MailBaby Plesk Webuzo Relay: Outbound Setup

Plesk and Webuzo are less common than cPanel in shared hosting but common enough on VPS fleets that a provider usually has a few of each. Both can relay outbound mail through MailBaby, and in both cases the trick is to use the panel’s own override mechanism so the setting survives updates. This guide covers Plesk Obsidian with Postfix (and the qmail equivalent), then Webuzo’s Exim configuration.

Short answer: On Plesk, run plesk bin mailserver --set-relay-host relay.mailbaby.net:25 and --set-relay-auth true with your mbXXXXX credentials, then add smtp_sasl_mechanism_filter = login and smtp_tls_security_level = may with postconf -e and reload Postfix; servers on qmail should switch to Postfix first because qmail cannot do STARTTLS before AUTH. On Webuzo, put a LOGIN authenticator, an authenticated TLS transport with DKIM options and a manualroute router in the /etc/exim.*.pre.conf and .post.conf include files, then run exim -bV and restart Exim. Both panels also need include:spf-c.mailbaby.net in each sending domain’s SPF.

Plesk Obsidian with Postfix

Plesk exposes an “outgoing mail relay” setting in the panel at Tools & Settings » Mail Server Settings » Outgoing mail mode, but that page only handles unauthenticated relays on some versions. Configure it from the CLI instead, which handles authentication properly and writes the Postfix files for you:

plesk bin mailserver --set-relay-host relay.mailbaby.net:25
plesk bin mailserver --set-relay-auth true -relay-user mb12345 -relay-passwd 'YOUR_PASSWORD'

Check what Plesk wrote:

postconf -n | grep -E 'relayhost|smtp_sasl|smtp_tls'

You should see relayhost = [relay.mailbaby.net]:25, smtp_sasl_auth_enable = yes and a smtp_sasl_password_maps entry. Two settings that Plesk does not always set and that MailBaby needs:

postconf -e 'smtp_sasl_mechanism_filter = login'
postconf -e 'smtp_tls_security_level = may'
postconf -e 'smtp_sasl_security_options = noanonymous'
systemctl reload postfix

If postconf -n shows no password map at all, create /etc/postfix/sasl_passwd with the line [relay.mailbaby.net]:25 mb12345:YOUR_PASSWORD, run postmap on it, and add the map with postconf -e 'smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd'. The full Postfix explanation, including rate limiting, is in the Postfix guide.

Plesk manages DKIM per domain under Mail Settings » Use DKIM spam protection system; turn it on for every domain that sends so the signature is applied before the message reaches the relay. Plesk’s outgoing mail limits at Tools & Settings » Outgoing Mail Control should be set below 6,000 per hour per mailbox, because MailBaby discards excess rather than queueing it.

Plesk with qmail

Servers still on qmail can use the same CLI commands; Plesk writes the relay into /var/qmail/control/smtproutes in the form :relay.mailbaby.net:25 mb12345 YOUR_PASSWORD. qmail’s remote delivery does not support STARTTLS without a patch, and MailBaby requires TLS before AUTH, so on qmail servers we switch to Postfix first:

plesk installer --select-release-current --install-component postfix

The switch preserves mailboxes and domains; test on a staging server if you have never done it.

Webuzo

Webuzo uses Exim and, like DirectAdmin, rebuilds its configuration from a template. Custom settings belong in the include files Webuzo reads at startup rather than in /etc/exim.conf. Create three files.

Authenticator, in /etc/exim.authenticators.post.conf:

mailbaby_login:
  driver = plaintext
  public_name = LOGIN
  hide client_send = ": mb12345 : YOUR_PASSWORD"

Transport, in /etc/exim.transports.pre.conf:

mailbaby_smtp:
  driver = smtp
  port = 25
  hosts_require_auth = *
  hosts_require_tls = *
  tls_tempfail_tryclear = false
  dkim_domain = ${lc:${domain:$h_from:}}
  dkim_selector = default
  dkim_private_key = ${if exists{/etc/exim/dkim/${dkim_domain}.key}{/etc/exim/dkim/${dkim_domain}.key}{0}}

Router, in /etc/exim.routers.pre.conf:

mailbaby_route:
  driver = manualroute
  domains = ! +local_domains
  transport = mailbaby_smtp
  route_list = * relay.mailbaby.net::25
  no_more

Adjust the DKIM key path to wherever your Webuzo build stores keys; check with ls /etc/exim/dkim or the domain’s Email settings page. If the include files are not picked up, confirm the .include_if_exists lines are present in the generated configuration with grep -n include_if_exists /etc/exim.conf; some builds use /etc/exim/ rather than /etc/. Then:

exim -bV
systemctl restart exim

DNS for both panels

Every sending domain needs include:spf-c.mailbaby.net in its SPF record, with the server’s IP still authorised, or the _mailbaby.<domain> TXT ownership record. Plesk’s DNS template can add the include to every zone at Tools & Settings » DNS Template; Webuzo requires editing each zone. The two methods are compared in the SPF guide.

Verify

On Plesk, send from a mailbox and read the log:

tail -f /var/log/maillog

Look for relay=relay.mailbaby.net[IP]:25 and status=sent. On Webuzo, tail -f /var/log/exim_mainlog should show T=mailbaby_smtp with A=mailbaby_login and an X=TLS field. In both cases, open the received message and confirm spf=pass and dkim=pass on your domain. The common pitfall on Plesk is a password containing shell metacharacters passed unquoted to plesk bin; the panel stores a truncated string and the log shows 535 authentication failed. Wrap the password in single quotes, or set it through the panel interface and re-check postconf -n.

MailBaby Plesk Webuzo at a glance

Official documentation: RFC 5321 (SMTP), Linux man pages.

Related guides: MailBaby DKIM transport signing explained: why some mail shows “via mailbaby.net” · Sending WordPress email through MailBaby: SMTP plugin setup and testing · What is MailBaby? Outbound SMTP relay pricing, limits and how it works.

Frequently asked questions