Changing the mail hostname

Changing the mail hostname means you stop using the server’s raw name and have clients connect to something like mail.example.com instead. That name needs public DNS aimed at this server, a certificate that lists it, and—on a VPS—a HELO and PTR that match what the mail system announces. Do the DNS work before you change client settings, or phones will keep rejecting the connection.

Set DNS, then wait for the certificate

Create A and AAAA records for mail.example.com that point to this server’s addresses. Wait until public resolvers answer with those records before you expect a new certificate. On shared hosting, AutoSSL with Let’s Encrypt will issue a cert that includes the name once DNS is correct. After that, configure mail apps to use mail.example.com on ports 993 and 587 with TLS on.

echo | openssl s_client -connect mail.example.com:993 -servername mail.example.com 2>/dev/null | openssl x509 -noout -dates -subject

Run that check and read the subject and dates. If the certificate still shows an old hostname, or the handshake never completes, clients are right to complain. If an AAAA record still points at a previous provider, dual-stack devices may land there and see the old cert. That often looks like an SSL problem on our side when it is leftover DNS.

Shared hosting versus a VPS

On shared cPanel you cannot rename the underlying server. You still add mail.example.com in DNS and let AutoSSL cover it so clients have a clean name to use. The shared server already has its own hostname and certificate story; your job is the domain-side name only.

On a VPS you control the system hostname that Postfix uses in HELO. That name should have a matching PTR record. You can use mail.example.com itself, or a server name clients never type, as long as A, PTR, and HELO all agree. Names like localhost.localdomain or a leftover ubuntu hostname after a rebuild will cause delivery problems with many receivers.

What must stay consistent

Clients, the certificate name, HELO, and PTR need to tell the same story. Change DNS first, confirm the cert covers mail.example.com, align HELO and PTR on a VPS if you run one, and only then update the apps on phones and desktops. Skipping that order is how leftover certificates and old AAAA records keep blocking mail.