open and cut everything else. Setting expiresAt on the password credential is another way to time-box it.

For Blocked, Sieve reject or ereject is the mechanism, and it is what gives you the custom text; there is no per-account switch and no 4xx versus 5xx selector.

For the bounce loop specifically I would remove the forward rather than block the account, since that stops the loop at the source rather than turning it into a stream of rejections.