> ## Documentation Index > Fetch the complete documentation index at: https://docs.oximail.ch/llms.txt > Use this file to discover all available pages before exploring further. # CLI reference > The oximail command-line surface, grouped by domain: setup, accounts, mail, filtering, security, storage, compliance, and diagnostics. Conventions shared by every verb. Everything the server can be told to do without the HTTP API is an `oximail` subcommand. This page maps the surface; `oximail --help` is always the authoritative reference for flags, and the per-feature pages explain the workflows. ## Conventions * **`--config `** — every command that touches the database takes it; default `/etc/oximail/oximail.toml`. * **`--tenant-id `** (alias `--tenant`) — defaults to `default`. When a command takes `--account ` instead, the email lookup resolves its own organization. * **Account selection** — commands accept `--account ` or `--account-id `, mutually exclusive. * **Destructive commands prompt.** `[y/N]` confirmation, skipped only with an explicit `--yes` (for scripts). * **Repair commands are dry-run by default.** `dedupe-folders`, `dedupe-tasks`, `blob promote-room-blobs`, and their kin print their plan and touch nothing until `--apply`. ## The command map ### Serve & setup | Command | Purpose | | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | `serve` | Run the server (what the systemd unit calls). | | `setup` | The [first-boot wizard](../first-boot); subcommands `dns`, `dkim`, `admin`, `verify`, `relay-preflight` re-run single steps. | | `setup-dkim` | Generate a DKIM keypair and print the DNS record. | | `firstboot`, `print-systemd-unit` | Headless provisioning helpers. | | `check-dns` | Live DNS scoring for a mail domain ([email auth](./email-auth-security)). | | `check-config` | Validate a TOML file without starting the server. | ### Accounts & organizations | Command | Purpose | | -------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | `account create` / `create-shared` / `list` | Provision human accounts and [shared team accounts](./multi-tenancy). | | `account set-password` / `set-role` / `enable` / `disable` / `quota` | Lifecycle and limits. | | `account delete [--dsar ]` | Enqueue the [erasure phase machine](./compliance). | | `account custodian show\|reattach` | Shared-drive custody. | | `account relay add-domain\|verify\|list\|mint-token\|revoke-tokens` | [Smarthost relay accounts](./outbound-relay). | | `account envelope-domain add\|verify\|list\|remove` | [Envelope-sender domain grants](./bulk-sending) (Return-Path ≠ From, DNS-proven). | | `account dedupe-folders` / `dedupe-tasks` | Post-migration repairs ([groupware](./groupware)). | | `account regenerate-key` | **Destructive** keypair regeneration (old blobs become unreadable). | | `tenant create\|update\|list` | Organizations; `update --default-timezone` sets the calendar fallback zone. | | `admin`, `alias`, `rights`, `token`, `sessions` | Admin principals, address aliases, rights inspection, token and session management. | | `principal-reconcile` | Offline one-shot: re-mint principal ids from the legacy import cohort (`--dry-run` supported). | ### Mail, filtering & groupware | Command | Purpose | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `mailbox`, `email` | Inspect and manage folders and messages. | | `sieve`, `rule` | The two [filtering layers](./sieve-rules). | | `queue` | The outbound delivery queue: list, inspect, cancel. | | `spam` | Spam corpus and model management, plus the read-only `spam check` ([anti-spam](./anti-spam)). | | `calendar` | Calendar maintenance verbs. | | `migrate` | The [import tool](./migration) (`--from-imap`, `--from-jmap`, `--from-dump`, `--from-mbox`, `--from-google-takeout`, `--from-vcf`, `--from-ics`). | ### Compliance | Command | Purpose | | ----------------------------------------------- | ---------------------------------------------- | | `journaling list\|add\|remove\|enable\|disable` | [Journaling rules](./compliance). | | `erasure list\|undo\|prove` | Erasure jobs, the reversal buffer, DSAR proof. | ### Security & TLS | Command | Purpose | | ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------- | | `ban list\|add`, `unban ` | The in-binary fail2ban. | | `cert`, `dane`, `dkim`, `tls-rpt`, `vapid` | Certificates, TLSA records, DKIM keys, TLS-RPT, web-push keys. | | `key` | At-rest key operations (rotation, escrow drill) — see [encryption at rest](./encryption-at-rest). | | `hash-password` | Argon2id hash for config files. | | `passkey list\|revoke` | Enumerate and revoke an account's WebAuthn passkeys — the out-of-band door when the webmail itself is what is compromised. | ### Storage & maintenance | Command | Purpose | | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `backup`, `restore`, `verify-backup` | [Backups](./operations). | | `reindex` | Rebuild the search index. | | `blob`, `blobs` | Blob maintenance: `promote-room-blobs`, the unreferenced-blob collector `blobs gc` (dry-run by default, `--apply` deletes, server stopped), and the re-wrap sweeps. | | `encrypt-blobs`, `migrate-db`, `sql` | Storage migrations and a guarded SQL escape hatch. | | `backfill-*`, `decode-attachment-names` | One-shot backfills for columns introduced after the data existed. | | `volume-recover`, `rollback-guard` | Disaster-recovery guards. | | `chat-rekey` | Chat identity re-keying machinery. | ### Diagnostics | Command | Purpose | | ---------------------------- | ---------------------------------------------------------------------- | | `status`, `health`, `doctor` | Local process / port / config / storage checks, clock health included. | ### Two behaviours of the maintenance verbs **`sql` routes on the shape of the statement, not on its first word.** It used to sniff the prefix, so a CTE — `WITH … SELECT` — was taken for a mutation, executed, its rows thrown away, and reported as `0 rows affected`. A statement that returns data being reported as a successful write is exactly the silent failure this project forbids, and it is worse on a verb that scripts trust. Each statement is now prepared and routed on whether it returns columns, which also gets `VALUES`, `EXPLAIN` and `INSERT … RETURNING` right, while a `WITH … INSERT` stays on the write path and is counted. Multi-statement input keeps batch semantics (everything runs, it stops at the first error, earlier writes stand) and now counts **per statement**. Result rows go to stdout, counts to stderr, so the output stays pipeable. **`blobs gc` will not collect a fresh unreferenced blob.** Between a client's upload and the `/set` that names it, a blob is unreferenced by protocol (RFC 8620 §6.1). The collector skips anything unreferenced and younger than a 24-hour grace window, read from the file's own timestamp — an unreadable or future timestamp keeps the file. The summary counts "unreferenced but in grace" separately, so the number is visible rather than implied. ## Where the CLI ends The CLI covers provisioning, maintenance, and repair. Day-to-day *data* administration — runtime config overrides, ban listing over HTTP, version verification — also exists on the [admin REST API](../developer/admin-api), and journaling rules are equally manageable over admin JMAP. CLI and API are thin adapters over the same orchestration, so an operation behaves identically wherever it is invoked from.