diff --git a/frontend/src/apps/mail/components/AppSidebar.vue b/frontend/src/apps/mail/components/AppSidebar.vue
index bad7580c4b..dd578107ac 100644
--- a/frontend/src/apps/mail/components/AppSidebar.vue
+++ b/frontend/src/apps/mail/components/AppSidebar.vue
@@ -107,18 +107,30 @@ import QuotaBar from '@/apps/mail/components/QuotaBar.vue'
 import type { MailboxData } from '@/apps/mail/types'
 
 import BookUser from '~icons/lucide/book-user'
+import Clock from '~icons/lucide/clock'
 import ContactRound from '~icons/lucide/contact-round'
 import Crown from '~icons/lucide/crown'
 import Ellipsis from '~icons/lucide/ellipsis'
+import Flag from '~icons/lucide/flag'
 import Globe from '~icons/lucide/globe'
+import KeyRound from '~icons/lucide/key-round'
+import Lock from '~icons/lucide/lock'
 import LogOut from '~icons/lucide/log-out'
 import Mailbox from '~icons/lucide/mailbox'
 import Mails from '~icons/lucide/mails'
+import Megaphone from '~icons/lucide/megaphone'
 import Plus from '~icons/lucide/plus'
+import Radar from '~icons/lucide/radar'
+import ScrollText from '~icons/lucide/scroll-text'
 import Settings from '~icons/lucide/settings'
+import Shield from '~icons/lucide/shield'
+import ShieldCheck from '~icons/lucide/shield-check'
+import Signature from '~icons/lucide/signature'
 import Star from '~icons/lucide/star'
 import Trash2 from '~icons/lucide/trash-2'
 import Users from '~icons/lucide/users'
+import UsersRound from '~icons/lucide/users-round'
+import Wrench from '~icons/lucide/wrench'
 
 const route = useRoute()
 const router = useRouter()
@@ -252,6 +264,42 @@ const menuItems = computed(() => [
 
 const dashboardItems = [
 	{
+		label: __('Directory'),
+		items: [
+			{
+				label: __('Members'),
+				icon: Users,
+				to: { name: 'mail-members' },
+				activeFor: ['mail-members', 'mail-invites', 'mail-member'],
+			},
+			{
+				label: __('Groups'),
+				icon: UsersRound,
+				to: { name: 'mail-groups' },
+				activeFor: ['mail-groups', 'mail-group'],
+			},
+			{
+				label: __('Mailing Lists'),
+				icon: Megaphone,
+				to: { name: 'mail-mailing-lists' },
+				activeFor: ['mail-mailing-lists', 'mail-mailing-list'],
+			},
+			{
+				label: __('Roles'),
+				icon: Shield,
+				to: { name: 'mail-roles' },
+				activeFor: ['mail-roles', 'mail-role'],
+			},
+			{
+				label: __('OAuth Clients'),
+				icon: KeyRound,
+				to: { name: 'mail-oauth-clients' },
+				activeFor: ['mail-oauth-clients', 'mail-oauth-client'],
+			},
+		],
+	},
+	{
+		label: __('Domains'),
 		items: [
 			{
 				label: __('Domains'),
@@ -260,10 +308,89 @@ const dashboardItems = [
 				activeFor: ['mail-domains', 'mail-domain'],
 			},
 			{
-				label: __('Members'),
-				icon: Users,
-				to: { name: 'mail-members' },
-				activeFor: ['mail-members', 'mail-invites', 'mail-member'],
+				label: __('DKIM Signatures'),
+				icon: Signature,
+				to: { name: 'mail-dkim-signatures' },
+				activeFor: ['mail-dkim-signatures', 'mail-dkim-signature'],
+			},
+		],
+	},
+	{
+		label: __('Emails'),
+		items: [
+			{
+				label: __('Queued'),
+				icon: Clock,
+				to: { name: 'mail-queued-messages' },
+				activeFor: ['mail-queued-messages', 'mail-queued-message'],
+			},
+			{
+				label: __('Delivery Test'),
+				icon: Radar,
+				to: { name: 'mail-delivery-test' },
+				activeFor: ['mail-delivery-test'],
+			},
+		],
+	},
+	{
+		label: __('Inbound Reports'),
+		items: [
+			{
+				label: __('DMARC'),
+				icon: ShieldCheck,
+				to: { name: 'mail-reports-dmarc-inbound' },
+				activeFor: ['mail-reports-dmarc-inbound'],
+			},
+			{
+				label: __('TLS'),
+				icon: Lock,
+				to: { name: 'mail-reports-tls-inbound' },
+				activeFor: ['mail-reports-tls-inbound'],
+			},
+			{
+				label: __('ARF'),
+				icon: Flag,
+				to: { name: 'mail-reports-arf-inbound' },
+				activeFor: ['mail-reports-arf-inbound'],
+			},
+		],
+	},
+	{
+		label: __('Outbound Reports'),
+		items: [
+			{
+				label: __('DMARC'),
+				icon: ShieldCheck,
+				to: { name: 'mail-reports-dmarc-outbound' },
+				activeFor: ['mail-reports-dmarc-outbound'],
+			},
+			{
+				label: __('TLS'),
+				icon: Lock,
+				to: { name: 'mail-reports-tls-outbound' },
+				activeFor: ['mail-reports-tls-outbound'],
+			},
+		],
+	},
+	{
+		label: __('Observability'),
+		items: [
+			{
+				label: __('Logs'),
+				icon: ScrollText,
+				to: { name: 'mail-logs' },
+				activeFor: ['mail-logs', 'mail-log'],
+			},
+		],
+	},
+	{
+		label: __('Actions'),
+		items: [
+			{
+				label: __('Actions'),
+				icon: Wrench,
+				to: { name: 'mail-actions' },
+				activeFor: ['mail-actions'],
 			},
 		],
 	},
diff --git a/frontend/src/apps/mail/components/DashboardPager.vue b/frontend/src/apps/mail/components/DashboardPager.vue
new file mode 100644
index 0000000000..89e235da3a
--- /dev/null
+++ b/frontend/src/apps/mail/components/DashboardPager.vue
@@ -0,0 +1,37 @@
+<template>
+	<div v-if="total > 0" class="text-ink-gray-5 flex items-center justify-between px-1 py-2 text-sm">
+		<span>{{ rangeLabel }}</span>
+		<div class="flex items-center gap-2">
+			<Button variant="ghost" :disabled="page <= 1" @click="emit('update:page', page - 1)">
+				<template #icon><FeatherIcon name="chevron-left" class="h-4 w-4" /></template>
+			</Button>
+			<span>{{ page }} / {{ totalPages }}</span>
+			<Button variant="ghost" :disabled="!canGoNext" @click="emit('update:page', page + 1)">
+				<template #icon><FeatherIcon name="chevron-right" class="h-4 w-4" /></template>
+			</Button>
+		</div>
+	</div>
+</template>
+
+<script setup lang="ts">
+import { computed } from 'vue'
+import { Button, FeatherIcon } from 'frappe-ui'
+
+// `hasNextPage` overrides the count-derived limit, for listings whose total cannot be trusted to
+// bound the pages (the log store reports how many entries it retains, ignoring any search).
+const {
+	page,
+	pageLength,
+	total,
+	hasNextPage = undefined,
+} = defineProps<{ page: number; pageLength: number; total: number; hasNextPage?: boolean }>()
+const emit = defineEmits<{ 'update:page': [value: number] }>()
+
+const totalPages = computed(() => Math.max(1, Math.ceil(total / pageLength)))
+const canGoNext = computed(() => (hasNextPage === undefined ? page < totalPages.value : hasNextPage))
+const rangeLabel = computed(() => {
+	const start = (page - 1) * pageLength + 1
+	const end = Math.min(page * pageLength, total)
+	return __('{0}–{1} of {2}').replace('{0}', String(start)).replace('{1}', String(end)).replace('{2}', String(total))
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddGroupEmailModal.vue b/frontend/src/apps/mail/components/Modals/AddGroupEmailModal.vue
new file mode 100644
index 0000000000..d5f69cef31
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddGroupEmailModal.vue
@@ -0,0 +1,75 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add Email Address'),
+			actions: [
+				{ label: __('Add'), variant: 'solid', disabled: !(username && domain), onClick: addEmail.submit },
+			],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<div class="flex items-center justify-between">
+					<FormControl v-model="username" :label="__('Username')" placeholder="team" class="w-full" />
+					<FeatherIcon class="text-ink-gray-3 mx-2.5 mb-1.5 mt-auto h-4 w-4" name="at-sign" />
+					<FormControl
+						v-model="domain"
+						type="combobox"
+						:label="__('Domain')"
+						placeholder="yourdomain.com"
+						class="w-full"
+						:options="domains.data"
+						:open-on-click="true"
+					/>
+				</div>
+				<FormControl
+					v-model="description"
+					:label="__('Description')"
+					:placeholder="__('Used as the display name for this address')"
+				/>
+				<ErrorMessage :message="addEmail.error?.messages?.[0] || addEmail.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { ref, watch } from 'vue'
+import { Dialog, ErrorMessage, FeatherIcon, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const show = defineModel<boolean>()
+const { groupId } = defineProps<{ groupId: string }>()
+const emit = defineEmits(['reload'])
+
+const username = ref('')
+const domain = ref('')
+const description = ref('')
+
+const domains = createResource({ url: 'suite.mail.api.admin.get_enabled_domains', auto: true })
+
+watch(show, () => {
+	if (show.value) {
+		username.value = ''
+		domain.value = ''
+		description.value = ''
+		addEmail.reset()
+	}
+})
+
+const addEmail = createResource({
+	url: 'suite.mail.api.admin.add_group_email',
+	makeParams: () => ({
+		group_id: groupId,
+		email: `${username.value}@${domain.value}`,
+		description: description.value?.trim() || undefined,
+	}),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Email address added.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddGroupMembersModal.vue b/frontend/src/apps/mail/components/Modals/AddGroupMembersModal.vue
new file mode 100644
index 0000000000..8673d4b3bb
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddGroupMembersModal.vue
@@ -0,0 +1,58 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add Members'),
+			actions: [
+				{ label: __('Add'), variant: 'solid', disabled: !accountIds.length, onClick: addMembers.submit },
+			],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-1.5">
+				<label class="text-ink-gray-5 block text-xs">{{ __('Accounts') }}</label>
+				<MultiSelect v-model="accountIds" :options="options" />
+				<ErrorMessage :message="addMembers.error?.messages?.[0] || addMembers.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { Dialog, ErrorMessage, MultiSelect, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const show = defineModel<boolean>()
+const { groupId, currentIds } = defineProps<{ groupId: string; currentIds: string[] }>()
+const emit = defineEmits(['reload'])
+
+const accountIds = ref<string[]>([])
+
+const accounts = createResource({ url: 'suite.mail.api.admin.get_accounts', auto: true })
+
+// Exclude accounts already in the group.
+const options = computed(() =>
+	(accounts.data || [])
+		.filter((a: { id: string }) => !currentIds.includes(a.id))
+		.map((a: { id: string; email: string }) => ({ label: a.email, value: a.id })),
+)
+
+watch(show, () => {
+	if (show.value) {
+		accountIds.value = []
+		addMembers.reset()
+	}
+})
+
+const addMembers = createResource({
+	url: 'suite.mail.api.admin.add_group_members',
+	makeParams: () => ({ group_id: groupId, account_ids: accountIds.value }),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Members added.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddGroupModal.vue b/frontend/src/apps/mail/components/Modals/AddGroupModal.vue
new file mode 100644
index 0000000000..1c7ba105d8
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddGroupModal.vue
@@ -0,0 +1,102 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add Group'),
+			actions: [
+				{
+					label: __('Add Group'),
+					variant: 'solid',
+					disabled: !(name && domain),
+					onClick: addGroup.submit,
+				},
+			],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl
+					v-model="name"
+					:label="__('Name')"
+					placeholder="team"
+					autocomplete="off"
+				/>
+				<FormControl
+					v-model="domain"
+					type="select"
+					:label="__('Domain')"
+					:options="domainOptions"
+				/>
+				<FormControl v-model="description" :label="__('Description')" />
+				<div class="space-y-1.5">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Members') }}</label>
+					<MultiSelect v-model="memberIds" :options="accountOptions" />
+				</div>
+				<div class="space-y-1.5">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Roles') }}</label>
+					<MultiSelect v-model="roleIds" :options="roleOptions" />
+				</div>
+				<ErrorMessage :message="addGroup.error?.messages?.[0] || addGroup.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { useRouter } from 'vue-router'
+import { Dialog, ErrorMessage, FormControl, MultiSelect, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const show = defineModel<boolean>()
+const router = useRouter()
+const emit = defineEmits(['reload'])
+
+const name = ref('')
+const domain = ref('')
+const description = ref('')
+const memberIds = ref<string[]>([])
+const roleIds = ref<string[]>([])
+
+const domains = createResource({ url: 'suite.mail.api.admin.get_enabled_domains', auto: true })
+const accounts = createResource({ url: 'suite.mail.api.admin.get_accounts', auto: true })
+const roles = createResource({ url: 'suite.mail.api.admin.get_roles_list', auto: true })
+
+const domainOptions = computed(() => (domains.data || []).map((d: string) => ({ label: d, value: d })))
+const accountOptions = computed(() =>
+	(accounts.data || []).map((a: { id: string; email: string }) => ({ label: a.email, value: a.id })),
+)
+const roleOptions = computed(() =>
+	(roles.data || []).map((r: { id: string; description: string }) => ({ label: r.description, value: r.id })),
+)
+
+watch(show, () => {
+	if (show.value) {
+		name.value = ''
+		domain.value = ''
+		description.value = ''
+		memberIds.value = []
+		roleIds.value = []
+		addGroup.reset()
+	}
+})
+
+const addGroup = createResource({
+	url: 'suite.mail.api.admin.add_group',
+	makeParams: () => ({
+		name: name.value,
+		domain: domain.value,
+		description: description.value?.trim() || undefined,
+		members: memberIds.value,
+		roles: roleIds.value,
+	}),
+	onSuccess: (data: string) => {
+		if (!data) return
+		show.value = false
+		emit('reload')
+		raiseToast(__('Group added.'))
+		router.push({ name: 'mail-group', params: { groupId: data } })
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddMailingListEmailModal.vue b/frontend/src/apps/mail/components/Modals/AddMailingListEmailModal.vue
new file mode 100644
index 0000000000..1b751102df
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddMailingListEmailModal.vue
@@ -0,0 +1,75 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add Email Address'),
+			actions: [
+				{ label: __('Add'), variant: 'solid', disabled: !(username && domain), onClick: addEmail.submit },
+			],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<div class="flex items-center justify-between">
+					<FormControl v-model="username" :label="__('Username')" placeholder="announce" class="w-full" />
+					<FeatherIcon class="text-ink-gray-3 mx-2.5 mb-1.5 mt-auto h-4 w-4" name="at-sign" />
+					<FormControl
+						v-model="domain"
+						type="combobox"
+						:label="__('Domain')"
+						placeholder="yourdomain.com"
+						class="w-full"
+						:options="domains.data"
+						:open-on-click="true"
+					/>
+				</div>
+				<FormControl
+					v-model="description"
+					:label="__('Description')"
+					:placeholder="__('Used as the display name for this address')"
+				/>
+				<ErrorMessage :message="addEmail.error?.messages?.[0] || addEmail.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { ref, watch } from 'vue'
+import { Dialog, ErrorMessage, FeatherIcon, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const show = defineModel<boolean>()
+const { listId } = defineProps<{ listId: string }>()
+const emit = defineEmits(['reload'])
+
+const username = ref('')
+const domain = ref('')
+const description = ref('')
+
+const domains = createResource({ url: 'suite.mail.api.admin.get_enabled_domains', auto: true })
+
+watch(show, () => {
+	if (show.value) {
+		username.value = ''
+		domain.value = ''
+		description.value = ''
+		addEmail.reset()
+	}
+})
+
+const addEmail = createResource({
+	url: 'suite.mail.api.admin.add_mailing_list_email',
+	makeParams: () => ({
+		list_id: listId,
+		email: `${username.value}@${domain.value}`,
+		description: description.value?.trim() || undefined,
+	}),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Email address added.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddMailingListModal.vue b/frontend/src/apps/mail/components/Modals/AddMailingListModal.vue
new file mode 100644
index 0000000000..83627f9927
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddMailingListModal.vue
@@ -0,0 +1,84 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add Mailing List'),
+			actions: [
+				{
+					label: __('Add Mailing List'),
+					variant: 'solid',
+					disabled: !(name && domain),
+					onClick: addList.submit,
+				},
+			],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl v-model="name" :label="__('Name')" placeholder="announce" autocomplete="off" />
+				<FormControl v-model="domain" type="select" :label="__('Domain')" :options="domainOptions" />
+				<FormControl v-model="description" :label="__('Description')" type="textarea" />
+				<FormControl
+					v-model="recipients"
+					:label="__('Recipients')"
+					type="textarea"
+					:placeholder="__('One email address per line')"
+				/>
+				<ErrorMessage :message="addList.error?.messages?.[0] || addList.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { useRouter } from 'vue-router'
+import { Dialog, ErrorMessage, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const show = defineModel<boolean>()
+const router = useRouter()
+const emit = defineEmits(['reload'])
+
+const name = ref('')
+const domain = ref('')
+const description = ref('')
+const recipients = ref('')
+
+const domains = createResource({ url: 'suite.mail.api.admin.get_enabled_domains', auto: true })
+const domainOptions = computed(() => (domains.data || []).map((d: string) => ({ label: d, value: d })))
+
+const toLines = (text: string) =>
+	text
+		.split('\n')
+		.map((line) => line.trim())
+		.filter(Boolean)
+
+watch(show, () => {
+	if (show.value) {
+		name.value = ''
+		domain.value = ''
+		description.value = ''
+		recipients.value = ''
+		addList.reset()
+	}
+})
+
+const addList = createResource({
+	url: 'suite.mail.api.admin.add_mailing_list',
+	makeParams: () => ({
+		name: name.value,
+		domain: domain.value,
+		description: description.value?.trim() || undefined,
+		recipients: toLines(recipients.value),
+	}),
+	onSuccess: (data: string) => {
+		if (!data) return
+		show.value = false
+		emit('reload')
+		raiseToast(__('Mailing list added.'))
+		router.push({ name: 'mail-mailing-list', params: { listId: data } })
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddMailingListRecipientsModal.vue b/frontend/src/apps/mail/components/Modals/AddMailingListRecipientsModal.vue
new file mode 100644
index 0000000000..0c3d8342c6
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddMailingListRecipientsModal.vue
@@ -0,0 +1,71 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add Recipients'),
+			actions: [
+				{ label: __('Add'), variant: 'solid', disabled: !validEmails.length, onClick: addRecipients.submit },
+			],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<div class="space-y-2">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Recipients') }}</label>
+					<div v-for="(row, index) in emails" :key="index" class="flex items-center gap-2">
+						<FormControl
+							v-model="row.email"
+							type="email"
+							placeholder="someone@example.com"
+							class="w-full"
+						/>
+						<Button
+							v-if="emails.length > 1"
+							variant="ghost"
+							theme="red"
+							@click="emails.splice(index, 1)"
+						>
+							<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+						</Button>
+					</div>
+					<Button variant="ghost" size="sm" :label="__('Add another')" @click="emails.push({ email: '' })">
+						<template #prefix><FeatherIcon name="plus" class="h-4 w-4" /></template>
+					</Button>
+				</div>
+				<ErrorMessage :message="addRecipients.error?.messages?.[0] || addRecipients.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { Button, Dialog, ErrorMessage, FeatherIcon, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const show = defineModel<boolean>()
+const { listId } = defineProps<{ listId: string }>()
+const emit = defineEmits(['reload'])
+
+const emails = ref<{ email: string }[]>([{ email: '' }])
+
+const validEmails = computed(() => emails.value.map((e) => e.email.trim()).filter(Boolean))
+
+watch(show, () => {
+	if (show.value) {
+		emails.value = [{ email: '' }]
+		addRecipients.reset()
+	}
+})
+
+const addRecipients = createResource({
+	url: 'suite.mail.api.admin.add_mailing_list_recipients',
+	makeParams: () => ({ list_id: listId, recipients: validEmails.value }),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Recipients added.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddMemberEmailModal.vue b/frontend/src/apps/mail/components/Modals/AddMemberEmailModal.vue
new file mode 100644
index 0000000000..b9b980de99
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddMemberEmailModal.vue
@@ -0,0 +1,75 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add Email Address'),
+			actions: [
+				{ label: __('Add'), variant: 'solid', disabled: !(username && domain), onClick: addEmail.submit },
+			],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<div class="flex items-center justify-between">
+					<FormControl v-model="username" :label="__('Username')" placeholder="johndoe" class="w-full" />
+					<FeatherIcon class="text-ink-gray-3 mx-2.5 mb-1.5 mt-auto h-4 w-4" name="at-sign" />
+					<FormControl
+						v-model="domain"
+						type="combobox"
+						:label="__('Domain')"
+						placeholder="yourdomain.com"
+						class="w-full"
+						:options="domains.data"
+						:open-on-click="true"
+					/>
+				</div>
+				<FormControl
+					v-model="description"
+					:label="__('Full Name')"
+					:placeholder="__('Used as the display name for this address')"
+				/>
+				<ErrorMessage :message="addEmail.error?.messages?.[0] || addEmail.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { ref, watch } from 'vue'
+import { Dialog, ErrorMessage, FeatherIcon, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const show = defineModel<boolean>()
+const { memberId } = defineProps<{ memberId: string }>()
+const emit = defineEmits(['reload'])
+
+const username = ref('')
+const domain = ref('')
+const description = ref('')
+
+const domains = createResource({ url: 'suite.mail.api.admin.get_enabled_domains', auto: true })
+
+watch(show, () => {
+	if (show.value) {
+		username.value = ''
+		domain.value = ''
+		description.value = ''
+		addEmail.reset()
+	}
+})
+
+const addEmail = createResource({
+	url: 'suite.mail.api.admin.add_member_email',
+	makeParams: () => ({
+		member_id: memberId,
+		email: `${username.value}@${domain.value}`,
+		description: description.value?.trim() || undefined,
+	}),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Email address added.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddMemberGroupsModal.vue b/frontend/src/apps/mail/components/Modals/AddMemberGroupsModal.vue
new file mode 100644
index 0000000000..6e8bf77399
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddMemberGroupsModal.vue
@@ -0,0 +1,58 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add to Groups'),
+			actions: [
+				{ label: __('Add'), variant: 'solid', disabled: !groupIds.length, onClick: addGroups.submit },
+			],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-1.5">
+				<label class="text-ink-gray-5 block text-xs">{{ __('Groups') }}</label>
+				<MultiSelect v-model="groupIds" :options="options" />
+				<ErrorMessage :message="addGroups.error?.messages?.[0] || addGroups.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { Dialog, ErrorMessage, MultiSelect, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const show = defineModel<boolean>()
+const { memberId, currentIds } = defineProps<{ memberId: string; currentIds: string[] }>()
+const emit = defineEmits(['reload'])
+
+const groupIds = ref<string[]>([])
+
+const groups = createResource({ url: 'suite.mail.api.admin.get_groups', auto: true })
+
+// Exclude groups the member already belongs to.
+const options = computed(() =>
+	(groups.data || [])
+		.filter((g: { id: string }) => !currentIds.includes(g.id))
+		.map((g: { id: string; name: string; email?: string }) => ({ label: g.email || g.name, value: g.id })),
+)
+
+watch(show, () => {
+	if (show.value) {
+		groupIds.value = []
+		addGroups.reset()
+	}
+})
+
+const addGroups = createResource({
+	url: 'suite.mail.api.admin.add_member_to_groups',
+	makeParams: () => ({ member_id: memberId, group_ids: groupIds.value }),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Added to groups.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddMemberMailingListsModal.vue b/frontend/src/apps/mail/components/Modals/AddMemberMailingListsModal.vue
new file mode 100644
index 0000000000..050d44d42c
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddMemberMailingListsModal.vue
@@ -0,0 +1,58 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add to Mailing Lists'),
+			actions: [
+				{ label: __('Add'), variant: 'solid', disabled: !listIds.length, onClick: addLists.submit },
+			],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-1.5">
+				<label class="text-ink-gray-5 block text-xs">{{ __('Mailing Lists') }}</label>
+				<MultiSelect v-model="listIds" :options="options" />
+				<ErrorMessage :message="addLists.error?.messages?.[0] || addLists.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { Dialog, ErrorMessage, MultiSelect, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const show = defineModel<boolean>()
+const { memberId, currentIds } = defineProps<{ memberId: string; currentIds: string[] }>()
+const emit = defineEmits(['reload'])
+
+const listIds = ref<string[]>([])
+
+const lists = createResource({ url: 'suite.mail.api.admin.get_mailing_lists', auto: true })
+
+// Exclude mailing lists the member is already a recipient of.
+const options = computed(() =>
+	(lists.data || [])
+		.filter((ml: { id: string }) => !currentIds.includes(ml.id))
+		.map((ml: { id: string; name: string; email?: string }) => ({ label: ml.email || ml.name, value: ml.id })),
+)
+
+watch(show, () => {
+	if (show.value) {
+		listIds.value = []
+		addLists.reset()
+	}
+})
+
+const addLists = createResource({
+	url: 'suite.mail.api.admin.add_member_to_mailing_lists',
+	makeParams: () => ({ member_id: memberId, list_ids: listIds.value }),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Added to mailing lists.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddMemberModal.vue b/frontend/src/apps/mail/components/Modals/AddMemberModal.vue
index e9c4e75cac..b0c0d0dac0 100644
--- a/frontend/src/apps/mail/components/Modals/AddMemberModal.vue
+++ b/frontend/src/apps/mail/components/Modals/AddMemberModal.vue
@@ -14,26 +14,48 @@
 	>
 		<template #body-content>
 			<div class="space-y-4">
-				<div class="flex items-center justify-between">
-					<FormControl
-						v-model="accountRequest.username"
-						:label="__('Username')"
-						placeholder="johndoe"
-						class="w-full"
-					/>
-					<FeatherIcon
-						class="text-ink-gray-3 mx-2.5 mb-1.5 mt-auto h-4 w-4"
-						name="at-sign"
-					/>
-					<FormControl
-						v-model="accountRequest.domain"
-						type="combobox"
-						:label="__('Domain')"
-						placeholder="yourdomain.com"
-						class="w-full"
-						:options="domains.data"
-						:open-on-click="true"
-					/>
+				<div class="space-y-3">
+					<div v-for="(email, index) in emails" :key="index" class="space-y-1.5">
+						<div class="flex items-center justify-between">
+							<label class="text-ink-gray-5 block text-xs">
+								{{ index === 0 ? __('Primary Email') : __('Alias') }}
+							</label>
+							<Button
+								v-if="index > 0"
+								variant="ghost"
+								theme="red"
+								size="sm"
+								:label="__('Remove')"
+								@click="emails.splice(index, 1)"
+							/>
+						</div>
+						<div class="flex items-center justify-between">
+							<FormControl
+								v-model="email.username"
+								placeholder="johndoe"
+								class="w-full"
+							/>
+							<FeatherIcon class="text-ink-gray-3 mx-2.5 h-4 w-4" name="at-sign" />
+							<FormControl
+								v-model="email.domain"
+								type="combobox"
+								placeholder="yourdomain.com"
+								class="w-full"
+								:options="domains.data"
+								:open-on-click="true"
+							/>
+						</div>
+					</div>
+					<Button
+						variant="ghost"
+						size="sm"
+						:label="__('Add another email')"
+						@click="emails.push({ username: '', domain: emails[0]?.domain || '' })"
+					>
+						<template #prefix>
+							<FeatherIcon name="plus" class="h-4 w-4" />
+						</template>
+					</Button>
 				</div>
 				<FormControl
 					v-model="accountRequest.role"
@@ -47,6 +69,21 @@
 					:label="__('Backup Email')"
 					placeholder="johndoe@personal.com"
 				/>
+				<FormControl
+					v-model="accountRequest.quota_gb"
+					type="number"
+					:min="0"
+					:label="__('Quota (GB, 0 = unlimited)')"
+					:description="__('Leave blank to use the configured default disk quota.')"
+				/>
+				<div class="space-y-1.5">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Groups') }}</label>
+					<MultiSelect v-model="groupIds" :options="groupOptions" />
+				</div>
+				<div class="space-y-1.5">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Mailing Lists') }}</label>
+					<MultiSelect v-model="mailingListIds" :options="mailingListOptions" />
+				</div>
 				<hr />
 
 				<Switch
@@ -77,6 +114,24 @@
 						:label="__('Password')"
 						placeholder="••••••••"
 					/>
+					<!-- Only set here when the account is created right away; an invited member picks
+					their own on the setup form. -->
+					<div class="space-y-1.5">
+						<label class="text-ink-gray-5 block text-xs">{{ __('Locale') }}</label>
+						<Combobox
+							v-model="accountRequest.locale"
+							:options="localeOptions"
+							:placeholder="__('Select a locale')"
+						/>
+					</div>
+					<div class="space-y-1.5">
+						<label class="text-ink-gray-5 block text-xs">{{ __('Time Zone') }}</label>
+						<Combobox
+							v-model="accountRequest.time_zone"
+							:options="timeZoneOptions"
+							:placeholder="__('Select a time zone')"
+						/>
+					</div>
 				</template>
 				<ErrorMessage :message="addMember.error?.messages[0]" />
 			</div>
@@ -85,20 +140,26 @@
 </template>
 
 <script setup lang="ts">
-import { inject, reactive, watch } from 'vue'
-import { Dialog, ErrorMessage, FeatherIcon, FormControl, Switch, createResource } from 'frappe-ui'
+import { computed, reactive, ref, watch } from 'vue'
+import {
+	Button,
+	Combobox,
+	Dialog,
+	ErrorMessage,
+	FeatherIcon,
+	FormControl,
+	MultiSelect,
+	Switch,
+	createResource,
+} from 'frappe-ui'
 
 import { raiseToast } from '@/apps/mail/utils'
+import { fromLocalInput, toLocalInput, utcFromNow } from '@/apps/mail/utils/datetime'
+import { useAccountOptions } from '@/apps/mail/composables/useAccountOptions'
 import { userStore } from '@/apps/mail/stores/user'
 
 const show = defineModel<boolean>()
 
-type DayjsFn = () => {
-	add: (value: number, unit: string) => { format: (fmt: string) => string }
-}
-
-const dayjs = inject<DayjsFn>('$dayjs')
-
 const { domains } = userStore()
 
 const ROLE_OPTIONS = [
@@ -107,38 +168,83 @@ const ROLE_OPTIONS = [
 ]
 
 const defaultAccountRequest = {
-	username: '',
-	domain: '',
 	role: 'user',
 	send_invite: true,
-	expires_at: dayjs?.().add(1, 'day').format('YYYY-MM-DDTHH:mm') || '',
+	expires_at: '',
 	backup_email: '',
+	// Blank hands the choice to the server, which falls back to the configured default.
+	quota_gb: '',
 	first_name: '',
 	last_name: '',
 	password: '',
+	locale: '',
+	time_zone: '',
 }
 
 const accountRequest = reactive({ ...defaultAccountRequest })
+const emails = ref<{ username: string; domain: string }[]>([{ username: '', domain: '' }])
+const groupIds = ref<string[]>([])
+const mailingListIds = ref<string[]>([])
 
 const emit = defineEmits(['reload'])
 
+type Directory = { id: string; name: string; email?: string }
+
+// The account joins these once it exists: immediately when the invite is skipped, otherwise when the
+// invited member verifies and their account is created. Both are read live from Stalwart, so they are
+// fetched when the dialog opens rather than on every visit to the members list.
+const groups = createResource({ url: 'suite.mail.api.admin.get_groups' })
+const mailingLists = createResource({ url: 'suite.mail.api.admin.get_mailing_lists' })
+
+const toOptions = (rows: Directory[]) => rows.map((r) => ({ label: r.email || r.name, value: r.id }))
+const groupOptions = computed(() => toOptions(groups.data || []))
+const mailingListOptions = computed(() => toOptions(mailingLists.data || []))
+
+const { localeOptions, timeZoneOptions } = useAccountOptions()
+
 watch(
 	() => accountRequest.send_invite,
 	() => addMember.reset(),
 )
 watch(show, () => {
 	if (show.value) {
-		Object.assign(accountRequest, defaultAccountRequest)
+		// Shown and typed in the user's zone (converted to UTC on submit), and seeded here rather
+		// than in the default shape so a dialog opened later gets a fresh expiry.
+		Object.assign(accountRequest, defaultAccountRequest, {
+			expires_at: toLocalInput(utcFromNow(1, 'day')),
+		})
+		emails.value = [{ username: '', domain: '' }]
+		groupIds.value = []
+		mailingListIds.value = []
+		groups.fetch()
+		mailingLists.fetch()
 		addMember.reset()
 	}
 })
 
 const addMember = createResource({
 	url: 'suite.mail.api.admin.add_member',
-	makeParams: () => ({
-		...accountRequest,
-		is_admin: accountRequest.role === 'admin',
-	}),
+	makeParams: () => {
+		const [primary, ...rest] = emails.value
+		const aliases = rest
+			.filter((e) => e.username && e.domain)
+			.map((e) => `${e.username}@${e.domain}`)
+
+		return {
+			...accountRequest,
+			username: primary?.username || '',
+			domain: primary?.domain || '',
+			aliases,
+			groups: groupIds.value,
+			mailing_lists: mailingListIds.value,
+			expires_at: fromLocalInput(accountRequest.expires_at),
+			quota_gb: accountRequest.quota_gb === '' ? null : Number(accountRequest.quota_gb),
+			// Blank means "server default" for both, which the API spells as null.
+			locale: accountRequest.locale || null,
+			time_zone: accountRequest.time_zone || null,
+			is_admin: accountRequest.role === 'admin',
+		}
+	},
 	onSuccess: () => {
 		raiseToast(accountRequest.send_invite ? __('Member invited.') : __('Member added.'))
 		emit('reload')
diff --git a/frontend/src/apps/mail/components/Modals/AddOAuthClientModal.vue b/frontend/src/apps/mail/components/Modals/AddOAuthClientModal.vue
new file mode 100644
index 0000000000..4f083be5d0
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddOAuthClientModal.vue
@@ -0,0 +1,109 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add OAuth Client'),
+			actions: [
+				{ label: __('Add OAuth Client'), variant: 'solid', disabled: !clientId, onClick: addClient.submit },
+			],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl v-model="clientId" :label="__('Client ID')" autocomplete="off" />
+				<FormControl v-model="description" :label="__('Description')" type="textarea" />
+
+				<div class="space-y-2">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Contacts') }}</label>
+					<div v-for="(row, index) in contacts" :key="index" class="flex items-center gap-2">
+						<FormControl v-model="row.value" type="email" placeholder="someone@example.com" class="w-full" />
+						<Button v-if="contacts.length > 1" variant="ghost" theme="red" @click="contacts.splice(index, 1)">
+							<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+						</Button>
+					</div>
+					<Button variant="ghost" size="sm" :label="__('Add another')" @click="contacts.push({ value: '' })">
+						<template #prefix><FeatherIcon name="plus" class="h-4 w-4" /></template>
+					</Button>
+				</div>
+
+				<div class="space-y-2">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Redirect URIs') }}</label>
+					<div v-for="(row, index) in redirectUris" :key="index" class="flex items-center gap-2">
+						<FormControl v-model="row.value" placeholder="https://app.example.com/callback" class="w-full" />
+						<Button v-if="redirectUris.length > 1" variant="ghost" theme="red" @click="redirectUris.splice(index, 1)">
+							<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+						</Button>
+					</div>
+					<Button variant="ghost" size="sm" :label="__('Add another')" @click="redirectUris.push({ value: '' })">
+						<template #prefix><FeatherIcon name="plus" class="h-4 w-4" /></template>
+					</Button>
+				</div>
+
+				<FormControl v-model="secret" :label="__('Client Secret')" autocomplete="off" />
+				<FormControl
+					v-model="logo"
+					:label="__('Logo (URL or base64 encoded)')"
+					type="textarea"
+				/>
+				<FormControl v-model="expiresAt" type="datetime-local" :label="__('Expires At')" />
+				<ErrorMessage :message="addClient.error?.messages?.[0] || addClient.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { ref, watch } from 'vue'
+import { useRouter } from 'vue-router'
+import { Button, Dialog, ErrorMessage, FeatherIcon, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+import { fromLocalInput } from '@/apps/mail/utils/datetime'
+
+const show = defineModel<boolean>()
+const router = useRouter()
+const emit = defineEmits(['reload'])
+
+const clientId = ref('')
+const description = ref('')
+const contacts = ref<{ value: string }[]>([{ value: '' }])
+const redirectUris = ref<{ value: string }[]>([{ value: '' }])
+const secret = ref('')
+const logo = ref('')
+const expiresAt = ref('')
+
+const values = (rows: { value: string }[]) => rows.map((r) => r.value.trim()).filter(Boolean)
+
+watch(show, () => {
+	if (show.value) {
+		clientId.value = ''
+		description.value = ''
+		contacts.value = [{ value: '' }]
+		redirectUris.value = [{ value: '' }]
+		secret.value = ''
+		logo.value = ''
+		expiresAt.value = ''
+		addClient.reset()
+	}
+})
+
+const addClient = createResource({
+	url: 'suite.mail.api.admin.add_oauth_client',
+	makeParams: () => ({
+		client_id: clientId.value,
+		description: description.value?.trim() || undefined,
+		contacts: values(contacts.value),
+		redirect_uris: values(redirectUris.value),
+		secret: secret.value?.trim() || undefined,
+		logo: logo.value?.trim() || undefined,
+		expires_at: fromLocalInput(expiresAt.value) || undefined,
+	}),
+	onSuccess: (data: string) => {
+		if (!data) return
+		show.value = false
+		emit('reload')
+		raiseToast(__('OAuth client added.'))
+		router.push({ name: 'mail-oauth-client', params: { clientId: data } })
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddOAuthContactsModal.vue b/frontend/src/apps/mail/components/Modals/AddOAuthContactsModal.vue
new file mode 100644
index 0000000000..836cd1819d
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddOAuthContactsModal.vue
@@ -0,0 +1,71 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add Contacts'),
+			actions: [
+				{ label: __('Add'), variant: 'solid', disabled: !validContacts.length, onClick: addContacts.submit },
+			],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<div class="space-y-2">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Contacts') }}</label>
+					<div v-for="(row, index) in contacts" :key="index" class="flex items-center gap-2">
+						<FormControl
+							v-model="row.value"
+							type="email"
+							placeholder="someone@example.com"
+							class="w-full"
+						/>
+						<Button
+							v-if="contacts.length > 1"
+							variant="ghost"
+							theme="red"
+							@click="contacts.splice(index, 1)"
+						>
+							<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+						</Button>
+					</div>
+					<Button variant="ghost" size="sm" :label="__('Add another')" @click="contacts.push({ value: '' })">
+						<template #prefix><FeatherIcon name="plus" class="h-4 w-4" /></template>
+					</Button>
+				</div>
+				<ErrorMessage :message="addContacts.error?.messages?.[0] || addContacts.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { Button, Dialog, ErrorMessage, FeatherIcon, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const show = defineModel<boolean>()
+const { clientId } = defineProps<{ clientId: string }>()
+const emit = defineEmits(['reload'])
+
+const contacts = ref<{ value: string }[]>([{ value: '' }])
+
+const validContacts = computed(() => contacts.value.map((c) => c.value.trim()).filter(Boolean))
+
+watch(show, () => {
+	if (show.value) {
+		contacts.value = [{ value: '' }]
+		addContacts.reset()
+	}
+})
+
+const addContacts = createResource({
+	url: 'suite.mail.api.admin.add_oauth_client_contacts',
+	makeParams: () => ({ client_id: clientId, contacts: validContacts.value }),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Contacts added.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddOAuthRedirectUrisModal.vue b/frontend/src/apps/mail/components/Modals/AddOAuthRedirectUrisModal.vue
new file mode 100644
index 0000000000..fd25b77e4d
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddOAuthRedirectUrisModal.vue
@@ -0,0 +1,63 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add Redirect URIs'),
+			actions: [{ label: __('Add'), variant: 'solid', disabled: !validUris.length, onClick: addUris.submit }],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<div class="space-y-2">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Redirect URIs') }}</label>
+					<div v-for="(row, index) in uris" :key="index" class="flex items-center gap-2">
+						<FormControl
+							v-model="row.value"
+							placeholder="https://app.example.com/callback"
+							class="w-full"
+						/>
+						<Button v-if="uris.length > 1" variant="ghost" theme="red" @click="uris.splice(index, 1)">
+							<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+						</Button>
+					</div>
+					<Button variant="ghost" size="sm" :label="__('Add another')" @click="uris.push({ value: '' })">
+						<template #prefix><FeatherIcon name="plus" class="h-4 w-4" /></template>
+					</Button>
+				</div>
+				<ErrorMessage :message="addUris.error?.messages?.[0] || addUris.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { Button, Dialog, ErrorMessage, FeatherIcon, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const show = defineModel<boolean>()
+const { clientId } = defineProps<{ clientId: string }>()
+const emit = defineEmits(['reload'])
+
+const uris = ref<{ value: string }[]>([{ value: '' }])
+
+const validUris = computed(() => uris.value.map((u) => u.value.trim()).filter(Boolean))
+
+watch(show, () => {
+	if (show.value) {
+		uris.value = [{ value: '' }]
+		addUris.reset()
+	}
+})
+
+const addUris = createResource({
+	url: 'suite.mail.api.admin.add_oauth_client_redirect_uris',
+	makeParams: () => ({ client_id: clientId, redirect_uris: validUris.value }),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Redirect URIs added.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddQueuedRecipientModal.vue b/frontend/src/apps/mail/components/Modals/AddQueuedRecipientModal.vue
new file mode 100644
index 0000000000..383a8da2b6
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddQueuedRecipientModal.vue
@@ -0,0 +1,46 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add Recipient'),
+			actions: [{ label: __('Add'), variant: 'solid', disabled: !email, onClick: addRecipient.submit }],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl v-model="email" :label="__('Email')" type="email" placeholder="someone@example.com" />
+				<ErrorMessage :message="addRecipient.error?.messages?.[0] || addRecipient.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { ref, watch } from 'vue'
+import { Dialog, ErrorMessage, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const show = defineModel<boolean>()
+const { messageId } = defineProps<{ messageId: string }>()
+const emit = defineEmits(['reload'])
+
+const email = ref('')
+
+watch(show, () => {
+	if (show.value) {
+		email.value = ''
+		addRecipient.reset()
+	}
+})
+
+const addRecipient = createResource({
+	url: 'suite.mail.api.admin.add_queued_recipient',
+	makeParams: () => ({ message_id: messageId, email: email.value.trim() }),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Recipient added.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/AddRoleModal.vue b/frontend/src/apps/mail/components/Modals/AddRoleModal.vue
new file mode 100644
index 0000000000..caa51a86b5
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/AddRoleModal.vue
@@ -0,0 +1,84 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Add Role'),
+			actions: [
+				{ label: __('Add Role'), variant: 'solid', disabled: !description, onClick: addRole.submit },
+			],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl v-model="description" :label="__('Description')" autocomplete="off" />
+				<div class="space-y-1.5">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Enabled Permissions') }}</label>
+					<MultiSelect v-model="enabledPermissions" :options="permissionOptions" />
+				</div>
+				<div class="space-y-1.5">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Disabled Permissions') }}</label>
+					<MultiSelect v-model="disabledPermissions" :options="permissionOptions" />
+				</div>
+				<div class="space-y-1.5">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Inherited Roles') }}</label>
+					<MultiSelect v-model="roleIds" :options="roleOptions" />
+				</div>
+				<ErrorMessage :message="addRole.error?.messages?.[0] || addRole.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { useRouter } from 'vue-router'
+import { Dialog, ErrorMessage, FormControl, MultiSelect, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const show = defineModel<boolean>()
+const router = useRouter()
+const emit = defineEmits(['reload'])
+
+const description = ref('')
+const enabledPermissions = ref<string[]>([])
+const disabledPermissions = ref<string[]>([])
+const roleIds = ref<string[]>([])
+
+const permissions = createResource({ url: 'suite.mail.api.admin.get_permissions', auto: true })
+const roles = createResource({ url: 'suite.mail.api.admin.get_roles_list', auto: true })
+
+const permissionOptions = computed(() =>
+	(permissions.data || []).map((p: { value: string; label: string }) => ({ label: p.label, value: p.value })),
+)
+const roleOptions = computed(() =>
+	(roles.data || []).map((r: { id: string; description: string }) => ({ label: r.description, value: r.id })),
+)
+
+watch(show, () => {
+	if (show.value) {
+		description.value = ''
+		enabledPermissions.value = []
+		disabledPermissions.value = []
+		roleIds.value = []
+		addRole.reset()
+	}
+})
+
+const addRole = createResource({
+	url: 'suite.mail.api.admin.add_role',
+	makeParams: () => ({
+		description: description.value,
+		enabled_permissions: enabledPermissions.value,
+		disabled_permissions: disabledPermissions.value,
+		role_ids: roleIds.value,
+	}),
+	onSuccess: (data: string) => {
+		if (!data) return
+		show.value = false
+		emit('reload')
+		raiseToast(__('Role added.'))
+		router.push({ name: 'mail-role', params: { roleId: data } })
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/ChangeMemberPasswordModal.vue b/frontend/src/apps/mail/components/Modals/ChangeMemberPasswordModal.vue
new file mode 100644
index 0000000000..bcb866b987
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/ChangeMemberPasswordModal.vue
@@ -0,0 +1,70 @@
+<template>
+	<Dialog v-model="show" :options="dialogOptions">
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl
+					v-model="newPassword"
+					type="password"
+					:label="__('New Password')"
+					placeholder="••••••••"
+					variant="outline"
+				/>
+				<FormControl
+					v-model="confirmPassword"
+					type="password"
+					:label="__('Confirm New Password')"
+					placeholder="••••••••"
+					variant="outline"
+				/>
+				<ErrorMessage :message="errorMessage" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { Dialog, ErrorMessage, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+const { memberId } = defineProps<{ memberId: string }>()
+
+const show = defineModel<boolean>()
+
+const newPassword = ref('')
+const confirmPassword = ref('')
+
+const errorMessage = computed(() =>
+	confirmPassword.value && confirmPassword.value !== newPassword.value
+		? __('Passwords do not match')
+		: changePassword.error?.messages?.[0],
+)
+
+const dialogOptions = computed(() => ({
+	title: __('Change Password'),
+	actions: [
+		{
+			label: __('Confirm'),
+			variant: 'solid',
+			onClick: () => changePassword.submit(),
+			disabled: !newPassword.value.length || confirmPassword.value !== newPassword.value,
+		},
+	],
+}))
+
+const changePassword = createResource({
+	url: 'suite.mail.api.admin.change_member_password',
+	makeParams: () => ({ member_id: memberId, new_password: newPassword.value }),
+	onSuccess: () => {
+		show.value = false
+		raiseToast(__('Password updated.'))
+	},
+})
+
+watch(show, () => {
+	newPassword.value = ''
+	confirmPassword.value = ''
+	changePassword.reset()
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/EditGroupModal.vue b/frontend/src/apps/mail/components/Modals/EditGroupModal.vue
new file mode 100644
index 0000000000..accdeae4ef
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/EditGroupModal.vue
@@ -0,0 +1,87 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Edit Group'),
+			actions: [{ label: __('Save'), variant: 'solid', onClick: updateGroup.submit }],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl v-model="description" :label="__('Description')" />
+				<div class="space-y-1.5">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Roles') }}</label>
+					<MultiSelect v-model="roleIds" :options="roleOptions" />
+				</div>
+				<div class="space-y-1.5">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Locale') }}</label>
+					<Combobox v-model="locale" :options="localeOptions" :placeholder="__('Select a locale')" />
+				</div>
+				<div class="space-y-1.5">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Time Zone') }}</label>
+					<Combobox v-model="timeZone" :options="timeZoneOptions" :placeholder="__('Select a time zone')" />
+				</div>
+				<ErrorMessage :message="updateGroup.error?.messages?.[0] || updateGroup.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { Combobox, Dialog, ErrorMessage, FormControl, MultiSelect, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+import { useAccountOptions } from '@/apps/mail/composables/useAccountOptions'
+
+type GroupData = {
+	id: string
+	description?: string
+	role_ids: string[]
+	locale?: string | null
+	time_zone?: string | null
+}
+
+const show = defineModel<boolean>()
+const { group } = defineProps<{ group: GroupData }>()
+const emit = defineEmits(['reload'])
+
+const description = ref('')
+const roleIds = ref<string[]>([])
+const locale = ref<string | null>(null)
+const timeZone = ref<string | null>(null)
+
+const { localeOptions, timeZoneOptions } = useAccountOptions()
+
+const roles = createResource({ url: 'suite.mail.api.admin.get_roles_list', auto: true })
+const roleOptions = computed(() =>
+	(roles.data || []).map((r: { id: string; description: string }) => ({ label: r.description, value: r.id })),
+)
+
+watch(show, () => {
+	if (show.value && group) {
+		description.value = group.description || ''
+		roleIds.value = [...group.role_ids]
+		locale.value = group.locale || null
+		timeZone.value = group.time_zone || ''
+		updateGroup.reset()
+	}
+})
+
+const updateGroup = createResource({
+	url: 'suite.mail.api.admin.update_group',
+	makeParams: () => ({
+		group_id: group.id,
+		description: description.value?.trim() || '',
+		roles: roleIds.value,
+		locale: locale.value || '',
+		// Always sent: an empty value clears the time zone, which is how it is unset.
+		time_zone: timeZone.value || '',
+	}),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Group updated.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/EditGroupQuotaModal.vue b/frontend/src/apps/mail/components/Modals/EditGroupQuotaModal.vue
new file mode 100644
index 0000000000..baaa95a827
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/EditGroupQuotaModal.vue
@@ -0,0 +1,48 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Edit Quota'),
+			actions: [{ label: __('Save'), variant: 'solid', onClick: updateQuota.submit }],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl v-model="quotaGb" type="number" :min="0" :label="__('Quota (GB, 0 = unlimited)')" />
+				<ErrorMessage :message="updateQuota.error?.messages?.[0] || updateQuota.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { ref, watch } from 'vue'
+import { Dialog, ErrorMessage, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+type GroupData = { id: string; quota: { total: number } }
+
+const show = defineModel<boolean>()
+const { group } = defineProps<{ group: GroupData }>()
+const emit = defineEmits(['reload'])
+
+const quotaGb = ref(0)
+
+watch(show, () => {
+	if (show.value && group) {
+		quotaGb.value = group.quota?.total ? Math.round(group.quota.total / 1024 ** 3) : 0
+		updateQuota.reset()
+	}
+})
+
+const updateQuota = createResource({
+	url: 'suite.mail.api.admin.update_group',
+	makeParams: () => ({ group_id: group.id, quota_gb: Number(quotaGb.value) || 0 }),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Quota updated.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/EditInviteModal.vue b/frontend/src/apps/mail/components/Modals/EditInviteModal.vue
index 45ee0cc803..9b58f81d12 100644
--- a/frontend/src/apps/mail/components/Modals/EditInviteModal.vue
+++ b/frontend/src/apps/mail/components/Modals/EditInviteModal.vue
@@ -5,6 +5,15 @@
 		:options="{
 			title: __('Edit Invite'),
 			actions: [
+				...(canSendInvite
+					? [
+							{
+								label: __('Send Invitation Email'),
+								loading: accountRequest.sendVerificationEmail?.loading,
+								onClick: sendInvitationEmail,
+							},
+						]
+					: []),
 				{
 					label: __('Save'),
 					variant: 'solid',
@@ -22,12 +31,23 @@
 					disabled
 				/>
 				<FormControl
-					v-model="inviteRole"
-					type="select"
-					:label="__('Role')"
-					:options="ROLE_OPTIONS"
+					v-if="accountRequest.doc.aliases"
+					type="textarea"
+					:label="__('Aliases')"
+					:value="accountRequest.doc.aliases"
+					disabled
+				/>
+				<FormControl
+					v-model="inviteQuota"
+					type="number"
+					:min="0"
+					:label="__('Quota (GB, 0 = unlimited)')"
+					:description="__('Leave blank to use the configured default disk quota.')"
 					:disabled="!isEditableInvite"
 				/>
+				<!-- Fixed when the request was created (set_only_once on the doctype), so the roles the
+				account is created with cannot be changed on an existing invite. -->
+				<FormControl :label="__('Role')" :value="roleLabel" disabled />
 				<FormControl
 					:label="__('Backup Email')"
 					:value="accountRequest.doc.backup_email"
@@ -44,6 +64,32 @@
 					:label="__('Expires At')"
 					:disabled="!isEditableInvite"
 				/>
+				<hr />
+
+				<!-- Send Invite, the aliases and the memberships are fixed when the request is created
+				(set_only_once on the doctype), so they are all shown read-only. -->
+				<Switch
+					:model-value="Boolean(accountRequest.doc.send_invite)"
+					:label="__('Send Invite')"
+					disabled
+					class="hover:!bg-surface-base !cursor-default !p-0"
+				/>
+				<template v-if="groupIds.length || mailingListIds.length">
+					<hr />
+					<p class="text-ink-gray-5 text-xs font-medium">{{ __('Membership Details') }}</p>
+					<FormControl
+						v-if="groupIds.length"
+						:label="__('Groups')"
+						:value="groupLabels.join(', ')"
+						disabled
+					/>
+					<FormControl
+						v-if="mailingListIds.length"
+						:label="__('Mailing Lists')"
+						:value="mailingListLabels.join(', ')"
+						disabled
+					/>
+				</template>
 			</div>
 		</template>
 	</Dialog>
@@ -51,7 +97,7 @@
 
 <script setup lang="ts">
 import { computed, ref, watch } from 'vue'
-import { Dialog, FormControl, createDocumentResource } from 'frappe-ui'
+import { Dialog, FormControl, Switch, createDocumentResource, createResource } from 'frappe-ui'
 
 import { raiseToast } from '@/apps/mail/utils'
 
@@ -63,32 +109,41 @@ const emit = defineEmits(['reloadInvites'])
 
 type InviteDoc = {
 	account: string
+	aliases?: string
 	is_admin: boolean | 0 | 1
 	backup_email: string
 	invited_by: string
 	expires_at?: string
+	quota_gb?: number | null
+	send_invite: boolean | 0 | 1
 	is_verified: boolean | 0 | 1
+	groups?: string
+	mailing_lists?: string
 }
 
+type MethodResource = { submit?: () => void; loading?: boolean }
+
 type AccountRequestResource = {
 	doc?: InviteDoc
 	isDirty: boolean
 	save?: { submit?: () => void }
 	reload?: () => void
+	sendVerificationEmail?: MethodResource
 }
 
+type Directory = { id: string; name: string; email?: string }
+
 const accountRequest = ref<AccountRequestResource>()
 
-const ROLE_OPTIONS = [
-	{ label: __('User'), value: 'user' },
-	{ label: __('Admin'), value: 'admin' },
-]
+const roleLabel = computed(() => (accountRequest.value?.doc?.is_admin ? __('Admin') : __('User')))
 
-const inviteRole = computed<'user' | 'admin'>({
-	get: () => (accountRequest.value?.doc?.is_admin ? 'admin' : 'user'),
+// Cleared back to null rather than 0, so a blank field keeps deferring to the configured default
+// instead of silently meaning unlimited.
+const inviteQuota = computed<number | string>({
+	get: () => accountRequest.value?.doc?.quota_gb ?? '',
 	set: (value) => {
 		if (!accountRequest.value?.doc) return
-		accountRequest.value.doc.is_admin = value === 'admin'
+		accountRequest.value.doc.quota_gb = value === '' ? null : Number(value)
 	},
 })
 
@@ -98,11 +153,47 @@ const isEditableInvite = computed(() => {
 	return !doc.is_verified
 })
 
+// Expiry is read off the local doc so extending it lights the send action up only once saved.
+const isExpired = computed(() => {
+	const expiresAt = accountRequest.value?.doc?.expires_at
+	return Boolean(expiresAt) && new Date(expiresAt as string) < new Date()
+})
+
+// The server sends the link with whatever is stored, so pending edits have to be saved first.
+const canSendInvite = computed(
+	() => isEditableInvite.value && !isExpired.value && !accountRequest.value?.isDirty,
+)
+
+// The account request stores the ids it was created with; the labels come from the live directory.
+const groups = createResource({ url: 'suite.mail.api.admin.get_groups' })
+const mailingLists = createResource({ url: 'suite.mail.api.admin.get_mailing_lists' })
+
+const lines = (value?: string) =>
+	(value || '')
+		.split('\n')
+		.map((line) => line.trim())
+		.filter(Boolean)
+
+const labelsFor = (rows: Directory[], ids: string[]) => {
+	const map = new Map(rows.map((r) => [String(r.id), r.email || r.name]))
+	return ids.map((id) => map.get(id) || id)
+}
+
+const groupIds = computed(() => lines(accountRequest.value?.doc?.groups))
+const mailingListIds = computed(() => lines(accountRequest.value?.doc?.mailing_lists))
+const groupLabels = computed(() => labelsFor(groups.data || [], groupIds.value))
+const mailingListLabels = computed(() => labelsFor(mailingLists.data || [], mailingListIds.value))
+
 const saveInvite = () => {
 	if (!isEditableInvite.value) return
 	accountRequest.value?.save?.submit?.()
 }
 
+const sendInvitationEmail = () => {
+	if (!canSendInvite.value) return
+	accountRequest.value?.sendVerificationEmail?.submit?.()
+}
+
 const getMailAccountRequest = () =>
 	createDocumentResource({
 		doctype: 'Mail Account Request',
@@ -118,6 +209,14 @@ const getMailAccountRequest = () =>
 				accountRequest.value?.reload?.()
 			},
 		},
+		whitelistedMethods: {
+			sendVerificationEmail: {
+				method: 'send_verification_email',
+				onSuccess: () => raiseToast(__('Invitation email sent.')),
+				onError: (error: { messages?: string[] }) =>
+					raiseToast(error.messages?.[0] || __('Failed to send invitation email.'), 'error'),
+			},
+		},
 	})
 
 watch(
@@ -127,4 +226,12 @@ watch(
 	},
 	{ immediate: true },
 )
+
+// Both are live Stalwart reads, so they are only fetched for invites that carry memberships.
+watch(groupIds, (ids) => {
+	if (ids.length && !groups.fetched && !groups.loading) groups.fetch()
+})
+watch(mailingListIds, (ids) => {
+	if (ids.length && !mailingLists.fetched && !mailingLists.loading) mailingLists.fetch()
+})
 </script>
diff --git a/frontend/src/apps/mail/components/Modals/EditMailingListModal.vue b/frontend/src/apps/mail/components/Modals/EditMailingListModal.vue
new file mode 100644
index 0000000000..5a3b4456eb
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/EditMailingListModal.vue
@@ -0,0 +1,48 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Edit Mailing List'),
+			actions: [{ label: __('Save'), variant: 'solid', onClick: updateList.submit }],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl v-model="description" :label="__('Description')" />
+				<ErrorMessage :message="updateList.error?.messages?.[0] || updateList.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { ref, watch } from 'vue'
+import { Dialog, ErrorMessage, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+type ListData = { id: string; description?: string }
+
+const show = defineModel<boolean>()
+const { list } = defineProps<{ list: ListData }>()
+const emit = defineEmits(['reload'])
+
+const description = ref('')
+
+watch(show, () => {
+	if (show.value && list) {
+		description.value = list.description || ''
+		updateList.reset()
+	}
+})
+
+const updateList = createResource({
+	url: 'suite.mail.api.admin.update_mailing_list',
+	makeParams: () => ({ list_id: list.id, description: description.value?.trim() || '' }),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Mailing list updated.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/EditMemberModal.vue b/frontend/src/apps/mail/components/Modals/EditMemberModal.vue
new file mode 100644
index 0000000000..03195c944c
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/EditMemberModal.vue
@@ -0,0 +1,84 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Edit Member'),
+			actions: [{ label: __('Save'), variant: 'solid', disabled: !description, onClick: updateMember.submit }],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl v-model="role" type="select" :label="__('Role')" :options="ROLE_OPTIONS" />
+				<FormControl v-model="description" :label="__('Full Name')" />
+				<div class="space-y-1.5">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Locale') }}</label>
+					<Combobox v-model="locale" :options="localeOptions" :placeholder="__('Select a locale')" />
+				</div>
+				<div class="space-y-1.5">
+					<label class="text-ink-gray-5 block text-xs">{{ __('Time Zone') }}</label>
+					<Combobox v-model="timeZone" :options="timeZoneOptions" :placeholder="__('Select a time zone')" />
+				</div>
+				<ErrorMessage :message="updateMember.error?.messages?.[0] || updateMember.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { ref, watch } from 'vue'
+import { Combobox, Dialog, ErrorMessage, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+import { useAccountOptions } from '@/apps/mail/composables/useAccountOptions'
+
+type MemberData = {
+	name: string
+	is_admin: boolean
+	description?: string
+	locale?: string | null
+	time_zone?: string | null
+}
+
+const show = defineModel<boolean>()
+const { member } = defineProps<{ member: MemberData }>()
+const emit = defineEmits(['reload'])
+
+const ROLE_OPTIONS = [
+	{ label: __('User'), value: 'user' },
+	{ label: __('Admin'), value: 'admin' },
+]
+
+const role = ref('user')
+const description = ref('')
+const locale = ref<string | null>(null)
+const timeZone = ref<string | null>(null)
+
+const { localeOptions, timeZoneOptions } = useAccountOptions()
+
+watch(show, () => {
+	if (show.value && member) {
+		role.value = member.is_admin ? 'admin' : 'user'
+		description.value = member.description || ''
+		locale.value = member.locale || null
+		timeZone.value = member.time_zone || ''
+		updateMember.reset()
+	}
+})
+
+const updateMember = createResource({
+	url: 'suite.mail.api.admin.update_member',
+	makeParams: () => ({
+		member_id: member.name,
+		role: role.value,
+		description: description.value?.trim(),
+		locale: locale.value || '',
+		// Always sent: an empty value clears the time zone, which is how it is unset.
+		time_zone: timeZone.value || '',
+	}),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Member updated.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/EditMemberQuotaModal.vue b/frontend/src/apps/mail/components/Modals/EditMemberQuotaModal.vue
new file mode 100644
index 0000000000..9919b348d9
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/EditMemberQuotaModal.vue
@@ -0,0 +1,53 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Edit Quota'),
+			actions: [{ label: __('Save'), variant: 'solid', onClick: updateQuota.submit }],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl
+					v-model="quotaGb"
+					type="number"
+					:min="0"
+					:label="__('Quota (GB, 0 = unlimited)')"
+				/>
+				<ErrorMessage :message="updateQuota.error?.messages?.[0] || updateQuota.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { ref, watch } from 'vue'
+import { Dialog, ErrorMessage, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+type MemberData = { name: string; quota: { total: number } }
+
+const show = defineModel<boolean>()
+const { member } = defineProps<{ member: MemberData }>()
+const emit = defineEmits(['reload'])
+
+const quotaGb = ref(0)
+
+watch(show, () => {
+	if (show.value && member) {
+		quotaGb.value = member.quota?.total ? Math.round(member.quota.total / 1024 ** 3) : 0
+		updateQuota.reset()
+	}
+})
+
+const updateQuota = createResource({
+	url: 'suite.mail.api.admin.update_member',
+	makeParams: () => ({ member_id: member.name, quota_gb: Number(quotaGb.value) || 0 }),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Quota updated.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/EditOAuthClientModal.vue b/frontend/src/apps/mail/components/Modals/EditOAuthClientModal.vue
new file mode 100644
index 0000000000..4b909723d5
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/EditOAuthClientModal.vue
@@ -0,0 +1,79 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Edit OAuth Client'),
+			actions: [{ label: __('Save'), variant: 'solid', onClick: updateClient.submit }],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl v-model="clientId" :label="__('Client ID')" autocomplete="off" />
+				<FormControl v-model="description" :label="__('Description')" type="textarea" />
+				<FormControl
+					v-model="secret"
+					:label="__('Client Secret')"
+					autocomplete="off"
+					:placeholder="__('Leave blank to keep unchanged')"
+				/>
+				<FormControl v-model="logo" :label="__('Logo (URL or base64 encoded)')" type="textarea" />
+				<FormControl v-model="expiresAt" type="datetime-local" :label="__('Expires At')" />
+				<ErrorMessage :message="updateClient.error?.messages?.[0] || updateClient.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { ref, watch } from 'vue'
+import { Dialog, ErrorMessage, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+import { fromLocalInput, toLocalInput } from '@/apps/mail/utils/datetime'
+
+type ClientData = {
+	id: string
+	client_id: string
+	description?: string
+	logo?: string
+	expires_at?: string
+}
+
+const show = defineModel<boolean>()
+const { client } = defineProps<{ client: ClientData }>()
+const emit = defineEmits(['reload'])
+
+const clientId = ref('')
+const description = ref('')
+const secret = ref('')
+const logo = ref('')
+const expiresAt = ref('')
+
+watch(show, () => {
+	if (show.value && client) {
+		clientId.value = client.client_id || ''
+		description.value = client.description || ''
+		secret.value = ''
+		logo.value = client.logo || ''
+		expiresAt.value = toLocalInput(client.expires_at)
+		updateClient.reset()
+	}
+})
+
+const updateClient = createResource({
+	url: 'suite.mail.api.admin.update_oauth_client',
+	makeParams: () => ({
+		oauth_client_id: client.id,
+		client_id: clientId.value?.trim() || undefined,
+		description: description.value?.trim() || '',
+		secret: secret.value?.trim() || undefined,
+		logo: logo.value?.trim() ?? '',
+		expires_at: fromLocalInput(expiresAt.value),
+	}),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('OAuth client updated.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/EditQueuedMessageModal.vue b/frontend/src/apps/mail/components/Modals/EditQueuedMessageModal.vue
new file mode 100644
index 0000000000..33bf43a2ea
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/EditQueuedMessageModal.vue
@@ -0,0 +1,47 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Edit Queued Message'),
+			actions: [{ label: __('Save'), variant: 'solid', onClick: updateMessage.submit }],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl v-model="nextRetry" :label="__('Next Retry')" type="datetime-local" />
+				<ErrorMessage :message="updateMessage.error?.messages?.[0] || updateMessage.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { ref, watch } from 'vue'
+import { Dialog, ErrorMessage, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+import { fromLocalInput, toLocalInput } from '@/apps/mail/utils/datetime'
+
+const show = defineModel<boolean>()
+const { messageId, message } = defineProps<{ messageId: string; message: { next_retry?: string } }>()
+const emit = defineEmits(['reload'])
+
+const nextRetry = ref('')
+
+watch(show, () => {
+	if (show.value) {
+		nextRetry.value = toLocalInput(message?.next_retry)
+		updateMessage.reset()
+	}
+})
+
+const updateMessage = createResource({
+	url: 'suite.mail.api.admin.update_queued_message',
+	makeParams: () => ({ message_id: messageId, next_retry: fromLocalInput(nextRetry.value) }),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Queued message updated.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/EditQueuedRecipientModal.vue b/frontend/src/apps/mail/components/Modals/EditQueuedRecipientModal.vue
new file mode 100644
index 0000000000..e7eacca480
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/EditQueuedRecipientModal.vue
@@ -0,0 +1,208 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Edit Recipient'),
+			size: '3xl',
+			actions: [{ label: __('Save'), variant: 'solid', onClick: updateRecipient.submit }],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-6">
+				<!-- Recipient -->
+				<section class="space-y-3">
+					<h3 class="text-ink-gray-7 text-sm font-semibold">{{ __('Recipient') }}</h3>
+					<div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
+						<FormControl v-model="form.email" :label="__('Email')" type="email" />
+						<FormControl v-model="form.orcpt" :label="__('Original Recipient')" />
+					</div>
+				</section>
+
+				<!-- Status -->
+				<section class="space-y-3">
+					<h3 class="text-ink-gray-7 text-sm font-semibold">{{ __('Status') }}</h3>
+					<div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
+						<FormControl v-model="form.status_type" :label="__('Status')" type="select" :options="statusOptions" />
+						<FormControl
+							v-if="isFailure"
+							v-model="form.error_type"
+							:label="__('Error Type')"
+							type="select"
+							:options="errorOptions"
+						/>
+					</div>
+					<template v-if="isFailure">
+						<FormControl v-model="form.error_message" :label="__('Error Message')" type="textarea" />
+						<FormControl v-model="form.smtp_command" :label="__('SMTP Command')" />
+					</template>
+				</section>
+
+				<!-- Server Response -->
+				<section v-if="hasResponse" class="space-y-3">
+					<h3 class="text-ink-gray-7 text-sm font-semibold">{{ __('Server Response') }}</h3>
+					<div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
+						<FormControl v-model="form.hostname" :label="__('Hostname')" />
+						<FormControl v-model="form.response_code" :label="__('Response Code')" type="number" />
+						<FormControl v-model="form.enhanced_code" :label="__('Enhanced Code')" placeholder="4.7.1" />
+						<FormControl v-model="form.message" :label="__('Message')" />
+					</div>
+				</section>
+
+				<!-- Delivery -->
+				<section class="space-y-3">
+					<h3 class="text-ink-gray-7 text-sm font-semibold">{{ __('Delivery') }}</h3>
+					<div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
+						<FormControl v-model="form.next_retry" :label="__('Next Retry')" type="datetime-local" />
+						<FormControl v-model="form.retry_count" :label="__('Retry Count')" type="number" />
+						<FormControl v-model="form.next_notification" :label="__('Next Notification')" type="datetime-local" />
+						<FormControl v-model="form.notify_count" :label="__('Notify Count')" type="number" />
+					</div>
+				</section>
+
+				<!-- Expiry -->
+				<section class="space-y-3">
+					<h3 class="text-ink-gray-7 text-sm font-semibold">{{ __('Expiry') }}</h3>
+					<div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
+						<FormControl v-model="form.expiry_type" :label="__('Expiry')" type="select" :options="expiryOptions" />
+						<FormControl
+							v-if="form.expiry_type === 'Ttl'"
+							v-model="form.expires_at"
+							:label="__('Expires At')"
+							type="datetime-local"
+						/>
+						<FormControl
+							v-else-if="form.expiry_type === 'Attempts'"
+							v-model="form.expires_attempts"
+							:label="__('Max Attempts')"
+							type="number"
+						/>
+					</div>
+				</section>
+
+				<ErrorMessage :message="updateRecipient.error?.messages?.[0] || updateRecipient.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { computed, reactive, watch } from 'vue'
+import { Dialog, ErrorMessage, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+import { fromLocalInput, toLocalInput } from '@/apps/mail/utils/datetime'
+
+type Option = { value: string; label: string }
+type Recipient = {
+	email: string
+	orcpt?: string
+	status_type?: string
+	error_type?: string
+	error_message?: string
+	smtp_command?: string
+	hostname?: string
+	response_code?: number
+	enhanced_code?: string
+	message?: string
+	next_retry?: string
+	retry_count?: number
+	next_notification?: string
+	notify_count?: number
+	expiry_type?: string
+	expires_at?: string
+	expires_attempts?: number
+}
+
+const show = defineModel<boolean>()
+const { messageId, recipient, options } = defineProps<{
+	messageId: string
+	recipient: Recipient | null
+	options: { status_types: Option[]; error_types: Option[]; expiry_types: Option[] }
+}>()
+const emit = defineEmits(['reload'])
+
+const blank = () => ({
+	email: '',
+	orcpt: '',
+	status_type: 'Scheduled',
+	error_type: '',
+	error_message: '',
+	smtp_command: '',
+	hostname: '',
+	response_code: '',
+	enhanced_code: '',
+	message: '',
+	next_retry: '',
+	retry_count: '',
+	next_notification: '',
+	notify_count: '',
+	expiry_type: 'Ttl',
+	expires_at: '',
+	expires_attempts: '',
+})
+const form = reactive<Record<string, string>>(blank())
+
+const toLocal = toLocalInput
+const str = (value: unknown) => (value === null || value === undefined ? '' : String(value))
+
+const statusOptions = computed(() => options.status_types)
+const errorOptions = computed(() => options.error_types)
+const expiryOptions = computed(() => options.expiry_types)
+const isFailure = computed(() => ['TemporaryFailure', 'PermanentFailure'].includes(form.status_type))
+const hasResponse = computed(() => form.status_type && form.status_type !== 'Scheduled')
+
+watch(show, () => {
+	if (show.value && recipient) {
+		Object.assign(form, blank(), {
+			email: recipient.email || '',
+			orcpt: recipient.orcpt || '',
+			status_type: recipient.status_type || 'Scheduled',
+			error_type: recipient.error_type || '',
+			error_message: recipient.error_message || '',
+			smtp_command: recipient.smtp_command || '',
+			hostname: recipient.hostname || '',
+			response_code: str(recipient.response_code),
+			enhanced_code: recipient.enhanced_code || '',
+			message: recipient.message || '',
+			next_retry: toLocal(recipient.next_retry),
+			retry_count: str(recipient.retry_count),
+			next_notification: toLocal(recipient.next_notification),
+			notify_count: str(recipient.notify_count),
+			expiry_type: recipient.expiry_type || 'Ttl',
+			expires_at: toLocal(recipient.expires_at),
+			expires_attempts: str(recipient.expires_attempts),
+		})
+		updateRecipient.reset()
+	}
+})
+
+const updateRecipient = createResource({
+	url: 'suite.mail.api.admin.update_queued_recipient',
+	makeParams: () => ({
+		message_id: messageId,
+		email: recipient?.email,
+		new_email: form.email.trim(),
+		orcpt: form.orcpt.trim(),
+		status_type: form.status_type,
+		error_type: isFailure.value ? form.error_type : '',
+		error_message: isFailure.value ? form.error_message : '',
+		smtp_command: isFailure.value ? form.smtp_command : '',
+		hostname: hasResponse.value ? form.hostname.trim() : '',
+		response_code: hasResponse.value ? form.response_code : '',
+		enhanced_code: hasResponse.value ? form.enhanced_code.trim() : '',
+		message: hasResponse.value ? form.message.trim() : '',
+		next_retry: fromLocalInput(form.next_retry),
+		retry_count: form.retry_count,
+		next_notification: fromLocalInput(form.next_notification),
+		notify_count: form.notify_count,
+		expiry_type: form.expiry_type,
+		expires_at: form.expiry_type === 'Ttl' ? fromLocalInput(form.expires_at) : '',
+		expires_attempts: form.expiry_type === 'Attempts' ? form.expires_attempts : '',
+	}),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Recipient updated.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/EditRoleModal.vue b/frontend/src/apps/mail/components/Modals/EditRoleModal.vue
new file mode 100644
index 0000000000..039dfde50a
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/EditRoleModal.vue
@@ -0,0 +1,48 @@
+<template>
+	<Dialog
+		v-model="show"
+		:options="{
+			title: __('Edit Role'),
+			actions: [{ label: __('Save'), variant: 'solid', disabled: !description, onClick: updateRole.submit }],
+		}"
+	>
+		<template #body-content>
+			<div class="space-y-4">
+				<FormControl v-model="description" :label="__('Description')" autocomplete="off" />
+				<ErrorMessage :message="updateRole.error?.messages?.[0] || updateRole.error?.message" />
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { ref, watch } from 'vue'
+import { Dialog, ErrorMessage, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+type RoleData = { id: string; description: string }
+
+const show = defineModel<boolean>()
+const { role } = defineProps<{ role: RoleData }>()
+const emit = defineEmits(['reload'])
+
+const description = ref('')
+
+watch(show, () => {
+	if (show.value && role) {
+		description.value = role.description
+		updateRole.reset()
+	}
+})
+
+const updateRole = createResource({
+	url: 'suite.mail.api.admin.update_role',
+	makeParams: () => ({ role_id: role.id, description: description.value }),
+	onSuccess: () => {
+		show.value = false
+		emit('reload')
+		raiseToast(__('Role updated.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/components/Modals/RunActionModal.vue b/frontend/src/apps/mail/components/Modals/RunActionModal.vue
new file mode 100644
index 0000000000..2cbfd4faa2
--- /dev/null
+++ b/frontend/src/apps/mail/components/Modals/RunActionModal.vue
@@ -0,0 +1,167 @@
+<template>
+	<Dialog v-model="show" :options="dialogOptions">
+		<template #body-content>
+			<div class="space-y-4">
+				<template v-for="field in fields" :key="field.name">
+					<!-- A set-valued input (e.g. the recipients): one row per entry. -->
+					<div v-if="field.type === 'list'">
+						<label class="text-ink-gray-5 mb-1.5 block text-xs">{{ __(field.label) }}</label>
+						<div class="space-y-2">
+							<div v-for="(entry, index) in entriesOf(field)" :key="index" class="flex items-center gap-2">
+								<FormControl
+									class="flex-1"
+									:model-value="entry"
+									:placeholder="field.placeholder"
+									:disabled="hasRun"
+									@update:model-value="(value: string) => setEntry(field, index, value)"
+								/>
+								<Button
+									variant="ghost"
+									:disabled="hasRun || entriesOf(field).length === 1"
+									:tooltip="__('Remove')"
+									@click="removeEntry(field, index)"
+								>
+									<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+								</Button>
+							</div>
+						</div>
+						<Button class="mt-2" variant="ghost" :label="__('Add')" :disabled="hasRun" @click="addEntry(field)">
+							<template #prefix><FeatherIcon name="plus" class="h-4 w-4" /></template>
+						</Button>
+					</div>
+					<FormControl
+						v-else
+						v-model="values[field.name]"
+						:label="__(field.label)"
+						:type="field.type || 'text'"
+						:placeholder="field.placeholder"
+						:options="field.type === 'select' ? selectOptions(field) : undefined"
+						:required="field.required"
+						:disabled="hasRun"
+					/>
+				</template>
+				<ErrorMessage
+					:message="validationError || runAction.error?.messages?.[0] || runAction.error?.message"
+				/>
+				<div v-if="result">
+					<label class="text-ink-gray-5 mb-1 block text-xs">{{ __('Result') }}</label>
+					<pre
+						class="bg-surface-gray-2 max-h-[45vh] overflow-auto rounded p-4 text-xs whitespace-pre-wrap"
+						>{{ result }}</pre
+					>
+				</div>
+			</div>
+		</template>
+	</Dialog>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { Button, Dialog, ErrorMessage, FeatherIcon, FormControl, createResource } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+
+type ActionOption = { value: string; label: string }
+type ActionField = {
+	name: string
+	label: string
+	type?: string
+	placeholder?: string
+	required?: boolean
+	options?: ActionOption[]
+}
+type ActionInfo = { value: string; label: string; schema_name?: string | null }
+type FieldValue = string | boolean | string[]
+
+const show = defineModel<boolean>()
+const { action, fields } = defineProps<{ action: ActionInfo | null; fields: ActionField[] }>()
+
+const values = ref<Record<string, FieldValue>>({})
+const resultData = ref<Record<string, unknown> | null>(null)
+const validationError = ref('')
+
+const result = computed(() => (resultData.value ? JSON.stringify(resultData.value, null, 2) : ''))
+// The inputs freeze once the action has run, so the result on screen always reflects them; reopening
+// the dialog starts a fresh run.
+const hasRun = computed(() => resultData.value !== null)
+
+const dialogOptions = computed(() => ({
+	title: action?.label,
+	size: '2xl',
+	actions: hasRun.value
+		? [{ label: __('Close'), variant: 'subtle', onClick: () => (show.value = false) }]
+		: [{ label: __('Run'), variant: 'solid', onClick: run }],
+}))
+
+const emptyValue = (field: ActionField): FieldValue =>
+	field.type === 'checkbox' ? false : field.type === 'list' ? [''] : ''
+
+watch(show, () => {
+	if (show.value) {
+		values.value = Object.fromEntries(fields.map((f) => [f.name, emptyValue(f)]))
+		resultData.value = null
+		validationError.value = ''
+		runAction.reset()
+	}
+})
+
+// A select is only ever optional here, so it needs a blank choice to mean "unset".
+const selectOptions = (field: ActionField) => [{ value: '', label: '' }, ...(field.options || [])]
+
+const entriesOf = (field: ActionField) => (values.value[field.name] as string[]) || ['']
+const setEntry = (field: ActionField, index: number, value: string) => {
+	const entries = [...entriesOf(field)]
+	entries[index] = value
+	values.value[field.name] = entries
+}
+const addEntry = (field: ActionField) => (values.value[field.name] = [...entriesOf(field), ''])
+const removeEntry = (field: ActionField, index: number) =>
+	(values.value[field.name] = entriesOf(field).filter((_, i) => i !== index))
+
+const isBlank = (field: ActionField) => {
+	const value = values.value[field.name]
+	if (field.type === 'checkbox') return false
+	if (field.type === 'list') return !(value as string[]).some((entry) => entry.trim())
+	return !String(value ?? '').trim()
+}
+
+// The action only makes sense with every required input filled in, and the server would just report
+// its own generic failure, so hold the request back until they are.
+const run = () => {
+	const missing = fields.filter((f) => f.required && isBlank(f))
+	if (missing.length) {
+		const labels = missing.map((f) => __(f.label)).join(', ')
+		validationError.value =
+			missing.length === 1
+				? __('{0} is required.').replace('{0}', labels)
+				: __('These fields are required: {0}').replace('{0}', labels)
+		return
+	}
+	validationError.value = ''
+	return runAction.submit()
+}
+
+const runAction = createResource({
+	url: 'suite.mail.api.admin.run_action',
+	makeParams: () => {
+		const params: Record<string, FieldValue> = {}
+		for (const field of fields) {
+			const value = values.value[field.name]
+			if (field.type === 'checkbox') {
+				params[field.name] = Boolean(value)
+			} else if (field.type === 'list') {
+				const entries = (value as string[]).map((entry) => entry.trim()).filter(Boolean)
+				if (entries.length) params[field.name] = entries
+			} else {
+				const text = String(value ?? '').trim()
+				if (text) params[field.name] = text
+			}
+		}
+		return { action_type: action?.value, params }
+	},
+	onSuccess: (data: Record<string, unknown>) => {
+		resultData.value = data || {}
+		raiseToast(__('Action completed.'))
+	},
+})
+</script>
diff --git a/frontend/src/apps/mail/composables/useAccountOptions.ts b/frontend/src/apps/mail/composables/useAccountOptions.ts
new file mode 100644
index 0000000000..d96d662538
--- /dev/null
+++ b/frontend/src/apps/mail/composables/useAccountOptions.ts
@@ -0,0 +1,32 @@
+import { computed } from 'vue'
+import { createResource } from 'frappe-ui'
+
+type Option = { value: string; label: string }
+
+// Locales and time zones are long, fixed lists (hundreds of entries each) shared by the member and
+// group editors, so they are fetched once and cached rather than per dialog.
+const accountOptions = createResource({
+	url: 'suite.mail.api.admin.get_account_options',
+	cache: 'accountOptions',
+})
+
+const localeLabels = computed(() => {
+	const locales: Option[] = accountOptions.data?.locales || []
+	return new Map(locales.map((o) => [o.value, o.label]))
+})
+
+export const useAccountOptions = () => {
+	if (!accountOptions.fetched && !accountOptions.loading) accountOptions.fetch()
+
+	return {
+		localeOptions: computed<Option[]>(() => accountOptions.data?.locales || []),
+		// Accounts store the bare locale code, so the detail pages resolve it against the same list
+		// the picker uses. Falls back to the code itself until the list has loaded.
+		localeLabel: (value?: string | null) => (value ? localeLabels.value.get(value) || value : ''),
+		// The time zone is nullable on the server, so it needs a blank choice to clear it.
+		timeZoneOptions: computed<Option[]>(() => [
+			{ value: '', label: __('Not set') },
+			...(accountOptions.data?.time_zones || []),
+		]),
+	}
+}
diff --git a/frontend/src/apps/mail/pages/InviteSetupView.vue b/frontend/src/apps/mail/pages/InviteSetupView.vue
index 8aef997486..6fad39579a 100644
--- a/frontend/src/apps/mail/pages/InviteSetupView.vue
+++ b/frontend/src/apps/mail/pages/InviteSetupView.vue
@@ -31,6 +31,18 @@
 			autocomplete="current-password"
 			required
 		/>
+		<div class="space-y-1.5">
+			<label class="text-ink-gray-5 block text-xs">{{ __('Locale') }}</label>
+			<Combobox v-model="locale" :options="localeOptions" :placeholder="__('Select a locale')" />
+		</div>
+		<div class="space-y-1.5">
+			<label class="text-ink-gray-5 block text-xs">{{ __('Time Zone') }}</label>
+			<Combobox
+				v-model="timeZone"
+				:options="timeZoneOptions"
+				:placeholder="__('Select a time zone')"
+			/>
+		</div>
 		<ErrorMessage :message="errorMessage" />
 		<Button
 			variant="solid"
@@ -46,9 +58,9 @@
 	</div>
 </template>
 <script setup lang="ts">
-import { ref, watch } from 'vue'
+import { computed, ref, watch } from 'vue'
 import { useRouter } from 'vue-router'
-import { Button, ErrorMessage, FormControl, createResource } from 'frappe-ui'
+import { Button, Combobox, ErrorMessage, FormControl, createResource } from 'frappe-ui'
 
 import { sessionStore } from '@/apps/mail/stores/session'
 
@@ -57,22 +69,40 @@ const { requestKey } = defineProps<{ requestKey: string }>()
 const router = useRouter()
 const { login } = sessionStore()
 
+type Option = { value: string; label: string }
+
 const email = ref('')
 const firstName = ref('')
 const lastName = ref('')
 const password = ref('')
+const locale = ref('')
+const timeZone = ref('')
 const errorMessage = ref('')
 
 const getAccountRequest = createResource({
 	url: 'suite.mail.api.account.get_account_request',
 	makeParams: () => ({ request_key: requestKey }),
 	onSuccess: (data) => {
-		if ((data?.backup_email || data?.account) && !data?.is_verified && !data?.is_expired)
+		if ((data?.backup_email || data?.account) && !data?.is_verified && !data?.is_expired) {
 			email.value = data.account || data.backup_email
-		else router.replace({ name: 'mail-signup' })
+			accountOptions.submit()
+		} else router.replace({ name: 'mail-signup' })
 	},
 })
 
+// Fetched only once the request is known to be pending, since the endpoint is gated on that too.
+const accountOptions = createResource({
+	url: 'suite.mail.api.account.get_account_setup_options',
+	makeParams: () => ({ request_key: requestKey }),
+})
+
+const localeOptions = computed<Option[]>(() => accountOptions.data?.locales || [])
+// The time zone is optional, so it needs a blank choice to leave it unset.
+const timeZoneOptions = computed<Option[]>(() => [
+	{ value: '', label: __('Not set') },
+	...(accountOptions.data?.time_zones || []),
+])
+
 const createAccount = createResource({
 	url: 'suite.mail.api.account.create_account',
 	makeParams: () => ({
@@ -80,6 +110,9 @@ const createAccount = createResource({
 		first_name: firstName.value,
 		last_name: lastName.value,
 		password: password.value,
+		// Blank means "server default" for both, which the API spells as null.
+		locale: locale.value || null,
+		time_zone: timeZone.value || null,
 	}),
 	onSuccess: () => {
 		errorMessage.value = ''
diff --git a/frontend/src/apps/mail/pages/dashboard/ActionsView.vue b/frontend/src/apps/mail/pages/dashboard/ActionsView.vue
new file mode 100644
index 0000000000..e2609af23d
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/ActionsView.vue
@@ -0,0 +1,185 @@
+<template>
+	<DashboardLayout :breadcrumbs="[{ label: __('Actions') }]">
+		<div v-if="actions?.data" class="flex flex-col gap-5">
+			<DashboardCard v-for="group in groupedActions" :key="group.label" :title="group.label">
+				<template #actions><span /></template>
+				<div class="grid grid-cols-1 sm:grid-cols-2">
+					<div
+						v-for="(action, index) in group.items"
+						:key="action.value"
+						class="flex items-center justify-between gap-3 px-5 py-3.5"
+						:class="cellBorders(index, group.items.length)"
+					>
+						<div class="flex min-w-0 items-center gap-3">
+							<div class="bg-surface-gray-2 text-ink-gray-7 flex size-7 shrink-0 items-center justify-center rounded">
+								<FeatherIcon :name="actionIcon(action, group.label)" class="size-4" />
+							</div>
+							<div class="min-w-0">
+								<p class="truncate text-base">{{ action.name }}</p>
+								<p v-if="needsInput(action)" class="text-ink-gray-5 mt-0.5 text-xs">
+									{{ __('Takes input') }}
+								</p>
+							</div>
+						</div>
+						<!-- The tooltip sits on a wrapper: a disabled button emits no hover events itself. -->
+						<Tooltip
+							:text="isLocked(action) ? __('Only the Administrator can run this action.') : ''"
+							:disabled="!isLocked(action)"
+						>
+							<span class="shrink-0">
+								<Button :label="__('Run')" :disabled="isLocked(action)" @click="trigger(action)" />
+							</span>
+						</Tooltip>
+					</div>
+				</div>
+			</DashboardCard>
+		</div>
+	</DashboardLayout>
+	<Dialog v-model="showConfirm" :options="confirmOptions" />
+	<RunActionModal v-model="showRun" :action="activeAction" :fields="activeFields" />
+</template>
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import { Button, Dialog, FeatherIcon, Tooltip, createResource, usePageMeta } from 'frappe-ui'
+
+import { getSessionUser } from '@/boot/session'
+
+import { raiseToast } from '@/apps/mail/utils'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import DashboardCard from '@/apps/mail/components/DashboardCard.vue'
+import RunActionModal from '@/apps/mail/components/Modals/RunActionModal.vue'
+
+type ActionOption = { value: string; label: string }
+type ActionInfo = {
+	value: string
+	label: string
+	schema_name?: string | null
+	administrator_only?: boolean
+	options?: Record<string, ActionOption[]>
+}
+type ActionField = {
+	name: string
+	label: string
+	type?: string
+	placeholder?: string
+	required?: boolean
+	options?: ActionOption[]
+}
+
+usePageMeta(() => ({ title: __('Actions') }))
+
+// Input fields for the parameterized actions (parameterless actions run directly).
+const ACTION_FIELDS: Record<string, ActionField[]> = {
+	// Mirrors the "Input" section of the server's x:DmarcTroubleshoot form; only the body is optional.
+	'x:DmarcTroubleshoot': [
+		{ name: 'remoteIp', label: 'Remote IP', placeholder: '192.168.1.1', required: true },
+		{ name: 'ehloDomain', label: 'EHLO Domain', placeholder: 'mail.example.com', required: true },
+		{ name: 'mailFrom', label: 'MAIL FROM', placeholder: 'sender@example.com', required: true },
+		{ name: 'spfEhloDomain', label: 'SPF EHLO Domain', placeholder: 'mail.example.com', required: true },
+		{ name: 'spfMailFromDomain', label: 'SPF MAIL FROM Domain', placeholder: 'example.com', required: true },
+		{ name: 'message', label: 'Message Body', type: 'textarea' },
+	],
+	// Mirrors the "Input" section of the server's x:SpamClassify form; the choices for
+	// `envFromParameters` come from the action itself, as only the server knows its exact values.
+	'x:SpamClassify': [
+		{ name: 'message', label: 'Message', type: 'textarea', required: true },
+		{ name: 'remoteIp', label: 'Remote IP', placeholder: '192.168.1.1', required: true },
+		{ name: 'ehloDomain', label: 'EHLO Domain', placeholder: 'mail.example.com', required: true },
+		{ name: 'authenticatedAs', label: 'Authenticated As', placeholder: 'user@example.com' },
+		{ name: 'isTls', label: 'TLS Enabled', type: 'checkbox' },
+		{ name: 'envFrom', label: 'MAIL FROM', placeholder: 'sender@example.com', required: true },
+		{ name: 'envFromParameters', label: 'MAIL FROM Parameters', type: 'select' },
+		{ name: 'envRcptTo', label: 'RCPT TO', type: 'list', placeholder: 'recipient@example.org' },
+	],
+}
+
+// Icon per action, falling back to the section's icon for any action the server adds later.
+const ACTION_ICONS: Record<string, string> = {
+	ReloadSettings: 'sliders',
+	ReloadTlsCertificates: 'shield',
+	ReloadLookupStores: 'database',
+	ReloadBlockedIps: 'shield-off',
+	UpdateApps: 'download-cloud',
+	TroubleshootDmarc: 'tool',
+	ClassifySpam: 'filter',
+	InvalidateCaches: 'trash-2',
+	InvalidateNegativeCaches: 'trash',
+	PauseMtaQueue: 'pause-circle',
+	ResumeMtaQueue: 'play-circle',
+}
+const SECTION_ICONS: Record<string, string> = {
+	Reload: 'refresh-cw',
+	Cache: 'trash-2',
+	MTA: 'send',
+	DMARC: 'shield',
+	'Spam Filter': 'filter',
+	'Application Management': 'package',
+}
+const FALLBACK_ICON = 'zap'
+
+const showConfirm = ref(false)
+const showRun = ref(false)
+const activeAction = ref<ActionInfo | null>(null)
+const activeFields = ref<ActionField[]>([])
+
+const actions = createResource({ url: 'suite.mail.api.admin.get_actions', auto: true })
+
+// Group actions by the prefix before the first ":" in their label (e.g. "Reload", "Cache", "MTA").
+const groupedActions = computed(() => {
+	const groups = new Map<string, { label: string; items: (ActionInfo & { name: string })[] }>()
+	for (const action of (actions.data || []) as ActionInfo[]) {
+		const [prefix, rest] = action.label.includes(':')
+			? [action.label.split(':')[0].trim(), action.label.split(':').slice(1).join(':').trim()]
+			: [__('General'), action.label]
+		if (!groups.has(prefix)) groups.set(prefix, { label: prefix, items: [] })
+		groups.get(prefix)!.items.push({ ...action, name: rest })
+	}
+	return Array.from(groups.values())
+})
+
+const needsInput = (action: ActionInfo) => Boolean(action.schema_name && ACTION_FIELDS[action.schema_name])
+// Which actions are restricted is the server's call; this only reflects it, and run_action enforces it.
+const isAdministrator = getSessionUser() === 'Administrator'
+const isLocked = (action: ActionInfo) => Boolean(action.administrator_only) && !isAdministrator
+const actionIcon = (action: ActionInfo, section: string) =>
+	ACTION_ICONS[action.value] || SECTION_ICONS[section] || FALLBACK_ICON
+
+// Two actions per row: a cell keeps its bottom divider unless it sits in the last row of the
+// current layout, and its right divider only when a second action shares the row.
+const cellBorders = (index: number, count: number) => {
+	const lastRowStart = count % 2 === 0 ? count - 2 : count - 1
+	return [
+		index < count - 1 ? 'border-b' : '',
+		index >= lastRowStart ? 'sm:border-b-0' : '',
+		index % 2 === 0 && index + 1 < count ? 'sm:border-r' : '',
+	]
+}
+
+const trigger = (action: ActionInfo) => {
+	activeAction.value = action
+	if (action.schema_name && ACTION_FIELDS[action.schema_name]) {
+		// Selects take their choices from the schema the server reported alongside the action.
+		activeFields.value = ACTION_FIELDS[action.schema_name].map((field) =>
+			field.type === 'select' ? { ...field, options: action.options?.[field.name] || [] } : field,
+		)
+		showRun.value = true
+	} else {
+		showConfirm.value = true
+	}
+}
+
+const runAction = createResource({
+	url: 'suite.mail.api.admin.run_action',
+	makeParams: () => ({ action_type: activeAction.value?.value }),
+	onSuccess: () => {
+		showConfirm.value = false
+		raiseToast(__('Action completed.'))
+	},
+})
+
+const confirmOptions = computed(() => ({
+	title: activeAction.value?.label,
+	message: __('Run this action now?'),
+	actions: [{ label: __('Run'), variant: 'solid', onClick: runAction.submit }],
+}))
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/DeliveryTestView.vue b/frontend/src/apps/mail/pages/dashboard/DeliveryTestView.vue
new file mode 100644
index 0000000000..c45de7355f
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/DeliveryTestView.vue
@@ -0,0 +1,144 @@
+<template>
+	<DashboardLayout :breadcrumbs="[{ label: __('Delivery Test') }]">
+		<div class="flex flex-col gap-5">
+			<DashboardCard :title="__('Test SMTP Delivery')">
+				<template #actions><span /></template>
+				<div class="flex items-end gap-3 p-5">
+					<div class="flex-1">
+						<label class="text-ink-gray-5 mb-1.5 block text-xs">{{ __('Recipient or domain') }}</label>
+						<FormControl
+							v-model="target"
+							placeholder="someone@example.com"
+							:disabled="running"
+							@keyup.enter="start"
+						/>
+					</div>
+					<Button v-if="!running" variant="solid" :label="__('Start Test')" :disabled="!target" @click="start" />
+					<Button v-else theme="red" :label="__('Stop')" @click="stop" />
+				</div>
+			</DashboardCard>
+
+			<DashboardCard v-if="events.length || running" :title="__('Delivery Trace')">
+				<template #actions>
+					<Button v-if="!running && events.length" variant="ghost" :label="__('Run Another')" @click="reset" />
+				</template>
+				<div class="flex flex-col">
+					<div
+						v-for="(event, index) in events"
+						:key="index"
+						class="flex items-start gap-3 border-b px-5 py-3 last:border-b-0"
+					>
+						<span class="mt-1.5 h-2.5 w-2.5 shrink-0 rounded-full" :class="dotClass(event.type)" />
+						<div class="min-w-0 flex-1">
+							<p class="text-sm font-medium">{{ humanize(event.type) }}</p>
+							<p v-if="detail(event)" class="text-ink-gray-5 mt-0.5 break-words text-xs">{{ detail(event) }}</p>
+						</div>
+					</div>
+					<div v-if="running" class="text-ink-gray-5 flex items-center gap-2 px-5 py-3 text-sm">
+						<LoadingIndicator class="h-4 w-4" />
+						<span>{{ __('Testing delivery…') }}</span>
+					</div>
+				</div>
+			</DashboardCard>
+		</div>
+	</DashboardLayout>
+</template>
+<script setup lang="ts">
+import { onUnmounted, ref } from 'vue'
+import { Button, FormControl, LoadingIndicator, usePageMeta } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import DashboardCard from '@/apps/mail/components/DashboardCard.vue'
+
+type TraceEvent = { type: string; [key: string]: unknown }
+
+usePageMeta(() => ({ title: __('Delivery Test') }))
+
+const target = ref('')
+const running = ref(false)
+const events = ref<TraceEvent[]>([])
+
+let source: EventSource | null = null
+let finished = false
+
+// Terminal event types that end the trace.
+const TERMINAL = new Set(['completed', 'deliverySuccessful', 'deliveryFailed', 'connectionLost', 'failedToStart', 'invalidTarget'])
+// Terminal types that represent a failure (for the status dot colour).
+const TERMINAL_ERRORS = new Set(['deliveryFailed', 'connectionLost', 'failedToStart', 'invalidTarget'])
+
+const close = () => {
+	source?.close()
+	source = null
+	running.value = false
+}
+
+const start = () => {
+	if (!target.value || running.value) return
+	events.value = []
+	finished = false
+	running.value = true
+
+	const url = `/api/method/suite.mail.api.admin.stream_delivery_test?target=${encodeURIComponent(target.value)}`
+	source = new EventSource(url, { withCredentials: true })
+
+	source.addEventListener('event', (message: MessageEvent) => {
+		let batch: TraceEvent[] = []
+		try {
+			batch = JSON.parse(message.data)
+		} catch {
+			return
+		}
+		events.value.push(...batch)
+		if (batch.some((e) => TERMINAL.has(e.type))) {
+			finished = true
+			close()
+		}
+	})
+
+	source.onerror = () => {
+		// The proxy closes the stream when the trace ends; EventSource surfaces that as an error.
+		if (finished || events.value.length) {
+			finished = true
+			close()
+		} else {
+			close()
+			raiseToast(__('Could not start the delivery test.'), 'error')
+		}
+	}
+}
+
+const stop = () => {
+	finished = true
+	close()
+}
+
+const reset = () => {
+	events.value = []
+	finished = false
+}
+
+const humanize = (type: string) =>
+	type
+		.replace(/([A-Z])/g, ' $1')
+		.replace(/^./, (c) => c.toUpperCase())
+		.trim()
+
+const detail = (event: TraceEvent) => {
+	const { type, ...rest } = event
+	const keys = Object.keys(rest)
+	if (!keys.length) return ''
+	return keys.map((k) => `${k}: ${typeof rest[k] === 'object' ? JSON.stringify(rest[k]) : rest[k]}`).join(' · ')
+}
+
+const dotClass = (type: string) => {
+	// Anchor suffix matches so incidental substrings (e.g. "lost" inside "ehloStart") don't misfire.
+	if (/Success(ful)?$/i.test(type)) return 'bg-green-500'
+	if (/NotFound$/.test(type)) return 'bg-amber-500'
+	if (/(Error|Failed|Fatal|Timeout|Rejected|Denied|Lost|Refused)$/i.test(type) || TERMINAL_ERRORS.has(type))
+		return 'bg-red-500'
+	return 'bg-surface-gray-5'
+}
+
+onUnmounted(close)
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/DkimSignatureView.vue b/frontend/src/apps/mail/pages/dashboard/DkimSignatureView.vue
new file mode 100644
index 0000000000..d0fc887d79
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/DkimSignatureView.vue
@@ -0,0 +1,138 @@
+<template>
+	<DashboardLayout v-if="signature.data" :breadcrumbs="breadcrumbs">
+		<template #actions>
+			<Dropdown :options="dropdownOptions" :button="{ icon: 'more-horizontal' }" />
+		</template>
+		<div class="grid grid-cols-1 gap-5 lg:grid-cols-2">
+			<!-- Signature -->
+			<DashboardCard :title="__('Signature')">
+				<template #actions><span /></template>
+				<div>
+					<InformationField :label="__('Signature Type')" :value="signature.data.algorithm" />
+					<InformationField :label="__('Selector')" :value="signature.data.selector" />
+					<InformationField :label="__('Domain')" :value="signature.data.domain" />
+				</div>
+			</DashboardCard>
+
+			<!-- Rotation -->
+			<DashboardCard :title="__('Rotation')">
+				<template #actions><span /></template>
+				<div>
+					<InformationField :label="__('Stage')" :value="stageLabel" />
+					<InformationField :label="__('Created At')" :value="createdAt" />
+					<InformationField :label="__('Next Transition')" :value="nextTransition" />
+				</div>
+			</DashboardCard>
+
+			<!-- Options -->
+			<DashboardCard :title="__('Options')">
+				<template #actions><span /></template>
+				<div>
+					<InformationField :label="__('Signed Headers')" :value="signedHeaders" />
+					<InformationField :label="__('Canonicalization')" :value="signature.data.canonicalization" />
+					<InformationField :label="__('Expiration')" :value="signature.data.expiration" />
+					<InformationField :label="__('Request Reports')" :value="requestReports" />
+					<InformationField :label="__('Agent User ID')" :value="signature.data.auid" />
+				</div>
+			</DashboardCard>
+
+			<!-- Public Key -->
+			<DashboardCard :title="__('Public Key')">
+				<template #actions><span /></template>
+				<div class="p-4">
+					<code class="text-ink-gray-7 block break-all font-mono text-xs">
+						{{ signature.data.public_key || '—' }}
+					</code>
+				</div>
+			</DashboardCard>
+		</div>
+	</DashboardLayout>
+	<Dialog v-model="showDelete" :options="deleteDialogOptions" />
+</template>
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import { useRouter } from 'vue-router'
+import { Dialog, Dropdown, createResource, usePageMeta } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+import { formatDateTime } from '@/apps/mail/utils/datetime'
+import DashboardCard from '@/apps/mail/components/DashboardCard.vue'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import InformationField from '@/apps/mail/components/InformationField.vue'
+
+type DkimData = {
+	id: string
+	algorithm?: string
+	selector?: string
+	domain?: string
+	signed_headers: string[]
+	canonicalization?: string
+	expiration?: string | null
+	request_reports: boolean
+	auid?: string | null
+	public_key?: string
+	stage?: string
+	created_at?: string
+	next_transition?: string | null
+}
+
+const { signatureId } = defineProps<{ signatureId: string }>()
+const router = useRouter()
+
+const showDelete = ref(false)
+
+usePageMeta(() => ({ title: (signature.data as DkimData | undefined)?.selector || signatureId }))
+
+const signature = createResource({
+	url: 'suite.mail.api.admin.get_dkim_signature',
+	auto: true,
+	makeParams: () => ({ signature_id: signatureId }),
+	cache: ['mailDkimSignature', signatureId],
+	onError: () => router.replace({ name: 'mail-dkim-signatures' }),
+})
+
+const data = computed(() => signature.data as DkimData | undefined)
+
+const formatDate = (value?: string | null) => formatDateTime(value)
+
+const stageLabel = computed(() => {
+	const stage = data.value?.stage
+	return stage ? stage.charAt(0).toUpperCase() + stage.slice(1) : ''
+})
+const createdAt = computed(() => formatDate(data.value?.created_at))
+const nextTransition = computed(() => formatDate(data.value?.next_transition))
+const signedHeaders = computed(() => (data.value?.signed_headers || []).join(', '))
+const requestReports = computed(() => (data.value?.request_reports ? __('Yes') : __('No')))
+
+const breadcrumbs = computed(() => [
+	{ label: __('DKIM Signatures'), route: '/mail/dashboard/dkim-signatures' },
+	{ label: data.value?.selector || signatureId },
+])
+
+const deleteSignature = createResource({
+	url: 'suite.mail.api.admin.delete_dkim_signatures',
+	makeParams: () => ({ ids: [signatureId] }),
+	onSuccess: () => {
+		showDelete.value = false
+		raiseToast(__('DKIM signature deleted.'))
+		router.push({ name: 'mail-dkim-signatures' })
+	},
+	onError: (error: { messages?: string[] }) =>
+		raiseToast(error.messages?.[0] || __('Failed to delete DKIM signature.'), 'error'),
+})
+
+const deleteDialogOptions = computed(() => ({
+	title: __('Delete DKIM Signature'),
+	message: __('Are you sure you want to delete this DKIM signature? This action cannot be undone.'),
+	size: 'xl',
+	icon: { name: 'alert-triangle', appearance: 'warning' },
+	actions: [{ label: __('Confirm'), variant: 'solid', theme: 'red', onClick: deleteSignature.submit }],
+}))
+
+const dropdownOptions = computed(() => [
+	{
+		group: '',
+		items: [{ label: __('Delete'), icon: 'trash-2', onClick: () => (showDelete.value = true) }],
+	},
+])
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/DkimSignaturesView.vue b/frontend/src/apps/mail/pages/dashboard/DkimSignaturesView.vue
new file mode 100644
index 0000000000..808abd26d1
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/DkimSignaturesView.vue
@@ -0,0 +1,71 @@
+<template>
+	<DashboardLayout :breadcrumbs="[{ label: __('DKIM Signatures') }]">
+		<ListView
+			v-if="signatures?.data"
+			class="flex-1"
+			:columns="LIST_COLUMNS"
+			:rows="signatures.data"
+			:options="LIST_OPTIONS"
+			row-key="id"
+		>
+			<ListHeader />
+			<ListRows>
+				<template v-if="signatures.data.length">
+					<ListRow
+						v-for="row in signatures.data"
+						:key="row.id"
+						v-slot="{ column, item }"
+						:row="row"
+						class="hover:!bg-surface-gray-1"
+					>
+						<ListRowItem :item="item">
+							<span v-if="column.key === 'created_at'">{{ formatCreatedAt(item) }}</span>
+						</ListRowItem>
+					</ListRow>
+				</template>
+				<ListEmptyState v-else />
+			</ListRows>
+		</ListView>
+	</DashboardLayout>
+</template>
+<script setup lang="ts">
+import {
+	ListEmptyState,
+	ListHeader,
+	ListRow,
+	ListRowItem,
+	ListRows,
+	ListView,
+	createResource,
+	usePageMeta,
+} from 'frappe-ui'
+
+import { fromNow } from '@/apps/mail/utils/datetime'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+
+usePageMeta(() => ({ title: __('DKIM Signatures') }))
+
+const signatures = createResource({
+	url: 'suite.mail.api.admin.get_dkim_signatures',
+	auto: true,
+	cache: ['mailDkimSignatures'],
+})
+
+type DkimRow = { id: string; algorithm?: string; domain?: string; selector?: string; created_at?: string }
+
+const LIST_COLUMNS = [
+	{ label: __('Algorithm'), key: 'algorithm' },
+	{ label: __('Domain'), key: 'domain' },
+	{ label: __('Selector'), key: 'selector' },
+	{ label: __('Created At'), key: 'created_at' },
+]
+
+const LIST_OPTIONS = {
+	selectable: false,
+	showTooltip: false,
+	emptyState: { description: __('No DKIM signatures found.') },
+	getRowRoute: (row: DkimRow) => ({ name: 'mail-dkim-signature', params: { signatureId: row.id } }),
+}
+
+const formatCreatedAt = (createdAt?: string) => fromNow(createdAt) || '-'
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/DomainsView.vue b/frontend/src/apps/mail/pages/dashboard/DomainsView.vue
index b018f0cc80..93786a142d 100644
--- a/frontend/src/apps/mail/pages/dashboard/DomainsView.vue
+++ b/frontend/src/apps/mail/pages/dashboard/DomainsView.vue
@@ -71,7 +71,7 @@ import {
 	usePageMeta,
 } from 'frappe-ui'
 
-import dayjs from '@/apps/mail/utils/dayjs'
+import { fromNow } from '@/apps/mail/utils/datetime'
 import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
 import AddDomainModal from '@/apps/mail/components/Modals/AddDomainModal.vue'
 
@@ -116,7 +116,7 @@ const LIST_OPTIONS = {
 	getRowRoute: (row: DomainRow) => ({ name: 'mail-domain', params: { domainId: row.id } }),
 }
 
-const formatCreatedAt = (createdAt?: string) => (createdAt ? dayjs(createdAt).fromNow() : '-')
+const formatCreatedAt = (createdAt?: string) => fromNow(createdAt) || '-'
 
 const STATUS_OPTIONS = [
 	{ label: __('All'), value: 'All' },
diff --git a/frontend/src/apps/mail/pages/dashboard/GroupView.vue b/frontend/src/apps/mail/pages/dashboard/GroupView.vue
new file mode 100644
index 0000000000..44c6cbaebf
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/GroupView.vue
@@ -0,0 +1,349 @@
+<template>
+	<DashboardLayout v-if="member.data" :breadcrumbs="breadcrumbs">
+		<template #actions>
+			<Dropdown :options="dropdownOptions" :button="{ icon: 'more-horizontal' }" />
+		</template>
+
+		<div class="grid grid-cols-1 gap-5 lg:grid-cols-2">
+			<!-- General Information -->
+			<DashboardCard
+				:title="__('General Information')"
+				:button-label="__('Edit')"
+				@action="showEdit = true"
+			>
+				<div>
+					<InformationField :label="__('Roles')" :value="roleLabels.join(', ')" />
+					<InformationField :label="__('Description')" :value="member.data.description" />
+					<InformationField :label="__('Locale')" :value="localeLabel(member.data.locale)" />
+					<InformationField :label="__('Time Zone')" :value="member.data.time_zone" />
+					<InformationField :label="__('Created At')" :value="createdAt" />
+				</div>
+			</DashboardCard>
+
+			<!-- Quota Usage -->
+			<DashboardCard :title="__('Quota Usage')" :button-label="__('Edit')" @action="showEditQuota = true">
+				<div class="flex flex-1 items-center justify-center gap-8 p-6">
+					<div class="relative shrink-0">
+						<svg :width="DONUT_SIZE" :height="DONUT_SIZE" class="-rotate-90">
+							<circle
+								:cx="DONUT_SIZE / 2"
+								:cy="DONUT_SIZE / 2"
+								:r="DONUT_RADIUS"
+								fill="none"
+								stroke="var(--surface-gray-4)"
+								:stroke-width="DONUT_STROKE"
+							/>
+							<circle
+								v-if="!member.data.quota.unlimited && usedDashArc > 0"
+								:cx="DONUT_SIZE / 2"
+								:cy="DONUT_SIZE / 2"
+								:r="DONUT_RADIUS"
+								fill="none"
+								stroke="var(--surface-gray-10)"
+								:stroke-width="DONUT_STROKE"
+								stroke-linecap="round"
+								:stroke-dasharray="`${usedDashArc} ${DONUT_CIRCUMFERENCE}`"
+							/>
+						</svg>
+						<div class="absolute inset-0 flex flex-col items-center justify-center text-center">
+							<span class="text-lg font-semibold">{{ totalQuotaLabel }}</span>
+							<span class="text-ink-gray-5 text-xs">
+								{{ member.data.quota.unlimited ? __('Unlimited') : __('Total Quota') }}
+							</span>
+						</div>
+					</div>
+					<div class="space-y-4">
+						<div class="flex items-start gap-2">
+							<span class="bg-surface-gray-10 mt-1 h-3 w-3 shrink-0 rounded-sm" />
+							<div>
+								<p class="text-sm font-medium">{{ usedLabel }}</p>
+								<p class="text-ink-gray-5 text-xs">{{ __('Used') }}</p>
+							</div>
+						</div>
+						<div v-if="!member.data.quota.unlimited" class="flex items-start gap-2">
+							<span class="bg-surface-gray-4 mt-1 h-3 w-3 shrink-0 rounded-sm" />
+							<div>
+								<p class="text-sm font-medium">{{ availableLabel }}</p>
+								<p class="text-ink-gray-5 text-xs">{{ __('Available') }}</p>
+							</div>
+						</div>
+					</div>
+				</div>
+			</DashboardCard>
+
+			<!-- Email Addresses -->
+			<DashboardCard :title="__('Email Addresses')" :button-label="__('Add')" @action="showAddEmail = true">
+				<div class="flex flex-col">
+					<div class="bg-surface-gray-2 text-ink-gray-5 flex items-center rounded px-5 py-2.5 text-sm">
+						<span class="flex-1">{{ __('Email Address') }}</span>
+						<span class="flex-1">{{ __('Description') }}</span>
+						<span class="w-20 shrink-0 text-center">{{ __('Enabled') }}</span>
+						<span class="w-8 shrink-0" />
+					</div>
+					<template v-if="member.data.email_addresses.length">
+						<div
+							v-for="entry in member.data.email_addresses"
+							:key="entry.email"
+							class="group border-b px-5 py-3 text-base last:border-b-0"
+						>
+							<Tooltip
+								class="block"
+								:text="__('This is the primary address and cannot be removed.')"
+								:disabled="!entry.is_primary"
+							>
+								<div class="flex w-full items-center">
+									<span class="flex-1 truncate">{{ entry.email }}</span>
+									<span class="text-ink-gray-5 flex-1 truncate">{{ entry.description || '—' }}</span>
+									<span class="flex w-20 shrink-0 justify-center">
+										<Switch
+											:model-value="entry.enabled"
+											:disabled="entry.is_primary"
+											@update:model-value="(value) => toggleEmailEnabled(entry, value)"
+										/>
+									</span>
+									<span class="flex w-8 shrink-0 justify-end">
+										<Button
+											v-if="!entry.is_primary"
+											variant="ghost"
+											theme="red"
+											class="invisible group-hover:visible"
+											@click="removeEmail(entry.email)"
+										>
+											<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+										</Button>
+									</span>
+								</div>
+							</Tooltip>
+						</div>
+					</template>
+					<div v-else class="text-ink-gray-5 px-5 py-6 text-center text-sm">
+						{{ __('No email addresses found.') }}
+					</div>
+				</div>
+			</DashboardCard>
+
+			<!-- Members -->
+			<DashboardCard :title="__('Members')" :button-label="__('Add')" @action="showAddMembers = true">
+				<div class="flex flex-col">
+					<div class="px-5 py-2.5">
+						<FormControl v-model="memberSearch" :placeholder="__('Search by email')">
+							<template #prefix>
+								<FeatherIcon name="search" class="text-ink-gray-5 w-4" />
+							</template>
+						</FormControl>
+					</div>
+					<template v-if="filteredMembers.length">
+						<div
+							v-for="m in filteredMembers"
+							:key="m.id"
+							class="group hover:bg-surface-gray-2 flex cursor-pointer items-center border-b px-5 py-3 text-base last:border-b-0"
+							@click="m.email && router.push({ name: 'mail-member', params: { memberId: m.email } })"
+						>
+							<span class="flex-1 truncate">{{ m.email || m.name }}</span>
+							<Button
+								variant="ghost"
+								theme="red"
+								class="invisible group-hover:visible"
+								@click.stop="removeMember(m.id)"
+							>
+								<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+							</Button>
+						</div>
+					</template>
+					<div v-else class="text-ink-gray-5 px-5 py-6 text-center text-sm">
+						{{ __('No members found.') }}
+					</div>
+				</div>
+			</DashboardCard>
+		</div>
+	</DashboardLayout>
+	<EditGroupModal v-if="member.data" v-model="showEdit" :group="member.data" @reload="member.reload()" />
+	<EditGroupQuotaModal v-if="member.data" v-model="showEditQuota" :group="member.data" @reload="member.reload()" />
+	<AddGroupEmailModal v-model="showAddEmail" :group-id="groupId" @reload="member.reload()" />
+	<AddGroupMembersModal
+		v-model="showAddMembers"
+		:group-id="groupId"
+		:current-ids="currentMemberIds"
+		@reload="member.reload()"
+	/>
+	<Dialog v-model="showDelete" :options="deleteDialogOptions" />
+</template>
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import { useRouter } from 'vue-router'
+import {
+	Button,
+	Dialog,
+	Dropdown,
+	FeatherIcon,
+	FormControl,
+	Switch,
+	Tooltip,
+	createResource,
+	usePageMeta,
+} from 'frappe-ui'
+
+import { formatBytes, raiseToast } from '@/apps/mail/utils'
+import { formatDateTime } from '@/apps/mail/utils/datetime'
+import { useAccountOptions } from '@/apps/mail/composables/useAccountOptions'
+import AddGroupEmailModal from '@/apps/mail/components/Modals/AddGroupEmailModal.vue'
+import AddGroupMembersModal from '@/apps/mail/components/Modals/AddGroupMembersModal.vue'
+import DashboardCard from '@/apps/mail/components/DashboardCard.vue'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import EditGroupModal from '@/apps/mail/components/Modals/EditGroupModal.vue'
+import EditGroupQuotaModal from '@/apps/mail/components/Modals/EditGroupQuotaModal.vue'
+import InformationField from '@/apps/mail/components/InformationField.vue'
+
+type QuotaUsage = {
+	total: number
+	used: number
+	available: number
+	used_percentage: number
+	available_percentage: number
+	unlimited: boolean
+}
+type GroupData = {
+	id: string
+	name: string
+	email: string
+	description?: string
+	created_at?: string
+	role_ids: string[]
+	email_addresses: { email: string; description?: string; is_primary: boolean; enabled: boolean }[]
+	members: { id: string; name?: string; email?: string }[]
+	quota: QuotaUsage
+}
+
+const { groupId } = defineProps<{ groupId: string }>()
+
+const router = useRouter()
+const { localeLabel } = useAccountOptions()
+
+usePageMeta(() => ({ title: (member.data as GroupData | undefined)?.email || groupId }))
+
+const showEdit = ref(false)
+const showEditQuota = ref(false)
+const showAddEmail = ref(false)
+const showAddMembers = ref(false)
+const showDelete = ref(false)
+const memberSearch = ref('')
+
+// Named `member` so the quota/card markup mirrors MemberView.vue one-to-one.
+const member = createResource({
+	url: 'suite.mail.api.admin.get_group',
+	auto: true,
+	makeParams: () => ({ group_id: groupId }),
+	cache: ['mailGroup', groupId],
+	onError: () => router.replace({ name: 'mail-groups' }),
+})
+
+const data = computed(() => member.data as GroupData | undefined)
+
+const roles = createResource({ url: 'suite.mail.api.admin.get_roles_list', auto: true })
+const roleLabels = computed(() => {
+	const map = new Map((roles.data || []).map((r: { id: string; description: string }) => [r.id, r.description]))
+	return (data.value?.role_ids || []).map((id: string) => map.get(id) || id)
+})
+
+const currentMemberIds = computed(() => data.value?.members.map((m) => m.id) || [])
+const filteredMembers = computed(() => {
+	const members = data.value?.members || []
+	const q = memberSearch.value.trim().toLowerCase()
+	return q ? members.filter((m) => (m.email || '').toLowerCase().includes(q)) : members
+})
+
+const createdAt = computed(() => formatDateTime(data.value?.created_at))
+
+const breadcrumbs = computed(() => [
+	{ label: __('Groups'), route: '/mail/dashboard/groups' },
+	{ label: data.value?.email || groupId },
+])
+
+// Quota donut geometry (mirrors MemberView.vue).
+const DONUT_SIZE = 140
+const DONUT_STROKE = 12
+const DONUT_RADIUS = (DONUT_SIZE - DONUT_STROKE) / 2
+const DONUT_CIRCUMFERENCE = 2 * Math.PI * DONUT_RADIUS
+
+const usedDashArc = computed(() => {
+	const pct = data.value?.quota.used_percentage || 0
+	const arc = DONUT_CIRCUMFERENCE * (pct / 100)
+	return arc >= 1 ? arc : 0
+})
+const totalQuotaLabel = computed(() =>
+	data.value?.quota.unlimited ? '∞' : formatBytes(data.value?.quota.total || 0),
+)
+const usedLabel = computed(() => {
+	const quota = data.value?.quota
+	if (!quota) return ''
+	if (quota.unlimited) return formatBytes(quota.used)
+	return `${formatBytes(quota.used)} (${quota.used_percentage.toFixed(1)}%)`
+})
+const availableLabel = computed(() => {
+	const quota = data.value?.quota
+	if (!quota) return ''
+	return `${formatBytes(quota.available)} (${quota.available_percentage.toFixed(1)}%)`
+})
+
+const toggleEmailEnabled = (entry: { email: string; enabled: boolean }, value: boolean) => {
+	entry.enabled = value // optimistic; reverted on error via reload
+	createResource({
+		url: 'suite.mail.api.admin.set_group_email_enabled',
+		makeParams: () => ({ group_id: groupId, email: entry.email, enabled: value ? 1 : 0 }),
+		onSuccess: () => raiseToast(value ? __('Email address enabled.') : __('Email address disabled.')),
+		onError: (error: { messages?: string[] }) => {
+			member.reload()
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error')
+		},
+	}).submit()
+}
+
+const removeEmail = (email: string) =>
+	createResource({
+		url: 'suite.mail.api.admin.remove_group_email',
+		makeParams: () => ({ group_id: groupId, email }),
+		onSuccess: () => {
+			member.reload()
+			raiseToast(__('Email address removed.'))
+		},
+		onError: (error: { messages?: string[] }) =>
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error'),
+	}).submit()
+
+const removeMember = (accountId: string) =>
+	createResource({
+		url: 'suite.mail.api.admin.remove_group_member',
+		makeParams: () => ({ group_id: groupId, account_id: accountId }),
+		onSuccess: () => {
+			member.reload()
+			raiseToast(__('Member removed.'))
+		},
+		onError: (error: { messages?: string[] }) =>
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error'),
+	}).submit()
+
+const deleteGroup = createResource({
+	url: 'suite.mail.api.admin.delete_groups',
+	makeParams: () => ({ ids: [groupId] }),
+	onSuccess: () => {
+		showDelete.value = false
+		raiseToast(__('Group deleted.'))
+		router.push({ name: 'mail-groups' })
+	},
+})
+
+const deleteDialogOptions = computed(() => ({
+	title: __('Delete Group'),
+	message: __('Are you sure you want to delete this group? This action cannot be undone.'),
+	size: 'xl',
+	icon: { name: 'alert-triangle', appearance: 'warning' },
+	actions: [{ label: __('Confirm'), variant: 'solid', theme: 'red', onClick: deleteGroup.submit }],
+}))
+
+const dropdownOptions = computed(() => [
+	{
+		group: '',
+		items: [{ label: __('Delete'), icon: 'trash-2', onClick: () => (showDelete.value = true) }],
+	},
+])
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/GroupsView.vue b/frontend/src/apps/mail/pages/dashboard/GroupsView.vue
new file mode 100644
index 0000000000..7046285e65
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/GroupsView.vue
@@ -0,0 +1,93 @@
+<template>
+	<DashboardLayout
+		:breadcrumbs="[{ label: __('Groups') }]"
+		:button-label="__('Add Group')"
+		:button-action="() => (showAddGroup = true)"
+	>
+		<div class="flex items-center space-x-3">
+			<FormControl v-model="search" :placeholder="__('Search')" class="w-80">
+				<template #prefix>
+					<FeatherIcon name="search" class="text-ink-gray-5 w-4" />
+				</template>
+			</FormControl>
+		</div>
+		<ListView
+			v-if="groups?.data"
+			class="flex-1"
+			:columns="LIST_COLUMNS"
+			:rows="groups.data"
+			:options="LIST_OPTIONS"
+			row-key="id"
+		>
+			<ListHeader />
+			<ListRows>
+				<template v-if="groups.data.length">
+					<ListRow
+						v-for="row in groups.data"
+						:key="row.id"
+						v-slot="{ column, item }"
+						:row="row"
+						class="hover:!bg-surface-gray-1"
+					>
+						<ListRowItem :item="item">
+							<span v-if="column.key === 'created_at'">{{ formatCreatedAt(item) }}</span>
+						</ListRowItem>
+					</ListRow>
+				</template>
+				<ListEmptyState v-else />
+			</ListRows>
+		</ListView>
+	</DashboardLayout>
+	<AddGroupModal v-model="showAddGroup" @reload="groups.reload()" />
+</template>
+<script setup lang="ts">
+import { ref } from 'vue'
+import { watchDebounced } from '@vueuse/core'
+import {
+	FeatherIcon,
+	FormControl,
+	ListEmptyState,
+	ListHeader,
+	ListRow,
+	ListRowItem,
+	ListRows,
+	ListView,
+	createResource,
+	usePageMeta,
+} from 'frappe-ui'
+
+import { fromNow } from '@/apps/mail/utils/datetime'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import AddGroupModal from '@/apps/mail/components/Modals/AddGroupModal.vue'
+
+usePageMeta(() => ({ title: __('Groups') }))
+
+const showAddGroup = ref(false)
+const search = ref('')
+
+const groups = createResource({
+	url: 'suite.mail.api.admin.get_groups',
+	auto: true,
+	makeParams: () => ({ search: search.value }),
+	cache: ['mailGroups', search.value],
+})
+
+watchDebounced(() => search.value, groups.reload, { debounce: 300 })
+
+type GroupRow = { id: string; name: string; email?: string; description?: string; created_at?: string }
+
+const LIST_COLUMNS = [
+	{ label: __('Email'), key: 'email' },
+	{ label: __('Description'), key: 'description' },
+	{ label: __('Created At'), key: 'created_at' },
+]
+
+const LIST_OPTIONS = {
+	selectable: false,
+	showTooltip: false,
+	emptyState: { description: __('No groups found.') },
+	getRowRoute: (row: GroupRow) => ({ name: 'mail-group', params: { groupId: row.id } }),
+}
+
+const formatCreatedAt = (createdAt?: string) => fromNow(createdAt) || '-'
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/LogView.vue b/frontend/src/apps/mail/pages/dashboard/LogView.vue
new file mode 100644
index 0000000000..a71707cef7
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/LogView.vue
@@ -0,0 +1,62 @@
+<template>
+	<DashboardLayout v-if="log?.data" :breadcrumbs="breadcrumbs">
+		<template #default>
+			<div class="grid grid-cols-1 gap-5 lg:grid-cols-2">
+				<DashboardCard :title="__('Log Entry')">
+					<template #actions><span /></template>
+					<InformationField :label="__('Timestamp')" :value="formatDate(data.timestamp)" />
+					<InformationField :label="__('Level')" :value="data.level_label" />
+					<InformationField :label="__('Event')" :value="data.event_label" />
+				</DashboardCard>
+				<DashboardCard :title="__('Details')">
+					<template #actions><span /></template>
+					<pre
+						class="bg-surface-gray-2 max-h-[60vh] overflow-auto rounded p-4 text-xs whitespace-pre-wrap"
+						>{{ data.details || '—' }}</pre
+					>
+				</DashboardCard>
+			</div>
+		</template>
+	</DashboardLayout>
+</template>
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useRouter } from 'vue-router'
+import { createResource, usePageMeta } from 'frappe-ui'
+
+import { formatDateTime } from '@/apps/mail/utils/datetime'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import DashboardCard from '@/apps/mail/components/DashboardCard.vue'
+import InformationField from '@/apps/mail/components/InformationField.vue'
+
+type LogData = {
+	id: string
+	timestamp?: string
+	level?: string
+	level_label?: string
+	event?: string
+	event_label?: string
+	details?: string
+}
+
+const { logId } = defineProps<{ logId: string }>()
+const router = useRouter()
+
+usePageMeta(() => ({ title: __('Log Entry') }))
+
+const log = createResource({
+	url: 'suite.mail.api.admin.get_log',
+	auto: true,
+	makeParams: () => ({ log_id: logId }),
+	cache: ['mailLog', logId],
+	onError: () => router.replace({ name: 'mail-logs' }),
+})
+
+const data = computed(() => log.data as LogData)
+const formatDate = (value?: string) => formatDateTime(value, 'MMM D YYYY, h:mm:ss A') || '—'
+
+const breadcrumbs = computed(() => [
+	{ label: __('Logs'), route: '/mail/dashboard/logs' },
+	{ label: data.value?.event_label || data.value?.event || logId },
+])
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/LogsView.vue b/frontend/src/apps/mail/pages/dashboard/LogsView.vue
new file mode 100644
index 0000000000..4802dd3a14
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/LogsView.vue
@@ -0,0 +1,155 @@
+<template>
+	<DashboardLayout :breadcrumbs="[{ label: __('Logs') }]">
+		<div class="flex items-center space-x-3">
+			<FormControl v-model="search" :placeholder="__('Search logs')" class="w-80">
+				<template #prefix><FeatherIcon name="search" class="text-ink-gray-5 w-4" /></template>
+			</FormControl>
+			<Button :label="__('Refresh')" @click="logs.reload()">
+				<template #prefix><FeatherIcon name="refresh-cw" class="h-4 w-4" /></template>
+			</Button>
+		</div>
+		<ListView
+			v-if="logs?.data"
+			class="flex-1"
+			:columns="LIST_COLUMNS"
+			:rows="rows"
+			:options="LIST_OPTIONS"
+			row-key="id"
+		>
+			<ListHeader />
+			<ListRows>
+				<template v-if="rows.length">
+					<ListRow
+						v-for="row in rows"
+						:key="row.id"
+						v-slot="{ column, item }"
+						:row="row"
+						class="hover:!bg-surface-gray-1"
+					>
+						<ListRowItem :item="item">
+							<span v-if="column.key === 'timestamp'">{{ formatDate(row.timestamp) }}</span>
+							<Badge
+								v-else-if="column.key === 'level'"
+								:label="row.level_label || '—'"
+								:theme="levelTheme(row.level)"
+							/>
+							<span v-else-if="column.key === 'event'">{{ row.event_label || row.event || '—' }}</span>
+							<code
+								v-else-if="column.key === 'details'"
+								class="text-ink-gray-6 block w-full truncate font-mono text-xs"
+							>
+								{{ row.details || '—' }}
+							</code>
+						</ListRowItem>
+					</ListRow>
+				</template>
+				<ListEmptyState v-else />
+			</ListRows>
+		</ListView>
+		<DashboardPager
+			:page="page"
+			:page-length="PAGE_LENGTH"
+			:total="total"
+			:has-next-page="Boolean(nextAnchor)"
+			@update:page="goToPage"
+		/>
+	</DashboardLayout>
+</template>
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { watchDebounced } from '@vueuse/core'
+import {
+	Badge,
+	Button,
+	FeatherIcon,
+	FormControl,
+	ListEmptyState,
+	ListHeader,
+	ListRow,
+	ListRowItem,
+	ListRows,
+	ListView,
+	createResource,
+	usePageMeta,
+} from 'frappe-ui'
+
+import { formatDateTime } from '@/apps/mail/utils/datetime'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import DashboardPager from '@/apps/mail/components/DashboardPager.vue'
+
+type LogRow = {
+	id: string
+	timestamp?: string
+	level?: string
+	level_label?: string
+	event?: string
+	event_label?: string
+	details?: string
+}
+
+usePageMeta(() => ({ title: __('Logs') }))
+
+const PAGE_LENGTH = 100
+const search = ref('')
+const page = ref(1)
+// The log store pages by cursor only, so each visited page remembers the id it starts after
+// (`undefined` for the first page) and pages are walked one step at a time.
+const anchors = ref<(string | undefined)[]>([undefined])
+
+const logs = createResource({
+	url: 'suite.mail.api.admin.get_logs',
+	auto: true,
+	makeParams: () => ({
+		search: search.value,
+		anchor: anchors.value[page.value - 1],
+		page_length: PAGE_LENGTH,
+	}),
+})
+
+const rows = computed<LogRow[]>(() => logs.data?.logs || [])
+const total = computed(() => logs.data?.total || 0)
+const nextAnchor = computed<string | null>(() => logs.data?.next_anchor ?? null)
+
+const resetPaging = () => {
+	page.value = 1
+	anchors.value = [undefined]
+}
+
+const goToPage = (next: number) => {
+	if (next > page.value) {
+		if (!nextAnchor.value) return
+		anchors.value[next - 1] = nextAnchor.value
+	}
+	page.value = next
+}
+
+watchDebounced(() => search.value, () => (resetPaging(), logs.reload()), { debounce: 300 })
+watch(page, logs.reload)
+
+const formatDate = (value?: string) => formatDateTime(value, 'MMM D, h:mm:ss A') || '—'
+
+// Mirrors the colours the server's TracingLevel enum assigns to each level.
+const LEVEL_THEMES: Record<string, string> = {
+	error: 'red',
+	warn: 'amber',
+	info: 'green',
+	debug: 'blue',
+	trace: 'violet',
+}
+const levelTheme = (level?: string) => LEVEL_THEMES[(level || '').toLowerCase()] || 'gray'
+
+const LIST_COLUMNS = [
+	{ label: __('Timestamp'), key: 'timestamp', width: '11rem' },
+	{ label: __('Level'), key: 'level', width: '7rem' },
+	{ label: __('Event'), key: 'event', width: '18rem' },
+	{ label: __('Details'), key: 'details', width: 2 },
+]
+
+const LIST_OPTIONS = {
+	selectable: false,
+	showTooltip: false,
+	rowHeight: 44,
+	emptyState: { description: __('No log entries found.') },
+	getRowRoute: (row: LogRow) => ({ name: 'mail-log', params: { logId: row.id } }),
+}
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/MailingListView.vue b/frontend/src/apps/mail/pages/dashboard/MailingListView.vue
new file mode 100644
index 0000000000..3eb6d2a1e9
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/MailingListView.vue
@@ -0,0 +1,239 @@
+<template>
+	<DashboardLayout v-if="list.data" :breadcrumbs="breadcrumbs">
+		<template #actions>
+			<Dropdown :options="dropdownOptions" :button="{ icon: 'more-horizontal' }" />
+		</template>
+
+		<div class="grid grid-cols-1 gap-5 lg:grid-cols-2">
+			<!-- General Information -->
+			<DashboardCard
+				:title="__('General Information')"
+				:button-label="__('Edit')"
+				@action="showEdit = true"
+			>
+				<div>
+					<InformationField :label="__('Description')" :value="list.data.description" />
+				</div>
+			</DashboardCard>
+
+			<!-- Email Addresses -->
+			<DashboardCard :title="__('Email Addresses')" :button-label="__('Add')" @action="showAddEmail = true">
+				<div class="flex flex-col">
+					<div class="bg-surface-gray-2 text-ink-gray-5 flex items-center rounded px-5 py-2.5 text-sm">
+						<span class="flex-1">{{ __('Email Address') }}</span>
+						<span class="flex-1">{{ __('Description') }}</span>
+						<span class="w-20 shrink-0 text-center">{{ __('Enabled') }}</span>
+						<span class="w-8 shrink-0" />
+					</div>
+					<template v-if="list.data.email_addresses.length">
+						<div
+							v-for="entry in list.data.email_addresses"
+							:key="entry.email"
+							class="group border-b px-5 py-3 text-base last:border-b-0"
+						>
+							<Tooltip
+								class="block"
+								:text="__('This is the primary address and cannot be removed.')"
+								:disabled="!entry.is_primary"
+							>
+								<div class="flex w-full items-center">
+									<span class="flex-1 truncate">{{ entry.email }}</span>
+									<span class="text-ink-gray-5 flex-1 truncate">{{ entry.description || '—' }}</span>
+									<span class="flex w-20 shrink-0 justify-center">
+										<Switch
+											:model-value="entry.enabled"
+											:disabled="entry.is_primary"
+											@update:model-value="(value) => toggleEmailEnabled(entry, value)"
+										/>
+									</span>
+									<span class="flex w-8 shrink-0 justify-end">
+										<Button
+											v-if="!entry.is_primary"
+											variant="ghost"
+											theme="red"
+											class="invisible group-hover:visible"
+											@click="removeEmail(entry.email)"
+										>
+											<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+										</Button>
+									</span>
+								</div>
+							</Tooltip>
+						</div>
+					</template>
+					<div v-else class="text-ink-gray-5 px-5 py-6 text-center text-sm">
+						{{ __('No email addresses found.') }}
+					</div>
+				</div>
+			</DashboardCard>
+
+			<!-- Recipients -->
+			<DashboardCard
+				:title="__('Recipients')"
+				:button-label="__('Add')"
+				@action="showAddRecipients = true"
+			>
+				<div class="flex flex-col">
+					<div class="px-5 py-2.5">
+						<FormControl v-model="recipientSearch" :placeholder="__('Search by email')">
+							<template #prefix>
+								<FeatherIcon name="search" class="text-ink-gray-5 w-4" />
+							</template>
+						</FormControl>
+					</div>
+					<template v-if="filteredRecipients.length">
+						<div
+							v-for="recipient in filteredRecipients"
+							:key="recipient"
+							class="group flex items-center border-b px-5 py-3 text-base last:border-b-0"
+						>
+							<span class="flex-1 truncate">{{ recipient }}</span>
+							<Button
+								variant="ghost"
+								theme="red"
+								class="invisible group-hover:visible"
+								@click="removeRecipient(recipient)"
+							>
+								<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+							</Button>
+						</div>
+					</template>
+					<div v-else class="text-ink-gray-5 px-5 py-6 text-center text-sm">
+						{{ __('No recipients found.') }}
+					</div>
+				</div>
+			</DashboardCard>
+		</div>
+	</DashboardLayout>
+	<EditMailingListModal v-if="list.data" v-model="showEdit" :list="list.data" @reload="list.reload()" />
+	<AddMailingListEmailModal v-model="showAddEmail" :list-id="listId" @reload="list.reload()" />
+	<AddMailingListRecipientsModal v-model="showAddRecipients" :list-id="listId" @reload="list.reload()" />
+	<Dialog v-model="showDelete" :options="deleteDialogOptions" />
+</template>
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import { useRouter } from 'vue-router'
+import {
+	Button,
+	Dialog,
+	Dropdown,
+	FeatherIcon,
+	FormControl,
+	Switch,
+	Tooltip,
+	createResource,
+	usePageMeta,
+} from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+import AddMailingListEmailModal from '@/apps/mail/components/Modals/AddMailingListEmailModal.vue'
+import AddMailingListRecipientsModal from '@/apps/mail/components/Modals/AddMailingListRecipientsModal.vue'
+import DashboardCard from '@/apps/mail/components/DashboardCard.vue'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import EditMailingListModal from '@/apps/mail/components/Modals/EditMailingListModal.vue'
+import InformationField from '@/apps/mail/components/InformationField.vue'
+
+type ListData = {
+	id: string
+	name: string
+	email: string
+	description?: string
+	email_addresses: { email: string; description?: string; is_primary: boolean; enabled: boolean }[]
+	recipients: string[]
+}
+
+const { listId } = defineProps<{ listId: string }>()
+
+const router = useRouter()
+
+usePageMeta(() => ({ title: (list.data as ListData | undefined)?.email || listId }))
+
+const showEdit = ref(false)
+const showAddEmail = ref(false)
+const showAddRecipients = ref(false)
+const showDelete = ref(false)
+const recipientSearch = ref('')
+
+const list = createResource({
+	url: 'suite.mail.api.admin.get_mailing_list',
+	auto: true,
+	makeParams: () => ({ list_id: listId }),
+	cache: ['mailMailingList', listId],
+	onError: () => router.replace({ name: 'mail-mailing-lists' }),
+})
+
+const data = computed(() => list.data as ListData | undefined)
+
+const filteredRecipients = computed(() => {
+	const recipients = data.value?.recipients || []
+	const q = recipientSearch.value.trim().toLowerCase()
+	return q ? recipients.filter((r) => r.toLowerCase().includes(q)) : recipients
+})
+
+const breadcrumbs = computed(() => [
+	{ label: __('Mailing Lists'), route: '/mail/dashboard/mailing-lists' },
+	{ label: data.value?.email || listId },
+])
+
+const toggleEmailEnabled = (entry: { email: string; enabled: boolean }, value: boolean) => {
+	entry.enabled = value // optimistic; reverted on error via reload
+	createResource({
+		url: 'suite.mail.api.admin.set_mailing_list_email_enabled',
+		makeParams: () => ({ list_id: listId, email: entry.email, enabled: value ? 1 : 0 }),
+		onSuccess: () => raiseToast(value ? __('Email address enabled.') : __('Email address disabled.')),
+		onError: (error: { messages?: string[] }) => {
+			list.reload()
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error')
+		},
+	}).submit()
+}
+
+const removeEmail = (email: string) =>
+	createResource({
+		url: 'suite.mail.api.admin.remove_mailing_list_email',
+		makeParams: () => ({ list_id: listId, email }),
+		onSuccess: () => {
+			list.reload()
+			raiseToast(__('Email address removed.'))
+		},
+		onError: (error: { messages?: string[] }) =>
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error'),
+	}).submit()
+
+const removeRecipient = (email: string) =>
+	createResource({
+		url: 'suite.mail.api.admin.remove_mailing_list_recipient',
+		makeParams: () => ({ list_id: listId, email }),
+		onSuccess: () => {
+			list.reload()
+			raiseToast(__('Recipient removed.'))
+		},
+		onError: (error: { messages?: string[] }) =>
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error'),
+	}).submit()
+
+const deleteList = createResource({
+	url: 'suite.mail.api.admin.delete_mailing_lists',
+	makeParams: () => ({ ids: [listId] }),
+	onSuccess: () => {
+		showDelete.value = false
+		raiseToast(__('Mailing list deleted.'))
+		router.push({ name: 'mail-mailing-lists' })
+	},
+})
+
+const deleteDialogOptions = computed(() => ({
+	title: __('Delete Mailing List'),
+	message: __('Are you sure you want to delete this mailing list? This action cannot be undone.'),
+	size: 'xl',
+	icon: { name: 'alert-triangle', appearance: 'warning' },
+	actions: [{ label: __('Confirm'), variant: 'solid', theme: 'red', onClick: deleteList.submit }],
+}))
+
+const dropdownOptions = computed(() => [
+	{
+		group: '',
+		items: [{ label: __('Delete'), icon: 'trash-2', onClick: () => (showDelete.value = true) }],
+	},
+])
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/MailingListsView.vue b/frontend/src/apps/mail/pages/dashboard/MailingListsView.vue
new file mode 100644
index 0000000000..c5031a58d2
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/MailingListsView.vue
@@ -0,0 +1,88 @@
+<template>
+	<DashboardLayout
+		:breadcrumbs="[{ label: __('Mailing Lists') }]"
+		:button-label="__('Add Mailing List')"
+		:button-action="() => (showAdd = true)"
+	>
+		<div class="flex items-center space-x-3">
+			<FormControl v-model="search" :placeholder="__('Search')" class="w-80">
+				<template #prefix>
+					<FeatherIcon name="search" class="text-ink-gray-5 w-4" />
+				</template>
+			</FormControl>
+		</div>
+		<ListView
+			v-if="lists?.data"
+			class="flex-1"
+			:columns="LIST_COLUMNS"
+			:rows="lists.data"
+			:options="LIST_OPTIONS"
+			row-key="id"
+		>
+			<ListHeader />
+			<ListRows>
+				<template v-if="lists.data.length">
+					<ListRow
+						v-for="row in lists.data"
+						:key="row.id"
+						v-slot="{ item }"
+						:row="row"
+						class="hover:!bg-surface-gray-1"
+					>
+						<ListRowItem :item="item" />
+					</ListRow>
+				</template>
+				<ListEmptyState v-else />
+			</ListRows>
+		</ListView>
+	</DashboardLayout>
+	<AddMailingListModal v-model="showAdd" @reload="lists.reload()" />
+</template>
+<script setup lang="ts">
+import { ref } from 'vue'
+import { watchDebounced } from '@vueuse/core'
+import {
+	FeatherIcon,
+	FormControl,
+	ListEmptyState,
+	ListHeader,
+	ListRow,
+	ListRowItem,
+	ListRows,
+	ListView,
+	createResource,
+	usePageMeta,
+} from 'frappe-ui'
+
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import AddMailingListModal from '@/apps/mail/components/Modals/AddMailingListModal.vue'
+
+usePageMeta(() => ({ title: __('Mailing Lists') }))
+
+const showAdd = ref(false)
+const search = ref('')
+
+const lists = createResource({
+	url: 'suite.mail.api.admin.get_mailing_lists',
+	auto: true,
+	makeParams: () => ({ search: search.value }),
+	cache: ['mailMailingLists', search.value],
+})
+
+watchDebounced(() => search.value, lists.reload, { debounce: 300 })
+
+type ListRowType = { id: string; email?: string; description?: string; recipient_count?: number }
+
+const LIST_COLUMNS = [
+	{ label: __('Email'), key: 'email' },
+	{ label: __('Description'), key: 'description' },
+	{ label: __('Recipients'), key: 'recipient_count' },
+]
+
+const LIST_OPTIONS = {
+	selectable: false,
+	showTooltip: false,
+	emptyState: { description: __('No mailing lists found.') },
+	getRowRoute: (row: ListRowType) => ({ name: 'mail-mailing-list', params: { listId: row.id } }),
+}
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/MemberView.vue b/frontend/src/apps/mail/pages/dashboard/MemberView.vue
new file mode 100644
index 0000000000..501d85e7d3
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/MemberView.vue
@@ -0,0 +1,512 @@
+<template>
+	<DashboardLayout
+		v-if="member.data"
+		:breadcrumbs="BREADCRUMBS"
+		:badge-label="badge.label"
+		:badge-theme="badge.theme"
+	>
+		<template #actions>
+			<Dropdown :options="dropdownOptions" :button="{ icon: 'more-horizontal' }" />
+		</template>
+
+		<div class="grid grid-cols-1 gap-5 lg:grid-cols-2">
+			<!-- General Information -->
+			<DashboardCard
+				:title="__('General Information')"
+				:button-label="__('Edit')"
+				@action="showEdit = true"
+			>
+				<div>
+					<InformationField
+						:label="__('Role')"
+						:value="member.data.is_admin ? __('Admin') : __('User')"
+					/>
+					<InformationField :label="__('Full Name')" :value="member.data.description" />
+					<InformationField :label="__('Locale')" :value="localeLabel(member.data.locale)" />
+					<InformationField :label="__('Time Zone')" :value="member.data.time_zone" />
+					<InformationField :label="__('Last Active')" :value="lastActive" />
+					<InformationField :label="__('Joined On')" :value="joinedOn" />
+				</div>
+			</DashboardCard>
+
+			<!-- Quota Usage -->
+			<DashboardCard :title="__('Quota Usage')" :button-label="__('Edit')" @action="showEditQuota = true">
+				<div class="flex flex-1 items-center justify-center gap-8 p-6">
+					<div class="relative shrink-0">
+						<svg :width="DONUT_SIZE" :height="DONUT_SIZE" class="-rotate-90">
+							<circle
+								:cx="DONUT_SIZE / 2"
+								:cy="DONUT_SIZE / 2"
+								:r="DONUT_RADIUS"
+								fill="none"
+								stroke="var(--surface-gray-4)"
+								:stroke-width="DONUT_STROKE"
+							/>
+							<circle
+								v-if="!member.data.quota.unlimited && usedDashArc > 0"
+								:cx="DONUT_SIZE / 2"
+								:cy="DONUT_SIZE / 2"
+								:r="DONUT_RADIUS"
+								fill="none"
+								stroke="var(--surface-gray-10)"
+								:stroke-width="DONUT_STROKE"
+								stroke-linecap="round"
+								:stroke-dasharray="`${usedDashArc} ${DONUT_CIRCUMFERENCE}`"
+							/>
+						</svg>
+						<div class="absolute inset-0 flex flex-col items-center justify-center text-center">
+							<span class="text-lg font-semibold">{{ totalQuotaLabel }}</span>
+							<span class="text-ink-gray-5 text-xs">
+								{{ member.data.quota.unlimited ? __('Unlimited') : __('Total Quota') }}
+							</span>
+						</div>
+					</div>
+					<div class="space-y-4">
+						<div class="flex items-start gap-2">
+							<span class="bg-surface-gray-10 mt-1 h-3 w-3 shrink-0 rounded-sm" />
+							<div>
+								<p class="text-sm font-medium">{{ usedLabel }}</p>
+								<p class="text-ink-gray-5 text-xs">{{ __('Used') }}</p>
+							</div>
+						</div>
+						<div v-if="!member.data.quota.unlimited" class="flex items-start gap-2">
+							<span class="bg-surface-gray-4 mt-1 h-3 w-3 shrink-0 rounded-sm" />
+							<div>
+								<p class="text-sm font-medium">{{ availableLabel }}</p>
+								<p class="text-ink-gray-5 text-xs">{{ __('Available') }}</p>
+							</div>
+						</div>
+					</div>
+				</div>
+			</DashboardCard>
+
+			<!-- Email Addresses -->
+			<DashboardCard
+				:title="__('Email Addresses')"
+				:button-label="__('Add')"
+				@action="showAddEmail = true"
+			>
+				<div class="flex flex-col">
+					<div class="bg-surface-gray-2 text-ink-gray-5 flex items-center rounded px-5 py-2.5 text-sm">
+						<span class="flex-1">{{ __('Email Address') }}</span>
+						<span class="flex-1">{{ __('Full Name') }}</span>
+						<span class="w-20 shrink-0 text-center">{{ __('Enabled') }}</span>
+						<span class="w-8 shrink-0" />
+					</div>
+					<template v-if="member.data.email_addresses.length">
+						<div
+							v-for="entry in member.data.email_addresses"
+							:key="entry.email"
+							class="group border-b px-5 py-3 text-base last:border-b-0"
+						>
+							<Tooltip
+								class="block"
+								:text="__('This is the primary address and cannot be removed.')"
+								:disabled="!entry.is_primary"
+							>
+								<div class="flex w-full items-center">
+									<span class="flex-1 truncate">{{ entry.email }}</span>
+									<span class="text-ink-gray-5 flex-1 truncate">
+										{{ entry.description || '—' }}
+									</span>
+									<span class="flex w-20 shrink-0 justify-center">
+										<Switch
+											:model-value="entry.enabled"
+											:disabled="entry.is_primary"
+											@update:model-value="(value) => toggleEmailEnabled(entry, value)"
+										/>
+									</span>
+									<span class="flex w-8 shrink-0 justify-end">
+										<Button
+											v-if="!entry.is_primary"
+											variant="ghost"
+											theme="red"
+											class="invisible group-hover:visible"
+											@click="removeEmail(entry.email)"
+										>
+											<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+										</Button>
+									</span>
+								</div>
+							</Tooltip>
+						</div>
+					</template>
+					<div v-else class="text-ink-gray-5 px-5 py-6 text-center text-sm">
+						{{ __('No email addresses found.') }}
+					</div>
+				</div>
+			</DashboardCard>
+
+			<!-- Groups -->
+			<DashboardCard :title="__('Groups')" :button-label="__('Add')" @action="showAddGroups = true">
+				<div class="flex flex-col">
+					<div class="bg-surface-gray-2 text-ink-gray-5 rounded px-5 py-2.5 text-sm">
+						{{ __('Group') }}
+					</div>
+					<template v-if="member.data.groups.length">
+						<div
+							v-for="group in member.data.groups"
+							:key="group.id"
+							class="group hover:bg-surface-gray-2 flex cursor-pointer items-center justify-between border-b px-5 py-3 text-base last:border-b-0"
+							@click="router.push({ name: 'mail-group', params: { groupId: group.id } })"
+						>
+							<span>{{ group.email || group.name }}</span>
+							<Button
+								variant="ghost"
+								theme="red"
+								class="invisible group-hover:visible"
+								@click.stop="removeGroup(group.id)"
+							>
+								<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+							</Button>
+						</div>
+					</template>
+					<div v-else class="text-ink-gray-5 px-5 py-6 text-center text-sm">
+						{{ __('Not a member of any group.') }}
+					</div>
+				</div>
+			</DashboardCard>
+
+			<!-- Mailing Lists -->
+			<DashboardCard :title="__('Mailing Lists')" :button-label="__('Add')" @action="showAddLists = true">
+				<div class="flex flex-col">
+					<div class="bg-surface-gray-2 text-ink-gray-5 rounded px-5 py-2.5 text-sm">
+						{{ __('Mailing List') }}
+					</div>
+					<template v-if="member.data.mailing_lists.length">
+						<div
+							v-for="list in member.data.mailing_lists"
+							:key="list.id"
+							class="group hover:bg-surface-gray-2 flex cursor-pointer items-center justify-between border-b px-5 py-3 text-base last:border-b-0"
+							@click="router.push({ name: 'mail-mailing-list', params: { listId: list.id } })"
+						>
+							<span>{{ list.email || list.name }}</span>
+							<Button
+								variant="ghost"
+								theme="red"
+								class="invisible group-hover:visible"
+								@click.stop="removeList(list.id)"
+							>
+								<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+							</Button>
+						</div>
+					</template>
+					<div v-else class="text-ink-gray-5 px-5 py-6 text-center text-sm">
+						{{ __('Not a recipient of any mailing list.') }}
+					</div>
+				</div>
+			</DashboardCard>
+		</div>
+	</DashboardLayout>
+	<Dialog v-model="showResetPassword" :options="RESET_PASSWORD_OPTIONS" />
+	<Dialog v-model="showToggleEnabled" :options="TOGGLE_ENABLED_OPTIONS" />
+	<Dialog v-model="showDeleteMember" :options="DELETE_MEMBER_OPTIONS" />
+	<ChangeMemberPasswordModal v-model="showChangePassword" :member-id="memberId" />
+		<EditMemberModal v-if="data" v-model="showEdit" :member="data" @reload="member.reload()" />
+		<EditMemberQuotaModal v-if="data" v-model="showEditQuota" :member="data" @reload="member.reload()" />
+		<AddMemberEmailModal v-model="showAddEmail" :member-id="memberId" @reload="member.reload()" />
+		<AddMemberGroupsModal
+			v-model="showAddGroups"
+			:member-id="memberId"
+			:current-ids="currentGroupIds"
+			@reload="member.reload()"
+		/>
+		<AddMemberMailingListsModal
+			v-model="showAddLists"
+			:member-id="memberId"
+			:current-ids="currentListIds"
+			@reload="member.reload()"
+		/>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import { useRouter } from 'vue-router'
+import {
+	Button,
+	Dialog,
+	Dropdown,
+	FeatherIcon,
+	Switch,
+	Tooltip,
+	createResource,
+	usePageMeta,
+} from 'frappe-ui'
+
+import { formatBytes, raiseToast } from '@/apps/mail/utils'
+import { formatDateTime } from '@/apps/mail/utils/datetime'
+import { useAccountOptions } from '@/apps/mail/composables/useAccountOptions'
+import AddMemberEmailModal from '@/apps/mail/components/Modals/AddMemberEmailModal.vue'
+import AddMemberGroupsModal from '@/apps/mail/components/Modals/AddMemberGroupsModal.vue'
+import AddMemberMailingListsModal from '@/apps/mail/components/Modals/AddMemberMailingListsModal.vue'
+import ChangeMemberPasswordModal from '@/apps/mail/components/Modals/ChangeMemberPasswordModal.vue'
+import DashboardCard from '@/apps/mail/components/DashboardCard.vue'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import EditMemberModal from '@/apps/mail/components/Modals/EditMemberModal.vue'
+import EditMemberQuotaModal from '@/apps/mail/components/Modals/EditMemberQuotaModal.vue'
+import InformationField from '@/apps/mail/components/InformationField.vue'
+
+type QuotaUsage = {
+	total: number
+	used: number
+	available: number
+	used_percentage: number
+	available_percentage: number
+	unlimited: boolean
+}
+type MemberData = {
+	name: string
+	full_name: string
+	description: string
+	last_active: string | null
+	joined_on: string
+	enabled: boolean
+	is_admin: boolean
+	email_addresses: { email: string; description?: string; is_primary: boolean; enabled: boolean }[]
+	groups: { id: string; name: string; email: string }[]
+	mailing_lists: { id: string; name: string; email: string }[]
+	quota: QuotaUsage
+}
+
+const { memberId } = defineProps<{ memberId: string }>()
+
+const router = useRouter()
+const { localeLabel } = useAccountOptions()
+
+usePageMeta(() => ({ title: memberId }))
+
+const showDeleteMember = ref(false)
+const showResetPassword = ref(false)
+const showChangePassword = ref(false)
+const showToggleEnabled = ref(false)
+const showEdit = ref(false)
+const showEditQuota = ref(false)
+const showAddEmail = ref(false)
+const showAddGroups = ref(false)
+const showAddLists = ref(false)
+
+const member = createResource({
+	url: 'suite.mail.api.admin.get_member',
+	auto: true,
+	makeParams: () => ({ member_id: memberId }),
+	cache: ['mailMember', memberId],
+	onError: () => router.replace({ name: 'mail-members' }),
+})
+
+const data = computed(() => member.data as MemberData | undefined)
+
+const currentGroupIds = computed(() => data.value?.groups.map((g) => g.id) || [])
+const currentListIds = computed(() => data.value?.mailing_lists.map((l) => l.id) || [])
+
+const toggleEmailEnabled = (entry: { email: string; enabled: boolean }, value: boolean) => {
+	entry.enabled = value // optimistic; reverted on error via reload
+	createResource({
+		url: 'suite.mail.api.admin.set_member_email_enabled',
+		makeParams: () => ({ member_id: memberId, email: entry.email, enabled: value ? 1 : 0 }),
+		onSuccess: () => raiseToast(value ? __('Email address enabled.') : __('Email address disabled.')),
+		onError: (error: { messages?: string[] }) => {
+			member.reload()
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error')
+		},
+	}).submit()
+}
+
+const removeEmail = (email: string) =>
+	createResource({
+		url: 'suite.mail.api.admin.remove_member_email',
+		makeParams: () => ({ member_id: memberId, email }),
+		onSuccess: () => {
+			member.reload()
+			raiseToast(__('Email address removed.'))
+		},
+		onError: (error: { messages?: string[] }) =>
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error'),
+	}).submit()
+
+const removeGroup = (groupId: string) =>
+	createResource({
+		url: 'suite.mail.api.admin.remove_member_from_group',
+		makeParams: () => ({ member_id: memberId, group_id: groupId }),
+		onSuccess: () => {
+			member.reload()
+			raiseToast(__('Removed from group.'))
+		},
+		onError: (error: { messages?: string[] }) =>
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error'),
+	}).submit()
+
+const removeList = (listId: string) =>
+	createResource({
+		url: 'suite.mail.api.admin.remove_member_from_mailing_list',
+		makeParams: () => ({ member_id: memberId, list_id: listId }),
+		onSuccess: () => {
+			member.reload()
+			raiseToast(__('Removed from mailing list.'))
+		},
+		onError: (error: { messages?: string[] }) =>
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error'),
+	}).submit()
+
+const badge = computed<{ label: string; theme: 'green' | 'gray' }>(() =>
+	data.value?.enabled
+		? { label: __('Enabled'), theme: 'green' }
+		: { label: __('Disabled'), theme: 'gray' },
+)
+
+const formatDate = (value?: string | null) => formatDateTime(value)
+
+const lastActive = computed(() => formatDate(data.value?.last_active) || __('Never'))
+const joinedOn = computed(() => formatDate(data.value?.joined_on))
+
+// Quota donut geometry.
+const DONUT_SIZE = 140
+const DONUT_STROKE = 12
+const DONUT_RADIUS = (DONUT_SIZE - DONUT_STROKE) / 2
+const DONUT_CIRCUMFERENCE = 2 * Math.PI * DONUT_RADIUS
+
+// Length of the "used" arc. Guarded against sub-pixel arcs (e.g. a few hundred bytes of a
+// multi-GB quota) that a round line cap would otherwise render as a misleading full dot.
+const usedDashArc = computed(() => {
+	const pct = data.value?.quota.used_percentage || 0
+	const arc = DONUT_CIRCUMFERENCE * (pct / 100)
+	return arc >= 1 ? arc : 0
+})
+
+const totalQuotaLabel = computed(() =>
+	data.value?.quota.unlimited ? '∞' : formatBytes(data.value?.quota.total || 0),
+)
+
+const usedLabel = computed(() => {
+	const quota = data.value?.quota
+	if (!quota) return ''
+	if (quota.unlimited) return formatBytes(quota.used)
+	return `${formatBytes(quota.used)} (${quota.used_percentage.toFixed(1)}%)`
+})
+
+const availableLabel = computed(() => {
+	const quota = data.value?.quota
+	if (!quota) return ''
+	return `${formatBytes(quota.available)} (${quota.available_percentage.toFixed(1)}%)`
+})
+
+const BREADCRUMBS = computed(() => [
+	{ label: __('Members'), route: '/mail/dashboard/members' },
+	{ label: data.value?.name || memberId },
+])
+
+// Member actions reuse the bulk admin endpoints with a single-name list.
+
+const setEnabled = (enabled: boolean) =>
+	createResource({
+		url: enabled
+			? 'suite.mail.api.admin.enable_members'
+			: 'suite.mail.api.admin.disable_members',
+		makeParams: () => ({ names: [memberId] }),
+		onSuccess: () => {
+			showToggleEnabled.value = false
+			member.reload()
+			raiseToast(enabled ? __('Member enabled.') : __('Member disabled.'))
+		},
+		onError: (error: { messages?: string[] }) => {
+			showToggleEnabled.value = false
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error')
+		},
+	}).submit()
+
+const TOGGLE_ENABLED_OPTIONS = computed(() => {
+	const enabling = !data.value?.enabled
+	return {
+		title: enabling ? __('Enable Member') : __('Disable Member'),
+		message: enabling
+			? __('Are you sure you want to enable this member? They will be able to log in again.')
+			: __(
+					'Are you sure you want to disable this member? They will no longer be able to log in.',
+				),
+		actions: [
+			{ label: __('Confirm'), variant: 'solid', onClick: () => setEnabled(enabling) },
+		],
+	}
+})
+
+const resetPassword = createResource({
+	url: 'suite.mail.api.account.send_reset_password_link',
+	makeParams: () => ({ user: memberId }),
+	onSuccess: (email: string) => {
+		showResetPassword.value = false
+		raiseToast(__('Reset password link sent to {0}.', [email]))
+	},
+	onError: (error: { messages?: string[] }) => {
+		showResetPassword.value = false
+		raiseToast(error.messages?.[0] || __('Failed to send reset password link.'), 'error')
+	},
+})
+
+const RESET_PASSWORD_OPTIONS = {
+	title: __('Reset Password'),
+	message: __(
+		'Send a password reset link to this member? The link will be emailed to their backup email address.',
+	),
+	actions: [{ label: __('Confirm'), variant: 'solid', onClick: () => resetPassword.submit() }],
+}
+
+const deleteMember = createResource({
+	url: 'suite.mail.api.admin.delete_members',
+	makeParams: () => ({ names: [memberId] }),
+	onSuccess: () => {
+		showDeleteMember.value = false
+		raiseToast(__('Member deleted.'))
+		router.push({ name: 'mail-members' })
+	},
+	onError: (error: { messages?: string[] }) => {
+		showDeleteMember.value = false
+		raiseToast(error.messages?.[0] || __('Failed to delete member.'), 'error')
+	},
+})
+
+const DELETE_MEMBER_OPTIONS = {
+	title: __('Delete Member'),
+	message: __('Are you sure you want to delete this member? This action cannot be undone.'),
+	size: 'xl',
+	icon: { name: 'alert-triangle', appearance: 'warning' },
+	actions: [{ label: __('Confirm'), variant: 'solid', onClick: () => deleteMember.submit() }],
+}
+
+const dropdownOptions = computed(() => [
+	{
+		group: '',
+		items: [
+			{
+				label: __('Reset Password'),
+				icon: 'mail',
+				onClick: () => (showResetPassword.value = true),
+			},
+			{
+				label: __('Change Password'),
+				icon: 'key',
+				onClick: () => (showChangePassword.value = true),
+			},
+		],
+	},
+	{
+		group: '',
+		items: [
+			data.value?.enabled
+				? {
+						label: __('Disable'),
+						icon: 'user-x',
+						onClick: () => (showToggleEnabled.value = true),
+					}
+				: {
+						label: __('Enable'),
+						icon: 'user-check',
+						onClick: () => (showToggleEnabled.value = true),
+					},
+			{
+				label: __('Delete'),
+				icon: 'trash-2',
+				onClick: () => (showDeleteMember.value = true),
+			},
+		],
+	},
+])
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/OAuthClientView.vue b/frontend/src/apps/mail/pages/dashboard/OAuthClientView.vue
new file mode 100644
index 0000000000..78e2c62162
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/OAuthClientView.vue
@@ -0,0 +1,172 @@
+<template>
+	<DashboardLayout v-if="client?.data" :breadcrumbs="breadcrumbs">
+		<template #actions>
+			<Dropdown :options="dropdownOptions" :button="{ icon: 'more-horizontal' }" />
+		</template>
+		<template #default>
+			<div class="grid grid-cols-1 gap-5 lg:grid-cols-2">
+				<!-- General Information -->
+				<DashboardCard
+					:title="__('General Information')"
+					:button-label="__('Edit')"
+					@action="showEdit = true"
+				>
+					<InformationField :label="__('Client ID')" :value="client.data.client_id" />
+					<InformationField :label="__('Description')" :value="client.data.description" />
+					<InformationField :label="__('Created At')" :value="createdAt" />
+					<InformationField :label="__('Expires At')" :value="expiresAt" />
+				</DashboardCard>
+
+				<!-- Contacts -->
+				<DashboardCard :title="__('Contacts')" :button-label="__('Add')" @action="showAddContacts = true">
+					<div class="flex flex-col">
+						<template v-if="client.data.contacts.length">
+							<div
+								v-for="contact in client.data.contacts"
+								:key="contact"
+								class="group flex items-center border-b px-5 py-3 text-base last:border-b-0"
+							>
+								<span class="flex-1 truncate">{{ contact }}</span>
+								<Button
+									variant="ghost"
+									theme="red"
+									class="invisible group-hover:visible"
+									@click="removeContact(contact)"
+								>
+									<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+								</Button>
+							</div>
+						</template>
+						<div v-else class="text-ink-gray-5 px-5 py-6 text-center text-sm">
+							{{ __('No contacts.') }}
+						</div>
+					</div>
+				</DashboardCard>
+
+				<!-- Redirect URIs -->
+				<DashboardCard
+					:title="__('Redirect URIs')"
+					:button-label="__('Add')"
+					@action="showAddRedirectUris = true"
+				>
+					<div class="flex flex-col">
+						<template v-if="client.data.redirect_uris.length">
+							<div
+								v-for="uri in client.data.redirect_uris"
+								:key="uri"
+								class="group flex items-center border-b px-5 py-3 text-base last:border-b-0"
+							>
+								<span class="flex-1 truncate">{{ uri }}</span>
+								<Button
+									variant="ghost"
+									theme="red"
+									class="invisible group-hover:visible"
+									@click="removeRedirectUri(uri)"
+								>
+									<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+								</Button>
+							</div>
+						</template>
+						<div v-else class="text-ink-gray-5 px-5 py-6 text-center text-sm">
+							{{ __('No redirect URIs.') }}
+						</div>
+					</div>
+				</DashboardCard>
+			</div>
+		</template>
+	</DashboardLayout>
+	<EditOAuthClientModal v-if="client.data" v-model="showEdit" :client="client.data" @reload="client.reload()" />
+	<AddOAuthContactsModal v-model="showAddContacts" :client-id="clientId" @reload="client.reload()" />
+	<AddOAuthRedirectUrisModal v-model="showAddRedirectUris" :client-id="clientId" @reload="client.reload()" />
+	<Dialog v-model="showDelete" :options="deleteDialogOptions" />
+</template>
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import { useRouter } from 'vue-router'
+import { Button, Dialog, Dropdown, FeatherIcon, createResource, usePageMeta } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+import { formatDateTime } from '@/apps/mail/utils/datetime'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import DashboardCard from '@/apps/mail/components/DashboardCard.vue'
+import InformationField from '@/apps/mail/components/InformationField.vue'
+import EditOAuthClientModal from '@/apps/mail/components/Modals/EditOAuthClientModal.vue'
+import AddOAuthContactsModal from '@/apps/mail/components/Modals/AddOAuthContactsModal.vue'
+import AddOAuthRedirectUrisModal from '@/apps/mail/components/Modals/AddOAuthRedirectUrisModal.vue'
+
+const { clientId } = defineProps<{ clientId: string }>()
+const router = useRouter()
+
+usePageMeta(() => ({ title: client.data?.client_id || clientId }))
+
+const showEdit = ref(false)
+const showAddContacts = ref(false)
+const showAddRedirectUris = ref(false)
+const showDelete = ref(false)
+
+const client = createResource({
+	url: 'suite.mail.api.admin.get_oauth_client',
+	auto: true,
+	makeParams: () => ({ client_id: clientId }),
+	cache: ['mailOAuthClient', clientId],
+	onError: () => router.replace({ name: 'mail-oauth-clients' }),
+})
+
+const formatDate = (value?: string | null) => formatDateTime(value)
+const createdAt = computed(() => formatDate(client.data?.created_at))
+const expiresAt = computed(() => formatDate(client.data?.expires_at))
+
+const breadcrumbs = computed(() => [
+	{ label: __('OAuth Clients'), route: '/mail/dashboard/oauth-clients' },
+	{ label: client.data?.client_id || clientId },
+])
+
+const removeContact = (contact: string) =>
+	createResource({
+		url: 'suite.mail.api.admin.remove_oauth_client_contact',
+		makeParams: () => ({ client_id: clientId, contact }),
+		onSuccess: () => {
+			client.reload()
+			raiseToast(__('Contact removed.'))
+		},
+		onError: (error: { messages?: string[] }) =>
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error'),
+	}).submit()
+
+const removeRedirectUri = (uri: string) =>
+	createResource({
+		url: 'suite.mail.api.admin.remove_oauth_client_redirect_uri',
+		makeParams: () => ({ client_id: clientId, uri }),
+		onSuccess: () => {
+			client.reload()
+			raiseToast(__('Redirect URI removed.'))
+		},
+		onError: (error: { messages?: string[] }) =>
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error'),
+	}).submit()
+
+const deleteClient = createResource({
+	url: 'suite.mail.api.admin.delete_oauth_clients',
+	makeParams: () => ({ ids: [clientId] }),
+	onSuccess: () => {
+		showDelete.value = false
+		raiseToast(__('OAuth client deleted.'))
+		router.push({ name: 'mail-oauth-clients' })
+	},
+})
+
+const deleteDialogOptions = computed(() => ({
+	title: __('Delete OAuth Client'),
+	message: __('Are you sure you want to delete this OAuth client? This action cannot be undone.'),
+	size: 'xl',
+	icon: { name: 'alert-triangle', appearance: 'warning' },
+	actions: [{ label: __('Confirm'), variant: 'solid', theme: 'red', onClick: deleteClient.submit }],
+}))
+
+const dropdownOptions = computed(() => [
+	{
+		group: '',
+		items: [{ label: __('Delete'), icon: 'trash-2', onClick: () => (showDelete.value = true) }],
+	},
+])
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/OAuthClientsView.vue b/frontend/src/apps/mail/pages/dashboard/OAuthClientsView.vue
new file mode 100644
index 0000000000..67d67ae73d
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/OAuthClientsView.vue
@@ -0,0 +1,93 @@
+<template>
+	<DashboardLayout
+		:breadcrumbs="[{ label: __('OAuth Clients') }]"
+		:button-label="__('Add OAuth Client')"
+		:button-action="() => (showAdd = true)"
+	>
+		<div class="flex items-center space-x-3">
+			<FormControl v-model="search" :placeholder="__('Search')" class="w-80">
+				<template #prefix>
+					<FeatherIcon name="search" class="text-ink-gray-5 w-4" />
+				</template>
+			</FormControl>
+		</div>
+		<ListView
+			v-if="clients?.data"
+			class="flex-1"
+			:columns="LIST_COLUMNS"
+			:rows="clients.data"
+			:options="LIST_OPTIONS"
+			row-key="id"
+		>
+			<ListHeader />
+			<ListRows>
+				<template v-if="clients.data.length">
+					<ListRow
+						v-for="row in clients.data"
+						:key="row.id"
+						v-slot="{ column, item }"
+						:row="row"
+						class="hover:!bg-surface-gray-1"
+					>
+						<ListRowItem :item="item">
+							<span v-if="column.key === 'created_at'">{{ formatCreatedAt(item) }}</span>
+						</ListRowItem>
+					</ListRow>
+				</template>
+				<ListEmptyState v-else />
+			</ListRows>
+		</ListView>
+	</DashboardLayout>
+	<AddOAuthClientModal v-model="showAdd" @reload="clients.reload()" />
+</template>
+<script setup lang="ts">
+import { ref } from 'vue'
+import { watchDebounced } from '@vueuse/core'
+import {
+	FeatherIcon,
+	FormControl,
+	ListEmptyState,
+	ListHeader,
+	ListRow,
+	ListRowItem,
+	ListRows,
+	ListView,
+	createResource,
+	usePageMeta,
+} from 'frappe-ui'
+
+import { fromNow } from '@/apps/mail/utils/datetime'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import AddOAuthClientModal from '@/apps/mail/components/Modals/AddOAuthClientModal.vue'
+
+usePageMeta(() => ({ title: __('OAuth Clients') }))
+
+const showAdd = ref(false)
+const search = ref('')
+
+const clients = createResource({
+	url: 'suite.mail.api.admin.get_oauth_clients',
+	auto: true,
+	makeParams: () => ({ search: search.value }),
+	cache: ['mailOAuthClients', search.value],
+})
+
+watchDebounced(() => search.value, clients.reload, { debounce: 300 })
+
+type ClientRow = { id: string; client_id: string; description?: string; created_at?: string }
+
+const LIST_COLUMNS = [
+	{ label: __('Client ID'), key: 'client_id' },
+	{ label: __('Description'), key: 'description' },
+	{ label: __('Created At'), key: 'created_at' },
+]
+
+const LIST_OPTIONS = {
+	selectable: false,
+	showTooltip: false,
+	emptyState: { description: __('No OAuth clients found.') },
+	getRowRoute: (row: ClientRow) => ({ name: 'mail-oauth-client', params: { clientId: row.id } }),
+}
+
+const formatCreatedAt = (createdAt?: string) => fromNow(createdAt) || '-'
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/QueuedMessageView.vue b/frontend/src/apps/mail/pages/dashboard/QueuedMessageView.vue
new file mode 100644
index 0000000000..59d9469daa
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/QueuedMessageView.vue
@@ -0,0 +1,238 @@
+<template>
+	<DashboardLayout v-if="message?.data" :breadcrumbs="breadcrumbs">
+		<template #actions>
+			<Dropdown :options="dropdownOptions" :button="{ icon: 'more-horizontal' }" />
+		</template>
+		<template #default>
+			<div class="grid grid-cols-1 gap-5 lg:grid-cols-2">
+				<DashboardCard :title="__('General Information')" :button-label="__('Edit')" @action="showEditMessage = true">
+					<InformationField :label="__('Sender')" :value="data.sender" />
+					<InformationField :label="__('Size')" :value="formatBytes(data.size || 0)" />
+					<InformationField :label="__('Priority')" :value="String(data.priority ?? '—')" />
+					<InformationField :label="__('Envelope ID')" :value="data.env_id" />
+					<InformationField :label="__('Next Retry')" :value="formatDate(data.next_retry)" />
+					<InformationField :label="__('Next Notification')" :value="formatDate(data.next_notify)" />
+					<InformationField :label="__('Received From IP')" :value="data.received_from_ip" />
+					<InformationField :label="__('Received Via Port')" :value="String(data.received_via_port ?? '—')" />
+					<InformationField :label="__('Received At')" :value="formatDate(data.created_at)" />
+					<div class="px-5 py-3.5">
+						<p class="text-ink-gray-5 mb-1.5 text-sm">{{ __('Flags') }}</p>
+						<div v-if="data.flags.length" class="flex flex-wrap gap-1.5">
+							<Badge v-for="flag in data.flags" :key="flag.value" :label="flag.label" theme="gray" />
+						</div>
+						<span v-else class="text-base">—</span>
+					</div>
+				</DashboardCard>
+
+				<DashboardCard :title="__('Recipients')" :button-label="__('Add')" @action="showAddRecipient = true">
+					<div class="flex flex-col">
+						<template v-if="data.recipients.length">
+							<div
+								v-for="r in data.recipients"
+								:key="r.email"
+								class="group hover:bg-surface-gray-2 flex cursor-pointer items-center gap-3 border-b px-5 py-3 last:border-b-0"
+								@click="editRecipient(r)"
+							>
+								<div class="min-w-0 flex-1">
+									<p class="truncate text-base">{{ r.email }}</p>
+									<p class="text-ink-gray-5 mt-0.5 text-xs">{{ recipientSummary(r) }}</p>
+								</div>
+								<Badge :label="statusLabel(r.status_type)" :theme="statusTheme(r.status_type)" />
+								<Button
+									variant="ghost"
+									theme="red"
+									class="invisible group-hover:visible"
+									@click.stop="removeRecipient(r.email)"
+								>
+									<template #icon><FeatherIcon name="x" class="h-4 w-4" /></template>
+								</Button>
+							</div>
+						</template>
+						<div v-else class="text-ink-gray-5 px-5 py-6 text-center text-sm">{{ __('No recipients.') }}</div>
+					</div>
+				</DashboardCard>
+			</div>
+		</template>
+	</DashboardLayout>
+
+	<EditQueuedMessageModal
+		v-if="message.data"
+		v-model="showEditMessage"
+		:message-id="messageId"
+		:message="data"
+		@reload="message.reload()"
+	/>
+	<AddQueuedRecipientModal v-model="showAddRecipient" :message-id="messageId" @reload="message.reload()" />
+	<EditQueuedRecipientModal
+		v-model="showEditRecipient"
+		:message-id="messageId"
+		:recipient="activeRecipient"
+		:options="options"
+		@reload="message.reload()"
+	/>
+	<Dialog v-model="showCancel" :options="cancelDialogOptions" />
+	<Dialog v-model="showSource" :options="{ title: __('Message Source'), size: '4xl' }">
+		<template #body-content>
+			<pre
+				v-if="source.data"
+				class="bg-surface-gray-2 max-h-[70vh] overflow-auto rounded p-4 text-xs whitespace-pre-wrap"
+				>{{ source.data.source }}</pre
+			>
+			<div v-else class="text-ink-gray-5 py-6 text-center text-sm">{{ __('Loading…') }}</div>
+		</template>
+	</Dialog>
+</template>
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import { useRouter } from 'vue-router'
+import { Badge, Button, Dialog, Dropdown, FeatherIcon, createResource, usePageMeta } from 'frappe-ui'
+
+import { formatBytes, raiseToast } from '@/apps/mail/utils'
+import { formatDateTime, fromNow } from '@/apps/mail/utils/datetime'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import DashboardCard from '@/apps/mail/components/DashboardCard.vue'
+import InformationField from '@/apps/mail/components/InformationField.vue'
+import AddQueuedRecipientModal from '@/apps/mail/components/Modals/AddQueuedRecipientModal.vue'
+import EditQueuedRecipientModal from '@/apps/mail/components/Modals/EditQueuedRecipientModal.vue'
+import EditQueuedMessageModal from '@/apps/mail/components/Modals/EditQueuedMessageModal.vue'
+
+type Recipient = {
+	email: string
+	status_type?: string
+	retry_count?: number
+	next_retry?: string
+	[key: string]: unknown
+}
+type MessageData = {
+	id: string
+	sender?: string
+	size?: number
+	priority?: number
+	env_id?: string
+	flags: { value: string; label: string }[]
+	next_retry?: string
+	next_notify?: string
+	received_from_ip?: string
+	received_via_port?: number
+	created_at?: string
+	recipients: Recipient[]
+	has_content: boolean
+}
+
+const { messageId } = defineProps<{ messageId: string }>()
+const router = useRouter()
+
+usePageMeta(() => ({ title: __('Queued Message') }))
+
+const showEditMessage = ref(false)
+const showAddRecipient = ref(false)
+const showEditRecipient = ref(false)
+const showCancel = ref(false)
+const showSource = ref(false)
+const activeRecipient = ref<Recipient | null>(null)
+
+const message = createResource({
+	url: 'suite.mail.api.admin.get_queued_message',
+	auto: true,
+	makeParams: () => ({ message_id: messageId }),
+	cache: ['mailQueuedMessage', messageId],
+	onError: () => router.replace({ name: 'mail-queued-messages' }),
+})
+
+const data = computed(() => message.data as MessageData)
+
+const recipientOptions = createResource({
+	url: 'suite.mail.api.admin.get_queue_recipient_options',
+	auto: true,
+	cache: 'mailQueueRecipientOptions',
+})
+const options = computed(
+	() => recipientOptions.data || { status_types: [], error_types: [], expiry_types: [] },
+)
+
+const source = createResource({
+	url: 'suite.mail.api.admin.get_queued_message_source',
+	makeParams: () => ({ message_id: messageId }),
+})
+
+const STATUS_LABELS: Record<string, string> = {
+	Scheduled: __('Scheduled'),
+	Completed: __('Delivered'),
+	TemporaryFailure: __('Temporary Failure'),
+	PermanentFailure: __('Permanent Failure'),
+}
+const formatDate = (value?: string | null) => formatDateTime(value) || '—'
+const statusLabel = (type?: string) => STATUS_LABELS[type || ''] || type || __('Scheduled')
+const statusTheme = (type?: string) => {
+	if (type === 'Completed') return 'green'
+	if (type === 'PermanentFailure') return 'red'
+	if (type === 'TemporaryFailure') return 'orange'
+	return 'gray'
+}
+const recipientSummary = (r: Recipient) => {
+	const parts = [__('Retries: {0}').replace('{0}', String(r.retry_count ?? 0))]
+	if (r.next_retry) parts.push(__('Next retry {0}').replace('{0}', fromNow(r.next_retry)))
+	return parts.join(' · ')
+}
+
+const editRecipient = (r: Recipient) => {
+	activeRecipient.value = r
+	showEditRecipient.value = true
+}
+
+const breadcrumbs = computed(() => [
+	{ label: __('Queued'), route: '/mail/dashboard/queued' },
+	{ label: data.value?.sender || messageId },
+])
+
+const retry = createResource({
+	url: 'suite.mail.api.admin.retry_queued_messages',
+	makeParams: () => ({ ids: [messageId] }),
+	onSuccess: () => {
+		message.reload()
+		raiseToast(__('Message scheduled for retry.'))
+	},
+})
+
+const removeRecipient = (email: string) =>
+	createResource({
+		url: 'suite.mail.api.admin.remove_queued_recipient',
+		makeParams: () => ({ message_id: messageId, email }),
+		onSuccess: () => {
+			message.reload()
+			raiseToast(__('Recipient removed.'))
+		},
+		onError: (error: { messages?: string[] }) =>
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error'),
+	}).submit()
+
+const cancel = createResource({
+	url: 'suite.mail.api.admin.cancel_queued_messages',
+	makeParams: () => ({ ids: [messageId] }),
+	onSuccess: () => {
+		showCancel.value = false
+		raiseToast(__('Message cancelled.'))
+		router.push({ name: 'mail-queued-messages' })
+	},
+})
+
+const cancelDialogOptions = computed(() => ({
+	title: __('Cancel Message'),
+	message: __('Cancel (delete) this queued message? This cannot be undone.'),
+	icon: { name: 'alert-triangle', appearance: 'warning' },
+	actions: [{ label: __('Confirm'), variant: 'solid', theme: 'red', onClick: cancel.submit }],
+}))
+
+const dropdownOptions = computed(() => {
+	const items = [{ label: __('Retry Now'), icon: 'refresh-cw', onClick: retry.submit }]
+	if (data.value?.has_content) {
+		items.push({
+			label: __('View Source'),
+			icon: 'file-text',
+			onClick: () => ((showSource.value = true), source.fetch()),
+		})
+	}
+	items.push({ label: __('Cancel'), icon: 'trash-2', onClick: () => (showCancel.value = true) })
+	return [{ group: '', items }]
+})
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/QueuedMessagesView.vue b/frontend/src/apps/mail/pages/dashboard/QueuedMessagesView.vue
new file mode 100644
index 0000000000..b2dc474a1d
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/QueuedMessagesView.vue
@@ -0,0 +1,191 @@
+<template>
+	<DashboardLayout :breadcrumbs="[{ label: __('Queued') }]">
+		<div class="flex items-center justify-between">
+			<div class="flex items-center space-x-3">
+				<FormControl v-model="search" :placeholder="__('Search')" class="w-72">
+					<template #prefix><FeatherIcon name="search" class="text-ink-gray-5 w-4" /></template>
+				</FormControl>
+				<FormControl v-model="sender" :placeholder="__('Sender')" class="w-56" />
+			</div>
+			<div class="flex items-center gap-2">
+				<Button :label="__('Retry All')" @click="showRetryAll = true" />
+				<Button theme="red" :label="__('Cancel All')" @click="showCancelAll = true" />
+			</div>
+		</div>
+		<ListView
+			v-if="messages?.data"
+			ref="listView"
+			class="flex-1"
+			:columns="LIST_COLUMNS"
+			:rows="rows"
+			:options="LIST_OPTIONS"
+			row-key="id"
+		>
+			<ListHeader />
+			<ListRows>
+				<template v-if="rows.length">
+					<ListRow
+						v-for="row in rows"
+						:key="row.id"
+						v-slot="{ column, item }"
+						:row="row"
+						class="hover:!bg-surface-gray-1"
+					>
+						<ListRowItem :item="item">
+							<span v-if="column.key === 'recipients'" class="truncate">{{ recipientLabel(row) }}</span>
+							<span v-else-if="column.key === 'size'">{{ formatBytes(row.size || 0) }}</span>
+							<span v-else-if="column.key === 'next_retry'">{{ fromNow(row.next_retry) }}</span>
+							<span v-else-if="column.key === 'created_at'">{{ fromNow(row.created_at) }}</span>
+						</ListRowItem>
+					</ListRow>
+				</template>
+				<ListEmptyState v-else />
+			</ListRows>
+			<ListSelectBanner>
+				<template #actions>
+					<Button variant="ghost" :label="__('Retry')" @click="showRetrySelected = true" />
+					<Button variant="ghost" theme="red" :label="__('Cancel')" @click="showCancelSelected = true" />
+				</template>
+			</ListSelectBanner>
+		</ListView>
+		<DashboardPager :page="page" :page-length="PAGE_LENGTH" :total="total" @update:page="(p) => (page = p)" />
+	</DashboardLayout>
+	<Dialog v-model="showRetrySelected" :options="retrySelectedOptions" />
+	<Dialog v-model="showCancelSelected" :options="cancelSelectedOptions" />
+	<Dialog v-model="showRetryAll" :options="retryAllOptions" />
+	<Dialog v-model="showCancelAll" :options="cancelAllOptions" />
+</template>
+<script setup lang="ts">
+import { computed, ref, useTemplateRef, watch } from 'vue'
+import { watchDebounced } from '@vueuse/core'
+import {
+	Button,
+	Dialog,
+	FeatherIcon,
+	FormControl,
+	ListEmptyState,
+	ListHeader,
+	ListRow,
+	ListRowItem,
+	ListRows,
+	ListSelectBanner,
+	ListView,
+	createResource,
+	usePageMeta,
+} from 'frappe-ui'
+
+import { formatBytes, raiseToast } from '@/apps/mail/utils'
+import { fromNow as formatFromNow } from '@/apps/mail/utils/datetime'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import DashboardPager from '@/apps/mail/components/DashboardPager.vue'
+
+type QueueRow = {
+	id: string
+	sender?: string
+	recipients: string[]
+	recipient_count: number
+	size?: number
+	next_retry?: string
+	created_at?: string
+}
+
+usePageMeta(() => ({ title: __('Queued') }))
+
+const PAGE_LENGTH = 50
+const search = ref('')
+const sender = ref('')
+const page = ref(1)
+const showRetrySelected = ref(false)
+const showCancelSelected = ref(false)
+const showRetryAll = ref(false)
+const showCancelAll = ref(false)
+const listView = useTemplateRef<{ selections?: Set<string>; toggleAllRows?: () => void }>('listView')
+
+const messages = createResource({
+	url: 'suite.mail.api.admin.get_queued_messages',
+	auto: true,
+	makeParams: () => ({ search: search.value, sender: sender.value, page: page.value, page_length: PAGE_LENGTH }),
+	cache: ['mailQueue', search.value, sender.value, page.value],
+})
+
+const rows = computed<QueueRow[]>(() => messages.data?.messages || [])
+const total = computed(() => messages.data?.total || 0)
+
+watchDebounced(() => [search.value, sender.value], () => ((page.value = 1), messages.reload()), { debounce: 300 })
+watch(page, messages.reload)
+
+const selectedIds = () => Array.from(listView.value?.selections || [])
+const currentFilter = () => ({ search: search.value, sender: sender.value })
+
+const fromNow = (value?: string) => formatFromNow(value) || '—'
+const recipientLabel = (row: QueueRow) => {
+	if (!row.recipients.length) return '—'
+	const [first, ...rest] = row.recipients
+	return rest.length ? `${first} +${rest.length}` : first
+}
+
+const LIST_COLUMNS = [
+	{ label: __('Sender'), key: 'sender' },
+	{ label: __('Recipients'), key: 'recipients' },
+	{ label: __('Next Retry'), key: 'next_retry' },
+	{ label: __('Received'), key: 'created_at' },
+	{ label: __('Size'), key: 'size' },
+]
+
+const LIST_OPTIONS = {
+	showTooltip: false,
+	rowHeight: 50,
+	emptyState: { description: __('No queued messages found.') },
+	getRowRoute: (row: QueueRow) => ({ name: 'mail-queued-message', params: { messageId: row.id } }),
+}
+
+const afterAction = (message: string) => {
+	messages.reload()
+	listView.value?.toggleAllRows?.()
+	raiseToast(message)
+}
+
+const retrySelected = createResource({
+	url: 'suite.mail.api.admin.retry_queued_messages',
+	makeParams: () => ({ ids: selectedIds() }),
+	onSuccess: () => ((showRetrySelected.value = false), afterAction(__('Messages scheduled for retry.'))),
+})
+const cancelSelected = createResource({
+	url: 'suite.mail.api.admin.cancel_queued_messages',
+	makeParams: () => ({ ids: selectedIds() }),
+	onSuccess: () => ((showCancelSelected.value = false), afterAction(__('Messages cancelled.'))),
+})
+const retryAll = createResource({
+	url: 'suite.mail.api.admin.retry_all_queued_messages',
+	makeParams: currentFilter,
+	onSuccess: () => ((showRetryAll.value = false), afterAction(__('All matching messages scheduled for retry.'))),
+})
+const cancelAll = createResource({
+	url: 'suite.mail.api.admin.cancel_all_queued_messages',
+	makeParams: currentFilter,
+	onSuccess: () => ((showCancelAll.value = false), afterAction(__('All matching messages cancelled.'))),
+})
+
+const retrySelectedOptions = computed(() => ({
+	title: __('Retry Messages'),
+	message: __('Schedule the selected messages for immediate delivery?'),
+	actions: [{ label: __('Retry'), variant: 'solid', onClick: retrySelected.submit }],
+}))
+const cancelSelectedOptions = computed(() => ({
+	title: __('Cancel Messages'),
+	message: __('Cancel (delete) the selected messages? This cannot be undone.'),
+	icon: { name: 'alert-triangle', appearance: 'warning' },
+	actions: [{ label: __('Confirm'), variant: 'solid', theme: 'red', onClick: cancelSelected.submit }],
+}))
+const retryAllOptions = computed(() => ({
+	title: __('Retry All Messages'),
+	message: __('Schedule every message matching the current filter for immediate delivery?'),
+	actions: [{ label: __('Retry All'), variant: 'solid', onClick: retryAll.submit }],
+}))
+const cancelAllOptions = computed(() => ({
+	title: __('Cancel All Messages'),
+	message: __('Cancel (delete) every message matching the current filter? This cannot be undone.'),
+	icon: { name: 'alert-triangle', appearance: 'warning' },
+	actions: [{ label: __('Confirm'), variant: 'solid', theme: 'red', onClick: cancelAll.submit }],
+}))
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/ReportView.vue b/frontend/src/apps/mail/pages/dashboard/ReportView.vue
new file mode 100644
index 0000000000..4b99495dc7
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/ReportView.vue
@@ -0,0 +1,120 @@
+<template>
+	<DashboardLayout v-if="report?.data" :breadcrumbs="breadcrumbs">
+		<template #actions>
+			<Dropdown :options="dropdownOptions" :button="{ icon: 'more-horizontal' }" />
+		</template>
+		<template #default>
+			<div class="grid grid-cols-1 gap-5 lg:grid-cols-2">
+				<DashboardCard :title="__('Report')">
+					<template #actions><span /></template>
+					<template v-if="direction === 'inbound'">
+						<InformationField :label="__('From')" :value="data.from" />
+						<InformationField :label="__('Subject')" :value="data.subject" />
+						<InformationField :label="__('To')" :value="recipients" />
+						<InformationField :label="__('Received At')" :value="formatDate(data.received_at)" />
+						<InformationField :label="__('Expires At')" :value="formatDate(data.expires_at)" />
+					</template>
+					<template v-else>
+						<InformationField :label="__('Domain')" :value="data.domain" />
+						<template v-if="kind === 'dmarc'">
+							<InformationField :label="__('Report Recipients')" :value="reportRecipients" />
+							<InformationField :label="__('Policy Identifier')" :value="data.policy_identifier" />
+						</template>
+						<InformationField :label="__('Created At')" :value="formatDate(data.created_at)" />
+						<InformationField :label="__('Deliver At')" :value="formatDate(data.deliver_at)" />
+					</template>
+				</DashboardCard>
+
+				<DashboardCard :title="__('Details')">
+					<template #actions><span /></template>
+					<pre
+						class="bg-surface-gray-2 max-h-[60vh] overflow-auto rounded p-4 text-xs whitespace-pre-wrap"
+						>{{ reportJson }}</pre
+					>
+				</DashboardCard>
+			</div>
+		</template>
+	</DashboardLayout>
+	<Dialog v-model="showDelete" :options="deleteOptions" />
+</template>
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import { useRouter } from 'vue-router'
+import { Dialog, Dropdown, createResource, usePageMeta } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+import { formatDateTime } from '@/apps/mail/utils/datetime'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import DashboardCard from '@/apps/mail/components/DashboardCard.vue'
+import InformationField from '@/apps/mail/components/InformationField.vue'
+
+type ReportData = {
+	id: string
+	from?: string
+	subject?: string
+	to?: string[]
+	received_at?: string
+	expires_at?: string
+	domain?: string
+	rua?: string[]
+	policy_identifier?: string
+	created_at?: string
+	deliver_at?: string
+	report?: unknown
+}
+
+const { kind, direction, reportId } = defineProps<{ kind: string; direction: string; reportId: string }>()
+const router = useRouter()
+
+const KIND_LABELS: Record<string, string> = { dmarc: 'DMARC', tls: 'TLS', arf: 'ARF' }
+const listRouteName = computed(() => `mail-reports-${kind}-${direction}`)
+const listTitle = computed(() => {
+	const dir = direction === 'inbound' ? __('Inbound') : __('Outbound')
+	return `${dir} ${KIND_LABELS[kind] || kind} ${__('Reports')}`
+})
+
+usePageMeta(() => ({ title: listTitle.value }))
+
+const showDelete = ref(false)
+
+const report = createResource({
+	url: 'suite.mail.api.admin.get_report',
+	auto: true,
+	makeParams: () => ({ kind, direction, report_id: reportId }),
+	cache: ['mailReport', kind, direction, reportId],
+	onError: () => router.replace({ name: listRouteName.value }),
+})
+
+const data = computed(() => report.data as ReportData)
+const reportJson = computed(() => JSON.stringify(data.value?.report ?? {}, null, 2))
+const joinAddresses = (addresses?: string[]) => (addresses ?? []).join(', ')
+const recipients = computed(() => joinAddresses(data.value?.to))
+const reportRecipients = computed(() => joinAddresses(data.value?.rua))
+const formatDate = (value?: string | null) => formatDateTime(value) || '—'
+
+const breadcrumbs = computed(() => [
+	{ label: listTitle.value, route: `/mail/dashboard/reports/${direction}/${kind}` },
+	{ label: data.value?.domain || data.value?.subject || reportId },
+])
+
+const deleteReport = createResource({
+	url: 'suite.mail.api.admin.delete_reports',
+	makeParams: () => ({ kind, direction, ids: [reportId] }),
+	onSuccess: () => {
+		showDelete.value = false
+		raiseToast(__('Report deleted.'))
+		router.push({ name: listRouteName.value })
+	},
+})
+
+const deleteOptions = computed(() => ({
+	title: __('Delete Report'),
+	message: __('Delete this report? This cannot be undone.'),
+	icon: { name: 'alert-triangle', appearance: 'warning' },
+	actions: [{ label: __('Confirm'), variant: 'solid', theme: 'red', onClick: deleteReport.submit }],
+}))
+
+const dropdownOptions = computed(() => [
+	{ group: '', items: [{ label: __('Delete'), icon: 'trash-2', onClick: () => (showDelete.value = true) }] },
+])
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/ReportsView.vue b/frontend/src/apps/mail/pages/dashboard/ReportsView.vue
new file mode 100644
index 0000000000..2a6eb1abda
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/ReportsView.vue
@@ -0,0 +1,148 @@
+<template>
+	<DashboardLayout :breadcrumbs="[{ label: title }]">
+		<div v-if="supportsSearch" class="flex items-center space-x-3">
+			<FormControl v-model="search" :placeholder="searchPlaceholder" class="w-72">
+				<template #prefix><FeatherIcon name="search" class="text-ink-gray-5 w-4" /></template>
+			</FormControl>
+		</div>
+		<ListView
+			v-if="reports?.data"
+			ref="listView"
+			class="flex-1"
+			:columns="columns"
+			:rows="rows"
+			:options="listOptions"
+			row-key="id"
+		>
+			<ListHeader />
+			<ListRows>
+				<template v-if="rows.length">
+					<ListRow
+						v-for="row in rows"
+						:key="row.id"
+						v-slot="{ column, item }"
+						:row="row"
+						class="hover:!bg-surface-gray-1"
+					>
+						<ListRowItem :item="item">
+							<span v-if="['received_at', 'created_at', 'deliver_at'].includes(column.key)">
+								{{ fromNow(item) }}
+							</span>
+						</ListRowItem>
+					</ListRow>
+				</template>
+				<ListEmptyState v-else />
+			</ListRows>
+			<ListSelectBanner>
+				<template #actions>
+					<Button variant="ghost" theme="red" :label="__('Delete')" @click="showDelete = true" />
+				</template>
+			</ListSelectBanner>
+		</ListView>
+		<DashboardPager :page="page" :page-length="PAGE_LENGTH" :total="total" @update:page="(p) => (page = p)" />
+	</DashboardLayout>
+	<Dialog v-model="showDelete" :options="deleteOptions" />
+</template>
+<script setup lang="ts">
+import { computed, ref, useTemplateRef, watch } from 'vue'
+import { watchDebounced } from '@vueuse/core'
+import {
+	Button,
+	Dialog,
+	FeatherIcon,
+	FormControl,
+	ListEmptyState,
+	ListHeader,
+	ListRow,
+	ListRowItem,
+	ListRows,
+	ListSelectBanner,
+	ListView,
+	createResource,
+	usePageMeta,
+} from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+import { fromNow as formatFromNow } from '@/apps/mail/utils/datetime'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import DashboardPager from '@/apps/mail/components/DashboardPager.vue'
+
+type ReportRow = { id: string; [key: string]: string | undefined }
+
+const { kind, direction } = defineProps<{ kind: string; direction: string }>()
+
+const PAGE_LENGTH = 50
+const search = ref('')
+const page = ref(1)
+const showDelete = ref(false)
+const listView = useTemplateRef<{ selections?: Set<string>; toggleAllRows?: () => void }>('listView')
+
+const KIND_LABELS: Record<string, string> = { dmarc: 'DMARC', tls: 'TLS', arf: 'ARF' }
+// Only DMARC reports are searchable: a free-text match on the received ones, a domain match on ours.
+const supportsSearch = computed(() => kind === 'dmarc')
+const searchPlaceholder = computed(() =>
+	direction === 'inbound' ? __('Search by sender, recipient or domain') : __('Filter by domain'),
+)
+const title = computed(() => {
+	const dir = direction === 'inbound' ? __('Inbound') : __('Outbound')
+	return `${dir} ${KIND_LABELS[kind] || kind} ${__('Reports')}`
+})
+
+usePageMeta(() => ({ title: title.value }))
+
+const reports = createResource({
+	url: 'suite.mail.api.admin.get_reports',
+	auto: true,
+	makeParams: () => ({ kind, direction, search: search.value, page: page.value, page_length: PAGE_LENGTH }),
+	cache: ['mailReports', kind, direction, search.value, page.value],
+})
+
+const rows = computed<ReportRow[]>(() => reports.data?.reports || [])
+const total = computed(() => reports.data?.total || 0)
+
+watchDebounced(() => search.value, () => ((page.value = 1), reports.reload()), { debounce: 300 })
+watch(page, reports.reload)
+// Re-fetch when navigating between report kinds (same component, different props).
+watch(() => [kind, direction], () => ((page.value = 1), (search.value = ''), reports.reload()))
+
+const fromNow = (value?: string) => formatFromNow(value) || '—'
+
+const columns = computed(() =>
+	direction === 'inbound'
+		? [
+				{ label: __('From'), key: 'from' },
+				{ label: __('Subject'), key: 'subject' },
+				{ label: __('Received At'), key: 'received_at' },
+			]
+		: [
+				{ label: __('Domain'), key: 'domain' },
+				{ label: __('Created At'), key: 'created_at' },
+				{ label: __('Deliver At'), key: 'deliver_at' },
+			],
+)
+
+const listOptions = computed(() => ({
+	showTooltip: false,
+	rowHeight: 50,
+	emptyState: { description: __('No reports found.') },
+	getRowRoute: (row: ReportRow) => ({ name: 'mail-report', params: { direction, kind, reportId: row.id } }),
+}))
+
+const deleteReports = createResource({
+	url: 'suite.mail.api.admin.delete_reports',
+	makeParams: () => ({ kind, direction, ids: Array.from(listView.value?.selections || []) }),
+	onSuccess: () => {
+		showDelete.value = false
+		reports.reload()
+		listView.value?.toggleAllRows?.()
+		raiseToast(__('Reports deleted.'))
+	},
+})
+
+const deleteOptions = computed(() => ({
+	title: __('Delete Reports'),
+	message: __('Delete the selected reports? This cannot be undone.'),
+	icon: { name: 'alert-triangle', appearance: 'warning' },
+	actions: [{ label: __('Confirm'), variant: 'solid', theme: 'red', onClick: deleteReports.submit }],
+}))
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/RoleView.vue b/frontend/src/apps/mail/pages/dashboard/RoleView.vue
new file mode 100644
index 0000000000..6f71340c7b
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/RoleView.vue
@@ -0,0 +1,164 @@
+<template>
+	<DashboardLayout v-if="role.data" :breadcrumbs="breadcrumbs">
+		<template #actions>
+			<Dropdown :options="dropdownOptions" :button="{ icon: 'more-horizontal' }" />
+		</template>
+		<template #default>
+			<div class="grid grid-cols-1 gap-5 lg:grid-cols-2">
+				<DashboardCard
+					:title="__('General Information')"
+					:button-label="__('Edit')"
+					@action="showEdit = true"
+				>
+					<InformationField :label="__('Description')" :value="role.data.description" />
+				</DashboardCard>
+
+				<DashboardCard :title="__('Inherited Roles')">
+					<template #actions><span /></template>
+					<div class="p-4">
+						<MultiSelect
+							:model-value="roleIds"
+							:options="roleOptions"
+							@update:model-value="(value) => save('role_ids', value as string[])"
+						/>
+					</div>
+				</DashboardCard>
+
+				<DashboardCard :title="__('Enabled Permissions')">
+					<template #actions><span /></template>
+					<div class="p-4">
+						<MultiSelect
+							:model-value="enabledPermissions"
+							:options="permissionOptions"
+							@update:model-value="(value) => save('enabled_permissions', value as string[])"
+						/>
+					</div>
+				</DashboardCard>
+
+				<DashboardCard :title="__('Disabled Permissions')">
+					<template #actions><span /></template>
+					<div class="p-4">
+						<MultiSelect
+							:model-value="disabledPermissions"
+							:options="permissionOptions"
+							@update:model-value="(value) => save('disabled_permissions', value as string[])"
+						/>
+					</div>
+				</DashboardCard>
+			</div>
+		</template>
+	</DashboardLayout>
+	<EditRoleModal v-if="role.data" v-model="showEdit" :role="role.data" @reload="role.reload()" />
+	<Dialog v-model="showDelete" :options="deleteDialogOptions" />
+</template>
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { useRouter } from 'vue-router'
+import { Dialog, Dropdown, MultiSelect, createResource, usePageMeta } from 'frappe-ui'
+
+import { raiseToast } from '@/apps/mail/utils'
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import DashboardCard from '@/apps/mail/components/DashboardCard.vue'
+import InformationField from '@/apps/mail/components/InformationField.vue'
+import EditRoleModal from '@/apps/mail/components/Modals/EditRoleModal.vue'
+
+type RoleData = {
+	id: string
+	description: string
+	enabled_permissions: string[]
+	disabled_permissions: string[]
+	role_ids: string[]
+}
+
+const { roleId } = defineProps<{ roleId: string }>()
+const router = useRouter()
+
+usePageMeta(() => ({ title: (role.data as RoleData | undefined)?.description || roleId }))
+
+const showEdit = ref(false)
+const showDelete = ref(false)
+
+const enabledPermissions = ref<string[]>([])
+const disabledPermissions = ref<string[]>([])
+const roleIds = ref<string[]>([])
+
+const role = createResource({
+	url: 'suite.mail.api.admin.get_role',
+	auto: true,
+	makeParams: () => ({ role_id: roleId }),
+	cache: ['mailRole', roleId],
+	onError: () => router.replace({ name: 'mail-roles' }),
+})
+
+// Keep the editable chip selections in sync whenever the role (re)loads.
+watch(
+	() => role.data as RoleData | undefined,
+	(data) => {
+		if (!data) return
+		enabledPermissions.value = [...data.enabled_permissions]
+		disabledPermissions.value = [...data.disabled_permissions]
+		roleIds.value = [...data.role_ids]
+	},
+	{ immediate: true },
+)
+
+const permissions = createResource({ url: 'suite.mail.api.admin.get_permissions', auto: true })
+const roles = createResource({ url: 'suite.mail.api.admin.get_roles_list', auto: true })
+
+const permissionOptions = computed(() =>
+	(permissions.data || []).map((p: { value: string; label: string }) => ({ label: p.label, value: p.value })),
+)
+const roleOptions = computed(() =>
+	(roles.data || [])
+		.filter((r: { id: string }) => r.id !== roleId)
+		.map((r: { id: string; description: string }) => ({ label: r.description, value: r.id })),
+)
+
+const LOCAL_REFS: Record<string, typeof enabledPermissions> = {
+	enabled_permissions: enabledPermissions,
+	disabled_permissions: disabledPermissions,
+	role_ids: roleIds,
+}
+
+const save = (field: 'enabled_permissions' | 'disabled_permissions' | 'role_ids', value: string[]) => {
+	LOCAL_REFS[field].value = value // optimistic; reverted on error via reload
+	createResource({
+		url: 'suite.mail.api.admin.update_role',
+		makeParams: () => ({ role_id: roleId, [field]: value }),
+		onError: (error: { messages?: string[] }) => {
+			role.reload()
+			raiseToast(error.messages?.[0] || __('Request failed.'), 'error')
+		},
+	}).submit()
+}
+
+const breadcrumbs = computed(() => [
+	{ label: __('Roles'), route: '/mail/dashboard/roles' },
+	{ label: (role.data as RoleData | undefined)?.description || roleId },
+])
+
+const deleteRole = createResource({
+	url: 'suite.mail.api.admin.delete_roles',
+	makeParams: () => ({ ids: [roleId] }),
+	onSuccess: () => {
+		showDelete.value = false
+		raiseToast(__('Role deleted.'))
+		router.push({ name: 'mail-roles' })
+	},
+})
+
+const deleteDialogOptions = computed(() => ({
+	title: __('Delete Role'),
+	message: __('Are you sure you want to delete this role? This action cannot be undone.'),
+	size: 'xl',
+	icon: { name: 'alert-triangle', appearance: 'warning' },
+	actions: [{ label: __('Confirm'), variant: 'solid', theme: 'red', onClick: deleteRole.submit }],
+}))
+
+const dropdownOptions = computed(() => [
+	{
+		group: '',
+		items: [{ label: __('Delete'), icon: 'trash-2', onClick: () => (showDelete.value = true) }],
+	},
+])
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/RolesView.vue b/frontend/src/apps/mail/pages/dashboard/RolesView.vue
new file mode 100644
index 0000000000..f648986fbc
--- /dev/null
+++ b/frontend/src/apps/mail/pages/dashboard/RolesView.vue
@@ -0,0 +1,88 @@
+<template>
+	<DashboardLayout
+		:breadcrumbs="[{ label: __('Roles') }]"
+		:button-label="__('Add Role')"
+		:button-action="() => (showAdd = true)"
+	>
+		<div class="flex items-center space-x-3">
+			<FormControl v-model="search" :placeholder="__('Search')" class="w-80">
+				<template #prefix>
+					<FeatherIcon name="search" class="text-ink-gray-5 w-4" />
+				</template>
+			</FormControl>
+		</div>
+		<ListView
+			v-if="roles?.data"
+			class="flex-1"
+			:columns="LIST_COLUMNS"
+			:rows="roles.data"
+			:options="LIST_OPTIONS"
+			row-key="id"
+		>
+			<ListHeader />
+			<ListRows>
+				<template v-if="roles.data.length">
+					<ListRow
+						v-for="row in roles.data"
+						:key="row.id"
+						v-slot="{ item }"
+						:row="row"
+						class="hover:!bg-surface-gray-1"
+					>
+						<ListRowItem :item="item" />
+					</ListRow>
+				</template>
+				<ListEmptyState v-else />
+			</ListRows>
+		</ListView>
+	</DashboardLayout>
+	<AddRoleModal v-model="showAdd" @reload="roles.reload()" />
+</template>
+<script setup lang="ts">
+import { ref } from 'vue'
+import { watchDebounced } from '@vueuse/core'
+import {
+	FeatherIcon,
+	FormControl,
+	ListEmptyState,
+	ListHeader,
+	ListRow,
+	ListRowItem,
+	ListRows,
+	ListView,
+	createResource,
+	usePageMeta,
+} from 'frappe-ui'
+
+import DashboardLayout from '@/apps/mail/components/DashboardLayout.vue'
+import AddRoleModal from '@/apps/mail/components/Modals/AddRoleModal.vue'
+
+usePageMeta(() => ({ title: __('Roles') }))
+
+const showAdd = ref(false)
+const search = ref('')
+
+const roles = createResource({
+	url: 'suite.mail.api.admin.get_roles_list',
+	auto: true,
+	makeParams: () => ({ search: search.value }),
+	cache: ['mailRoles', search.value],
+})
+
+watchDebounced(() => search.value, roles.reload, { debounce: 300 })
+
+type RoleRow = { id: string; description: string; enabled_count: number; disabled_count: number }
+
+const LIST_COLUMNS = [
+	{ label: __('Description'), key: 'description' },
+	{ label: __('Enabled Permissions'), key: 'enabled_count' },
+	{ label: __('Disabled Permissions'), key: 'disabled_count' },
+]
+
+const LIST_OPTIONS = {
+	selectable: false,
+	showTooltip: false,
+	emptyState: { description: __('No roles found.') },
+	getRowRoute: (row: RoleRow) => ({ name: 'mail-role', params: { roleId: row.id } }),
+}
+</script>
diff --git a/frontend/src/apps/mail/pages/dashboard/UsersView.vue b/frontend/src/apps/mail/pages/dashboard/UsersView.vue
index 77cdafd96f..8fdfc37407 100644
--- a/frontend/src/apps/mail/pages/dashboard/UsersView.vue
+++ b/frontend/src/apps/mail/pages/dashboard/UsersView.vue
@@ -64,8 +64,8 @@
 						<template v-else-if="column.key === 'last_active'">
 							<span class="text-ink-gray-5 text-sm">
 								{{
-									row.last_active && dayjs
-										? dayjs(row.last_active).fromNow()
+									row.last_active
+										? fromNow(row.last_active)
 										: __('Never')
 								}}
 							</span>
@@ -102,7 +102,7 @@
 </template>
 
 <script setup lang="ts">
-import { computed, inject, ref, useTemplateRef, watch } from 'vue'
+import { computed, ref, useTemplateRef, watch } from 'vue'
 import { watchDebounced } from '@vueuse/core'
 import {
 	Avatar,
@@ -122,8 +122,8 @@ import {
 } from 'frappe-ui'
 
 import { raiseToast } from '@/apps/mail/utils'
+import { fromNow } from '@/apps/mail/utils/datetime'
 
-type DayjsFn = (value?: string | Date | null) => { fromNow: () => string }
 type MemberRow = {
 	name: string
 	full_name: string
@@ -133,7 +133,6 @@ type MemberRow = {
 	enabled: boolean
 }
 
-const dayjs = inject<DayjsFn>('$dayjs')
 
 const search = ref('')
 const roleFilter = ref<'all' | 'admin' | 'user'>('all')
@@ -207,6 +206,10 @@ const LIST_OPTIONS = {
 	showTooltip: false,
 	rowHeight: 50,
 	emptyState: { description: __('No members found.') },
+	getRowRoute: (row: MemberRow) => ({
+		name: 'mail-member',
+		params: { memberId: row.name },
+	}),
 }
 
 const enableMembers = createResource({
diff --git a/frontend/src/apps/mail/routes.ts b/frontend/src/apps/mail/routes.ts
index f78b023a1b..2a717f872e 100644
--- a/frontend/src/apps/mail/routes.ts
+++ b/frontend/src/apps/mail/routes.ts
@@ -202,6 +202,162 @@ export const routes: RouteRecordRaw[] = [
 				component: () => import('@/apps/mail/pages/dashboard/MembersView.vue'),
 				meta: { isDashboard: true },
 			},
+			{
+				path: 'dashboard/members/:memberId',
+				name: 'mail-member',
+				component: () => import('@/apps/mail/pages/dashboard/MemberView.vue'),
+				props: true,
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/groups',
+				name: 'mail-groups',
+				component: () => import('@/apps/mail/pages/dashboard/GroupsView.vue'),
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/groups/:groupId',
+				name: 'mail-group',
+				component: () => import('@/apps/mail/pages/dashboard/GroupView.vue'),
+				props: true,
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/mailing-lists',
+				name: 'mail-mailing-lists',
+				component: () => import('@/apps/mail/pages/dashboard/MailingListsView.vue'),
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/mailing-lists/:listId',
+				name: 'mail-mailing-list',
+				component: () => import('@/apps/mail/pages/dashboard/MailingListView.vue'),
+				props: true,
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/roles',
+				name: 'mail-roles',
+				component: () => import('@/apps/mail/pages/dashboard/RolesView.vue'),
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/roles/:roleId',
+				name: 'mail-role',
+				component: () => import('@/apps/mail/pages/dashboard/RoleView.vue'),
+				props: true,
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/oauth-clients',
+				name: 'mail-oauth-clients',
+				component: () => import('@/apps/mail/pages/dashboard/OAuthClientsView.vue'),
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/oauth-clients/:clientId',
+				name: 'mail-oauth-client',
+				component: () => import('@/apps/mail/pages/dashboard/OAuthClientView.vue'),
+				props: true,
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/dkim-signatures',
+				name: 'mail-dkim-signatures',
+				component: () => import('@/apps/mail/pages/dashboard/DkimSignaturesView.vue'),
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/dkim-signatures/:signatureId',
+				name: 'mail-dkim-signature',
+				component: () => import('@/apps/mail/pages/dashboard/DkimSignatureView.vue'),
+				props: true,
+				meta: { isDashboard: true },
+			},
+			// Emails
+			{
+				path: 'dashboard/queued',
+				name: 'mail-queued-messages',
+				component: () => import('@/apps/mail/pages/dashboard/QueuedMessagesView.vue'),
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/queued/:messageId',
+				name: 'mail-queued-message',
+				component: () => import('@/apps/mail/pages/dashboard/QueuedMessageView.vue'),
+				props: true,
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/delivery-test',
+				name: 'mail-delivery-test',
+				component: () => import('@/apps/mail/pages/dashboard/DeliveryTestView.vue'),
+				meta: { isDashboard: true },
+			},
+			// Reports
+			{
+				path: 'dashboard/reports/inbound/dmarc',
+				name: 'mail-reports-dmarc-inbound',
+				component: () => import('@/apps/mail/pages/dashboard/ReportsView.vue'),
+				props: { kind: 'dmarc', direction: 'inbound' },
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/reports/inbound/tls',
+				name: 'mail-reports-tls-inbound',
+				component: () => import('@/apps/mail/pages/dashboard/ReportsView.vue'),
+				props: { kind: 'tls', direction: 'inbound' },
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/reports/inbound/arf',
+				name: 'mail-reports-arf-inbound',
+				component: () => import('@/apps/mail/pages/dashboard/ReportsView.vue'),
+				props: { kind: 'arf', direction: 'inbound' },
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/reports/outbound/dmarc',
+				name: 'mail-reports-dmarc-outbound',
+				component: () => import('@/apps/mail/pages/dashboard/ReportsView.vue'),
+				props: { kind: 'dmarc', direction: 'outbound' },
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/reports/outbound/tls',
+				name: 'mail-reports-tls-outbound',
+				component: () => import('@/apps/mail/pages/dashboard/ReportsView.vue'),
+				props: { kind: 'tls', direction: 'outbound' },
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/reports/:direction/:kind/:reportId',
+				name: 'mail-report',
+				component: () => import('@/apps/mail/pages/dashboard/ReportView.vue'),
+				props: true,
+				meta: { isDashboard: true },
+			},
+			// Observability
+			{
+				path: 'dashboard/logs',
+				name: 'mail-logs',
+				component: () => import('@/apps/mail/pages/dashboard/LogsView.vue'),
+				meta: { isDashboard: true },
+			},
+			{
+				path: 'dashboard/logs/:logId',
+				name: 'mail-log',
+				component: () => import('@/apps/mail/pages/dashboard/LogView.vue'),
+				props: true,
+				meta: { isDashboard: true },
+			},
+			// Actions
+			{
+				path: 'dashboard/actions',
+				name: 'mail-actions',
+				component: () => import('@/apps/mail/pages/dashboard/ActionsView.vue'),
+				meta: { isDashboard: true },
+			},
 			// Shortcut routes: short paths that resolve to their full
 			// account-scoped equivalents once the active accountId is known
 			// (resolved in the mail guard — see ./router.ts).
diff --git a/frontend/src/apps/mail/types/doctypes.ts b/frontend/src/apps/mail/types/doctypes.ts
index 24af5b3110..9f148dab38 100644
--- a/frontend/src/apps/mail/types/doctypes.ts
+++ b/frontend/src/apps/mail/types/doctypes.ts
@@ -49,8 +49,8 @@ export interface MailAccountRequest extends DocType {
   is_expired: 0 | 1;
   /** Account: Data */
   account: string;
-  /** Domain: Data */
-  domain_name: string;
+  /** Aliases: Small Text */
+  aliases?: string;
   /** Send Invite: Check */
   send_invite: 0 | 1;
   /** IP Address: Data */
diff --git a/frontend/src/apps/mail/types/index.ts b/frontend/src/apps/mail/types/index.ts
index 1761e1c479..d0da2e0ae8 100644
--- a/frontend/src/apps/mail/types/index.ts
+++ b/frontend/src/apps/mail/types/index.ts
@@ -52,6 +52,8 @@ export interface User {
 	username: string | null
 	user_image: string | null
 	api_key: string | null
+	// The zone every timestamp is shown in and typed in; see utils/datetime.ts.
+	time_zone: string
 	user_settings?: string
 	color_scheme?: COLOR_SCHEME
 	group_messages_by?: 'None' | 'Day' | 'Month'
diff --git a/frontend/src/apps/mail/utils/datetime.test.ts b/frontend/src/apps/mail/utils/datetime.test.ts
new file mode 100644
index 0000000000..d94db91d09
--- /dev/null
+++ b/frontend/src/apps/mail/utils/datetime.test.ts
@@ -0,0 +1,36 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/apps/mail/stores/user', () => ({
+	userStore: () => ({ userResource: { data: { time_zone: 'Asia/Kolkata' } } }),
+}))
+
+const load = async () => await import('@/apps/mail/utils/datetime')
+
+describe('mail datetime helpers', () => {
+	it('renders a UTC timestamp in the user zone', async () => {
+		const { formatDateTime } = await load()
+		expect(formatDateTime('2026-07-28T09:02:30Z')).toBe('Jul 28 2026, 2:32 PM')
+	})
+
+	it('fills a datetime-local input in the user zone', async () => {
+		const { toLocalInput } = await load()
+		expect(toLocalInput('2026-07-28T09:02:30Z')).toBe('2026-07-28T14:32')
+	})
+
+	it('reads a datetime-local input back as UTC', async () => {
+		const { fromLocalInput } = await load()
+		expect(fromLocalInput('2026-07-28T14:32')).toBe('2026-07-28T09:02:00Z')
+	})
+
+	it('round-trips through the input format', async () => {
+		const { fromLocalInput, toLocalInput } = await load()
+		expect(fromLocalInput(toLocalInput('2026-07-28T09:02:00Z'))).toBe('2026-07-28T09:02:00Z')
+	})
+
+	it('leaves blanks blank', async () => {
+		const { formatDateTime, fromLocalInput, toLocalInput } = await load()
+		expect(formatDateTime(null)).toBe('')
+		expect(toLocalInput(undefined)).toBe('')
+		expect(fromLocalInput('')).toBe('')
+	})
+})
diff --git a/frontend/src/apps/mail/utils/datetime.ts b/frontend/src/apps/mail/utils/datetime.ts
new file mode 100644
index 0000000000..7df4cbab9a
--- /dev/null
+++ b/frontend/src/apps/mail/utils/datetime.ts
@@ -0,0 +1,51 @@
+import dayjs from '@/apps/mail/utils/dayjs'
+import { userStore } from '@/apps/mail/stores/user'
+
+/**
+ * Timestamps on the wire are always UTC, spelled the way Stalwart spells them:
+ * "2026-07-28T09:02:30Z". Nothing on the server converts them, so this module is the single place
+ * that moves between that wire format and the zone the session user reads and types in — their
+ * `time_zone` on the User doc, which `get_user_info` resolves (falling back to the site's zone).
+ */
+
+// What `<input type="datetime-local">` reads and writes.
+const LOCAL_INPUT_FORMAT = 'YYYY-MM-DDTHH:mm'
+const UTC_FORMAT = 'YYYY-MM-DDTHH:mm:ss[Z]'
+
+/**
+ * The user's zone, or the browser's until `get_user_info` has loaded (it is fetched once at
+ * startup, so this only matters for the first paint).
+ */
+export const userTimeZone = (): string => {
+	const { userResource } = userStore()
+	return userResource.data?.time_zone || dayjs.tz.guess()
+}
+
+/** Reads a UTC timestamp from an API into the user's zone. */
+export const inUserTimeZone = (value: string) => dayjs.utc(value).tz(userTimeZone())
+
+/** Formats a UTC timestamp from an API for display in the user's zone. */
+export const formatDateTime = (value?: string | null, format = 'MMM D YYYY, h:mm A'): string =>
+	value ? inUserTimeZone(value).format(format) : ''
+
+/** Formats a UTC timestamp from an API as "3 hours ago"; relative, so the zone does not matter. */
+export const fromNow = (value?: string | null): string => (value ? dayjs.utc(value).fromNow() : '')
+
+/** Fills a `datetime-local` input from a UTC timestamp, in the user's zone. */
+export const toLocalInput = (value?: string | null): string =>
+	value ? inUserTimeZone(value).format(LOCAL_INPUT_FORMAT) : ''
+
+/**
+ * Turns what the user typed into a `datetime-local` input — a wall clock reading in their zone,
+ * carrying no offset — back into the UTC timestamp the APIs take. Blank stays blank so callers can
+ * tell "unset" from a time.
+ */
+export const fromLocalInput = (value?: string | null): string =>
+	value ? dayjs.tz(value, userTimeZone()).utc().format(UTC_FORMAT) : ''
+
+/** The current time as a UTC timestamp the APIs take. */
+export const utcNow = (): string => dayjs.utc().format(UTC_FORMAT)
+
+/** Shifts the current time by `amount` of `unit` and returns it as a UTC timestamp. */
+export const utcFromNow = (amount: number, unit: 'day' | 'hour' | 'minute'): string =>
+	dayjs.utc().add(amount, unit).format(UTC_FORMAT)
diff --git a/frontend/src/apps/mail/utils/dayjs.ts b/frontend/src/apps/mail/utils/dayjs.ts
index 24cd167215..089bb7f111 100644
--- a/frontend/src/apps/mail/utils/dayjs.ts
+++ b/frontend/src/apps/mail/utils/dayjs.ts
@@ -5,7 +5,9 @@ import isToday from 'dayjs/esm/plugin/isToday'
 import isYesterday from 'dayjs/esm/plugin/isYesterday'
 import localizedFormat from 'dayjs/esm/plugin/localizedFormat'
 import relativeTime from 'dayjs/esm/plugin/relativeTime'
+import timezone from 'dayjs/esm/plugin/timezone'
 import updateLocale from 'dayjs/esm/plugin/updateLocale'
+import utc from 'dayjs/esm/plugin/utc'
 
 dayjs.extend(updateLocale)
 dayjs.extend(relativeTime)
@@ -14,5 +16,9 @@ dayjs.extend(isToday)
 dayjs.extend(isYesterday)
 dayjs.extend(isSameOrBefore)
 dayjs.extend(isSameOrAfter)
+// The APIs speak UTC while timestamps are shown in the user's own zone, so both are needed
+// (`timezone` builds on `utc`, and this order is required).
+dayjs.extend(utc)
+dayjs.extend(timezone)
 
 export default dayjs
diff --git a/suite/mail/api/account.py b/suite/mail/api/account.py
index f8fb7093e4..afa017f2c1 100644
--- a/suite/mail/api/account.py
+++ b/suite/mail/api/account.py
@@ -3,7 +3,7 @@
 
 import frappe
 from frappe import _
-from frappe.utils import cint, get_datetime, get_url, now_datetime
+from frappe.utils import cint, get_datetime, get_system_timezone, get_url, now_datetime
 from frappe.utils.data import sha256_hash
 
 from suite.mail.api.admin import add_member
@@ -14,6 +14,7 @@
 from suite.mail.stalwart import get_domains
 from suite.mail.utils import is_stalwart_configured, log_mail_error
 from suite.mail.utils.dns import parse_dns_zone_file
+from suite.mail.utils.logger import log_admin_action
 from suite.utils.rate_limiter import dynamic_rate_limit
 from suite.mail.utils.user import (
 	has_user_settings,
@@ -109,7 +110,41 @@ def get_account_request(request_key: str) -> dict | None:
 
 @frappe.whitelist(allow_guest=True)
 @dynamic_rate_limit()
-def create_account(request_key: str, first_name: str, last_name: str, password: str) -> None:
+def get_account_setup_options(request_key: str) -> dict:
+	"""Returns the locale and time zone choices for the invite setup form.
+
+	Gated on a pending request key: the choices come from the Stalwart schema, so they are not served
+	to arbitrary callers.
+	"""
+
+	from suite.mail.stalwart import get_account_metadata
+
+	account_request = frappe.db.get_value(
+		"Mail Account Request",
+		{"request_key": request_key},
+		["is_verified", "expires_at"],
+		as_dict=True,
+	)
+	if (
+		not account_request
+		or account_request.is_verified
+		or (account_request.expires_at and get_datetime(account_request.expires_at) < now_datetime())
+	):
+		frappe.throw(_("This request has expired. Please create a new one."))
+
+	return get_account_metadata()
+
+
+@frappe.whitelist(allow_guest=True)
+@dynamic_rate_limit()
+def create_account(
+	request_key: str,
+	first_name: str,
+	last_name: str,
+	password: str,
+	locale: str | None = None,
+	time_zone: str | None = None,
+) -> None:
 	"""Create a new mail account"""
 
 	account_request = frappe.get_last_doc("Mail Account Request", {"request_key": request_key})
@@ -122,7 +157,7 @@ def create_account(request_key: str, first_name: str, last_name: str, password:
 		# against the session user, which is Guest on this endpoint — run it elevated,
 		# same as signup().
 		with user_context("Administrator"):
-			account_request.create_account(first_name, last_name, password)
+			account_request.create_account(first_name, last_name, password, locale, time_zone)
 
 
 @frappe.whitelist(allow_guest=True)
@@ -156,6 +191,7 @@ def get_user_info() -> dict | None:
 			USER.user_type,
 			USER.username,
 			USER.api_key,
+			USER.time_zone,
 			USER_SETTINGS.color_scheme,
 			USER_SETTINGS.group_messages_by,
 			USER_SETTINGS.show_reading_pane,
@@ -169,6 +205,10 @@ def get_user_info() -> dict | None:
 
 	data = result[0]
 
+	# The APIs speak UTC, so the interface needs a zone to render those timestamps in. The User's own
+	# choice wins; sites that never set one fall back to the system zone.
+	data.time_zone = data.time_zone or get_system_timezone()
+
 	data.is_suite_admin = is_suite_admin(user)
 	data.is_system_manager = is_system_manager(user)
 	data.is_jmap_configured = is_jmap_configured(user)
@@ -324,6 +364,11 @@ def censor_email(email: str) -> str:
 def send_reset_password_link(user: str) -> str:
 	"""Send reset password link to the user"""
 
+	# Only an admin resetting somebody else's password is an administrative act; this same endpoint
+	# backs the public "forgot password" form, and a user asking for their own link is not audited.
+	if frappe.session.user != user:
+		log_admin_action("send reset password link", user)
+
 	email = get_backup_email(user)
 	key = set_reset_password_key(user)
 
diff --git a/suite/mail/api/admin.py b/suite/mail/api/admin.py
index e18b67bd5c..17be03e30e 100644
--- a/suite/mail/api/admin.py
+++ b/suite/mail/api/admin.py
@@ -2,37 +2,78 @@
 import io
 import json
 from contextlib import suppress
-from typing import Literal
+from typing import Any, Literal
 
 import frappe
 from frappe import _
 from frappe.query_builder.functions import Max
-from frappe.utils import cint
+from frappe.utils import cint, flt, validate_email_address
 from pypika import Case, Order
 
 from suite.mail.api.utils import get_avatar_url
-from suite.mail.stalwart import create_domain as create_stalwart_domain
-from suite.mail.stalwart import delete_domain as delete_stalwart_domain
+from suite.mail.doctype.mail_account_request.mail_account_request import (
+	STALWART_DEFAULT_ADMIN_ROLES,
+	STALWART_DEFAULT_USER_ROLES,
+)
+from suite.mail.doctype.user_account.user_account import get_user_personal_jmap_account
+from suite.mail.stalwart import (
+	add_account_role,
+	get_account_metadata,
+	get_account_service,
+	get_action_service,
+	get_action_types,
+	get_dkim_signature_service,
+	get_domain_service,
+	get_group_service,
+	get_log_labels,
+	get_log_service,
+	get_management_connection,
+	get_mailing_list_service,
+	get_oauth_client_service,
+	get_queue_metadata,
+	get_queued_message_service,
+	get_report_service,
+	get_role_service,
+	remove_account_role,
+)
 from suite.mail.stalwart import get_domains as get_stalwart_domains
+from suite.mail.stalwart import get_permissions as get_stalwart_permissions
+from suite.mail.stalwart.account import CustomRoles, EmailAlias, RoleType, UserRoles
+from suite.mail.stalwart.domain import Domain
+from suite.mail.stalwart.group import Group
+from suite.mail.stalwart.mailing_list import MailingList
+from suite.mail.stalwart.oauth import OAuthClient
+from suite.mail.stalwart.role import Role
 from suite.mail.utils import get_config
 from suite.mail.utils.dns import parse_dns_zone_file
+from suite.mail.utils.dt import from_utc_z, to_utc_z
+from suite.mail.utils.logger import log_admin_action
+from suite.mail.utils.validation import is_subaddressed_email
 from suite.utils.rate_limiter import dynamic_rate_limit
 from suite.utils import execute_with_logging
+from suite.utils.dt import get_utc_now
 from suite.utils.user import is_suite_admin, is_system_manager, is_user_enabled
 
 
-def check_admin_permission(action: str) -> str:
+def check_admin_permission(action: str, target: Any = None) -> str:
 	"""Ensure the session user is an enabled Suite Admin or System Manager, returning the user.
 
 	The enabled check is defense-in-depth: a disabled admin holding a still-valid session (or an
 	API key) must not be able to perform admin actions, e.g. re-enable their own account via
 	enable_members. Throws frappe.PermissionError otherwise.
+
+	Every action that changes something is also written to the admin log with ``target`` (the object
+	acted on), so a shared inbox of administrators stays accountable. Reads are not logged: each
+	dashboard page issues several and they change nothing.
 	"""
 
 	user = frappe.session.user
 	if (not is_suite_admin(user) and not is_system_manager(user)) or not is_user_enabled(user):
 		frappe.throw(_("User {0} does not have permission to {1}.").format(frappe.bold(user), action))
 
+	if not action.startswith("view "):
+		log_admin_action(action, target)
+
 	return user
 
 
@@ -53,17 +94,21 @@ def _get_stalwart_domain(domain_id: str) -> dict:
 def add_domain(name: str, description: str | None = None) -> str:
 	"""Adds a new domain to Stalwart with the specified name and description, returning the new domain's ID."""
 
+	check_admin_permission("add domains", name)
+
 	for domain in get_stalwart_domains():
 		if domain["name"].lower() == name.lower():
 			frappe.throw(_("Domain {0} already exists.").format(name))
 
 	domain_id = execute_with_logging(
-		func=lambda: create_stalwart_domain(name, description),
+		func=lambda: get_domain_service().create(Domain(name=name, description=description)),
 		title=_("Failed to add domain {0}").format(name),
 		user_message=_("An error occurred while adding the domain, check error logs for more details."),
 		with_context=False,
 		module="Mail",
 	)
+
+	get_stalwart_domains.clear_cache()
 	return domain_id
 
 
@@ -181,16 +226,18 @@ def is_mandatory(record: dict) -> bool:
 def delete_domain(domain_id: str) -> None:
 	"""Deletes a domain identified by Stalwart domain ID."""
 
-	check_admin_permission("delete domains")
+	check_admin_permission("delete domains", domain_id)
 
 	execute_with_logging(
-		func=lambda: delete_stalwart_domain(domain_id),
+		func=lambda: get_domain_service().delete([domain_id]),
 		title=_("Failed to delete domain with ID {0}").format(domain_id),
 		user_message=_("An error occurred while deleting the domain, check error logs for more details."),
 		with_context=False,
 		module="Mail",
 	)
 
+	get_stalwart_domains.clear_cache()
+
 
 @frappe.whitelist()
 def get_enabled_domains() -> list[str]:
@@ -250,21 +297,45 @@ def add_member(
 	last_name: str | None = None,
 	password: str | None = None,
 	expires_at: str | None = None,
+	aliases: list | None = None,
+	groups: list | None = None,
+	mailing_lists: list | None = None,
+	quota_gb: float | None = None,
+	locale: str | None = None,
+	time_zone: str | None = None,
 ) -> None:
-	"""Create a new Mail Account Request for adding a member"""
+	"""Create a new Mail Account Request for adding a member.
+
+	``username``/``domain`` are the primary address (becomes the User); ``aliases`` are additional
+	full email addresses attached as aliases to the same account. ``groups`` and ``mailing_lists``
+	are ids the account joins once it is created — right away when invites are off, on verification
+	otherwise. ``quota_gb`` is the account's disk quota, where ``0`` means unlimited and ``None``
+	falls back to the configured default.
+
+	``locale`` and ``time_zone``, like the name and password, only apply when the account is created
+	right away; an invited member picks their own on the setup form.
+	"""
 
 	account_request = frappe.new_doc("Mail Account Request")
-	account_request.domain_name = domain
 	account_request.account = f"{username}@{domain}"
+	account_request.aliases = "\n".join(_listify(aliases))
+	account_request.groups = "\n".join(str(g) for g in _listify(groups))
+	account_request.mailing_lists = "\n".join(str(ml) for ml in _listify(mailing_lists))
+	if quota_gb is not None:
+		account_request.quota_gb = flt(quota_gb)
 	account_request.is_admin = cint(is_admin)
 	account_request.invited_by = frappe.session.user
 	account_request.backup_email = backup_email
 	account_request.send_invite = cint(send_invite)
-	account_request.expires_at = expires_at
+	# Arrives as UTC like every other timestamp; the doctype field holds system time.
+	account_request.expires_at = from_utc_z(expires_at)
+	# Insert first: create permission on Mail Account Request is what gates this endpoint, so the
+	# action is only authorized (and worth recording) once the request exists.
 	account_request.insert()
+	log_admin_action("add members", account_request.account)
 
 	if not send_invite:
-		account_request.force_verify_and_create_account(first_name, last_name, password)
+		account_request.force_verify_and_create_account(first_name, last_name, password, locale, time_zone)
 
 
 @frappe.whitelist()
@@ -317,10 +388,161 @@ def get_members(
 
 		user["is_admin"] = bool(user.get("is_admin"))
 		user["enabled"] = bool(user.get("enabled"))
+		# Stored in system time; the API speaks UTC, like every other timestamp it returns.
+		user["last_active"] = to_utc_z(user.get("last_active"))
 
 	return users
 
 
+def _build_quota_usage(total: int, used: int) -> dict:
+	"""Normalizes raw disk-quota byte counts into the shape the member page renders.
+
+	A total of 0 (Stalwart omits maxDiskQuota) means unlimited storage, so percentages and the
+	available figure are meaningless and reported as such.
+	"""
+
+	total = max(total or 0, 0)
+	used = max(used or 0, 0)
+
+	if total <= 0:
+		return {
+			"total": 0,
+			"used": used,
+			"available": 0,
+			"used_percentage": 0,
+			"available_percentage": 0,
+			"unlimited": True,
+		}
+
+	available = max(total - used, 0)
+	used_percentage = min((used / total) * 100, 100)
+
+	return {
+		"total": total,
+		"used": used,
+		"available": available,
+		"used_percentage": used_percentage,
+		"available_percentage": 100 - used_percentage,
+		"unlimited": False,
+	}
+
+
+@frappe.whitelist()
+def get_member(member_id: str) -> dict:
+	"""Returns a member's profile along with their Stalwart quota usage and email addresses.
+
+	Quota and email addresses are read live from the member's personal Stalwart account via the CLI;
+	when the member has no personal account configured, those sections come back empty rather than
+	failing the whole page.
+	"""
+
+	check_admin_permission("view members")
+
+	user = frappe.db.get_value(
+		"User",
+		member_id,
+		["name", "full_name", "user_image", "last_active", "enabled", "creation"],
+		as_dict=True,
+	)
+	if not user:
+		frappe.throw(_("Member not found"), frappe.DoesNotExistError)
+
+	is_admin = bool(frappe.db.exists("Has Role", {"parent": member_id, "role": "Suite Admin"}))
+
+	result = {
+		"name": user.name,
+		"full_name": user.full_name,
+		"user_image": user.user_image or get_avatar_url(user.name),
+		"description": user.full_name,
+		# Both are stored in system time; the API speaks UTC.
+		"last_active": to_utc_z(user.last_active),
+		"joined_on": to_utc_z(user.creation),
+		"enabled": bool(user.enabled),
+		"is_admin": is_admin,
+		"email_addresses": [],
+		"groups": [],
+		"mailing_lists": [],
+		"quota": _build_quota_usage(0, 0),
+		"locale": None,
+		"time_zone": None,
+	}
+
+	account_id = get_user_personal_jmap_account(member_id)
+	if not account_id:
+		return result
+
+	with suppress(Exception):
+		account = get_account_service().get(
+			account_id,
+			properties=[
+				"emailAddress", "aliases", "quotas", "usedDiskQuota", "memberGroupIds", "description",
+				"locale", "timeZone",
+			],
+		)
+		if not account:
+			return result
+
+		result["locale"] = account.get("locale")
+		result["time_zone"] = account.get("timeZone")
+
+		# Each address carries a description used as its Identity display name: the primary uses the
+		# account description, each alias its own.
+		email_addresses = []
+		if primary := account.get("emailAddress"):
+			email_addresses.append(
+				{"email": primary, "description": account.get("description"), "is_primary": True, "enabled": True}
+			)
+
+		aliases = account.get("aliases") or {}
+		if aliases:
+			domain_names = {d["id"]: d["name"] for d in get_stalwart_domains()}
+			for alias in aliases.values():
+				name = alias.get("name")
+				domain_name = domain_names.get(alias.get("domainId"))
+				if name and domain_name:
+					email_addresses.append(
+						{
+							"email": f"{name}@{domain_name}",
+							"description": alias.get("description"),
+							"is_primary": False,
+							"enabled": bool(alias.get("enabled", True)),
+						}
+					)
+
+		emails = [entry["email"] for entry in email_addresses]
+		result["email_addresses"] = email_addresses
+		result["quota"] = _build_quota_usage(
+			(account.get("quotas") or {}).get("maxDiskQuota") or 0,
+			account.get("usedDiskQuota") or 0,
+		)
+
+		# Groups the account belongs to (membership lives on the account's memberGroupIds).
+		group_ids = _keys(account.get("memberGroupIds"))
+		if group_ids:
+			group_map = {
+				g["id"]: g
+				for g in get_group_service().get_all_groups(properties=["id", "name", "emailAddress"])
+			}
+			result["groups"] = [
+				{"id": gid, "name": group_map[gid].get("name"), "email": group_map[gid].get("emailAddress")}
+				for gid in group_ids
+				if gid in group_map
+			]
+
+		# Mailing lists that include the member as a recipient. Recipients are email addresses
+		# (internal or external), so match against the member's own addresses, not the account id.
+		member_emails = {email.lower() for email in emails}
+		result["mailing_lists"] = [
+			{"id": ml["id"], "name": ml.get("name"), "email": ml.get("emailAddress")}
+			for ml in get_mailing_list_service().get_all(
+				properties=["id", "name", "emailAddress", "recipients"]
+			)
+			if member_emails & {recipient.lower() for recipient in _keys(ml.get("recipients"))}
+		]
+
+	return result
+
+
 @frappe.whitelist()
 def get_account_requests(
 	search: str | None = None, status: Literal["All", "Pending", "Accepted", "Expired"] = "All"
@@ -362,7 +584,7 @@ def get_account_requests(
 def delete_account_requests(names: list) -> None:
 	"""Delete Mail Account Requests"""
 
-	check_admin_permission("delete account requests")
+	check_admin_permission("delete account requests", names)
 
 	for d in names:
 		frappe.delete_doc("Mail Account Request", d)
@@ -372,7 +594,7 @@ def delete_account_requests(names: list) -> None:
 def delete_members(names: list) -> None:
 	"""Delete member users. The User on_trash hooks cascade to their Stalwart account and settings."""
 
-	user = check_admin_permission("delete members")
+	user = check_admin_permission("delete members", names)
 
 	if user in names:
 		frappe.throw(_("You cannot delete your own account."))
@@ -385,7 +607,7 @@ def delete_members(names: list) -> None:
 def disable_members(names: list) -> None:
 	"""Disable member users. Disabled users can no longer log in and their sessions are cleared."""
 
-	user = check_admin_permission("disable members")
+	user = check_admin_permission("disable members", names)
 
 	if user in names:
 		frappe.throw(_("You cannot disable your own account."))
@@ -403,7 +625,7 @@ def disable_members(names: list) -> None:
 def enable_members(names: list) -> None:
 	"""Enable member users. The configured disabled account role is removed and the users can log in again."""
 
-	check_admin_permission("enable members")
+	check_admin_permission("enable members", names)
 
 	for name in names:
 		member = frappe.get_doc("User", name)
@@ -412,3 +634,1771 @@ def enable_members(names: list) -> None:
 
 		member.enabled = 1
 		member.save(ignore_permissions=True)
+
+
+@frappe.whitelist()
+@dynamic_rate_limit()
+def change_member_password(member_id: str, new_password: str) -> None:
+	"""Set a member's password directly.
+
+	Saving the User with `new_password` set triggers the update_account_password hook, which
+	propagates the new password to the member's Stalwart account.
+	"""
+
+	check_admin_permission("change member password", member_id)
+
+	if not new_password:
+		frappe.throw(_("New password is required."))
+
+	member = frappe.get_doc("User", member_id)
+	member.new_password = new_password
+	member.save(ignore_permissions=True)
+
+
+# ---------------------------------------------------------------------------
+# Member editing (Frappe User + Stalwart account)
+# ---------------------------------------------------------------------------
+
+_GB = 1024**3
+
+
+def _member_account(member_id: str) -> str | None:
+	"""Returns the member's personal Stalwart account id, or None if they have none."""
+
+	return get_user_personal_jmap_account(member_id, raise_exception=False)
+
+
+def _require_member_account(member_id: str) -> str:
+	account_id = _member_account(member_id)
+	if not account_id:
+		frappe.throw(_("This member does not have a mail account."))
+
+	return account_id
+
+
+def _alias_emails(account: dict, domain_names: dict) -> list[str]:
+	"""Builds the account's alias email addresses from its raw ``aliases`` map."""
+
+	emails = []
+	for alias in (account.get("aliases") or {}).values():
+		name = alias.get("name")
+		domain = domain_names.get(alias.get("domainId"))
+		if name and domain:
+			emails.append(f"{name}@{domain}")
+
+	return emails
+
+
+def _rebuild_aliases(account: dict, *, keep: callable) -> list[EmailAlias]:
+	"""Rebuilds the account's alias objects, keeping those for which ``keep(email)`` is True."""
+
+	domain_names = {d["id"]: d["name"] for d in get_stalwart_domains()}
+	aliases = []
+	for alias in (account.get("aliases") or {}).values():
+		domain = domain_names.get(alias.get("domainId"))
+		email = f"{alias.get('name')}@{domain}" if domain else None
+		if email and not keep(email.lower()):
+			continue
+
+		aliases.append(
+			EmailAlias(
+				name=alias["name"],
+				domain_id=alias["domainId"],
+				enabled=alias.get("enabled", True),
+				description=alias.get("description"),
+			)
+		)
+
+	return aliases
+
+
+def _locale_patch(locale: str | None, time_zone: str | None) -> dict:
+	"""Builds the account patch for the locale and time zone, skipping whatever was not passed.
+
+	The two differ on the server: a locale is required, so an empty one leaves it alone, while the
+	time zone is nullable and an empty one clears it back to "unset".
+	"""
+
+	patch = {}
+	if locale:
+		patch["locale"] = locale
+	if time_zone is not None:
+		patch["timeZone"] = time_zone or None
+	return patch
+
+
+@frappe.whitelist()
+def get_account_options() -> dict:
+	"""Returns the locale and time zone choices for editing a member or group."""
+
+	check_admin_permission("view account options")
+	return get_account_metadata()
+
+
+@frappe.whitelist()
+def update_member(
+	member_id: str,
+	role: str | None = None,
+	description: str | None = None,
+	quota_gb: float | None = None,
+	locale: str | None = None,
+	time_zone: str | None = None,
+) -> None:
+	"""Updates a member's role, display name, quota, locale and time zone on Frappe and Stalwart."""
+
+	check_admin_permission("update members", member_id)
+
+	member = frappe.get_doc("User", member_id)
+
+	if role is not None:
+		if role == "admin":
+			member.append_roles("Suite Admin")
+		else:
+			member.set("roles", [r for r in member.get("roles") if r.role != "Suite Admin"])
+
+	description = (description or "").strip()
+	if description:
+		first, _sep, last = description.partition(" ")
+		member.first_name = first
+		member.last_name = last or None
+
+	member.save(ignore_permissions=True)
+
+	account_id = _member_account(member_id)
+	account_service = get_account_service()
+
+	# Role: the base "User" Stalwart role always stays; only the admin-only roles are toggled.
+	if role is not None:
+		extra_roles = list(set(STALWART_DEFAULT_ADMIN_ROLES) - set(STALWART_DEFAULT_USER_ROLES))
+		toggle = add_account_role if role == "admin" else remove_account_role
+		execute_with_logging(
+			func=lambda: [toggle(member_id, r) for r in extra_roles],
+			title=_("Failed to update roles for {0}").format(member_id),
+			user_message=_("An error occurred while updating the role, check error logs for more details."),
+			with_context=False,
+			module="Mail",
+		)
+
+	if not account_id:
+		return
+
+	if description:
+		execute_with_logging(
+			func=lambda: account_service.update(account_id, {"description": description}),
+			title=_("Failed to update description for {0}").format(member_id),
+			user_message=_("An error occurred while updating the description, check error logs for more details."),
+			with_context=False,
+			module="Mail",
+		)
+
+	if quota_gb is not None:
+		quota_bytes = cint(float(quota_gb) * _GB)
+		execute_with_logging(
+			func=lambda: account_service.update(account_id, {"quotas/maxDiskQuota": quota_bytes}),
+			title=_("Failed to update quota for {0}").format(member_id),
+			user_message=_("An error occurred while updating the quota, check error logs for more details."),
+			with_context=False,
+			module="Mail",
+		)
+
+	if patch := _locale_patch(locale, time_zone):
+		execute_with_logging(
+			func=lambda: account_service.update(account_id, patch),
+			title=_("Failed to update locale for {0}").format(member_id),
+			user_message=_("An error occurred while updating the locale, check error logs for more details."),
+			with_context=False,
+			module="Mail",
+		)
+
+
+def _add_alias(service, resource_id: str, email: str, description: str | None = None) -> None:
+	"""Adds ``email`` as an alias (with optional description) to the given account or mailing list."""
+
+	email = (email or "").strip().lower()
+	validate_email_address(email, throw=True)
+	is_subaddressed_email(email, raise_exception=True)
+
+	local, _sep, domain = email.partition("@")
+	domain_id = get_domain_service().get_by_name(domain, raise_exception=True)["id"]
+
+	obj = service.get(resource_id, properties=["emailAddress", "aliases"])
+	if email == (obj.get("emailAddress") or "").lower():
+		frappe.throw(_("{0} is already the primary address.").format(email))
+
+	domain_names = {d["id"]: d["name"] for d in get_stalwart_domains()}
+	if email in {e.lower() for e in _alias_emails(obj, domain_names)}:
+		return
+
+	aliases = _rebuild_aliases(obj, keep=lambda _e: True)
+	aliases.append(EmailAlias(name=local, domain_id=domain_id, description=(description or "").strip() or None))
+
+	execute_with_logging(
+		func=lambda: service.set_aliases(resource_id, aliases),
+		title=_("Failed to add email {0}").format(email),
+		user_message=_("An error occurred while adding the email, check error logs for more details."),
+		with_context=False,
+		module="Mail",
+	)
+
+
+def _remove_alias(service, resource_id: str, email: str) -> None:
+	"""Removes the alias ``email`` from the given account or mailing list (the primary cannot be removed)."""
+
+	email = (email or "").strip().lower()
+	obj = service.get(resource_id, properties=["emailAddress", "aliases"])
+	if email == (obj.get("emailAddress") or "").lower():
+		frappe.throw(_("The primary address cannot be removed."))
+
+	aliases = _rebuild_aliases(obj, keep=lambda e: e != email)
+
+	execute_with_logging(
+		func=lambda: service.set_aliases(resource_id, aliases),
+		title=_("Failed to remove email {0}").format(email),
+		user_message=_("An error occurred while removing the email, check error logs for more details."),
+		with_context=False,
+		module="Mail",
+	)
+
+
+def _set_alias_enabled(service, resource_id: str, email: str, enabled: bool) -> None:
+	"""Enables or disables the alias ``email`` (the primary address is always enabled)."""
+
+	email = (email or "").strip().lower()
+	obj = service.get(resource_id, properties=["emailAddress", "aliases"])
+	if not obj or email == (obj.get("emailAddress") or "").lower():
+		return
+
+	domain_names = {d["id"]: d["name"] for d in get_stalwart_domains()}
+	aliases = []
+	for alias in (obj.get("aliases") or {}).values():
+		domain = domain_names.get(alias.get("domainId"))
+		alias_email = f"{alias.get('name')}@{domain}" if domain else None
+		is_target = bool(alias_email) and alias_email.lower() == email
+		aliases.append(
+			EmailAlias(
+				name=alias["name"],
+				domain_id=alias["domainId"],
+				enabled=enabled if is_target else alias.get("enabled", True),
+				description=alias.get("description"),
+			)
+		)
+
+	execute_with_logging(
+		func=lambda: service.set_aliases(resource_id, aliases),
+		title=_("Failed to update email {0}").format(email),
+		user_message=_("An error occurred while updating the email, check error logs for more details."),
+		with_context=False,
+		module="Mail",
+	)
+
+
+@frappe.whitelist()
+def add_member_email(member_id: str, email: str, description: str | None = None) -> None:
+	"""Adds an email address to the member's account as an alias with an optional description."""
+
+	check_admin_permission("update members", f"{member_id} ({email})")
+	_add_alias(get_account_service(), _require_member_account(member_id), email, description)
+
+
+@frappe.whitelist()
+def remove_member_email(member_id: str, email: str) -> None:
+	"""Removes an alias email address from the member's account (the primary cannot be removed)."""
+
+	check_admin_permission("update members", f"{member_id} ({email})")
+	_remove_alias(get_account_service(), _require_member_account(member_id), email)
+
+
+@frappe.whitelist()
+def set_member_email_enabled(member_id: str, email: str, enabled: int) -> None:
+	"""Enables or disables one of the member's alias email addresses."""
+
+	check_admin_permission("update members", f"{member_id} ({email})")
+	_set_alias_enabled(get_account_service(), _require_member_account(member_id), email, bool(cint(enabled)))
+
+
+@frappe.whitelist()
+def add_member_to_groups(member_id: str, group_ids: list) -> None:
+	"""Adds the member to the given groups."""
+
+	check_admin_permission("update members", member_id)
+	account_id = _require_member_account(member_id)
+
+	service = get_group_service()
+	for group_id in _listify(group_ids):
+		service.add_members(group_id, [account_id])
+
+
+@frappe.whitelist()
+def remove_member_from_group(member_id: str, group_id: str) -> None:
+	"""Removes the member from the given group."""
+
+	check_admin_permission("update members", f"{member_id} ({group_id})")
+	account_id = _require_member_account(member_id)
+	get_group_service().remove_members(group_id, [account_id])
+
+
+@frappe.whitelist()
+def add_member_to_mailing_lists(member_id: str, list_ids: list) -> None:
+	"""Adds the member's primary address as a recipient of the given mailing lists."""
+
+	check_admin_permission("update members", member_id)
+	account_id = _require_member_account(member_id)
+
+	account_service = get_account_service()
+	email = (account_service.get(account_id, properties=["emailAddress"]) or {}).get("emailAddress")
+	if not email:
+		return
+
+	service = get_mailing_list_service()
+	for list_id in _listify(list_ids):
+		recipients = dict((service.get(list_id, properties=["recipients"]) or {}).get("recipients") or {})
+		recipients[email] = True
+		service.update(list_id, {"recipients": recipients})
+
+
+@frappe.whitelist()
+def remove_member_from_mailing_list(member_id: str, list_id: str) -> None:
+	"""Removes all of the member's addresses from the given mailing list's recipients."""
+
+	check_admin_permission("update members", f"{member_id} ({list_id})")
+	account_id = _require_member_account(member_id)
+
+	account_service = get_account_service()
+	account = account_service.get(account_id, properties=["emailAddress", "aliases"])
+	domain_names = {d["id"]: d["name"] for d in get_stalwart_domains()}
+	member_emails = {(account.get("emailAddress") or "").lower(), *[e.lower() for e in _alias_emails(account, domain_names)]}
+
+	service = get_mailing_list_service()
+	recipients = (service.get(list_id, properties=["recipients"]) or {}).get("recipients") or {}
+	remaining = {r: v for r, v in recipients.items() if r.lower() not in member_emails}
+	service.update(list_id, {"recipients": remaining})
+
+
+# ---------------------------------------------------------------------------
+# Directory: shared helpers
+# ---------------------------------------------------------------------------
+
+
+def _listify(value) -> list:
+	"""Coerces a whitelisted argument (which may arrive as a JSON string) into a list."""
+
+	if value is None:
+		return []
+	if isinstance(value, str):
+		value = frappe.parse_json(value)
+	return list(value or [])
+
+
+def _keys(value) -> list[str]:
+	"""Returns the keys of a JMAP id-keyed map, or the list as-is."""
+
+	return list(value.keys()) if isinstance(value, dict) else list(value or [])
+
+
+def _search(rows: list[dict], search: str | None, fields: tuple[str, ...]) -> list[dict]:
+	"""Filters rows whose given fields contain the search text (case-insensitive)."""
+
+	if not search:
+		return rows
+
+	needle = search.lower()
+	return [r for r in rows if any(needle in (str(r.get(f) or "")).lower() for f in fields)]
+
+
+@frappe.whitelist()
+def get_accounts(search: str | None = None) -> list[dict]:
+	"""Returns Stalwart user accounts (id + email) for member/recipient pickers."""
+
+	check_admin_permission("view accounts")
+
+	accounts = get_account_service().get_all(
+		filter={"@type": "User"}, properties=["id", "name", "emailAddress"]
+	)
+	rows = [{"id": a["id"], "name": a.get("name"), "email": a.get("emailAddress")} for a in accounts]
+	return _search(rows, search, ("name", "email"))
+
+
+# ---------------------------------------------------------------------------
+# Directory: Groups
+# ---------------------------------------------------------------------------
+
+
+@frappe.whitelist()
+def get_groups(search: str | None = None) -> list[dict]:
+	"""Returns all groups."""
+
+	check_admin_permission("view groups")
+
+	groups = get_group_service().get_all_groups(
+		properties=["id", "name", "emailAddress", "description", "createdAt"]
+	)
+	rows = [
+		{
+			"id": g["id"],
+			"name": g.get("name"),
+			"email": g.get("emailAddress"),
+			"description": g.get("description"),
+			"created_at": g.get("createdAt"),
+		}
+		for g in groups
+	]
+	return _search(rows, search, ("name", "email", "description"))
+
+
+@frappe.whitelist()
+def get_group(group_id: str) -> dict:
+	"""Returns a group with its members and assigned role ids."""
+
+	check_admin_permission("view groups")
+
+	service = get_group_service()
+	group = service.get(
+		group_id,
+		properties=[
+			"id", "name", "emailAddress", "description", "createdAt", "roles", "aliases", "quotas",
+			"usedDiskQuota", "locale", "timeZone",
+		],
+	)
+	if not group:
+		frappe.throw(_("Group not found"), frappe.DoesNotExistError)
+
+	# Email addresses mirror the member page: primary uses the group description, aliases their own.
+	email_addresses = []
+	if primary := group.get("emailAddress"):
+		email_addresses.append(
+			{"email": primary, "description": group.get("description"), "is_primary": True, "enabled": True}
+		)
+
+	aliases = group.get("aliases") or {}
+	if aliases:
+		domain_names = {d["id"]: d["name"] for d in get_stalwart_domains()}
+		for alias in aliases.values():
+			name = alias.get("name")
+			domain_name = domain_names.get(alias.get("domainId"))
+			if name and domain_name:
+				email_addresses.append(
+					{
+						"email": f"{name}@{domain_name}",
+						"description": alias.get("description"),
+						"is_primary": False,
+						"enabled": bool(alias.get("enabled", True)),
+					}
+				)
+
+	members = service.get_members(group_id, properties=["id", "name", "emailAddress"])
+
+	return {
+		"id": group["id"],
+		"name": group.get("name"),
+		"email": group.get("emailAddress"),
+		"description": group.get("description"),
+		"created_at": group.get("createdAt"),
+		"role_ids": _keys((group.get("roles") or {}).get("roleIds")),
+		"locale": group.get("locale"),
+		"time_zone": group.get("timeZone"),
+		"email_addresses": email_addresses,
+		"members": [{"id": m["id"], "name": m.get("name"), "email": m.get("emailAddress")} for m in members],
+		"quota": _build_quota_usage(
+			(group.get("quotas") or {}).get("maxDiskQuota") or 0,
+			group.get("usedDiskQuota") or 0,
+		),
+	}
+
+
+@frappe.whitelist()
+@dynamic_rate_limit()
+def add_group(
+	name: str,
+	domain: str,
+	description: str | None = None,
+	members: list | None = None,
+	roles: list | None = None,
+) -> str:
+	"""Creates a group and returns its id. ``members`` and ``roles`` are account/role ids."""
+
+	check_admin_permission("add groups", f"{name}@{domain}")
+
+	member_ids = _listify(members)
+	role_ids = _listify(roles)
+
+	def _create() -> str:
+		domain_id = get_domain_service().get_by_name(domain, raise_exception=True)["id"]
+		service = get_group_service()
+		group_id = service.create(
+			Group(name=name, domain_id=domain_id, description=description, role_ids=role_ids or None)
+		)
+		if member_ids:
+			service.add_members(group_id, member_ids)
+		return group_id
+
+	return execute_with_logging(
+		func=_create,
+		title=_("Failed to add group {0}").format(name),
+		user_message=_("An error occurred while adding the group, check error logs for more details."),
+		with_context=False,
+		module="Mail",
+	)
+
+
+@frappe.whitelist()
+def update_group(
+	group_id: str,
+	description: str | None = None,
+	roles: list | None = None,
+	quota_gb: float | None = None,
+	locale: str | None = None,
+	time_zone: str | None = None,
+) -> None:
+	"""Updates a group's description (full name), roles, quota, locale and time zone."""
+
+	check_admin_permission("update groups", group_id)
+
+	patch = _locale_patch(locale, time_zone)
+	if description is not None:
+		patch["description"] = description
+	if roles is not None:
+		role_ids = _listify(roles)
+		patch["roles"] = (
+			UserRoles(type=RoleType.CUSTOM, roles=CustomRoles(role_ids=role_ids)).to_dict()
+			if role_ids
+			else {"@type": "Default"}
+		)
+	if quota_gb is not None:
+		patch["quotas/maxDiskQuota"] = cint(float(quota_gb) * _GB)
+
+	if patch:
+		get_group_service().update(group_id, patch)
+
+
+@frappe.whitelist()
+def add_group_email(group_id: str, email: str, description: str | None = None) -> None:
+	"""Adds an alias email address to the group with an optional description."""
+
+	check_admin_permission("update groups", f"{group_id} ({email})")
+	_add_alias(get_account_service(), group_id, email, description)
+
+
+@frappe.whitelist()
+def remove_group_email(group_id: str, email: str) -> None:
+	"""Removes an alias email address from the group (the primary cannot be removed)."""
+
+	check_admin_permission("update groups", f"{group_id} ({email})")
+	_remove_alias(get_account_service(), group_id, email)
+
+
+@frappe.whitelist()
+def set_group_email_enabled(group_id: str, email: str, enabled: int) -> None:
+	"""Enables or disables one of the group's alias email addresses."""
+
+	check_admin_permission("update groups", f"{group_id} ({email})")
+	_set_alias_enabled(get_account_service(), group_id, email, bool(cint(enabled)))
+
+
+@frappe.whitelist()
+def add_group_members(group_id: str, account_ids: list) -> None:
+	"""Adds the given accounts to the group."""
+
+	check_admin_permission("update groups", group_id)
+	get_group_service().add_members(group_id, _listify(account_ids))
+
+
+@frappe.whitelist()
+def remove_group_member(group_id: str, account_id: str) -> None:
+	"""Removes the given account from the group."""
+
+	check_admin_permission("update groups", f"{group_id} ({account_id})")
+	get_group_service().remove_members(group_id, [account_id])
+
+
+@frappe.whitelist()
+def delete_groups(ids: list) -> None:
+	"""Deletes the given groups."""
+
+	check_admin_permission("delete groups", ids)
+	get_group_service().delete(_listify(ids))
+
+
+# ---------------------------------------------------------------------------
+# Directory: Mailing Lists
+# ---------------------------------------------------------------------------
+
+
+@frappe.whitelist()
+def get_mailing_lists(search: str | None = None) -> list[dict]:
+	"""Returns all mailing lists."""
+
+	check_admin_permission("view mailing lists")
+
+	lists = get_mailing_list_service().get_all(
+		properties=["id", "name", "emailAddress", "description", "recipients"]
+	)
+	rows = [
+		{
+			"id": ml["id"],
+			"name": ml.get("name"),
+			"email": ml.get("emailAddress"),
+			"description": ml.get("description"),
+			"recipient_count": len(_keys(ml.get("recipients"))),
+		}
+		for ml in lists
+	]
+	return _search(rows, search, ("name", "email", "description"))
+
+
+@frappe.whitelist()
+def get_mailing_list(list_id: str) -> dict:
+	"""Returns a mailing list with its email addresses and recipients."""
+
+	check_admin_permission("view mailing lists")
+
+	ml = get_mailing_list_service().get(
+		list_id,
+		properties=["id", "name", "emailAddress", "description", "aliases", "recipients"],
+	)
+	if not ml:
+		frappe.throw(_("Mailing list not found"), frappe.DoesNotExistError)
+
+	# Email addresses mirror the member/group pages: primary uses the description, aliases their own.
+	email_addresses = []
+	if primary := ml.get("emailAddress"):
+		email_addresses.append(
+			{"email": primary, "description": ml.get("description"), "is_primary": True, "enabled": True}
+		)
+	aliases = ml.get("aliases") or {}
+	if aliases:
+		domain_names = {d["id"]: d["name"] for d in get_stalwart_domains()}
+		for alias in aliases.values():
+			name = alias.get("name")
+			domain_name = domain_names.get(alias.get("domainId"))
+			if name and domain_name:
+				email_addresses.append(
+					{
+						"email": f"{name}@{domain_name}",
+						"description": alias.get("description"),
+						"is_primary": False,
+						"enabled": bool(alias.get("enabled", True)),
+					}
+				)
+
+	return {
+		"id": ml["id"],
+		"name": ml.get("name"),
+		"email": ml.get("emailAddress"),
+		"description": ml.get("description"),
+		"email_addresses": email_addresses,
+		# Recipients are email addresses (internal accounts or external).
+		"recipients": _keys(ml.get("recipients")),
+	}
+
+
+@frappe.whitelist()
+@dynamic_rate_limit()
+def add_mailing_list(
+	name: str, domain: str, recipients: list | None = None, description: str | None = None
+) -> str:
+	"""Creates a mailing list and returns its id."""
+
+	check_admin_permission("add mailing lists", f"{name}@{domain}")
+
+	recipient_list = _listify(recipients)
+
+	def _create() -> str:
+		domain_id = get_domain_service().get_by_name(domain, raise_exception=True)["id"]
+		return get_mailing_list_service().create(
+			MailingList(
+				name=name, domain_id=domain_id, recipients=recipient_list or None, description=description
+			)
+		)
+
+	return execute_with_logging(
+		func=_create,
+		title=_("Failed to add mailing list {0}").format(name),
+		user_message=_("An error occurred while adding the mailing list, check error logs for more details."),
+		with_context=False,
+		module="Mail",
+	)
+
+
+@frappe.whitelist()
+def update_mailing_list(list_id: str, description: str | None = None) -> None:
+	"""Updates a mailing list's description."""
+
+	check_admin_permission("update mailing lists", list_id)
+
+	if description is not None:
+		get_mailing_list_service().update(list_id, {"description": description})
+
+
+@frappe.whitelist()
+def add_mailing_list_email(list_id: str, email: str, description: str | None = None) -> None:
+	"""Adds an alias email address to the mailing list."""
+
+	check_admin_permission("update mailing lists", f"{list_id} ({email})")
+	_add_alias(get_mailing_list_service(), list_id, email, description)
+
+
+@frappe.whitelist()
+def remove_mailing_list_email(list_id: str, email: str) -> None:
+	"""Removes an alias email address from the mailing list (the primary cannot be removed)."""
+
+	check_admin_permission("update mailing lists", f"{list_id} ({email})")
+	_remove_alias(get_mailing_list_service(), list_id, email)
+
+
+@frappe.whitelist()
+def set_mailing_list_email_enabled(list_id: str, email: str, enabled: int) -> None:
+	"""Enables or disables one of the mailing list's alias email addresses."""
+
+	check_admin_permission("update mailing lists", f"{list_id} ({email})")
+	_set_alias_enabled(get_mailing_list_service(), list_id, email, bool(cint(enabled)))
+
+
+@frappe.whitelist()
+def add_mailing_list_recipients(list_id: str, recipients: list) -> None:
+	"""Adds recipient email addresses to the mailing list."""
+
+	check_admin_permission("update mailing lists", list_id)
+
+	service = get_mailing_list_service()
+	current = dict((service.get(list_id, properties=["recipients"]) or {}).get("recipients") or {})
+	for email in _listify(recipients):
+		email = (email or "").strip()
+		if email:
+			current[email] = True
+
+	service.update(list_id, {"recipients": current})
+
+
+@frappe.whitelist()
+def remove_mailing_list_recipient(list_id: str, email: str) -> None:
+	"""Removes a recipient email address from the mailing list."""
+
+	check_admin_permission("update mailing lists", f"{list_id} ({email})")
+
+	service = get_mailing_list_service()
+	current = (service.get(list_id, properties=["recipients"]) or {}).get("recipients") or {}
+	remaining = {r: v for r, v in current.items() if r.lower() != (email or "").strip().lower()}
+	service.update(list_id, {"recipients": remaining})
+
+
+@frappe.whitelist()
+def delete_mailing_lists(ids: list) -> None:
+	"""Deletes the given mailing lists."""
+
+	check_admin_permission("delete mailing lists", ids)
+	get_mailing_list_service().delete(_listify(ids))
+
+
+# ---------------------------------------------------------------------------
+# Directory: Roles
+# ---------------------------------------------------------------------------
+
+
+@frappe.whitelist()
+def get_roles_list(search: str | None = None) -> list[dict]:
+	"""Returns all roles with permission counts."""
+
+	check_admin_permission("view roles")
+
+	roles = get_role_service().get_all()
+	rows = [
+		{
+			"id": r["id"],
+			"description": r.get("description"),
+			"enabled_count": len(_keys(r.get("enabledPermissions"))),
+			"disabled_count": len(_keys(r.get("disabledPermissions"))),
+		}
+		for r in roles
+	]
+	return _search(rows, search, ("description",))
+
+
+@frappe.whitelist()
+def get_role(role_id: str) -> dict:
+	"""Returns a role with its permissions and inherited role ids."""
+
+	check_admin_permission("view roles")
+
+	role = get_role_service().get(role_id)
+	if not role:
+		frappe.throw(_("Role not found"), frappe.DoesNotExistError)
+
+	return {
+		"id": role["id"],
+		"description": role.get("description"),
+		"enabled_permissions": _keys(role.get("enabledPermissions")),
+		"disabled_permissions": _keys(role.get("disabledPermissions")),
+		"role_ids": _keys(role.get("roleIds")),
+	}
+
+
+@frappe.whitelist()
+def get_permissions() -> list[dict]:
+	"""Returns the assignable permissions as ``{value, label}`` for the role editor."""
+
+	check_admin_permission("view roles")
+	return get_stalwart_permissions()
+
+
+@frappe.whitelist()
+@dynamic_rate_limit()
+def add_role(
+	description: str,
+	enabled_permissions: list | None = None,
+	disabled_permissions: list | None = None,
+	role_ids: list | None = None,
+) -> str:
+	"""Creates a role and returns its id."""
+
+	check_admin_permission("add roles", description)
+
+	def _create() -> str:
+		return get_role_service().create(
+			Role(
+				description=description,
+				enabled_permissions=_listify(enabled_permissions),
+				disabled_permissions=_listify(disabled_permissions),
+				role_ids=_listify(role_ids),
+			)
+		)
+
+	return execute_with_logging(
+		func=_create,
+		title=_("Failed to add role {0}").format(description),
+		user_message=_("An error occurred while adding the role, check error logs for more details."),
+		with_context=False,
+		module="Mail",
+	)
+
+
+@frappe.whitelist()
+def update_role(
+	role_id: str,
+	description: str | None = None,
+	enabled_permissions: list | None = None,
+	disabled_permissions: list | None = None,
+	role_ids: list | None = None,
+) -> None:
+	"""Updates a role's description/permissions/inherited roles."""
+
+	check_admin_permission("update roles", role_id)
+
+	patch = {}
+	if description is not None:
+		patch["description"] = description
+	if enabled_permissions is not None:
+		patch["enabledPermissions"] = {p: True for p in _listify(enabled_permissions)}
+	if disabled_permissions is not None:
+		patch["disabledPermissions"] = {p: True for p in _listify(disabled_permissions)}
+	if role_ids is not None:
+		patch["roleIds"] = {rid: True for rid in _listify(role_ids)}
+
+	if patch:
+		get_role_service().update(role_id, patch)
+
+
+@frappe.whitelist()
+def delete_roles(ids: list) -> None:
+	"""Deletes the given roles."""
+
+	check_admin_permission("delete roles", ids)
+	get_role_service().delete(_listify(ids))
+
+
+# ---------------------------------------------------------------------------
+# Directory: OAuth Clients
+# ---------------------------------------------------------------------------
+
+
+@frappe.whitelist()
+def get_oauth_clients(search: str | None = None) -> list[dict]:
+	"""Returns all OAuth clients."""
+
+	check_admin_permission("view oauth clients")
+
+	clients = get_oauth_client_service().get_all(
+		properties=["id", "clientId", "description", "createdAt"]
+	)
+	rows = [
+		{
+			"id": c["id"],
+			"client_id": c.get("clientId"),
+			"description": c.get("description"),
+			"created_at": c.get("createdAt"),
+		}
+		for c in clients
+	]
+	return _search(rows, search, ("client_id", "description"))
+
+
+@frappe.whitelist()
+def get_oauth_client(client_id: str) -> dict:
+	"""Returns an OAuth client with its redirect URIs and contacts."""
+
+	check_admin_permission("view oauth clients")
+
+	client = get_oauth_client_service().get(
+		client_id,
+		properties=[
+			"id",
+			"clientId",
+			"description",
+			"createdAt",
+			"expiresAt",
+			"redirectUris",
+			"contacts",
+			"logo",
+		],
+	)
+	if not client:
+		frappe.throw(_("OAuth client not found"), frappe.DoesNotExistError)
+
+	return {
+		"id": client["id"],
+		"client_id": client.get("clientId"),
+		"description": client.get("description"),
+		"created_at": client.get("createdAt"),
+		"expires_at": client.get("expiresAt"),
+		"redirect_uris": _keys(client.get("redirectUris")),
+		"contacts": _keys(client.get("contacts")),
+		"logo": client.get("logo"),
+	}
+
+
+@frappe.whitelist()
+@dynamic_rate_limit()
+def add_oauth_client(
+	client_id: str,
+	description: str | None = None,
+	contacts: list | None = None,
+	redirect_uris: list | None = None,
+	secret: str | None = None,
+	logo: str | None = None,
+	expires_at: str | None = None,
+) -> str:
+	"""Creates an OAuth client and returns its id."""
+
+	check_admin_permission("add oauth clients", client_id)
+
+	uris = _listify(redirect_uris)
+	contact_list = _listify(contacts)
+	expires = to_utc_z(expires_at)
+
+	def _create() -> str:
+		return get_oauth_client_service().create(
+			OAuthClient(
+				client_id=client_id,
+				description=description,
+				contacts=contact_list or None,
+				redirect_uris=uris or None,
+				secret=(secret or "").strip() or None,
+				logo=(logo or "").strip() or None,
+				expires_at=expires,
+			)
+		)
+
+	return execute_with_logging(
+		func=_create,
+		title=_("Failed to add OAuth client {0}").format(client_id),
+		user_message=_("An error occurred while adding the OAuth client, check error logs for more details."),
+		with_context=False,
+		module="Mail",
+	)
+
+
+@frappe.whitelist()
+def update_oauth_client(
+	oauth_client_id: str,
+	client_id: str | None = None,
+	description: str | None = None,
+	redirect_uris: list | None = None,
+	contacts: list | None = None,
+	secret: str | None = None,
+	logo: str | None = None,
+	expires_at: str | None = None,
+) -> None:
+	"""Updates an OAuth client's clientId, description, redirect URIs, contacts, secret, logo and expiry."""
+
+	check_admin_permission("update oauth clients", oauth_client_id)
+
+	patch = {}
+	if client_id is not None and client_id.strip():
+		patch["clientId"] = client_id.strip()
+	if description is not None:
+		patch["description"] = description
+	if redirect_uris is not None:
+		patch["redirectUris"] = {uri: True for uri in _listify(redirect_uris)}
+	if contacts is not None:
+		patch["contacts"] = {contact: True for contact in _listify(contacts)}
+	# A blank secret leaves the existing one untouched (it is never read back).
+	if secret is not None and secret.strip():
+		patch["secret"] = secret.strip()
+	if logo is not None:
+		patch["logo"] = logo.strip() or None
+	if expires_at is not None:
+		# Blank clears the expiry.
+		patch["expiresAt"] = to_utc_z(expires_at)
+
+	if patch:
+		get_oauth_client_service().update(oauth_client_id, patch)
+
+
+@frappe.whitelist()
+def add_oauth_client_contacts(client_id: str, contacts: list) -> None:
+	"""Adds contact email addresses to the OAuth client."""
+
+	check_admin_permission("update oauth clients", client_id)
+
+	service = get_oauth_client_service()
+	current = dict((service.get(client_id, properties=["contacts"]) or {}).get("contacts") or {})
+	for contact in _listify(contacts):
+		contact = (contact or "").strip()
+		if contact:
+			current[contact] = True
+
+	service.update(client_id, {"contacts": current})
+
+
+@frappe.whitelist()
+def remove_oauth_client_contact(client_id: str, contact: str) -> None:
+	"""Removes a contact email address from the OAuth client."""
+
+	check_admin_permission("update oauth clients", f"{client_id} ({contact})")
+
+	service = get_oauth_client_service()
+	current = (service.get(client_id, properties=["contacts"]) or {}).get("contacts") or {}
+	remaining = {c: v for c, v in current.items() if c.lower() != (contact or "").strip().lower()}
+	service.update(client_id, {"contacts": remaining})
+
+
+@frappe.whitelist()
+def add_oauth_client_redirect_uris(client_id: str, redirect_uris: list) -> None:
+	"""Adds redirect URIs to the OAuth client."""
+
+	check_admin_permission("update oauth clients", client_id)
+
+	service = get_oauth_client_service()
+	current = dict((service.get(client_id, properties=["redirectUris"]) or {}).get("redirectUris") or {})
+	for uri in _listify(redirect_uris):
+		uri = (uri or "").strip()
+		if uri:
+			current[uri] = True
+
+	service.update(client_id, {"redirectUris": current})
+
+
+@frappe.whitelist()
+def remove_oauth_client_redirect_uri(client_id: str, uri: str) -> None:
+	"""Removes a redirect URI from the OAuth client."""
+
+	check_admin_permission("update oauth clients", f"{client_id} ({uri})")
+
+	service = get_oauth_client_service()
+	current = (service.get(client_id, properties=["redirectUris"]) or {}).get("redirectUris") or {}
+	remaining = {u: v for u, v in current.items() if u != (uri or "").strip()}
+	service.update(client_id, {"redirectUris": remaining})
+
+
+@frappe.whitelist()
+def delete_oauth_clients(ids: list) -> None:
+	"""Deletes the given OAuth clients."""
+
+	check_admin_permission("delete oauth clients", ids)
+	get_oauth_client_service().delete(_listify(ids))
+
+
+# ---------------------------------------------------------------------------
+# Domains: DKIM Signatures
+# ---------------------------------------------------------------------------
+
+# Maps Stalwart's DKIM signature @type to a human-readable algorithm label.
+_DKIM_ALGORITHMS = {
+	"Dkim1RsaSha256": "RSA-SHA256",
+	"Dkim1Ed25519Sha256": "Ed25519-SHA256",
+}
+
+
+@frappe.whitelist()
+def get_dkim_signatures(domain_id: str | None = None) -> list[dict]:
+	"""Returns DKIM signatures, optionally scoped to a single domain."""
+
+	check_admin_permission("view dkim signatures")
+
+	service = get_dkim_signature_service()
+	properties = ["id", "@type", "selector", "domainId", "createdAt"]
+	signatures = (
+		service.get_all_by_domain(domain_id, properties=properties)
+		if domain_id
+		else service.get_all(properties=properties)
+	)
+
+	domain_names = {d["id"]: d["name"] for d in get_stalwart_domains()}
+	return [
+		{
+			"id": s["id"],
+			"algorithm": _DKIM_ALGORITHMS.get(s.get("@type"), s.get("@type")),
+			"domain": domain_names.get(s.get("domainId")),
+			"selector": s.get("selector"),
+			"created_at": s.get("createdAt"),
+		}
+		for s in signatures
+	]
+
+
+@frappe.whitelist()
+def get_dkim_signature(signature_id: str) -> dict:
+	"""Returns a single DKIM signature's details (read-only; never the private key)."""
+
+	check_admin_permission("view dkim signatures")
+
+	sig = get_dkim_signature_service().get(
+		signature_id,
+		properties=[
+			"id", "@type", "selector", "domainId", "createdAt", "stage", "nextTransitionAt",
+			"headers", "canonicalization", "expire", "report", "auid", "publicKey",
+		],
+	)
+	if not sig:
+		frappe.throw(_("DKIM signature not found"), frappe.DoesNotExistError)
+
+	domain_names = {d["id"]: d["name"] for d in get_stalwart_domains()}
+	return {
+		"id": sig["id"],
+		"algorithm": _DKIM_ALGORITHMS.get(sig.get("@type"), sig.get("@type")),
+		"selector": sig.get("selector"),
+		"domain": domain_names.get(sig.get("domainId")),
+		"signed_headers": _keys(sig.get("headers")),
+		"canonicalization": sig.get("canonicalization"),
+		"expiration": sig.get("expire"),
+		"request_reports": bool(sig.get("report")),
+		"auid": sig.get("auid"),
+		"public_key": sig.get("publicKey"),
+		"stage": sig.get("stage"),
+		"created_at": sig.get("createdAt"),
+		"next_transition": sig.get("nextTransitionAt"),
+	}
+
+
+@frappe.whitelist()
+def delete_dkim_signatures(ids: list) -> None:
+	"""Deletes the given DKIM signatures."""
+
+	check_admin_permission("delete dkim signatures", ids)
+	get_dkim_signature_service().delete(_listify(ids))
+
+
+# ---------------------------------------------------------------------------
+# Emails: Queue
+# ---------------------------------------------------------------------------
+
+
+def _set_keys(value) -> list[str]:
+	"""Returns the members of a JMAP ``set`` property, whether it arrives as a map or a list."""
+
+	if isinstance(value, dict):
+		return sorted(value.keys())
+	return _listify(value)
+
+
+def _queue_row(message: dict) -> dict:
+	"""Maps a queued message to its list-row shape."""
+
+	recipients = list((message.get("recipients") or {}).keys())
+	return {
+		"id": message["id"],
+		"sender": message.get("returnPath"),
+		"recipients": recipients,
+		"recipient_count": len(recipients),
+		"size": message.get("size"),
+		"next_retry": message.get("nextRetry"),
+		"created_at": message.get("createdAt"),
+	}
+
+
+def _queue_filter(search: str | None, to: str | None, sender: str | None) -> dict | None:
+	"""Builds a queue query filter from the provided, non-empty criteria."""
+
+	filter = {}
+	if search:
+		filter["text"] = search
+	if to:
+		filter["to"] = to
+	if sender:
+		filter["returnPath"] = sender
+	return filter or None
+
+
+@frappe.whitelist()
+def get_queued_messages(
+	search: str | None = None,
+	to: str | None = None,
+	sender: str | None = None,
+	page: int = 1,
+	page_length: int = 50,
+) -> dict:
+	"""Returns a page of messages pending outbound delivery with the total count."""
+
+	check_admin_permission("view queued messages")
+
+	page, page_length = cint(page) or 1, cint(page_length) or 50
+	result = get_queued_message_service().list_page(
+		filter=_queue_filter(search, to, sender),
+		position=(page - 1) * page_length,
+		limit=page_length,
+		properties=["id", "returnPath", "recipients", "size", "nextRetry", "createdAt"],
+	)
+	return {"messages": [_queue_row(m) for m in result["items"]], "total": result["total"]}
+
+
+@frappe.whitelist()
+def _recipient_detail(email: str, recipient: dict) -> dict:
+	"""Flattens a queued recipient (status/expiry unions included) into an editable row shape."""
+
+	status = recipient.get("status") or {}
+	expires = recipient.get("expires") or {}
+	return {
+		"email": email,
+		"orcpt": recipient.get("orcpt"),
+		"status_type": status.get("@type"),
+		"error_type": status.get("errorType"),
+		"error_message": status.get("errorMessage"),
+		"smtp_command": status.get("errorCommand"),
+		"hostname": status.get("responseHostname"),
+		"response_code": status.get("responseCode"),
+		"enhanced_code": status.get("responseEnhanced"),
+		"message": status.get("responseMessage"),
+		"next_retry": recipient.get("retryDue"),
+		"retry_count": recipient.get("retryCount"),
+		"next_notification": recipient.get("notifyDue"),
+		"notify_count": recipient.get("notifyCount"),
+		"expiry_type": expires.get("@type"),
+		"expires_at": expires.get("expiresAt"),
+		"expires_attempts": expires.get("expiresAttempts"),
+	}
+
+
+def _message_flags(message: dict) -> list[dict]:
+	"""Returns the message flags as ``{value, label}`` using the server's flag labels."""
+
+	labels = {f["value"]: f["label"] for f in get_queue_metadata()["message_flags"]}
+	return [{"value": flag, "label": labels.get(flag, flag)} for flag in _set_keys(message.get("flags"))]
+
+
+@frappe.whitelist()
+def get_queued_message(message_id: str) -> dict:
+	"""Returns a queued message with its per-recipient delivery status."""
+
+	check_admin_permission("view queued messages")
+
+	message = get_queued_message_service().get(message_id)
+	if not message:
+		frappe.throw(_("Queued message not found"), frappe.DoesNotExistError)
+
+	recipients = [_recipient_detail(email, r) for email, r in (message.get("recipients") or {}).items()]
+	return {
+		"id": message["id"],
+		"sender": message.get("returnPath"),
+		"size": message.get("size"),
+		"priority": message.get("priority"),
+		"env_id": message.get("envId"),
+		"flags": _message_flags(message),
+		"next_retry": message.get("nextRetry"),
+		"next_notify": message.get("nextNotify"),
+		"received_from_ip": message.get("receivedFromIp"),
+		"received_via_port": message.get("receivedViaPort"),
+		"created_at": message.get("createdAt"),
+		"recipients": recipients,
+		"has_content": bool(message.get("blobId")),
+	}
+
+
+@frappe.whitelist()
+def get_queue_recipient_options() -> dict:
+	"""Returns the option lists (status types, error types, expiry types) for editing recipients."""
+
+	check_admin_permission("view queued messages")
+	meta = get_queue_metadata()
+	return {
+		"status_types": meta["status_types"],
+		"error_types": meta["error_types"],
+		"expiry_types": meta["expiry_types"],
+	}
+
+
+def _utc_datetime(value: str | None) -> str | None:
+	"""Normalizes a timestamp the API was called with to the UTCDateTime Stalwart stores."""
+
+	return to_utc_z(value)
+
+
+def _status_object(
+	status_type: str,
+	error_type: str | None,
+	error_message: str | None,
+	smtp_command: str | None,
+	hostname: str | None,
+	response_code: str | int | None,
+	enhanced_code: str | None,
+	message: str | None,
+) -> dict:
+	"""Builds a recipient status union member from the edited fields."""
+
+	status = {"@type": status_type}
+	response = {
+		"responseHostname": hostname or None,
+		"responseCode": cint(response_code) if str(response_code or "").strip() else None,
+		"responseEnhanced": enhanced_code or None,
+		"responseMessage": message or None,
+	}
+	if status_type in ("TemporaryFailure", "PermanentFailure"):
+		status.update(
+			{
+				"errorType": error_type or None,
+				"errorMessage": error_message or None,
+				"errorCommand": smtp_command or None,
+				**response,
+			}
+		)
+	elif status_type == "Completed":
+		status.update(response)
+
+	# The whole status node is replaced, so absent keys are cleared; dropping None-valued keys also
+	# avoids sending null for the non-nullable errorType enum.
+	return {key: value for key, value in status.items() if value is not None}
+
+
+def _expires_object(expiry_type: str, expires_at: str | None, expires_attempts: str | int | None) -> dict:
+	"""Builds a queue-expiry union member from the edited fields."""
+
+	if expiry_type == "Attempts":
+		return {"@type": "Attempts", "expiresAttempts": cint(expires_attempts)}
+	return {"@type": "Ttl", "expiresAt": _utc_datetime(expires_at)}
+
+
+@frappe.whitelist()
+def update_queued_message(message_id: str, next_retry: str | None = None) -> None:
+	"""Updates a queued message's next retry time."""
+
+	check_admin_permission("update queued messages", message_id)
+
+	if next_retry is not None:
+		get_queued_message_service().update(message_id, {"nextRetry": _utc_datetime(next_retry)})
+
+
+@frappe.whitelist()
+def update_queued_recipient(
+	message_id: str,
+	email: str,
+	new_email: str | None = None,
+	orcpt: str | None = None,
+	status_type: str | None = None,
+	error_type: str | None = None,
+	error_message: str | None = None,
+	smtp_command: str | None = None,
+	hostname: str | None = None,
+	response_code: str | None = None,
+	enhanced_code: str | None = None,
+	message: str | None = None,
+	next_retry: str | None = None,
+	retry_count: str | None = None,
+	next_notification: str | None = None,
+	notify_count: str | None = None,
+	expiry_type: str | None = None,
+	expires_at: str | None = None,
+	expires_attempts: str | None = None,
+) -> None:
+	"""Updates a single recipient of a queued message (renames the address if ``new_email`` differs)."""
+
+	check_admin_permission("update queued messages", f"{message_id} ({email})")
+	service = get_queued_message_service()
+
+	# Scalar edits keyed by their JMAP property; a ``None`` argument means "leave unchanged".
+	changed = {}
+	if orcpt is not None:
+		changed["orcpt"] = orcpt or None
+	if next_retry is not None:
+		changed["retryDue"] = _utc_datetime(next_retry)
+	if retry_count is not None:
+		changed["retryCount"] = cint(retry_count)
+	if next_notification is not None:
+		changed["notifyDue"] = _utc_datetime(next_notification)
+	if notify_count is not None:
+		changed["notifyCount"] = cint(notify_count)
+	status = (
+		_status_object(status_type, error_type, error_message, smtp_command, hostname, response_code, enhanced_code, message)
+		if status_type
+		else None
+	)
+	expires = _expires_object(expiry_type, expires_at, expires_attempts) if expiry_type else None
+
+	new_email = (new_email or "").strip()
+	if new_email and new_email != email:
+		# Rename: rebuild the recipient (minus server-set fields) under the new key.
+		current = ((service.get(message_id, properties=["recipients"]) or {}).get("recipients") or {}).get(email)
+		if current is None:
+			frappe.throw(_("Recipient not found"), frappe.DoesNotExistError)
+		obj = {k: v for k, v in current.items() if k not in ("flags", "queueName")}
+		obj.update(changed)
+		if status is not None:
+			obj["status"] = status
+		if expires is not None:
+			obj["expires"] = expires
+		service.update(message_id, {f"recipients/{email}": None, f"recipients/{new_email}": obj})
+		return
+
+	patch = {f"recipients/{email}/{prop}": value for prop, value in changed.items()}
+	if status is not None:
+		patch[f"recipients/{email}/status"] = status
+	if expires is not None:
+		patch[f"recipients/{email}/expires"] = expires
+	if patch:
+		service.update(message_id, patch)
+
+
+@frappe.whitelist()
+def add_queued_recipient(message_id: str, email: str) -> None:
+	"""Adds a recipient (pending delivery) to a queued message."""
+
+	from datetime import timedelta
+
+	check_admin_permission("update queued messages", f"{message_id} ({email})")
+
+	email = (email or "").strip()
+	if not email:
+		frappe.throw(_("Recipient email is required."))
+
+	now = get_utc_now()
+	recipient = {
+		"status": {"@type": "Scheduled"},
+		"retryDue": to_utc_z(now),
+		"notifyDue": to_utc_z(now),
+		"expires": {"@type": "Ttl", "expiresAt": to_utc_z(now + timedelta(days=5))},
+	}
+	get_queued_message_service().update(message_id, {f"recipients/{email}": recipient})
+
+
+@frappe.whitelist()
+def remove_queued_recipient(message_id: str, email: str) -> None:
+	"""Removes a recipient from a queued message."""
+
+	check_admin_permission("update queued messages", f"{message_id} ({email})")
+	get_queued_message_service().update(message_id, {f"recipients/{email}": None})
+
+
+@frappe.whitelist()
+def get_queued_message_source(message_id: str) -> dict:
+	"""Returns the raw RFC822 source of a queued message."""
+
+	from urllib.parse import urljoin
+
+	check_admin_permission("view queued messages")
+
+	connection = get_queued_message_service().connection
+	message = get_queued_message_service().get(message_id, properties=["id", "blobId"])
+	blob_id = (message or {}).get("blobId")
+	if not blob_id:
+		frappe.throw(_("Queued message content is not available"), frappe.DoesNotExistError)
+
+	account_id = connection.primary_accounts["urn:stalwart:jmap"]
+	url = urljoin(
+		get_config("server_url"),
+		f"/jmap/download/{account_id}/{blob_id}/message.eml?accept=message/rfc822",
+	)
+	content = connection.request(method="GET", url=url, return_json=False)
+	return {"source": content.decode(errors="replace") if isinstance(content, bytes) else content}
+
+
+@frappe.whitelist()
+def retry_queued_messages(ids: list) -> None:
+	"""Schedules the given queued messages for immediate delivery."""
+
+	check_admin_permission("retry queued messages", ids)
+	get_queued_message_service().retry(_listify(ids))
+
+
+@frappe.whitelist()
+def cancel_queued_messages(ids: list) -> None:
+	"""Cancels (deletes) the given queued messages."""
+
+	check_admin_permission("cancel queued messages", ids)
+	get_queued_message_service().delete(_listify(ids))
+
+
+@frappe.whitelist()
+def retry_all_queued_messages(
+	search: str | None = None, to: str | None = None, sender: str | None = None
+) -> None:
+	"""Schedules every message matching the current filter for immediate delivery."""
+
+	check_admin_permission("retry queued messages", "all")
+	service = get_queued_message_service()
+	service.retry(service.query(filter=_queue_filter(search, to, sender))["ids"])
+
+
+@frappe.whitelist()
+def cancel_all_queued_messages(
+	search: str | None = None, to: str | None = None, sender: str | None = None
+) -> None:
+	"""Cancels (deletes) every message matching the current filter."""
+
+	check_admin_permission("cancel queued messages", "all")
+	service = get_queued_message_service()
+	service.delete(service.query(filter=_queue_filter(search, to, sender))["ids"])
+
+
+# ---------------------------------------------------------------------------
+# Emails: Delivery Test (live SMTP delivery trace)
+# ---------------------------------------------------------------------------
+
+
+@frappe.whitelist(methods=["GET"])
+def stream_delivery_test(target: str):
+	"""Proxies Stalwart's live SMTP delivery trace for ``target`` as a Server-Sent Events stream.
+
+	Stalwart sends no CORS headers and authenticates the trace with a short-lived token, so the
+	browser cannot connect directly. This mints the token server-side and relays the event stream
+	over the same origin instead.
+	"""
+
+	from urllib.parse import quote, urljoin
+
+	import requests
+	from werkzeug.wrappers import Response
+
+	check_admin_permission("run delivery test", target)
+
+	connection = get_management_connection()
+	server_url, verify_ssl = get_config(("server_url", "verify_ssl"))
+	token = connection.request(
+		method="GET", url=urljoin(server_url, "/api/token/delivery"), return_json=False
+	)
+	token = token.decode() if isinstance(token, bytes) else token
+
+	url = urljoin(server_url, f"/api/live/delivery/{quote(target)}?token={quote(token)}")
+	upstream = requests.get(url, stream=True, verify=bool(verify_ssl), timeout=(10, 300))
+
+	def relay():
+		try:
+			for chunk in upstream.iter_content(chunk_size=None):
+				if chunk:
+					yield chunk
+		finally:
+			upstream.close()
+
+	return Response(
+		relay(),
+		mimetype="text/event-stream",
+		headers={"Cache-Control": "no-store", "X-Accel-Buffering": "no"},
+	)
+
+
+# ---------------------------------------------------------------------------
+# Reports: inbound (received) and outbound (generated) DMARC / TLS / ARF
+# ---------------------------------------------------------------------------
+
+
+def _report_row(direction: str, report: dict) -> dict:
+	"""Maps a report to its list-row shape (columns differ by direction)."""
+
+	if direction == "inbound":
+		return {
+			"id": report["id"],
+			"from": report.get("from"),
+			"subject": report.get("subject"),
+			"received_at": report.get("receivedAt"),
+		}
+	return {
+		"id": report["id"],
+		"domain": report.get("domain"),
+		"created_at": report.get("createdAt"),
+		"deliver_at": report.get("deliverAt"),
+	}
+
+
+def _report_filter(kind: str, direction: str, search: str | None) -> dict | None:
+	"""Maps the search box onto the filter DMARC reports support; other kinds are unfiltered.
+
+	Only DMARC is searchable, and each direction takes a different filter: received reports take
+	Stalwart's free-text ``text`` filter (matching the sender/recipient addresses and the reported
+	domain, not the subject), while the reports Stalwart generates take an exact ``domain`` match.
+	Anything else is rejected as ``unsupportedFilter``.
+	"""
+
+	search = (search or "").strip()
+	if not search or kind != "dmarc":
+		return None
+	return {"text": search} if direction == "inbound" else {"domain": search}
+
+
+@frappe.whitelist()
+def get_reports(
+	kind: str,
+	direction: str,
+	search: str | None = None,
+	page: int = 1,
+	page_length: int = 50,
+) -> dict:
+	"""Returns a page of ``kind`` reports (dmarc/tls/arf) in the given direction (inbound/outbound)."""
+
+	check_admin_permission("view reports")
+
+	page, page_length = cint(page) or 1, cint(page_length) or 50
+	result = get_report_service(kind, direction).list_page(
+		filter=_report_filter(kind, direction, search), position=(page - 1) * page_length, limit=page_length
+	)
+	return {"reports": [_report_row(direction, r) for r in result["items"]], "total": result["total"]}
+
+
+@frappe.whitelist()
+def get_report(kind: str, direction: str, report_id: str) -> dict:
+	"""Returns a single report's metadata plus its parsed report body."""
+
+	check_admin_permission("view reports")
+
+	report = get_report_service(kind, direction).get(report_id)
+	if not report:
+		frappe.throw(_("Report not found"), frappe.DoesNotExistError)
+
+	meta = {"id": report["id"], "kind": kind, "direction": direction, "report": report.get("report")}
+	if direction == "inbound":
+		meta.update(
+			{
+				"from": report.get("from"),
+				"subject": report.get("subject"),
+				"to": _set_keys(report.get("to")),
+				"received_at": report.get("receivedAt"),
+				"expires_at": report.get("expiresAt"),
+			}
+		)
+	else:
+		meta.update(
+			{
+				"domain": report.get("domain"),
+				"created_at": report.get("createdAt"),
+				"deliver_at": report.get("deliverAt"),
+			}
+		)
+		if kind == "dmarc":
+			# `policyIdentifier` is a u64 hash that overflows JS's safe integer range, so send it as
+			# a string to keep the browser from rounding it.
+			identifier = report.get("policyIdentifier")
+			meta.update(
+				{
+					"rua": _set_keys(report.get("rua")),
+					"policy_identifier": str(identifier) if identifier is not None else None,
+				}
+			)
+	return meta
+
+
+@frappe.whitelist()
+def delete_reports(kind: str, direction: str, ids: list) -> None:
+	"""Deletes the given reports."""
+
+	check_admin_permission("delete reports", ids)
+	get_report_service(kind, direction).delete(_listify(ids))
+
+
+# ---------------------------------------------------------------------------
+# Observability: Logs
+# ---------------------------------------------------------------------------
+
+
+def _log_row(entry: dict, labels: dict) -> dict:
+	"""Maps a log entry to its row/detail shape, resolved against the schema's display labels.
+
+	The raw ``level``/``event`` identifiers are kept so the UI can still key off them (e.g. to colour
+	a level); ``labels`` comes from :func:`get_log_labels` and falls back to the identifier itself for
+	anything the server's enums do not describe.
+	"""
+
+	level, event = entry.get("level"), entry.get("event")
+	return {
+		"id": entry["id"],
+		"timestamp": entry.get("timestamp"),
+		"level": level,
+		"level_label": labels["levels"].get(level, level),
+		"event": event,
+		"event_label": labels["events"].get(event, event),
+		"details": entry.get("details"),
+	}
+
+
+@frappe.whitelist()
+def get_logs(search: str | None = None, anchor: str | None = None, page_length: int = 100) -> dict:
+	"""Returns a page of server log entries (most recent first), starting after ``anchor``.
+
+	The log store only supports cursor pagination, so pages are walked one at a time using the
+	``next_anchor`` returned here instead of jumping to an arbitrary offset; ``next_anchor`` is
+	``None`` on the last page. ``total`` is how many entries the server retains and, unlike the other
+	listings, is not narrowed by ``search``.
+	"""
+
+	check_admin_permission("view logs")
+
+	page_length = cint(page_length) or 100
+	result = get_log_service().list_page(
+		filter={"text": search} if search else None,
+		anchor=anchor,
+		limit=page_length,
+	)
+	labels = get_log_labels()
+	logs = [_log_row(e, labels) for e in result["items"]]
+	return {
+		"logs": logs,
+		"total": result["total"],
+		"next_anchor": logs[-1]["id"] if len(logs) == page_length else None,
+	}
+
+
+@frappe.whitelist()
+def get_log(log_id: str) -> dict:
+	"""Returns a single log entry."""
+
+	check_admin_permission("view logs")
+
+	entry = get_log_service().get(log_id)
+	if not entry:
+		frappe.throw(_("Log entry not found"), frappe.DoesNotExistError)
+
+	return _log_row(entry, get_log_labels())
+
+
+# ---------------------------------------------------------------------------
+# Actions: server management operations
+# ---------------------------------------------------------------------------
+
+
+# Pausing the queue stops delivery server-wide until someone resumes it, so it is kept to the
+# Administrator; `run_action` refuses it for anyone else.
+ADMINISTRATOR_ONLY_ACTIONS = frozenset({"PauseMtaQueue"})
+
+
+@frappe.whitelist()
+def get_actions() -> list[dict]:
+	"""Returns the executable server management actions (``{value, label, schema_name}``).
+
+	Each one carries ``administrator_only`` so the UI can lock what ``run_action`` would refuse.
+	"""
+
+	check_admin_permission("view actions")
+	return [{**a, "administrator_only": a["value"] in ADMINISTRATOR_ONLY_ACTIONS} for a in get_action_types()]
+
+
+@frappe.whitelist()
+def run_action(action_type: str, params: dict | None = None) -> dict:
+	"""Executes a server management action and returns its result (empty for parameterless actions).
+
+	Inputs the schema types as a JMAP ``set`` (e.g. the recipients of a spam classification) arrive as
+	a list and are encoded here, since the server rejects a plain list for them.
+	"""
+
+	user = check_admin_permission("run actions", action_type)
+	if action_type in ADMINISTRATOR_ONLY_ACTIONS and user != "Administrator":
+		frappe.throw(
+			_("Only the Administrator can run this action."),
+			frappe.PermissionError,
+		)
+
+	params = {k: dict.fromkeys(v, True) if isinstance(v, list) else v for k, v in (params or {}).items()}
+	return get_action_service().run(action_type, params=params or None)
diff --git a/suite/mail/doctype/jmap_account/jmap_account.py b/suite/mail/doctype/jmap_account/jmap_account.py
index 18807d5d69..45e37b5156 100644
--- a/suite/mail/doctype/jmap_account/jmap_account.py
+++ b/suite/mail/doctype/jmap_account/jmap_account.py
@@ -29,7 +29,7 @@
 from suite.mail.doctype.sieve_script.sieve_script import build_automation_sieve, maybe_build_automation_sieve
 from suite.mail.doctype.user_account.user_account import get_user_jmap_accounts
 from suite.mail.utils.user import get_account_emails
-from suite.utils import execute_with_logging
+from suite.utils import execute_with_logging, user_context
 from suite.utils.lock import acquire_lock, release_lock
 from suite.utils.user import is_suite_admin, is_system_manager
 
@@ -294,9 +294,14 @@ def sync_jmap_accounts(user: str, accounts: dict[str, dict]) -> None:
 		new_accounts = _ensure_jmap_account_docs(user, accounts)
 		_sync_user_accounts(user, set(accounts.keys()))
 
-		for account in new_accounts:
-			create_archive_mailbox(account)
-			build_automation_sieve(account, activate=True)
+		# Reached over JMAP as ``user``, not as whoever triggered the save: these accounts are only
+		# ever linked to ``user``, so an admin setting up a member's account (or any other user
+		# saving someone else's settings) would otherwise resolve the account to nobody and fail
+		# with "JMAP account <id> does not belong to the user <admin>".
+		with user_context(user):
+			for account in new_accounts:
+				create_archive_mailbox(account)
+				build_automation_sieve(account, activate=True)
 	finally:
 		release_lock(lockname, identifier)
 
diff --git a/suite/mail/doctype/mail_account_request/mail_account_request.json b/suite/mail/doctype/mail_account_request/mail_account_request.json
index 5a5d5f3c3c..bbfd9d3483 100644
--- a/suite/mail/doctype/mail_account_request/mail_account_request.json
+++ b/suite/mail/doctype/mail_account_request/mail_account_request.json
@@ -11,11 +11,16 @@
   "user_details_section",
   "backup_email",
   "roles",
+  "is_admin",
   "column_break_hswp",
   "invited_by",
-  "domain_name",
   "account",
-  "is_admin",
+  "aliases",
+  "quota_gb",
+  "membership_details_section",
+  "groups",
+  "column_break_mlgr",
+  "mailing_lists",
   "verification_details_section",
   "send_invite",
   "is_verified",
@@ -30,6 +35,7 @@
    "fieldtype": "Column Break"
   },
   {
+   "description": "Secret token embedded in the verification link, used to look up and verify this request.",
    "fieldname": "request_key",
    "fieldtype": "Data",
    "in_standard_filter": 1,
@@ -39,6 +45,7 @@
    "unique": 1
   },
   {
+   "description": "Alternate email the invite/verification link is sent to; also saved on the created account's settings.",
    "fieldname": "backup_email",
    "fieldtype": "Data",
    "in_list_view": 1,
@@ -51,6 +58,7 @@
    "set_only_once": 1
   },
   {
+   "description": "The Suite Admin or System Manager who created this request.",
    "fieldname": "invited_by",
    "fieldtype": "Link",
    "in_list_view": 1,
@@ -66,6 +74,7 @@
   {
    "default": "0",
    "depends_on": "eval: !doc.__islocal",
+   "description": "Whether the backup email has been verified via the invite link or OTP.",
    "fieldname": "is_verified",
    "fieldtype": "Check",
    "label": "Is Verified",
@@ -80,6 +89,7 @@
   {
    "default": "0",
    "depends_on": "eval: !doc.__islocal",
+   "description": "Whether the request has passed its expiry time. Computed at read time.",
    "fieldname": "is_expired",
    "fieldtype": "Check",
    "is_virtual": 1,
@@ -92,6 +102,7 @@
    "fieldtype": "Section Break"
   },
   {
+   "description": "Primary email address; becomes the Frappe User and the Stalwart account's primary address.",
    "fieldname": "account",
    "fieldtype": "Data",
    "in_list_view": 1,
@@ -104,12 +115,44 @@
    "set_only_once": 1
   },
   {
-   "fieldname": "domain_name",
-   "fieldtype": "Data",
-   "in_standard_filter": 1,
-   "label": "Domain",
-   "reqd": 1,
-   "search_index": 1,
+   "description": "Additional email addresses (one per line) added as aliases to the account.",
+   "fieldname": "aliases",
+   "fieldtype": "Small Text",
+   "label": "Aliases",
+   "no_copy": 1,
+   "set_only_once": 1
+  },
+  {
+   "description": "Disk quota in GB applied to the account on creation, where 0 means unlimited. Left blank, the configured default disk quota is used.",
+   "fieldname": "quota_gb",
+   "fieldtype": "Float",
+   "label": "Disk Quota (GB)",
+   "no_copy": 1,
+   "non_negative": 1
+  },
+  {
+   "fieldname": "membership_details_section",
+   "fieldtype": "Section Break",
+   "label": "Membership Details"
+  },
+  {
+   "description": "Stalwart group ids (one per line) the account is added to on creation.",
+   "fieldname": "groups",
+   "fieldtype": "Small Text",
+   "label": "Groups",
+   "no_copy": 1,
+   "set_only_once": 1
+  },
+  {
+   "fieldname": "column_break_mlgr",
+   "fieldtype": "Column Break"
+  },
+  {
+   "description": "Stalwart mailing list ids (one per line) the account's primary address is added to as a recipient on creation.",
+   "fieldname": "mailing_lists",
+   "fieldtype": "Small Text",
+   "label": "Mailing Lists",
+   "no_copy": 1,
    "set_only_once": 1
   },
   {
@@ -124,12 +167,14 @@
   },
   {
    "default": "1",
+   "description": "If enabled, emails a verification link to the backup email; otherwise the account is created immediately.",
    "fieldname": "send_invite",
    "fieldtype": "Check",
    "label": "Send Invite",
    "set_only_once": 1
   },
   {
+   "description": "IP address the request was created from.",
    "fieldname": "ip_address",
    "fieldtype": "Data",
    "label": "IP Address",
@@ -142,6 +187,7 @@
    "fieldtype": "Column Break"
   },
   {
+   "description": "When this request stops being valid and can no longer create an account.",
    "fieldname": "expires_at",
    "fieldtype": "Datetime",
    "label": "Expires At",
@@ -153,6 +199,7 @@
    "fieldtype": "Column Break"
   },
   {
+   "description": "Stalwart roles (one per line) assigned to the account on creation; defaults are chosen by the admin flag.",
    "fieldname": "roles",
    "fieldtype": "Small Text",
    "label": "Roles",
@@ -161,17 +208,19 @@
   },
   {
    "default": "0",
+   "description": "If enabled, the created user gets the Suite Admin role and admin Stalwart roles.",
    "fieldname": "is_admin",
    "fieldtype": "Check",
    "label": "Is Admin",
    "no_copy": 1,
-   "search_index": 1
+   "search_index": 1,
+   "set_only_once": 1
   }
  ],
  "grid_page_length": 50,
  "index_web_pages_for_search": 1,
  "links": [],
- "modified": "2026-07-21 00:00:00.000000",
+ "modified": "2026-07-24 20:37:34.829154",
  "modified_by": "Administrator",
  "module": "Mail",
  "name": "Mail Account Request",
diff --git a/suite/mail/doctype/mail_account_request/mail_account_request.py b/suite/mail/doctype/mail_account_request/mail_account_request.py
index 5d5af4c350..0b8ab055e4 100644
--- a/suite/mail/doctype/mail_account_request/mail_account_request.py
+++ b/suite/mail/doctype/mail_account_request/mail_account_request.py
@@ -10,6 +10,7 @@
 from frappe.utils import (
 	add_to_date,
 	cint,
+	flt,
 	get_datetime,
 	get_url,
 	now,
@@ -20,7 +21,8 @@
 
 from suite.mail.stalwart import create_account, create_app_password, get_roles
 from suite.mail.utils import get_config, is_stalwart_configured
-from suite.mail.utils.validation import is_subaddressed_email, is_valid_email_for_domain
+from suite.mail.utils.logger import log_admin_action
+from suite.mail.utils.validation import is_subaddressed_email
 from suite.utils import execute_with_logging
 from suite.utils.user import is_suite_admin, is_system_manager
 
@@ -28,7 +30,37 @@
 STALWART_DEFAULT_ADMIN_ROLES = ["User", "Tenant Administrator"]
 
 
+def _lines(value: str | None) -> list[str]:
+	"""Splits a newline-separated field into its entries, dropping blanks and duplicates."""
+
+	return list(dict.fromkeys(line.strip() for line in (value or "").split("\n") if line.strip()))
+
+
 class MailAccountRequest(Document):
+	# begin: auto-generated types
+	# This code is auto-generated. Do not modify anything in this block.
+
+	from typing import TYPE_CHECKING
+
+	if TYPE_CHECKING:
+		from frappe.types import DF
+
+		account: DF.Data
+		aliases: DF.SmallText | None
+		backup_email: DF.Data
+		expires_at: DF.Datetime | None
+		groups: DF.SmallText | None
+		invited_by: DF.Link
+		ip_address: DF.Data | None
+		is_admin: DF.Check
+		is_verified: DF.Check
+		mailing_lists: DF.SmallText | None
+		quota_gb: DF.Float | None
+		request_key: DF.Data | None
+		roles: DF.SmallText | None
+		send_invite: DF.Check
+	# end: auto-generated types
+
 	def autoname(self) -> None:
 		self.name = str(uuid7())
 
@@ -53,6 +85,44 @@ def _roles(self) -> list[str]:
 
 		return list(set(roles))
 
+	@property
+	def domain(self) -> str:
+		"""Returns the domain of the primary account."""
+
+		return self.account.split("@", 1)[1] if self.account and "@" in self.account else ""
+
+	@property
+	def _aliases(self) -> list[str]:
+		"""Returns the additional email addresses to attach as aliases to the account."""
+
+		if not self.aliases:
+			return []
+
+		return [alias.strip() for alias in self.aliases.split("\n") if alias.strip()]
+
+	@property
+	def _groups(self) -> list[str]:
+		"""Returns the ids of the groups the account is added to on creation."""
+
+		return _lines(self.groups)
+
+	@property
+	def _mailing_lists(self) -> list[str]:
+		"""Returns the ids of the mailing lists the account is added to on creation."""
+
+		return _lines(self.mailing_lists)
+
+	@property
+	def _quota(self) -> int:
+		"""Returns the disk quota in bytes to create the account with.
+
+		An unset quota falls back to the configured default, which ``get_config`` resolves from Mail
+		Settings first and the site config second. An explicit ``0`` means unlimited and is left alone.
+		"""
+
+		quota_gb = self.quota_gb if self.quota_gb is not None else get_config("default_disk_quota_gb")
+		return cint(flt(quota_gb) * 1024**3)
+
 	def before_insert(self) -> None:
 		is_stalwart_configured(raise_exception=True)
 		self.validate_backup_email()
@@ -60,9 +130,11 @@ def before_insert(self) -> None:
 		self.set_expires_at()
 		self.set_ip_address()
 		self.validate_invited_by()
-		self.validate_domain()
 		self.validate_account()
+		self.validate_aliases()
 		self.validate_roles()
+		self.validate_groups()
+		self.validate_mailing_lists()
 
 	def after_insert(self) -> None:
 		if self.send_invite:
@@ -103,31 +175,49 @@ def validate_invited_by(self) -> None:
 		else:
 			self.invited_by = user
 
-	def validate_domain(self) -> None:
-		"""Validates the domain."""
-
-		if not self.domain_name:
-			frappe.throw(_("Domain is mandatory."))
-
-		self.domain_name = self.domain_name.strip().lower()
-
 	def validate_account(self) -> None:
-		"""Validates the account."""
+		"""Validates the primary account email."""
 
 		self.account = self.account.strip().lower()
 		validate_email_address(self.account, throw=True)
 		is_subaddressed_email(self.account, raise_exception=True)
 
-		if not is_valid_email_for_domain(self.account, self.domain_name):
-			frappe.throw(
-				_("Account domain {0} does not match with domain {1}.").format(
-					frappe.bold(self.account.split("@")[1]), frappe.bold(self.domain_name)
-				)
-			)
-
 		if frappe.db.exists("User", {"email": self.account}):
 			frappe.throw(_("User with email {0} already exists.").format(frappe.bold(self.account)))
 
+	def validate_aliases(self) -> None:
+		"""Validates the additional email aliases and normalizes them.
+
+		Each alias must be a valid, non-subaddressed email on a domain that exists on the server.
+		Blanks, duplicates and any alias equal to the primary account are dropped.
+		"""
+
+		if not self.aliases:
+			return
+
+		from suite.mail.stalwart import get_domains
+
+		server_domains = {domain["name"] for domain in get_domains()}
+
+		seen = set()
+		cleaned = []
+		for alias in self.aliases.split("\n"):
+			alias = alias.strip().lower()
+			if not alias or alias == self.account or alias in seen:
+				continue
+
+			validate_email_address(alias, throw=True)
+			is_subaddressed_email(alias, raise_exception=True)
+
+			domain = alias.split("@", 1)[1]
+			if domain not in server_domains:
+				frappe.throw(_("Alias domain {0} does not exist on the server.").format(frappe.bold(domain)))
+
+			seen.add(alias)
+			cleaned.append(alias)
+
+		self.aliases = "\n".join(cleaned)
+
 	def validate_roles(self) -> None:
 		"""Validates the roles."""
 
@@ -140,6 +230,38 @@ def validate_roles(self) -> None:
 
 		self.roles = "\n".join(roles_to_assign)
 
+	def validate_groups(self) -> None:
+		"""Validates the groups the account will join and normalizes them."""
+
+		if not self.groups:
+			return
+
+		from suite.mail.stalwart import get_group_service
+
+		server_group_ids = {str(g["id"]) for g in get_group_service().get_all_groups(properties=["id"])}
+
+		for group_id in self._groups:
+			if group_id not in server_group_ids:
+				frappe.throw(_("Group {0} does not exist on the server.").format(frappe.bold(group_id)))
+
+		self.groups = "\n".join(self._groups)
+
+	def validate_mailing_lists(self) -> None:
+		"""Validates the mailing lists the account will be a recipient of and normalizes them."""
+
+		if not self.mailing_lists:
+			return
+
+		from suite.mail.stalwart import get_mailing_list_service
+
+		server_list_ids = {str(ml["id"]) for ml in get_mailing_list_service().get_all(properties=["id"])}
+
+		for list_id in self._mailing_lists:
+			if list_id not in server_list_ids:
+				frappe.throw(_("Mailing list {0} does not exist on the server.").format(frappe.bold(list_id)))
+
+		self.mailing_lists = "\n".join(self._mailing_lists)
+
 	def validate_expired(self) -> None:
 		"""Forbids action if the request has expired."""
 
@@ -172,8 +294,20 @@ def send_verification_email(self) -> None:
 			)
 			frappe.msgprint(_("Verification email sent successfully."), indicator="green", alert=True)
 
+			# Sending an invite link is worth recording, but only when an administrator did it: the
+			# signup OTP flow reaches this as Guest and is not part of the admin trail.
+			if is_suite_admin(frappe.session.user) or is_system_manager(frappe.session.user):
+				log_admin_action("send invite email", self.account)
+
 	@frappe.whitelist()
-	def force_verify_and_create_account(self, first_name: str, last_name: str, password: str) -> None:
+	def force_verify_and_create_account(
+		self,
+		first_name: str,
+		last_name: str,
+		password: str,
+		locale: str | None = None,
+		time_zone: str | None = None,
+	) -> None:
 		"""Force verify and create account for invited user."""
 
 		user = frappe.session.user
@@ -184,10 +318,21 @@ def force_verify_and_create_account(self, first_name: str, last_name: str, passw
 			frappe.throw(_("This account request is already verified."))
 
 		self.db_set("is_verified", 1)
-		self.create_account(first_name, last_name, password)
-
-	def create_account(self, first_name: str, last_name: str, password: str) -> None:
-		"""Create mail account for the user."""
+		self.create_account(first_name, last_name, password, locale, time_zone)
+
+	def create_account(
+		self,
+		first_name: str,
+		last_name: str,
+		password: str,
+		locale: str | None = None,
+		time_zone: str | None = None,
+	) -> None:
+		"""Create mail account for the user.
+
+		``locale`` and ``time_zone`` come from whoever completes the request — the admin on a forced
+		creation, the invited user on the setup form — and fall back to the server defaults when blank.
+		"""
 
 		if not self.is_verified:
 			frappe.throw(_("Account request is not verified. Please verify your email first."))
@@ -198,21 +343,21 @@ def create_account(self, first_name: str, last_name: str, password: str) -> None
 		self.validate_expired()
 
 		is_stalwart_configured(raise_exception=True)
-		self.validate_domain()
 		self.validate_account()
 
 		# Step - 1: Create Account on Stalwart
-		execute_with_logging(
+		account_id = execute_with_logging(
 			func=lambda: create_account(
 				name=self.account.split("@")[0],
-				domain=self.domain_name,
+				domain=self.domain,
 				password=password,
 				description=f"{first_name} {last_name}" if last_name else first_name,
-				aliases=[],
+				aliases=self._aliases,
 				groups=[],
 				roles=self._roles,
-				quota=cint(get_config("default_disk_quota_gb")) * 1024**3,
-				timezone=None,
+				quota=self._quota,
+				locale=locale,
+				timezone=time_zone,
 			),
 			title="Failed to create account on Stalwart",
 			user_message=_("Failed to create account on the server, check error log for details."),
@@ -257,6 +402,42 @@ def create_account(self, first_name: str, last_name: str, password: str) -> None
 				module="Mail",
 			)
 
+		# Step - 6: Join the groups and mailing lists picked when the request was created. Logged but
+		# not thrown: the account already exists, so a stale group or list must not fail the signup.
+		if account_id and self._groups:
+			execute_with_logging(
+				func=lambda: self._join_groups(account_id),
+				title="Failed to add account to groups on Stalwart",
+				module="Mail",
+			)
+
+		if self._mailing_lists:
+			execute_with_logging(
+				func=lambda: self._join_mailing_lists(),
+				title="Failed to add account to mailing lists on Stalwart",
+				module="Mail",
+			)
+
+	def _join_groups(self, account_id: str) -> None:
+		"""Adds the created account to each of the requested groups."""
+
+		from suite.mail.stalwart import get_group_service
+
+		service = get_group_service()
+		for group_id in self._groups:
+			service.add_members(group_id, [account_id])
+
+	def _join_mailing_lists(self) -> None:
+		"""Adds the account's primary address as a recipient of each requested mailing list."""
+
+		from suite.mail.stalwart import get_mailing_list_service
+
+		service = get_mailing_list_service()
+		for list_id in self._mailing_lists:
+			recipients = dict((service.get(list_id, properties=["recipients"]) or {}).get("recipients") or {})
+			recipients[self.account] = True
+			service.update(list_id, {"recipients": recipients})
+
 	def _update_user_settings(self, user: str, app_password: str) -> None:
 		"""Updates the user settings with the app password and backup email."""
 
diff --git a/suite/mail/doctype/mail_settings/mail_settings.json b/suite/mail/doctype/mail_settings/mail_settings.json
index 01dbeb0716..a32fffdb7c 100644
--- a/suite/mail/doctype/mail_settings/mail_settings.json
+++ b/suite/mail/doctype/mail_settings/mail_settings.json
@@ -41,16 +41,19 @@
   "process_pending_emails_batch_size",
   "process_pending_emails_max_batch_size",
   "logs_section",
+  "admin_log_file_count",
   "push_log_file_count",
   "inbound_log_file_count",
   "outbound_log_file_count",
   "exchange_log_file_count",
   "column_break_ztzv",
+  "admin_log_level",
   "push_log_level",
   "inbound_log_level",
   "outbound_log_level",
   "exchange_log_level",
   "column_break_pvju",
+  "admin_log_max_file_size",
   "push_log_max_file_size",
   "inbound_log_max_file_size",
   "outbound_log_max_file_size",
@@ -436,6 +439,28 @@
    "label": "Stalwart Version",
    "reqd": 1
   },
+  {
+   "default": "10",
+   "fieldname": "admin_log_file_count",
+   "fieldtype": "Int",
+   "label": "Admin Log File Count",
+   "reqd": 1
+  },
+  {
+   "default": "INFO",
+   "fieldname": "admin_log_level",
+   "fieldtype": "Select",
+   "label": "Admin Log Level",
+   "options": "ERROR\nWARNING\nINFO\nDEBUG",
+   "reqd": 1
+  },
+  {
+   "default": "5000000",
+   "fieldname": "admin_log_max_file_size",
+   "fieldtype": "Int",
+   "label": "Admin Log Max File Size",
+   "reqd": 1
+  },
   {
    "default": "10",
    "fieldname": "push_log_file_count",
diff --git a/suite/mail/doctype/mail_settings/mail_settings.py b/suite/mail/doctype/mail_settings/mail_settings.py
index aec503fbea..bda7c1f7c0 100644
--- a/suite/mail/doctype/mail_settings/mail_settings.py
+++ b/suite/mail/doctype/mail_settings/mail_settings.py
@@ -9,7 +9,7 @@
 from frappe.model.document import Document
 
 from suite.mail.doctype.dns_record.dns_record import get_dns_provider
-from suite.mail.stalwart import get_domain_by_name
+from suite.mail.stalwart import get_domain_service
 from suite.mail.utils import is_stalwart_configured
 
 
@@ -26,6 +26,9 @@ class MailSettings(Document):
 			MailClientConfiguration,
 		)
 
+		admin_log_file_count: DF.Int
+		admin_log_level: DF.Literal["ERROR", "WARNING", "INFO", "DEBUG"]
+		admin_log_max_file_size: DF.Int
 		allow_signup: DF.Check
 		ansible_play_timeout: DF.Int
 		custom_event_invites: DF.Check
@@ -175,7 +178,7 @@ def validate_signup(self) -> None:
 		for domain in signup_domains:
 			domain = domain.strip().lower()
 			if domain:
-				get_domain_by_name(domain, raise_exception=True)
+				get_domain_service().get_by_name(domain, raise_exception=True)
 				valid_signup_domains.append(domain)
 
 		self.signup_domains = "\n".join(valid_signup_domains)
diff --git a/suite/mail/events.py b/suite/mail/events.py
index fb2653bede..75b0145636 100644
--- a/suite/mail/events.py
+++ b/suite/mail/events.py
@@ -183,3 +183,10 @@ def delete_account(doc: Document, method: str | None = None) -> None:
 		with_context=False,
 		module="Mail",
 	)
+
+	# The cached JMAP session carries the account's ids. Left behind, a user recreated on the same
+	# address would inherit the deleted account's ids and every call would be scoped to an account
+	# the server no longer considers theirs.
+	from suite.mail.jmap import get_jmap_session_manager
+
+	get_jmap_session_manager(user).clear_session()
diff --git a/suite/mail/install.py b/suite/mail/install.py
index dcd2830cfc..cfd9378f79 100644
--- a/suite/mail/install.py
+++ b/suite/mail/install.py
@@ -2,7 +2,6 @@
 from frappe.core.api.file import create_new_folder
 
 from suite.suite_core.doctype.rate_limit.rate_limit import create_rate_limit
-from suite.mail.stalwart.cli import StalwartCLI
 
 
 def after_install() -> None:
@@ -12,7 +11,7 @@ def after_install() -> None:
 
 
 def after_migrate() -> None:
-	StalwartCLI()._install()
+	pass
 
 
 def add_rate_limits() -> None:
@@ -24,12 +23,17 @@ def add_rate_limits() -> None:
 		{"method_path": "suite.mail.api.account.resend_otp", "limit": 5, "seconds": 60 * 60},
 		{"method_path": "suite.mail.api.account.verify_otp", "limit": 5, "seconds": 60 * 60},
 		{"method_path": "suite.mail.api.account.get_account_request", "limit": 5, "seconds": 60 * 60},
+		{"method_path": "suite.mail.api.account.get_account_setup_options", "limit": 5, "seconds": 60 * 60},
 		{"method_path": "suite.mail.api.account.create_account", "limit": 10, "seconds": 60 * 60},
 		{"method_path": "suite.mail.api.account.send_reset_password_link", "limit": 5, "seconds": 60 * 60},
 		{"method_path": "suite.mail.api.account.validate_email_assigned", "limit": 10, "seconds": 60 * 60},
 		# suite.mail.api.admin
 		{"method_path": "suite.mail.api.admin.add_domain", "limit": 10, "seconds": 24 * 60 * 60},
 		{"method_path": "suite.mail.api.admin.add_member", "limit": 10, "seconds": 60 * 60},
+		{"method_path": "suite.mail.api.admin.add_group", "limit": 20, "seconds": 60 * 60},
+		{"method_path": "suite.mail.api.admin.add_mailing_list", "limit": 20, "seconds": 60 * 60},
+		{"method_path": "suite.mail.api.admin.add_role", "limit": 20, "seconds": 60 * 60},
+		{"method_path": "suite.mail.api.admin.add_oauth_client", "limit": 20, "seconds": 60 * 60},
 		# suite.mail.api.inbound
 		{"method_path": "suite.mail.api.inbound.fetch_blob", "limit": 60, "seconds": 60},
 		{"method_path": "suite.mail.api.inbound.pull", "limit": 10, "seconds": 60},
diff --git a/suite/mail/stalwart/__init__.py b/suite/mail/stalwart/__init__.py
index 8f44513e58..e57b482e99 100644
--- a/suite/mail/stalwart/__init__.py
+++ b/suite/mail/stalwart/__init__.py
@@ -1,3 +1,5 @@
+from urllib.parse import urljoin
+
 import frappe
 from frappe import _
 from frappe.utils import random_string
@@ -5,6 +7,7 @@
 
 from suite.mail.doctype.user_account.user_account import get_user_personal_jmap_account
 from suite.mail.stalwart.account import (
+	DEFAULT_LOCALE,
 	Account,
 	AccountService,
 	Credential,
@@ -15,133 +18,339 @@
 	StorageQuota,
 	UserRoles,
 )
+from suite.mail.stalwart.actions import Action, ActionService
 from suite.mail.stalwart.app_password import AppPassword, AppPasswordService
+from suite.mail.stalwart.connection import get_account_management_connection, get_management_connection
 from suite.mail.stalwart.domain import DkimSignatureService, Domain, DomainService
-from suite.mail.stalwart.role import RoleService
-from suite.mail.utils import get_config
+from suite.mail.stalwart.group import Group, GroupService
+from suite.mail.stalwart.logs import LogService
+from suite.mail.stalwart.mailing_list import MailingList, MailingListService
+from suite.mail.stalwart.oauth import OAuthClient, OAuthClientService
+from suite.mail.stalwart.queue import QueuedMessageService
+from suite.mail.stalwart.reports import (
+	ArfExternalReportService,
+	DmarcExternalReportService,
+	DmarcInternalReportService,
+	TlsExternalReportService,
+	TlsInternalReportService,
+)
+from suite.mail.stalwart.role import Role, RoleService
+from suite.mail.stalwart.service import ManagementService
 from suite.utils.dt import utcnow
 
+__all__ = [
+	"Account",
+	"AccountService",
+	"Action",
+	"ActionService",
+	"AppPassword",
+	"AppPasswordService",
+	"ArfExternalReportService",
+	"DmarcExternalReportService",
+	"DmarcInternalReportService",
+	"Domain",
+	"DomainService",
+	"Group",
+	"GroupService",
+	"LogService",
+	"MailingList",
+	"MailingListService",
+	"ManagementService",
+	"OAuthClient",
+	"OAuthClientService",
+	"QueuedMessageService",
+	"Role",
+	"RoleService",
+	"TlsExternalReportService",
+	"TlsInternalReportService",
+]
 
-def _resolve_alias(alias: str) -> tuple[str, str]:
-	"""Resolves alias into local-part and domain from a complete email address."""
 
-	alias = alias.strip()
-	if not alias or "@" not in alias:
-		frappe.throw(_("Alias must be a complete email address: {0}").format(alias))
+# --- service factories -----------------------------------------------------
 
-	alias_name, alias_domain = alias.split("@", 1)
-	if not alias_name or not alias_domain:
-		frappe.throw(_("Alias must be a complete email address: {0}").format(alias))
 
-	return alias_name, alias_domain
+def get_account_service() -> AccountService:
+	"""Returns an AccountService bound to the admin management connection."""
 
+	return AccountService(get_management_connection())
 
-def _resolve_group_ids(groups: list[str] | None = None) -> list[str]:
-	"""Resolves account names in groups to account IDs with validation."""
 
-	group_ids = []
-	for group in groups or []:
-		group_account = get_account_by_name(group, raise_exception=False)
-		if not group_account:
-			frappe.throw(_("Group account {0} not found on server.").format(group))
+def get_group_service() -> GroupService:
+	"""Returns a GroupService bound to the admin management connection."""
 
-		group_ids.append(group_account["id"])
+	return GroupService(get_management_connection())
 
-	return group_ids
 
+def get_domain_service() -> DomainService:
+	"""Returns a DomainService bound to the admin management connection."""
 
-@redis_cache(ttl=3600)
-def get_domain_by_name(
-	name: str, fields: list[str] | None = None, raise_exception: bool = True
-) -> dict | None:
-	"""Fetches a domain by name from the Stalwart server, selecting specific fields if provided."""
+	return DomainService(get_management_connection())
+
+
+def get_dkim_signature_service() -> DkimSignatureService:
+	"""Returns a DkimSignatureService bound to the admin management connection."""
+
+	return DkimSignatureService(get_management_connection())
+
+
+def get_role_service() -> RoleService:
+	"""Returns a RoleService bound to the admin management connection."""
+
+	return RoleService(get_management_connection())
+
+
+def get_mailing_list_service() -> MailingListService:
+	"""Returns a MailingListService bound to the admin management connection."""
+
+	return MailingListService(get_management_connection())
+
+
+def get_oauth_client_service() -> OAuthClientService:
+	"""Returns an OAuthClientService bound to the admin management connection."""
+
+	return OAuthClientService(get_management_connection())
+
+
+def get_app_password_service(account: str) -> AppPasswordService:
+	"""App passwords are account-scoped, so the returned service authenticates as ``account``."""
+
+	return AppPasswordService(get_account_management_connection(account))
 
-	domain_service = DomainService()
-	if domains := domain_service.get_all({"name": name}, fields=fields or ["id"]):
-		return domains[0]
 
-	if raise_exception:
-		frappe.throw(_("Domain {0} not found.").format(name))
+def get_queued_message_service() -> QueuedMessageService:
+	"""Returns a QueuedMessageService bound to the admin management connection."""
+
+	return QueuedMessageService(get_management_connection())
+
+
+def get_log_service() -> LogService:
+	"""Returns a LogService bound to the admin management connection."""
+
+	return LogService(get_management_connection())
+
+
+def get_action_service() -> ActionService:
+	"""Returns an ActionService bound to the admin management connection."""
+
+	return ActionService(get_management_connection())
+
+
+# Report kinds keyed by ``(kind, direction)`` → service factory. ``direction`` is ``inbound`` for
+# reports received from other servers and ``outbound`` for reports Stalwart generates and sends.
+_REPORT_SERVICES = {
+	("dmarc", "inbound"): DmarcExternalReportService,
+	("dmarc", "outbound"): DmarcInternalReportService,
+	("tls", "inbound"): TlsExternalReportService,
+	("tls", "outbound"): TlsInternalReportService,
+	("arf", "inbound"): ArfExternalReportService,
+}
+
+
+def get_report_service(kind: str, direction: str) -> ManagementService:
+	"""Returns the report service for ``(kind, direction)``, or throws if the pair is unsupported."""
+
+	service = _REPORT_SERVICES.get((kind, direction))
+	if not service:
+		frappe.throw(_("Unsupported report type: {0} {1}").format(kind, direction))
+
+	return service(get_management_connection())
+
+
+# --- cached lookups + resolvers --------------------------------------------
 
 
 @redis_cache(ttl=60)
 def get_domains() -> list[dict]:
-	"""Fetches all domains from the Stalwart server, selecting specific fields if provided."""
+	"""Returns all domains on the server (cached briefly)."""
 
-	return DomainService().get_all(
-		{}, fields=["id", "name", "description", "isEnabled", "createdAt", "dnsZoneFile"]
+	return get_domain_service().get_all(
+		properties=["id", "name", "description", "isEnabled", "createdAt", "dnsZoneFile"]
 	)
 
 
 @redis_cache(ttl=3600)
-def get_account_by_name(
-	name: str, fields: list[str] | None = None, raise_exception: bool = True
-) -> dict | None:
-	"""Fetches an account by name from the Stalwart server, selecting specific fields if provided."""
+def get_permissions() -> list[dict]:
+	"""Returns all assignable permissions as ``{value, label}`` from the Stalwart server schema.
+
+	The management API only carries raw permission keys; the server's schema endpoint provides the
+	human-readable labels (version-accurate), so we read them from there.
+	"""
 
-	account_service = AccountService()
-	if accounts := account_service.get_all({"name": name}, fields=fields or ["id"]):
-		return accounts[0]
+	from suite.mail.utils import get_config
 
-	if raise_exception:
-		frappe.throw(_("Account {0} not found.").format(name))
+	schema = get_management_connection().request(
+		method="GET", url=urljoin(get_config("server_url"), "/api/schema"), return_json=True
+	)
+	permissions = (schema.get("enums") or {}).get("Permission") or []
+	return [{"value": p["name"], "label": p.get("label") or p["name"]} for p in permissions]
 
 
 @redis_cache(ttl=3600)
-def get_role_by_description(
-	description: str, fields: list[str] | None = None, raise_exception: bool = True
-) -> dict | None:
-	"""Fetches a role by description from the Stalwart server, selecting specific fields if provided."""
+def get_action_types() -> list[dict]:
+	"""Returns the executable server actions as ``{value, label, schema_name, options}`` from the schema.
+
+	``schema_name`` is set only for actions that take extra input (e.g. DMARC troubleshooting and
+	spam classification); parameterless actions leave it ``None``. ``options`` holds the choices for
+	each enum input of that schema, so a select can be rendered without restating the server's enums —
+	which matters because the server is the only authority on the exact accepted values.
+	"""
 
-	role_service = RoleService()
-	if roles := role_service.get_all({"description": description}, fields=fields or ["id"]):
-		# Assuming description is unique and returning the first match.
-		return roles[0]
+	from suite.mail.utils import get_config
 
-	if raise_exception:
-		frappe.throw(_("Role with description {0} not found.").format(description))
+	schema = get_management_connection().request(
+		method="GET", url=urljoin(get_config("server_url"), "/api/schema"), return_json=True
+	)
+	enums = schema.get("enums") or {}
+	fields = schema.get("fields") or {}
+
+	def choice(variant: dict) -> dict:
+		# A few enum variants ship with an empty label and the description folded into the name
+		# ("bit8Mime - 8-bit MIME message content"); the name is still the only accepted value.
+		name = variant["name"]
+		label = variant.get("label") or (name.split(" - ", 1)[1] if " - " in name else name)
+		return {"value": name, "label": label}
+
+	def enum_options(schema_name: str | None) -> dict:
+		properties = (fields.get(schema_name) or {}).get("properties") or {}
+		options = {}
+		for name, spec in properties.items():
+			type = spec.get("type") or {}
+			if spec.get("update") == "serverSet" or type.get("type") != "enum":
+				continue
+			options[name] = [choice(v) for v in enums.get(type.get("enumName")) or []]
+		return options
+
+	variants = (schema.get("schemas") or {}).get("x:Action", {}).get("variants") or []
+	return [
+		{
+			"value": v["name"],
+			"label": v.get("label") or v["name"],
+			"schema_name": v.get("schemaName"),
+			"options": enum_options(v.get("schemaName")),
+		}
+		for v in variants
+	]
 
 
 @redis_cache(ttl=3600)
-def get_roles(description: str | None = None, fields: list[str] | None = None) -> list[dict]:
-	"""Fetches roles from the Stalwart server, filtering by description if provided, and selecting specific fields if provided."""
+def get_account_metadata() -> dict:
+	"""Returns the locale and time zone choices for an account, each as ``{value, label}``.
 
-	filters = {}
-	if description:
-		filters["description"] = description
+	The locale label leads with the code so it stays scannable, and keeps the schema's description
+	after it because the picker matches on the label — which is what makes searching by language
+	rather than by code work.
+	"""
 
-	role_service = RoleService()
-	return role_service.get_all(filters, fields=fields or ["id", "description"])
+	from suite.mail.utils import get_config
 
+	schema = get_management_connection().request(
+		method="GET", url=urljoin(get_config("server_url"), "/api/schema"), return_json=True
+	)
+	enums = schema.get("enums") or {}
+	return {
+		"locales": [
+			{"value": v["name"], "label": f"{v['name']} · {v['label']}" if v.get("label") else v["name"]}
+			for v in enums.get("Locale") or []
+		],
+		# The time zone label is only the id with its underscores spaced out, so the id itself reads
+		# better and matches what the member and group pages show.
+		"time_zones": [{"value": v["name"], "label": v["name"]} for v in enums.get("TimeZone") or []],
+	}
 
-def create_domain(name: str, description: str | None = None) -> str:
-	"""Creates a new domain on the Stalwart server with the specified name and description, returning the new domain's ID."""
 
-	domain = Domain(
-		name=name,
-		description=description,
+@redis_cache(ttl=3600)
+def get_log_labels() -> dict:
+	"""Returns the display labels for log entries as ``{"events": {...}, "levels": {...}}``.
+
+	Log entries carry raw identifiers (``smtp.dmarc-fail``, ``warn``); the schema's ``EventType`` and
+	``TracingLevel`` enums hold the human labels for them, so they stay version-accurate rather than
+	being duplicated here.
+	"""
+
+	from suite.mail.utils import get_config
+
+	schema = get_management_connection().request(
+		method="GET", url=urljoin(get_config("server_url"), "/api/schema"), return_json=True
 	)
-	domain_id = DomainService().create(domain)
 
-	get_domain_by_name.clear_cache()
-	get_domains.clear_cache()
+	def labels(items: list[dict]) -> dict:
+		return {i["name"]: i.get("label") or i["name"] for i in items}
+
+	enums = schema.get("enums") or {}
+	return {"events": labels(enums.get("EventType") or []), "levels": labels(enums.get("TracingLevel") or [])}
+
+
+@redis_cache(ttl=3600)
+def get_queue_metadata() -> dict:
+	"""Returns the enum/variant option lists used to render and edit queued messages.
+
+	All values come from the server schema so labels stay version-accurate: message flags, recipient
+	status types, delivery error types and expiry types (each as ``{value, label}``).
+	"""
+
+	from suite.mail.utils import get_config
+
+	schema = get_management_connection().request(
+		method="GET", url=urljoin(get_config("server_url"), "/api/schema"), return_json=True
+	)
+
+	def options(items: list[dict]) -> list[dict]:
+		return [{"value": i["name"], "label": i.get("label") or i["name"]} for i in items]
+
+	enums = schema.get("enums") or {}
+	schemas = schema.get("schemas") or {}
+	return {
+		"message_flags": options(enums.get("MessageFlag") or []),
+		"status_types": options((schemas.get("x:RecipientStatus") or {}).get("variants") or []),
+		"error_types": options(enums.get("DeliveryErrorType") or []),
+		"expiry_types": options((schemas.get("x:QueueExpiry") or {}).get("variants") or []),
+	}
+
+
+@redis_cache(ttl=3600)
+def get_roles(description: str | None = None) -> list[dict]:
+	"""Returns roles on the server, optionally filtered by description (cached)."""
+
+	filter = {"description": description} if description else None
+	return get_role_service().get_all(filter=filter, properties=["id", "description"])
+
+
+def resolve_domain_id(name: str, raise_exception: bool = True) -> str | None:
+	"""Resolves a domain name to its Stalwart id."""
 
-	return domain_id
+	domain = get_domain_service().get_by_name(name, raise_exception=raise_exception)
+	return domain["id"] if domain else None
 
 
-def delete_domain(domain_id: str) -> None:
-	"""Deletes a domain from the Stalwart server by ID."""
+def resolve_role_ids(descriptions: list[str] | None) -> list[str]:
+	if not descriptions:
+		return []
 
-	# Stalwart refuses to delete a domain while DKIM signatures are still linked to it,
-	# so the linked DKIM signatures must be removed first.
-	dkim_service = DkimSignatureService()
-	dkim_signature_ids = [signature["id"] for signature in dkim_service.get_all_by_domain(domain_id)]
-	if dkim_signature_ids:
-		dkim_service.delete(dkim_signature_ids)
+	role_map = {r["description"]: r["id"] for r in get_roles()}
 
-	DomainService().delete([domain_id])
-	get_domain_by_name.clear_cache()
-	get_domains.clear_cache()
+	role_ids = []
+	for description in descriptions:
+		role_id = role_map.get(description)
+		if not role_id:
+			frappe.throw(_("Role {0} does not exist on the Stalwart server.").format(description))
+
+		role_ids.append(role_id)
+
+	return role_ids
+
+
+def _resolve_alias(alias: str) -> tuple[str, str]:
+	"""Splits a full email address into its local-part and domain."""
+
+	alias = (alias or "").strip()
+	name, _, domain = alias.partition("@")
+	if not name or not domain:
+		frappe.throw(_("Alias must be a complete email address: {0}").format(alias))
+
+	return name, domain
+
+
+# --- high-level conveniences used by hooks, doctypes and admin APIs --------
 
 
 def create_account(
@@ -153,113 +362,90 @@ def create_account(
 	groups: list[str] | None = None,
 	roles: list[str] | None = None,
 	quota: int | None = None,
+	locale: str | None = None,
 	timezone: str | None = None,
-) -> None:
-	"""Creates an account on the Stalwart server with the specified parameters."""
+) -> str:
+	"""Creates a user account, resolving domain/group/role names to ids."""
+
+	account_service = get_account_service()
+	domain_service = get_domain_service()
 
-	domain_id = get_domain_by_name(domain, raise_exception=True)["id"]
-	password = password or random_string(12)
+	domain_id = domain_service.get_by_name(domain, raise_exception=True)["id"]
 
 	email_aliases = []
-	domain_ids_map = {domain: domain_id}
+	domain_ids = {domain: domain_id}
 	for alias in aliases or []:
 		if not alias:
 			continue
 
 		alias_name, alias_domain = _resolve_alias(alias)
+		if alias_domain not in domain_ids:
+			domain_ids[alias_domain] = domain_service.get_by_name(alias_domain, raise_exception=True)["id"]
 
-		alias_domain_id = domain_ids_map.get(alias_domain)
-		if not alias_domain_id:
-			alias_domain_id = get_domain_by_name(alias_domain, raise_exception=True)["id"]
-			domain_ids_map[alias_domain] = alias_domain_id
+		email_aliases.append(EmailAlias(name=alias_name, domain_id=domain_ids[alias_domain]))
 
-		email_aliases.append(EmailAlias(name=alias_name, domain_id=alias_domain_id))
+	member_group_ids = [
+		account_service.get_by_name(group, raise_exception=True)["id"] for group in groups or [] if group
+	]
 
-	member_group_ids = _resolve_group_ids(groups)
-
-	user_roles = UserRoles(type=RoleType.USER)
-	if roles:
-		role_ids = []
-		server_roles_map = {r["description"]: r["id"] for r in get_roles()}
-
-		for role in roles:
-			role_id = server_roles_map.get(role)
-			if not role_id:
-				frappe.throw(_("Role {0} does not exist on the server.").format(role))
-
-			role_ids.append(role_id)
-
-		if role_ids:
-			user_roles = UserRoles(type=RoleType.CUSTOM, roles=CustomRoles(role_ids=role_ids))
-
-	quotas = StorageQuota(max_disk_quota=quota) if quota is not None else None
+	role_ids = resolve_role_ids(roles)
+	user_roles = (
+		UserRoles(type=RoleType.CUSTOM, roles=CustomRoles(role_ids=role_ids))
+		if role_ids
+		else UserRoles(type=RoleType.USER)
+	)
 
 	account = Account(
 		name=name,
 		domain_id=domain_id,
-		credentials=[Credential(password=PasswordCredential(secret=password))],
-		member_group_ids=member_group_ids,
+		credentials=[Credential(password=PasswordCredential(secret=password or random_string(12)))],
+		member_group_ids=member_group_ids or None,
 		roles=user_roles,
-		quotas=quotas,
-		aliases=email_aliases,
+		quotas=StorageQuota(max_disk_quota=quota) if quota is not None else StorageQuota(),
+		aliases=email_aliases or None,
 		description=description,
+		locale=locale or DEFAULT_LOCALE,
 		timezone=timezone,
 	)
 
-	AccountService().create(account)
+	return account_service.create(account)
 
 
 def create_app_password(account: str, description: str | None = None) -> str:
-	"""Creates an app password for the specified account on the Stalwart server and returns the generated secret."""
+	"""Creates an app password for ``account`` and returns the generated secret."""
 
 	description = description or f"App Password for {frappe.local.site} - {utcnow()}"
-
-	config = get_config()
-	server_url = config["server_url"]
-	username = f"{account}%{config['username']}"
-	password = config["password"]
-
-	return AppPasswordService(
-		credentials={"server_url": server_url, "username": username, "password": password}
-	).create(AppPassword(description=description))
+	return get_app_password_service(account).create(AppPassword(description=description))
 
 
 def update_password(user: str | None = None, new_password: str | None = None) -> None:
-	"""Updates the password for the specified user's personal account on the Stalwart server."""
+	"""Sets the password of the user's personal Stalwart account (no-op if they have none)."""
 
-	if not user:
-		frappe.throw(_("User is required to update password on Stalwart server."))
-	if not new_password:
-		frappe.throw(_("New password is required to update password on Stalwart server."))
+	if not user or not new_password:
+		frappe.throw(_("User and new password are required to update the Stalwart password."))
 
-	account = get_user_personal_jmap_account(user, raise_exception=False)
-	AccountService().update_password(account, new_password)
+	if account := get_user_personal_jmap_account(user, raise_exception=False):
+		get_account_service().set_password(account, new_password)
 
 
 def delete_account(user: str) -> None:
-	"""Deletes the personal account of the specified user from the Stalwart server."""
+	"""Deletes the user's personal Stalwart account (no-op if they have none)."""
 
-	account = get_user_personal_jmap_account(user, raise_exception=False)
-	AccountService().delete([account])
+	if account := get_user_personal_jmap_account(user, raise_exception=False):
+		get_account_service().delete(account)
 
 
 def add_account_role(user: str, role: str) -> None:
-	"""Applies a Stalwart role (identified by its description) to the specified user's personal account."""
+	"""Applies a role (by description) to the user's personal account (no-op if they have none)."""
 
-	account = get_user_personal_jmap_account(user, raise_exception=False)
-	if not account:
-		return
-
-	role_id = get_role_by_description(role, raise_exception=True)["id"]
-	AccountService().add_roles(account, [role_id])
+	if account := get_user_personal_jmap_account(user, raise_exception=False):
+		role_id = get_role_service().get_by_description(role, raise_exception=True)["id"]
+		get_account_service().add_roles(account, [role_id])
 
 
 def remove_account_role(user: str, role: str) -> None:
-	"""Removes a Stalwart role (identified by its description) from the specified user's personal account."""
-
-	account = get_user_personal_jmap_account(user, raise_exception=False)
-	if not account:
-		return
+	"""Removes a role (by description) from the user's personal account (no-op if they have none)."""
 
-	role_id = get_role_by_description(role, raise_exception=True)["id"]
-	AccountService().remove_roles(account, [role_id])
+	if account := get_user_personal_jmap_account(user, raise_exception=False):
+		role_id = get_role_service().get_by_description(role, raise_exception=True)["id"]
+		get_account_service().remove_roles(account, [role_id])
diff --git a/suite/mail/stalwart/account.py b/suite/mail/stalwart/account.py
index 1920e74120..7d755e468c 100644
--- a/suite/mail/stalwart/account.py
+++ b/suite/mail/stalwart/account.py
@@ -1,15 +1,16 @@
-import json
 from dataclasses import dataclass, field
 from enum import Enum
-from typing import ClassVar
 
 import frappe
 from frappe import _
 from frappe.utils import random_string
 
-from suite.mail.stalwart.cli import StalwartCLI
+from suite.mail.stalwart.service import ManagementService
 from suite.utils import snake_to_camel
 
+# Stalwart requires every account to carry a locale, so one is picked when none was chosen.
+DEFAULT_LOCALE = "en_US"
+
 
 class CredentialType(Enum):
 	PASSWORD = "Password"
@@ -21,10 +22,14 @@ class PasswordCredential:
 
 
 def _default_password_credential() -> PasswordCredential:
+	"""Returns a password credential seeded with a random secret."""
+
 	return PasswordCredential(secret=random_string(20))
 
 
 def _default_credentials() -> list["Credential"]:
+	"""Returns the default credential list (a single random password)."""
+
 	return [Credential()]
 
 
@@ -34,13 +39,12 @@ class Credential:
 	password: PasswordCredential = field(default_factory=_default_password_credential)
 
 	def to_dict(self) -> dict:
+		"""Serializes the credential to the JMAP wire format."""
+
 		if self.type == CredentialType.PASSWORD:
-			return {
-				"@type": self.type.value,
-				"secret": self.password.secret,
-			}
-		else:
-			raise ValueError(f"Unsupported credential type: {self.type}")
+			return {"@type": self.type.value, "secret": self.password.secret}
+
+		raise ValueError(f"Unsupported credential type: {self.type}")
 
 
 class RoleType(Enum):
@@ -60,6 +64,8 @@ class UserRoles:
 	roles: CustomRoles | None = None
 
 	def __post_init__(self) -> None:
+		"""Validates that role ids are present only for the custom role type."""
+
 		if self.type == RoleType.CUSTOM and not self.roles:
 			raise ValueError("Custom role type requires roles to be defined.")
 
@@ -67,10 +73,12 @@ def __post_init__(self) -> None:
 			raise ValueError("Only custom role type can have roles defined.")
 
 	def to_dict(self) -> dict:
+		"""Serializes the roles tagged union to the JMAP wire format."""
+
 		if self.type == RoleType.CUSTOM:
 			return {"@type": self.type.value, "roleIds": {role_id: True for role_id in self.roles.role_ids}}
-		else:
-			return {"@type": self.type.value}
+
+		return {"@type": self.type.value}
 
 
 class PermissionType(Enum):
@@ -91,35 +99,33 @@ class Permissions:
 	permissions: PermissionsList | None = None
 
 	def __post_init__(self) -> None:
-		if self.type == PermissionType.INHERIT and (
-			self.permissions
-			and (self.permissions.enabled_permissions or self.permissions.disabled_permissions)
-		):
-			raise ValueError(
-				"Inherit permission type should not have enabled or disabled permissions defined."
-			)
-
-		if self.type != PermissionType.INHERIT and not (
-			self.permissions
-			and (self.permissions.enabled_permissions or self.permissions.disabled_permissions)
-		):
-			raise ValueError(
-				"Merge or Replace permission type requires at least one of enabled or disabled permissions to be defined."
-			)
+		"""Validates that a permission list is present unless the type is Inherit."""
+
+		has_permissions = self.permissions and (
+			self.permissions.enabled_permissions or self.permissions.disabled_permissions
+		)
+
+		if self.type == PermissionType.INHERIT and has_permissions:
+			raise ValueError("Inherit permission type cannot define enabled or disabled permissions.")
+
+		if self.type != PermissionType.INHERIT and not has_permissions:
+			raise ValueError("Merge or Replace permission type requires enabled or disabled permissions.")
 
 	def to_dict(self) -> dict:
+		"""Serializes the permissions tagged union to the JMAP wire format."""
+
 		if self.type == PermissionType.INHERIT:
 			return {"@type": self.type.value}
-		else:
-			return {
-				"@type": self.type.value,
-				"enabledPermissions": {perm: True for perm in self.permissions.enabled_permissions}
-				if self.permissions and self.permissions.enabled_permissions
-				else {},
-				"disabledPermissions": {perm: True for perm in self.permissions.disabled_permissions}
-				if self.permissions and self.permissions.disabled_permissions
-				else {},
-			}
+
+		return {
+			"@type": self.type.value,
+			"enabledPermissions": {perm: True for perm in self.permissions.enabled_permissions}
+			if self.permissions and self.permissions.enabled_permissions
+			else {},
+			"disabledPermissions": {perm: True for perm in self.permissions.disabled_permissions}
+			if self.permissions and self.permissions.disabled_permissions
+			else {},
+		}
 
 
 @dataclass
@@ -145,17 +151,16 @@ class StorageQuota:
 	max_disk_quota: int | None = None
 
 	def __post_init__(self) -> None:
+		"""Rejects any negative quota value."""
+
 		for field_name, value in self.__dict__.items():
 			if value is not None and value < 0:
 				raise ValueError(f"{field_name} cannot be negative")
 
 	def to_dict(self) -> dict:
-		quotas = {}
-		for field_name, value in self.__dict__.items():
-			if value is not None:
-				quotas[snake_to_camel(field_name)] = value
+		"""Serializes the set quotas to a camelCase JMAP map, omitting unset limits."""
 
-		return quotas
+		return {snake_to_camel(name): value for name, value in self.__dict__.items() if value is not None}
 
 
 @dataclass
@@ -166,6 +171,8 @@ class EmailAlias:
 	description: str | None = None
 
 	def to_dict(self) -> dict:
+		"""Serializes the alias to the JMAP wire format."""
+
 		return {
 			"name": self.name,
 			"domainId": self.domain_id,
@@ -187,6 +194,8 @@ class EncryptionSettings:
 	allow_spam_training: bool = False
 
 	def to_dict(self) -> dict:
+		"""Serializes the encryption settings to the JMAP wire format."""
+
 		return {
 			"publicKey": self.public_key_id,
 			"encryptOnAppend": self.encrypt_on_append,
@@ -200,6 +209,8 @@ class EncryptionAtRest:
 	settings: EncryptionSettings | None = None
 
 	def __post_init__(self) -> None:
+		"""Validates that settings are present only when encryption is enabled."""
+
 		if self.type != EncryptionType.DISABLED and not self.settings:
 			raise ValueError("Encryption settings must be provided when encryption is enabled.")
 
@@ -207,10 +218,12 @@ def __post_init__(self) -> None:
 			raise ValueError("Encryption settings should not be provided when encryption is disabled.")
 
 	def to_dict(self) -> dict:
+		"""Serializes the encryption-at-rest tagged union to the JMAP wire format."""
+
 		if self.type == EncryptionType.DISABLED:
 			return {"@type": self.type.value}
-		else:
-			return {"@type": self.type.value, "settings": self.settings.to_dict()}
+
+		return {"@type": self.type.value, "settings": self.settings.to_dict()}
 
 
 @dataclass
@@ -224,19 +237,19 @@ class Account:
 	quotas: StorageQuota = field(default_factory=StorageQuota)
 	aliases: list[EmailAlias] | None = None
 	description: str | None = None
-	locale: str = "en_US"
+	locale: str = DEFAULT_LOCALE
 	timezone: str | None = None
 	encryption_at_rest: EncryptionAtRest = field(default_factory=EncryptionAtRest)
 
-	def __post_init__(self) -> None:
-		self.encryption_at_rest = self.encryption_at_rest or EncryptionAtRest(type=EncryptionType.DISABLED)
-
 	def to_dict(self) -> dict:
+		"""Serializes the account to the JMAP wire format."""
+
 		return {
 			"@type": "User",
 			"name": self.name,
 			"domainId": self.domain_id,
-			"credentials": {f"{idx}": credential.to_dict() for idx, credential in enumerate(self.credentials)}
+			# credentials, memberGroupIds and aliases are id-keyed maps on the wire, not arrays.
+			"credentials": {f"{idx}": c.to_dict() for idx, c in enumerate(self.credentials)}
 			if self.credentials
 			else {},
 			"memberGroupIds": {group_id: True for group_id in self.member_group_ids}
@@ -245,9 +258,7 @@ def to_dict(self) -> dict:
 			"roles": self.roles.to_dict() if self.roles else {},
 			"permissions": self.permissions.to_dict() if self.permissions else {},
 			"quotas": self.quotas.to_dict() if self.quotas else {},
-			"aliases": {f"{idx}": alias.to_dict() for idx, alias in enumerate(self.aliases)}
-			if self.aliases
-			else {},
+			"aliases": {f"{idx}": a.to_dict() for idx, a in enumerate(self.aliases)} if self.aliases else {},
 			"description": self.description,
 			"locale": self.locale,
 			"timeZone": self.timezone,
@@ -255,8 +266,9 @@ def to_dict(self) -> dict:
 		}
 
 
-class AccountService(StalwartCLI):
-	DEFAULT_FIELDS: ClassVar[list[str]] = [
+class AccountService(ManagementService):
+	type = "Account"
+	default_properties = [
 		"@type",
 		"id",
 		"name",
@@ -264,178 +276,66 @@ class AccountService(StalwartCLI):
 		"emailAddress",
 		"aliases",
 		"domainId",
+		"locale",
 		"memberGroupIds",
 		"quotas",
 		"roles",
 		"timeZone",
 		"usedDiskQuota",
 	]
-	ALLOWED_FILTER_KEYS: ClassVar[set[str]] = {"text", "name", "domainId", "memberGroupIds"}
 
-	@classmethod
-	def _resolved_fields(cls, fields: list[str] | None) -> list[str]:
-		return fields if isinstance(fields, list) else cls.DEFAULT_FIELDS
+	def get_by_name(
+		self, name: str, properties: list[str] | None = None, raise_exception: bool = True
+	) -> dict | None:
+		"""Returns the account with the given name, or ``None`` (throws if ``raise_exception``)."""
 
-	@classmethod
-	def _append_filters(cls, commands: list[str], filters: dict[str, str]) -> None:
-		for key, value in filters.items():
-			if key in cls.ALLOWED_FILTER_KEYS:
-				commands.extend(["--where", f"{key}={value}"])
-			else:
-				frappe.throw(
-					_("Invalid filter key: {0}. Allowed keys are: {1}").format(
-						key, ", ".join(cls.ALLOWED_FILTER_KEYS)
-					)
-				)
+		account = self.find({"name": name}, properties=properties or ["id"])
+		if not account and raise_exception:
+			frappe.throw(_("Account {0} not found on the Stalwart server.").format(name))
 
-	@staticmethod
-	def _parse_query_output(output: str) -> list[dict]:
-		if not output:
-			return []
+		return account
 
-		return [json.loads(account) for account in output.splitlines()]
+	def _current_role_ids(self, account_id: str) -> list[str]:
+		"""Returns the account's currently assigned custom role ids."""
 
-	def get(self, id: str, fields: list[str] | None = None) -> dict:
-		"""Fetches an account by ID from the Stalwart server, selecting specific fields if provided."""
+		roles = (self.get(account_id, properties=["roles"]) or {}).get("roles") or {}
+		role_ids = roles.get("roleIds") or {}
+		return list(role_ids.keys() if isinstance(role_ids, dict) else role_ids)
 
-		fields = self._resolved_fields(fields)
+	def _set_roles(self, account_id: str, role_ids: list[str]) -> None:
+		"""Replaces the account's roles with the given ids (empty reverts to the default user role)."""
 
-		commands = ["get", "Account", id]
-
-		if fields:
-			commands.extend(["--fields", ",".join(fields)])
-
-		commands.append("--json")
-		response = self.run(commands)
-
-		if response["success"]:
-			if response["output"]:
-				return json.loads(response["output"])
-			else:
-				frappe.throw(title=_("Account not found"), msg=_("Account with ID {0} not found.").format(id))
-		else:
-			frappe.throw(title=_("Failed to fetch account"), msg=response["output"] or response["error"])
-
-	def get_all(self, filters: dict[str, str] | None = None, fields: list[str] | None = None) -> list[dict]:
-		"""Fetches all accounts from the Stalwart server, applying optional filters and selecting specific fields."""
-
-		filters = filters or {}
-		fields = self._resolved_fields(fields)
-
-		commands = ["query", "Account"]
-
-		if filters:
-			self._append_filters(commands, filters)
-
-		if fields:
-			commands.extend(["--fields", ",".join(fields)])
-
-		commands.append("--json")
-		response = self.run(commands)
-
-		if response["success"]:
-			return self._parse_query_output(response["output"])
-		else:
-			frappe.throw(title=_("Failed to fetch accounts"), msg=response["output"] or response["error"])
-
-	def create(self, account: "Account") -> None:
-		"""Creates a new account on the Stalwart server with the provided account data."""
-
-		account_data = account.to_dict()
-		account_json = json.dumps(account_data)
-		response = self.run(["create", "Account", "--json", account_json])
-
-		if not response["success"]:
-			frappe.throw(title=_("Failed to create account"), msg=response["output"] or response["error"])
-
-	def delete(self, ids: list[str]) -> None:
-		"""Deletes accounts with the specified IDs from the Stalwart server."""
-
-		if not ids:
-			frappe.throw(title=_("No account IDs provided"), msg=_("No account IDs provided for deletion."))
-
-		response = self.run(["delete", "Account", "--ids", ",".join(ids)])
-
-		if not response["success"]:
-			frappe.throw(title=_("Failed to delete accounts"), msg=response["output"] or response["error"])
-
-	def add_roles(self, account: str, role_ids: list[str]) -> None:
-		"""Adds the given role IDs to the account, switching it to a custom role set while preserving existing roles."""
-
-		if not role_ids:
-			return
-
-		current_roles = self.get(account, fields=["roles"]).get("roles") or {}
-		current_role_ids = current_roles.get("roleIds") or {}
-		existing = list(current_role_ids.keys() if isinstance(current_role_ids, dict) else current_role_ids)
-
-		merged = list(dict.fromkeys([*existing, *role_ids]))
-
-		# `roles` is a tagged union; its `@type` discriminator can't be patched via a sub-path
-		# (the server rejects `roles/@type` as an invalid JSON Pointer path). Replace the whole
-		# field with a full JSON object instead.
-		roles = UserRoles(type=RoleType.CUSTOM, roles=CustomRoles(role_ids=merged))
-		commands = ["update", "Account", account, "--field", f"roles={json.dumps(roles.to_dict())}"]
-
-		response = self.run(commands)
-
-		if not response["success"]:
-			frappe.throw(
-				title=_("Failed to update roles for account {0}").format(account),
-				msg=response["output"] or response["error"],
-			)
-
-	def remove_roles(self, account: str, role_ids: list[str]) -> None:
-		"""Removes the given role IDs from the account, reverting to the default user role set when none remain."""
-
-		if not role_ids:
-			return
-
-		current_roles = self.get(account, fields=["roles"]).get("roles") or {}
-		current_role_ids = current_roles.get("roleIds") or {}
-		existing = list(current_role_ids.keys() if isinstance(current_role_ids, dict) else current_role_ids)
-
-		remove = set(role_ids)
-		remaining = [role_id for role_id in existing if role_id not in remove]
-
-		# Replace the whole `roles` field with a full JSON object rather than patching sub-paths of
-		# the tagged union (the server rejects patching the `@type` discriminator via a pointer path).
-		if remaining:
-			roles = UserRoles(type=RoleType.CUSTOM, roles=CustomRoles(role_ids=remaining))
+		# roles is a tagged union; its @type discriminator can't be patched via a sub-path, so the
+		# whole field is replaced.
+		if role_ids:
+			roles = UserRoles(type=RoleType.CUSTOM, roles=CustomRoles(role_ids=list(dict.fromkeys(role_ids))))
 		else:
 			roles = UserRoles(type=RoleType.USER)
 
-		commands = ["update", "Account", account, "--field", f"roles={json.dumps(roles.to_dict())}"]
+		self.update(account_id, {"roles": roles.to_dict()})
 
-		response = self.run(commands)
+	def add_roles(self, account_id: str, role_ids: list[str]) -> None:
+		"""Adds role ids to the account, keeping any it already has."""
 
-		if not response["success"]:
-			frappe.throw(
-				title=_("Failed to update roles for account {0}").format(account),
-				msg=response["output"] or response["error"],
-			)
+		if role_ids:
+			self._set_roles(account_id, [*self._current_role_ids(account_id), *role_ids])
 
-	def update_password(self, account: str, new_password: str) -> None:
-		"""Updates the password for the specified account on the Stalwart server."""
+	def remove_roles(self, account_id: str, role_ids: list[str]) -> None:
+		"""Removes the given role ids from the account."""
 
-		if not new_password:
-			frappe.throw(title=_("Invalid password"), msg=_("New password cannot be empty."))
+		if role_ids:
+			remove = set(role_ids)
+			self._set_roles(account_id, [r for r in self._current_role_ids(account_id) if r not in remove])
 
-		credentials = self.get(account, fields=["credentials"]).get("credentials", {})
+	def set_password(self, account_id: str, new_password: str) -> None:
+		"""Sets the account's primary password credential, leaving other credentials intact."""
 
-		row_id = "0"
-		if credentials:
-			for idx, credential in credentials.items():
-				if credential["@type"] == CredentialType.PASSWORD.value:
-					row_id = str(idx)
-					break
+		if not new_password:
+			frappe.throw(_("New password cannot be empty."))
 
-		response = self.run(
-			["update", "Account", account, "--field", f"credentials/{row_id}/secret={new_password}"]
+		credentials = (self.get(account_id, properties=["credentials"]) or {}).get("credentials") or {}
+		row_id = next(
+			(idx for idx, c in credentials.items() if c.get("@type") == CredentialType.PASSWORD.value), "0"
 		)
 
-		if not response["success"]:
-			frappe.throw(
-				title=_("Failed to update password for account {0}").format(account),
-				msg=response["output"] or response["error"],
-			)
+		self.update(account_id, {f"credentials/{row_id}/secret": new_password})
diff --git a/suite/mail/stalwart/actions.py b/suite/mail/stalwart/actions.py
new file mode 100644
index 0000000000..f0a896d24b
--- /dev/null
+++ b/suite/mail/stalwart/actions.py
@@ -0,0 +1,34 @@
+from suite.mail.stalwart.service import ManagementService, Serializable
+
+
+class Action(Serializable):
+	"""A server management action, dispatched by its ``@type`` (see the ``ActionType`` schema enum).
+
+	Most actions are parameterless (reloads, cache invalidation, queue pause/resume). A few carry
+	extra input, e.g. ``TroubleshootDmarc`` and ``ClassifySpam``; those extra fields are passed
+	through verbatim in ``params``.
+	"""
+
+	def __init__(self, action_type: str, params: dict | None = None) -> None:
+		self.action_type = action_type
+		self.params = params or {}
+
+	def to_dict(self) -> dict:
+		"""Serializes the action to the JMAP wire format (``@type`` plus any parameters)."""
+
+		return {"@type": self.action_type, **self.params}
+
+
+class ActionService(ManagementService):
+	"""Executes server management actions (``x:Action``).
+
+	Actions are not queryable objects; running one is a ``set``/create whose created object carries
+	any result (e.g. the DMARC troubleshooting outcome or the spam classification score).
+	"""
+
+	type = "Action"
+
+	def run(self, action_type: str, params: dict | None = None) -> dict:
+		"""Executes ``action_type`` and returns the created action object, including any result."""
+
+		return self._create(Action(action_type, params))
diff --git a/suite/mail/stalwart/app_password.py b/suite/mail/stalwart/app_password.py
index 32b6b24e68..6963ece51c 100644
--- a/suite/mail/stalwart/app_password.py
+++ b/suite/mail/stalwart/app_password.py
@@ -1,52 +1,45 @@
-import json
-import re
 from dataclasses import dataclass, field
-from typing import ClassVar
 
 import frappe
 from frappe import _
 
 from suite.mail.stalwart.account import Permissions
-from suite.mail.stalwart.cli import StalwartCLI
+from suite.mail.stalwart.service import ManagementService
 
 
 @dataclass
 class AppPassword:
 	description: str
 	permissions: Permissions = field(default_factory=Permissions)
+	allowed_ips: list[str] | None = None
+	expires_at: str | None = None
 
 	def to_dict(self) -> dict:
-		return {
-			"description": self.description,
-			"permissions": self.permissions.to_dict(),
-		}
+		"""Serializes the app password to the JMAP wire format."""
 
+		payload = {"description": self.description, "permissions": self.permissions.to_dict()}
+		if self.allowed_ips:
+			payload["allowedIps"] = list(self.allowed_ips)
+		if self.expires_at:
+			payload["expiresAt"] = self.expires_at
 
-class AppPasswordService(StalwartCLI):
-	SECRET_PATTERN: ClassVar[re.Pattern] = re.compile(r"Secret:\s*(\S+)")
+		return payload
 
-	@classmethod
-	def _parse_secret(cls, output: str) -> str | None:
-		match = cls.SECRET_PATTERN.search(output)
-		return match.group(1) if match else None
 
-	def create(self, app_password: AppPassword) -> str:
-		"""Creates an app password on Stalwart and returns the generated secret."""
+class AppPasswordService(ManagementService):
+	"""App Passwords are account-scoped, so this service needs a connection authenticated as the
+	target account (see ``get_app_password_service``)."""
+
+	type = "AppPassword"
 
-		app_password_data = app_password.to_dict()
-		app_password_json = json.dumps(app_password_data)
-		response = self.run(["create", "AppPassword", "--json", app_password_json])
+	def create(self, app_password: AppPassword) -> str:
+		"""Creates an app password and returns the generated secret.
 
-		if not response["success"]:
-			frappe.throw(
-				title=_("Failed to create app password"), msg=response["output"] or response["error"]
-			)
+		Returns the secret rather than the id because the server only exposes it at creation time.
+		"""
 
-		secret = self._parse_secret(response["output"])
+		secret = self._create(app_password).get("secret")
 		if not secret:
-			frappe.throw(
-				title=_("Failed to parse app password secret"),
-				msg=_("Could not extract the generated app password secret from the response."),
-			)
+			frappe.throw(_("The Stalwart server did not return a generated app password secret."))
 
 		return secret
diff --git a/suite/mail/stalwart/cli.py b/suite/mail/stalwart/cli.py
deleted file mode 100644
index eb69b62ba0..0000000000
--- a/suite/mail/stalwart/cli.py
+++ /dev/null
@@ -1,155 +0,0 @@
-import os
-import platform
-import shutil
-import subprocess
-import tarfile
-import urllib.request
-from typing import TYPE_CHECKING, ClassVar
-
-import frappe
-from frappe import _
-
-from suite.mail.utils import (
-	get_config,
-	get_mail_app_path,
-	get_stalwart_cli_path,
-	get_stalwart_cli_version,
-	is_stalwart_configured,
-)
-
-if TYPE_CHECKING:
-	from subprocess import CompletedProcess
-
-
-class StalwartCLI:
-	CREDENTIAL_KEYS: ClassVar[tuple[str, ...]] = ("server_url", "username", "password")
-
-	@classmethod
-	def _normalize_credentials(cls, credentials: dict[str, str] | None) -> dict[str, str]:
-		credentials = credentials or {}
-		return {key: credentials.get(key) for key in cls.CREDENTIAL_KEYS}
-
-	@staticmethod
-	def _validate_credentials(credentials: dict[str, str]) -> None:
-		if not credentials.get("server_url"):
-			frappe.throw(_("Server URL is required for Stalwart CLI operations."))
-
-		has_user_password = bool(credentials.get("username") and credentials.get("password"))
-		if not has_user_password:
-			frappe.throw(_("Username and password are required for Stalwart CLI operations."))
-
-	@staticmethod
-	def _build_auth_args(credentials: dict[str, str]) -> list[str]:
-		return ["--user", credentials["username"], "--password", credentials["password"]]
-
-	def __init__(self, credentials: dict[str, str] | None = None) -> None:
-		credentials = self._normalize_credentials(credentials)
-
-		if any(credentials.values()):
-			self._validate_credentials(credentials)
-		elif not getattr(frappe.flags, "in_migrate", False):
-			is_stalwart_configured(raise_exception=True)
-
-			credentials = self._normalize_credentials(get_config())
-			self._validate_credentials(credentials)
-
-		self._credentials = credentials
-		self.cli_path = get_stalwart_cli_path()
-
-		if not os.path.exists(self.cli_path):
-			self._install()
-
-	def _url(self) -> tuple[str, str]:
-		"""Returns the download URL and filename for the appropriate Stalwart CLI release based on the current platform and architecture."""
-
-		version = get_stalwart_cli_version()
-		github_release_base = (
-			"https://github.com/stalwartlabs/cli/releases/latest/download"
-			if version == "latest"
-			else f"https://github.com/stalwartlabs/cli/releases/download/{version}"
-		)
-
-		system = platform.system().lower()
-		arch = platform.machine().lower()
-
-		if arch in ["x86_64", "amd64"]:
-			arch = "x86_64"
-		elif arch in ["arm64", "aarch64"]:
-			arch = "aarch64"
-		else:
-			frappe.throw(_("Unsupported architecture: {0}").format(arch))
-
-		if system == "linux":
-			os_id = "unknown-linux-gnu"
-		elif system == "darwin":
-			os_id = "apple-darwin"
-		else:
-			frappe.throw(_("Unsupported operating system: {0}").format(system))
-
-		filename = f"stalwart-cli-{arch}-{os_id}.tar.xz"
-		return f"{github_release_base}/{filename}", filename
-
-	def _install(self) -> None:
-		"""Downloads and installs the Stalwart CLI to the mail app directory."""
-
-		print("Installing Stalwart CLI...")
-
-		url, filename = self._url()
-		install_dir = get_mail_app_path()
-		tar_path = os.path.join(install_dir, filename)
-
-		if frappe.conf.developer_mode:
-			print(f"\tDownloading {url}...")
-
-		urllib.request.urlretrieve(url, tar_path)
-
-		if frappe.conf.developer_mode:
-			print(f"\tExtracting stalwart-cli from {filename}...")
-
-		with tarfile.open(tar_path, "r:xz") as tar:
-			member = next(
-				(m for m in tar.getmembers() if os.path.basename(m.name) == "stalwart-cli"),
-				None,
-			)
-
-			if not member or not member.isfile():
-				raise FileNotFoundError("stalwart-cli not found in archive")
-
-			extracted = tar.extractfile(member)
-			if not extracted:
-				raise FileNotFoundError("Failed to extract stalwart-cli from archive")
-
-			with open(self.cli_path, "wb") as binary:
-				shutil.copyfileobj(extracted, binary)
-
-		os.chmod(self.cli_path, 0o755)
-
-		if frappe.conf.developer_mode:
-			print(f"\tRemoving {tar_path}...")
-
-		os.remove(tar_path)
-
-		if frappe.conf.developer_mode:
-			print(f"\tStalwart CLI installed at: {self.cli_path}")
-
-	def _parse_process_result(self, result: "CompletedProcess") -> dict:
-		"""Parses the result of a subprocess execution and returns a dictionary with success status and output or error message."""
-
-		stdout = result.stdout.strip() if result.stdout else ""
-		stderr = result.stderr.strip() if result.stderr else ""
-
-		return {"success": result.returncode == 0, "output": stdout, "error": stderr}
-
-	def run(self, args: list[str]) -> dict:
-		"""Runs a Stalwart CLI command with the provided arguments and returns the result."""
-
-		if not self._credentials.get("server_url"):
-			frappe.throw(_("Stalwart credentials are not configured."))
-
-		cmd = [self.cli_path, "--url", self._credentials["server_url"]]
-		cmd.extend(self._build_auth_args(self._credentials))
-
-		cmd.extend(args)
-
-		result = subprocess.run(cmd, capture_output=True, text=True)
-		return self._parse_process_result(result)
diff --git a/suite/mail/stalwart/connection.py b/suite/mail/stalwart/connection.py
new file mode 100644
index 0000000000..4edc3c40b1
--- /dev/null
+++ b/suite/mail/stalwart/connection.py
@@ -0,0 +1,85 @@
+import hashlib
+
+import frappe
+from frappe.utils.caching import request_cache
+
+from suite.mail.jmap.connection import JMAPConnection, JMAPConnectionInfo, JMAPSessionManager
+from suite.mail.utils import get_config, is_stalwart_configured
+
+# Cache key under which the discovered management JMAP session is stored.
+MANAGEMENT_SESSION_CACHE_KEY = "stalwart:management:sessions"
+
+
+def _session_manager(cache_key: str) -> JMAPSessionManager:
+	"""Returns a session manager that persists the discovered session in Frappe's cache.
+
+	Sessions are keyed by a hash of the server URL and username so that switching servers or
+	admin credentials never reuses a stale session.
+	"""
+
+	return JMAPSessionManager(
+		get_session=lambda: frappe.cache.hget(MANAGEMENT_SESSION_CACHE_KEY, cache_key),
+		set_session=lambda session: frappe.cache.hset(MANAGEMENT_SESSION_CACHE_KEY, cache_key, session),
+		clear_session=lambda: frappe.cache.hdel(MANAGEMENT_SESSION_CACHE_KEY, cache_key),
+	)
+
+
+def _build_connection(
+	username: str, cache_key: str | None, timeout: tuple[float, float]
+) -> JMAPConnection:
+	"""Builds a JMAPConnection for ``username`` using the configured admin password.
+
+	``cache_key`` persists the discovered session; pass ``None`` to always re-discover it.
+	"""
+
+	is_stalwart_configured(raise_exception=True)
+
+	server_url, password, verify_ssl = get_config(("server_url", "password", "verify_ssl"))
+
+	return JMAPConnection(
+		JMAPConnectionInfo(
+			server_url,
+			username,
+			password,
+			timeout,
+			verify_ssl=bool(verify_ssl),
+		),
+		session_manager=_session_manager(cache_key) if cache_key else None,
+	)
+
+
+@request_cache
+def get_management_connection(timeout: tuple[float, float] = (30.0, 60.0)) -> JMAPConnection:
+	"""Returns a JMAPConnection authenticated as the Stalwart administrator.
+
+	Used for all server-scoped directory management (Accounts, Groups, Mailing Lists, Roles,
+	Domains, OAuth). Cached per request so the many service factories reuse one instance.
+	"""
+
+	server_url, username = get_config(("server_url", "username"))
+	cache_key = hashlib.sha1(f"{server_url}|{username}".encode()).hexdigest()
+
+	return _build_connection(username, cache_key, timeout)
+
+
+@request_cache
+def get_account_management_connection(
+	account: str, timeout: tuple[float, float] = (30.0, 60.0)
+) -> JMAPConnection:
+	"""Returns a JMAPConnection authenticated as ``account`` via Stalwart master-user auth.
+
+	Stalwart lets an administrator authenticate as any account by logging in with the username
+	``<account>%<admin_username>`` and the admin password. This is required for account-scoped
+	management objects such as App Passwords, which are created within the target account.
+
+	The session is deliberately not persisted. It carries the account's id, and that id changes
+	whenever an account is deleted and recreated on the same address — a cached session then scopes
+	every call to the id of the account that is gone, which the server rejects with "You are not an
+	owner of account <id>". These connections are short-lived (one app password when an account is
+	set up) and ``request_cache`` already shares them within a request, so rediscovering costs a
+	single request and keeps the account id honest.
+	"""
+
+	admin_username = get_config("username")
+
+	return _build_connection(f"{account}%{admin_username}", None, timeout)
diff --git a/suite/mail/stalwart/domain.py b/suite/mail/stalwart/domain.py
index 15893ffc8c..4f41059e48 100644
--- a/suite/mail/stalwart/domain.py
+++ b/suite/mail/stalwart/domain.py
@@ -1,13 +1,10 @@
-import json
-import re
 from dataclasses import dataclass, field
 from enum import Enum
-from typing import ClassVar
 
 import frappe
 from frappe import _
 
-from suite.mail.stalwart.cli import StalwartCLI
+from suite.mail.stalwart.service import ManagementService
 
 
 class CertificateManagementType(Enum):
@@ -27,20 +24,24 @@ class CertificateManagement:
 	properties: CertificateManagementProperties | None = None
 
 	def __post_init__(self) -> None:
+		"""Validates that properties are present only for automatic management."""
+
 		if self.type == CertificateManagementType.AUTOMATIC and not self.properties:
 			raise ValueError("Properties must be provided for automatic certificate management.")
-		elif self.type == CertificateManagementType.MANUAL and self.properties:
+		if self.type == CertificateManagementType.MANUAL and self.properties:
 			raise ValueError("Properties should not be provided for manual certificate management.")
 
 	def to_dict(self) -> dict:
+		"""Serializes the certificate management tagged union to the JMAP wire format."""
+
 		if self.type == CertificateManagementType.MANUAL:
 			return {"@type": self.type.value}
-		else:
-			return {
-				"@type": self.type.value,
-				"acmeProviderId": self.properties.acme_provider_id,
-				"subjectAlternativeNames": self.properties.subject_alternative_names,
-			}
+
+		return {
+			"@type": self.type.value,
+			"acmeProviderId": self.properties.acme_provider_id,
+			"subjectAlternativeNames": self.properties.subject_alternative_names,
+		}
 
 
 class DkimManagementType(Enum):
@@ -73,25 +74,29 @@ class DkimManagement:
 	properties: DkimManagementProperties = field(default_factory=DkimManagementProperties)
 
 	def __post_init__(self) -> None:
+		"""Validates that properties are present only for automatic management."""
+
 		if self.type == DkimManagementType.AUTOMATIC and not self.properties:
 			raise ValueError("Properties must be provided for automatic DKIM management.")
-		elif self.type == DkimManagementType.MANUAL and self.properties:
+		if self.type == DkimManagementType.MANUAL and self.properties:
 			raise ValueError("Properties should not be provided for manual DKIM management.")
 
 	def to_dict(self) -> dict:
+		"""Serializes the DKIM management tagged union to the JMAP wire format."""
+
 		if self.type == DkimManagementType.MANUAL:
 			return {"@type": self.type.value}
-		else:
-			return {
-				"@type": self.type.value,
-				"algorithms": {algorithm.value: True for algorithm in self.properties.algorithms}
-				if self.properties.algorithms
-				else {},
-				"selectorTemplate": self.properties.selector_template,
-				"rotateAfter": self.properties.rotate_after,
-				"retireAfter": self.properties.retire_after,
-				"deleteAfter": self.properties.delete_after,
-			}
+
+		return {
+			"@type": self.type.value,
+			"algorithms": {algorithm.value: True for algorithm in self.properties.algorithms}
+			if self.properties.algorithms
+			else {},
+			"selectorTemplate": self.properties.selector_template,
+			"rotateAfter": self.properties.rotate_after,
+			"retireAfter": self.properties.retire_after,
+			"deleteAfter": self.properties.delete_after,
+		}
 
 
 class DnsManagementType(Enum):
@@ -141,21 +146,25 @@ class DnsManagement:
 	properties: DnsManagementProperties | None = None
 
 	def __post_init__(self) -> None:
+		"""Validates that properties are present only for automatic management."""
+
 		if self.type == DnsManagementType.AUTOMATIC and not self.properties:
 			raise ValueError("Properties must be provided for automatic DNS management.")
-		elif self.type == DnsManagementType.MANUAL and self.properties:
+		if self.type == DnsManagementType.MANUAL and self.properties:
 			raise ValueError("Properties should not be provided for manual DNS management.")
 
 	def to_dict(self) -> dict:
+		"""Serializes the DNS management tagged union to the JMAP wire format."""
+
 		if self.type == DnsManagementType.MANUAL:
 			return {"@type": self.type.value}
-		else:
-			return {
-				"@type": self.type.value,
-				"dnsServerId": self.properties.dns_server_id,
-				"origin": self.properties.origin,
-				"publishRecords": [record.value for record in self.properties.publish_records],
-			}
+
+		return {
+			"@type": self.type.value,
+			"dnsServerId": self.properties.dns_server_id,
+			"origin": self.properties.origin,
+			"publishRecords": [record.value for record in self.properties.publish_records],
+		}
 
 
 class SubAddressingType(Enum):
@@ -175,19 +184,20 @@ class SubAddressing:
 	properties: SubAddressingCustom | None = None
 
 	def __post_init__(self) -> None:
+		"""Validates that a custom rule is present only for custom sub-addressing."""
+
 		if self.type == SubAddressingType.CUSTOM and not self.properties:
 			raise ValueError("Properties must be provided for custom sub-addressing.")
-		elif self.type != SubAddressingType.CUSTOM and self.properties:
+		if self.type != SubAddressingType.CUSTOM and self.properties:
 			raise ValueError("Properties should not be provided for non-custom sub-addressing.")
 
 	def to_dict(self) -> dict:
+		"""Serializes the sub-addressing tagged union to the JMAP wire format."""
+
 		if self.type != SubAddressingType.CUSTOM:
 			return {"@type": self.type.value}
-		else:
-			return {
-				"@type": self.type.value,
-				"customRule": self.properties.custom_rule,
-			}
+
+		return {"@type": self.type.value, "customRule": self.properties.custom_rule}
 
 
 @dataclass
@@ -205,6 +215,8 @@ class Domain:
 	report_address_uri: str | None = "mailto:postmaster"
 
 	def to_dict(self) -> dict:
+		"""Serializes the domain to the JMAP wire format."""
+
 		return {
 			"name": self.name,
 			"aliases": {alias: True for alias in self.aliases} if self.aliases else {},
@@ -220,159 +232,39 @@ def to_dict(self) -> dict:
 		}
 
 
-class DomainService(StalwartCLI):
-	DEFAULT_FIELDS: ClassVar[list[str]] = ["id", "isEnabled", "name", "description"]
-	ALLOWED_FILTER_KEYS: ClassVar[set[str]] = {"text", "name"}
-
-	@classmethod
-	def _resolved_fields(cls, fields: list[str] | None) -> list[str]:
-		return fields if isinstance(fields, list) else cls.DEFAULT_FIELDS
-
-	@classmethod
-	def _append_filters(cls, commands: list[str], filters: dict[str, str]) -> None:
-		for key, value in filters.items():
-			if key in cls.ALLOWED_FILTER_KEYS:
-				commands.extend(["--where", f"{key}={value}"])
-			else:
-				frappe.throw(
-					_("Invalid filter key: {0}. Allowed keys are: {1}").format(
-						key, ", ".join(cls.ALLOWED_FILTER_KEYS)
-					)
-				)
-
-	@staticmethod
-	def _parse_query_output(output: str) -> list[dict]:
-		if not output:
-			return []
-
-		return [json.loads(domain) for domain in output.splitlines()]
-
-	def get(self, id: str, fields: list[str] | None = None) -> dict:
-		"""Fetches a domain by ID from the Stalwart server, selecting specific fields if provided."""
-
-		fields = self._resolved_fields(fields)
-
-		commands = ["get", "Domain", id]
-
-		if fields:
-			commands.extend(["--fields", ",".join(fields)])
-
-		commands.append("--json")
-		response = self.run(commands)
-
-		if response["success"]:
-			if response["output"]:
-				return json.loads(response["output"])
-			else:
-				frappe.throw(title=_("Domain not found"), msg=_("Domain with ID {0} not found.").format(id))
-		else:
-			frappe.throw(title=_("Failed to fetch domain"), msg=response["output"] or response["error"])
-
-	def get_all(self, filters: dict[str, str] | None = None, fields: list[str] | None = None) -> list[dict]:
-		"""Fetches all domains from the Stalwart server, applying optional filters and selecting specific fields."""
-
-		filters = filters or {}
-		fields = self._resolved_fields(fields)
-
-		commands = ["query", "Domain"]
-
-		if filters:
-			self._append_filters(commands, filters)
-
-		if fields:
-			commands.extend(["--fields", ",".join(fields)])
-
-		commands.append("--json")
-		response = self.run(commands)
-
-		if response["success"]:
-			return self._parse_query_output(response["output"])
-		else:
-			frappe.throw(title=_("Failed to fetch domains"), msg=response["output"] or response["error"])
-
-	def create(self, domain: "Domain") -> str:
-		"""Creates a new domain on the Stalwart server with the provided domain data."""
-
-		def _parse_domain_id(output: str) -> str | None:
-			match = re.search(r"Created Domain\s+(\S+)", output)
-			if match:
-				return match.group(1)
-
-		domain_data = domain.to_dict()
-		domain_json = json.dumps(domain_data)
-		response = self.run(["create", "Domain", "--json", domain_json])
-
-		if not response["success"]:
-			frappe.throw(title=_("Failed to create domain"), msg=response["output"] or response["error"])
-
-		domain_id = _parse_domain_id(response["output"])
-		if not domain_id:
-			frappe.throw(
-				title=_("Failed to parse domain ID"),
-				msg=_("Could not extract the created domain ID from the response."),
-			)
-
-		return domain_id
-
-	def delete(self, ids: list[str]) -> None:
-		"""Deletes domains with the specified IDs from the Stalwart server."""
-
-		if not ids:
-			frappe.throw(title=_("No domain IDs provided"), msg=_("No domain IDs provided for deletion."))
-
-		response = self.run(["delete", "Domain", "--ids", ",".join(ids)])
-
-		if not response["success"]:
-			frappe.throw(title=_("Failed to delete domains"), msg=response["output"] or response["error"])
-
-
-class DkimSignatureService(StalwartCLI):
-	DEFAULT_FIELDS: ClassVar[list[str]] = ["id", "selector", "domainId", "stage"]
-
-	@classmethod
-	def _resolved_fields(cls, fields: list[str] | None) -> list[str]:
-		return fields if isinstance(fields, list) else cls.DEFAULT_FIELDS
-
-	@staticmethod
-	def _parse_query_output(output: str) -> list[dict]:
-		if not output:
-			return []
-
-		return [json.loads(signature) for signature in output.splitlines()]
+class DomainService(ManagementService):
+	type = "Domain"
+	default_properties = ["id", "name", "description", "isEnabled", "createdAt"]
 
-	def get_all_by_domain(self, domain_id: str, fields: list[str] | None = None) -> list[dict]:
-		"""Fetches all DKIM signatures associated with the given domain from the Stalwart server."""
+	def get_by_name(
+		self, name: str, properties: list[str] | None = None, raise_exception: bool = True
+	) -> dict | None:
+		"""Returns the domain with the given name, or ``None`` (throws if ``raise_exception``)."""
 
-		fields = self._resolved_fields(fields)
+		domain = self.find({"name": name}, properties=properties or ["id"])
+		if not domain and raise_exception:
+			frappe.throw(_("Domain {0} not found on the Stalwart server.").format(name))
 
-		commands = ["query", "DkimSignature", "--where", f"domainId={domain_id}"]
+		return domain
 
-		if fields:
-			commands.extend(["--fields", ",".join(fields)])
+	def delete(self, ids: str | list[str]) -> None:
+		"""Deletes domains, first removing DKIM signatures that would block the delete."""
 
-		commands.append("--json")
-		response = self.run(commands)
+		# Stalwart refuses to delete a domain while DKIM signatures still reference it.
+		ids = [ids] if isinstance(ids, str) else list(ids)
+		dkim_service = DkimSignatureService(self.connection)
+		for domain_id in ids:
+			if signature_ids := [s["id"] for s in dkim_service.get_all_by_domain(domain_id)]:
+				dkim_service.delete(signature_ids)
 
-		if response["success"]:
-			return self._parse_query_output(response["output"])
-		else:
-			frappe.throw(
-				title=_("Failed to fetch DKIM signatures"), msg=response["output"] or response["error"]
-			)
+		super().delete(ids)
 
-	def delete(self, ids: list[str]) -> None:
-		"""Deletes DKIM signatures with the specified IDs from the Stalwart server."""
 
-		if not ids:
-			frappe.throw(
-				title=_("No DKIM signature IDs provided"),
-				msg=_("No DKIM signature IDs provided for deletion."),
-			)
+class DkimSignatureService(ManagementService):
+	type = "DkimSignature"
+	default_properties = ["id", "selector", "domainId", "stage"]
 
-		response = self.run(["delete", "DkimSignature", "--ids", ",".join(ids)])
+	def get_all_by_domain(self, domain_id: str, properties: list[str] | None = None) -> list[dict]:
+		"""Returns every DKIM signature linked to the given domain."""
 
-		if not response["success"]:
-			frappe.throw(
-				title=_("Failed to delete DKIM signatures"),
-				msg=response["output"] or response["error"],
-			)
+		return self.get_all(filter={"domainId": domain_id}, properties=properties)
diff --git a/suite/mail/stalwart/group.py b/suite/mail/stalwart/group.py
new file mode 100644
index 0000000000..8380876b6d
--- /dev/null
+++ b/suite/mail/stalwart/group.py
@@ -0,0 +1,98 @@
+from dataclasses import dataclass, field
+
+from suite.mail.stalwart.account import (
+	AccountService,
+	CustomRoles,
+	EmailAlias,
+	Permissions,
+	RoleType,
+	StorageQuota,
+	UserRoles,
+)
+
+
+@dataclass
+class Group:
+	"""A group principal. Groups share the ``x:Account`` object with users but carry no
+	credentials and are distinguished by the ``@type: "Group"`` discriminator."""
+
+	name: str
+	domain_id: str
+	role_ids: list[str] | None = None
+	permissions: Permissions = field(default_factory=Permissions)
+	quotas: StorageQuota = field(default_factory=StorageQuota)
+	aliases: list[EmailAlias] | None = None
+	description: str | None = None
+
+	def to_dict(self) -> dict:
+		"""Serializes the group to the JMAP wire format (an ``x:Account`` with ``@type: Group``).
+
+		Groups carry no ``memberGroupIds`` — membership lives on each member account instead.
+		"""
+
+		payload = {
+			"@type": "Group",
+			"name": self.name,
+			"domainId": self.domain_id,
+			"permissions": self.permissions.to_dict() if self.permissions else {},
+			"quotas": self.quotas.to_dict() if self.quotas else {},
+			"aliases": {f"{idx}": a.to_dict() for idx, a in enumerate(self.aliases)} if self.aliases else {},
+			"description": self.description,
+		}
+
+		if self.role_ids:
+			payload["roles"] = UserRoles(
+				type=RoleType.CUSTOM, roles=CustomRoles(role_ids=self.role_ids)
+			).to_dict()
+
+		return payload
+
+
+class GroupService(AccountService):
+	"""Groups live in the same ``x:Account`` collection as users."""
+
+	def get_all_groups(self, properties: list[str] | None = None) -> list[dict]:
+		"""Returns every group principal."""
+
+		return self.get_all(filter={"@type": "Group"}, properties=properties)
+
+	def get_members(self, group_id: str, properties: list[str] | None = None) -> list[dict]:
+		"""Returns the accounts that belong to the group.
+
+		Membership lives on each member account's ``memberGroupIds``, not on the group itself.
+		"""
+
+		return self.get_all(filter={"memberGroupIds": group_id}, properties=properties)
+
+	def add_members(self, group_id: str, account_ids: list[str]) -> None:
+		"""Adds the given accounts to the group by patching each account's membership."""
+
+		for account_id in account_ids:
+			self.update(account_id, {f"memberGroupIds/{group_id}": True})
+
+	def remove_members(self, group_id: str, account_ids: list[str]) -> None:
+		"""Removes the given accounts from the group by patching each account's membership."""
+
+		for account_id in account_ids:
+			self.update(account_id, {f"memberGroupIds/{group_id}": None})
+
+	def set_members(self, group_id: str, account_ids: list[str]) -> None:
+		"""Reconciles the group's membership to exactly ``account_ids``."""
+
+		current = {m["id"] for m in self.get_members(group_id, properties=["id"])}
+		desired = set(account_ids)
+		self.add_members(group_id, list(desired - current))
+		self.remove_members(group_id, list(current - desired))
+
+	def delete(self, ids: str | list[str]) -> None:
+		"""Deletes groups, first clearing membership so the server's link check passes.
+
+		Stalwart refuses to destroy a group while accounts still reference it as a member.
+		"""
+
+		ids = [ids] if isinstance(ids, str) else list(ids)
+		for group_id in ids:
+			if member_ids := [m["id"] for m in self.get_members(group_id, properties=["id"])]:
+				self.remove_members(group_id, member_ids)
+
+		super().delete(ids)
diff --git a/suite/mail/stalwart/logs.py b/suite/mail/stalwart/logs.py
new file mode 100644
index 0000000000..86a75adeb7
--- /dev/null
+++ b/suite/mail/stalwart/logs.py
@@ -0,0 +1,10 @@
+from suite.mail.stalwart.service import ManagementService
+
+
+class LogService(ManagementService):
+	"""Read access to server log entries (``x:Log``)."""
+
+	type = "Log"
+	default_properties = ["id", "timestamp", "level", "event", "details"]
+	# The log store rejects offset paging ("Pagination is only possible using anchors for logs").
+	cursor_paginated = True
diff --git a/suite/mail/stalwart/mailing_list.py b/suite/mail/stalwart/mailing_list.py
new file mode 100644
index 0000000000..01bbff4b57
--- /dev/null
+++ b/suite/mail/stalwart/mailing_list.py
@@ -0,0 +1,43 @@
+from dataclasses import dataclass
+
+import frappe
+from frappe import _
+
+from suite.mail.stalwart.service import ManagementService
+
+
+@dataclass
+class MailingList:
+	name: str
+	domain_id: str
+	recipients: list[str] | None = None
+	description: str | None = None
+
+	def to_dict(self) -> dict:
+		"""Serializes the mailing list to the JMAP wire format.
+
+		``recipients`` is a set-valued map keyed by recipient email address — internal or
+		external (omitted when empty).
+		"""
+
+		payload = {"name": self.name, "domainId": self.domain_id, "description": self.description}
+		if self.recipients:
+			payload["recipients"] = {email: True for email in self.recipients}
+
+		return payload
+
+
+class MailingListService(ManagementService):
+	type = "MailingList"
+	default_properties = ["id", "name", "emailAddress", "domainId", "recipients", "description"]
+
+	def get_by_name(
+		self, name: str, properties: list[str] | None = None, raise_exception: bool = True
+	) -> dict | None:
+		"""Returns the mailing list with the given name, or ``None`` (throws if ``raise_exception``)."""
+
+		mailing_list = self.find({"name": name}, properties=properties or ["id"])
+		if not mailing_list and raise_exception:
+			frappe.throw(_("Mailing list {0} not found on the Stalwart server.").format(name))
+
+		return mailing_list
diff --git a/suite/mail/stalwart/oauth.py b/suite/mail/stalwart/oauth.py
new file mode 100644
index 0000000000..b54d51db7c
--- /dev/null
+++ b/suite/mail/stalwart/oauth.py
@@ -0,0 +1,47 @@
+from dataclasses import dataclass
+
+import frappe
+from frappe import _
+
+from suite.mail.stalwart.service import ManagementService
+
+
+@dataclass
+class OAuthClient:
+	client_id: str
+	description: str | None = None
+	contacts: list[str] | None = None
+	redirect_uris: list[str] | None = None
+	secret: str | None = None
+	logo: str | None = None
+	expires_at: str | None = None
+
+	def to_dict(self) -> dict:
+		"""Serializes the OAuth client to the JMAP wire format."""
+
+		return {
+			"clientId": self.client_id,
+			"description": self.description,
+			"contacts": {contact: True for contact in self.contacts} if self.contacts else {},
+			"redirectUris": {uri: True for uri in self.redirect_uris} if self.redirect_uris else {},
+			"secret": self.secret,
+			"logo": self.logo,
+			"expiresAt": self.expires_at,
+		}
+
+
+class OAuthClientService(ManagementService):
+	type = "OAuthClient"
+	default_properties = ["id", "clientId", "description", "contacts", "redirectUris", "expiresAt"]
+
+	def get_by_client_id(
+		self, client_id: str, properties: list[str] | None = None, raise_exception: bool = True
+	) -> dict | None:
+		"""Returns the OAuth client with the given clientId, or ``None`` (throws if ``raise_exception``)."""
+
+		client = self.find({"text": client_id}, properties=properties)
+		if client and client.get("clientId") == client_id:
+			return client
+
+		if raise_exception:
+			frappe.throw(_("OAuth client {0} not found on the Stalwart server.").format(client_id))
diff --git a/suite/mail/stalwart/queue.py b/suite/mail/stalwart/queue.py
new file mode 100644
index 0000000000..a098d3314f
--- /dev/null
+++ b/suite/mail/stalwart/queue.py
@@ -0,0 +1,30 @@
+from suite.mail.stalwart.service import ManagementService
+
+# Setting ``nextRetry`` to a time in the past tells Stalwart to attempt delivery immediately.
+RETRY_NOW = "2000-01-01T00:00:00Z"
+
+
+class QueuedMessageService(ManagementService):
+	"""Read + retry/cancel access to messages pending outbound delivery (``x:QueuedMessage``)."""
+
+	type = "QueuedMessage"
+	default_properties = [
+		"id",
+		"returnPath",
+		"recipients",
+		"size",
+		"priority",
+		"envId",
+		"flags",
+		"nextRetry",
+		"nextNotify",
+		"receivedFromIp",
+		"receivedViaPort",
+		"createdAt",
+		"blobId",
+	]
+
+	def retry(self, ids: list[str]) -> None:
+		"""Schedules the given messages for immediate delivery."""
+
+		self.update_many({id: {"nextRetry": RETRY_NOW} for id in ids})
diff --git a/suite/mail/stalwart/reports.py b/suite/mail/stalwart/reports.py
new file mode 100644
index 0000000000..ea3aab5bd5
--- /dev/null
+++ b/suite/mail/stalwart/reports.py
@@ -0,0 +1,41 @@
+from suite.mail.stalwart.service import ManagementService
+
+# Common metadata carried by every received (external) report.
+_EXTERNAL_PROPERTIES = ["id", "from", "subject", "to", "receivedAt", "expiresAt", "memberTenantId", "report"]
+# Common metadata carried by every generated (internal / outbound) report.
+_INTERNAL_PROPERTIES = ["id", "domain", "createdAt", "deliverAt", "report"]
+
+
+class DmarcExternalReportService(ManagementService):
+	"""Received DMARC aggregate reports (``x:DmarcExternalReport``)."""
+
+	type = "DmarcExternalReport"
+	default_properties = _EXTERNAL_PROPERTIES
+
+
+class DmarcInternalReportService(ManagementService):
+	"""Outbound DMARC aggregate reports Stalwart generates (``x:DmarcInternalReport``)."""
+
+	type = "DmarcInternalReport"
+	default_properties = [*_INTERNAL_PROPERTIES, "rua", "policyIdentifier"]
+
+
+class TlsExternalReportService(ManagementService):
+	"""Received TLS reports (``x:TlsExternalReport``)."""
+
+	type = "TlsExternalReport"
+	default_properties = _EXTERNAL_PROPERTIES
+
+
+class TlsInternalReportService(ManagementService):
+	"""Outbound TLS reports Stalwart generates (``x:TlsInternalReport``)."""
+
+	type = "TlsInternalReport"
+	default_properties = [*_INTERNAL_PROPERTIES, "mailRua", "httpRua", "policyIdentifiers"]
+
+
+class ArfExternalReportService(ManagementService):
+	"""Received ARF feedback reports (``x:ArfExternalReport``)."""
+
+	type = "ArfExternalReport"
+	default_properties = _EXTERNAL_PROPERTIES
diff --git a/suite/mail/stalwart/role.py b/suite/mail/stalwart/role.py
index 9f0b02b599..b2f4a0b3cf 100644
--- a/suite/mail/stalwart/role.py
+++ b/suite/mail/stalwart/role.py
@@ -1,84 +1,43 @@
-import json
-from typing import ClassVar
+from dataclasses import dataclass, field
 
 import frappe
 from frappe import _
 
-from suite.mail.stalwart.cli import StalwartCLI
+from suite.mail.stalwart.service import ManagementService
 
 
-class RoleService(StalwartCLI):
-	DEFAULT_FIELDS: ClassVar[list[str]] = [
-		"id",
-		"description",
-		"disabledPermissions",
-		"enabledPermissions",
-		"roleIds",
-	]
-	ALLOWED_FILTER_KEYS: ClassVar[set[str]] = {"description"}
+@dataclass
+class Role:
+	description: str
+	role_ids: list[str] = field(default_factory=list)
+	enabled_permissions: list[str] = field(default_factory=list)
+	disabled_permissions: list[str] = field(default_factory=list)
 
-	@classmethod
-	def _resolved_fields(cls, fields: list[str] | None) -> list[str]:
-		return fields if isinstance(fields, list) else cls.DEFAULT_FIELDS
+	def to_dict(self) -> dict:
+		"""Serializes the role to the JMAP wire format.
 
-	@classmethod
-	def _append_filters(cls, commands: list[str], filters: dict[str, str]) -> None:
-		for key, value in filters.items():
-			if key in cls.ALLOWED_FILTER_KEYS:
-				commands.extend(["--where", f"{key}={value}"])
-			else:
-				frappe.throw(
-					_("Invalid filter key: {0}. Allowed keys are: {1}").format(
-						key, ", ".join(cls.ALLOWED_FILTER_KEYS)
-					)
-				)
+		``roleIds`` and the permission sets are id-keyed maps on the wire, not arrays.
+		"""
 
-	@staticmethod
-	def _parse_query_output(output: str) -> list[dict]:
-		if not output:
-			return []
+		return {
+			"description": self.description,
+			"roleIds": {role_id: True for role_id in self.role_ids},
+			"enabledPermissions": {perm: True for perm in self.enabled_permissions},
+			"disabledPermissions": {perm: True for perm in self.disabled_permissions},
+		}
 
-		return [json.loads(role) for role in output.splitlines()]
 
-	def get(self, id: str, fields: list[str] | None = None) -> dict:
-		"""Fetches a role by ID from the Stalwart server, selecting specific fields if provided."""
+class RoleService(ManagementService):
+	type = "Role"
+	default_properties = ["id", "description", "roleIds", "enabledPermissions", "disabledPermissions"]
 
-		fields = self._resolved_fields(fields)
+	def get_by_description(
+		self, description: str, properties: list[str] | None = None, raise_exception: bool = True
+	) -> dict | None:
+		"""Returns the role with the given description, or ``None`` (throws if ``raise_exception``)."""
 
-		commands = ["get", "role", id]
+		role = self.find({"description": description}, properties=properties or ["id", "description"])
+		if not role and raise_exception:
+			frappe.throw(_("Role {0} not found on the Stalwart server.").format(description))
 
-		if fields:
-			commands.extend(["--fields", ",".join(fields)])
-
-		commands.append("--json")
-		response = self.run(commands)
-
-		if response["success"]:
-			if response["output"]:
-				return json.loads(response["output"])
-			else:
-				frappe.throw(title=_("Role not found"), msg=_("Role with ID {0} not found.").format(id))
-		else:
-			frappe.throw(title=_("Failed to fetch role"), msg=response["output"] or response["error"])
-
-	def get_all(self, filters: dict[str, str] | None = None, fields: list[str] | None = None) -> list[dict]:
-		"""Fetches all roles from the Stalwart server, applying optional filters and selecting specific fields."""
-
-		filters = filters or {}
-		fields = self._resolved_fields(fields)
-
-		commands = ["query", "role"]
-
-		if filters:
-			self._append_filters(commands, filters)
-
-		if fields:
-			commands.extend(["--fields", ",".join(fields)])
-
-		commands.append("--json")
-		response = self.run(commands)
-
-		if response["success"]:
-			return self._parse_query_output(response["output"])
-		else:
-			frappe.throw(title=_("Failed to fetch roles"), msg=response["output"] or response["error"])
+		return role
diff --git a/suite/mail/stalwart/service.py b/suite/mail/stalwart/service.py
new file mode 100644
index 0000000000..a204a9be59
--- /dev/null
+++ b/suite/mail/stalwart/service.py
@@ -0,0 +1,334 @@
+from collections.abc import Iterator
+from typing import Any, ClassVar
+
+import frappe
+from frappe import _
+
+from suite.mail.jmap.connection import JMAPConnection
+from suite.mail.utils import log_mail_error
+
+CORE_CAPABILITY = "urn:ietf:params:jmap:core"
+MANAGEMENT_CAPABILITY = "urn:stalwart:jmap"
+
+# Shown to the user for any Stalwart failure; the real cause is written to the error log instead.
+GENERIC_ERROR = "The mail server could not process this request. Please try again or contact your administrator if the problem persists."
+
+
+class Serializable:
+	"""Interface for objects that can be turned into a JMAP object body."""
+
+	def to_dict(self) -> dict:
+		"""Returns the JMAP wire representation of the object."""
+
+		raise NotImplementedError
+
+
+class ManagementService:
+	"""Base for every Stalwart directory resource.
+
+	The Stalwart management API is a JMAP dialect: it is reached with the ``urn:stalwart:jmap``
+	capability, every method name is prefixed with ``x:`` (e.g. ``x:Account/get``) and, unlike the
+	per-mailbox JMAP API, calls are server-scoped and carry no ``accountId``. All CRUD lives here so
+	each resource subclass only declares its ``type`` and any resource-specific helpers.
+	"""
+
+	type: ClassVar[str] = ""
+	default_properties: ClassVar[list[str] | None] = None
+	# Set by resources the server will only page with a cursor, never an offset.
+	cursor_paginated: ClassVar[bool] = False
+
+	def __init__(self, connection: JMAPConnection) -> None:
+		"""Binds the service to an admin-authenticated management connection."""
+
+		if not self.type:
+			raise NotImplementedError("A ManagementService subclass must set 'type'.")
+
+		self.connection = connection
+
+	# --- capability limits -------------------------------------------------
+
+	@property
+	def _core(self) -> dict:
+		"""Returns the server's advertised core JMAP capability object."""
+
+		return self.connection.capabilities.get(CORE_CAPABILITY) or {}
+
+	@property
+	def account_id(self) -> str:
+		"""Returns the account id management calls are scoped to (the admin's own account).
+
+		Stalwart advertises the management capability per-account, so the id comes from the
+		session's primary account for ``urn:stalwart:jmap``.
+		"""
+
+		return self.connection.primary_accounts[MANAGEMENT_CAPABILITY]
+
+	@property
+	def max_objects_in_get(self) -> int:
+		"""Returns the most objects the server allows in one ``get`` call."""
+
+		return self._core.get("maxObjectsInGet") or 500
+
+	@property
+	def max_objects_in_set(self) -> int:
+		"""Returns the most objects the server allows in one ``set`` call."""
+
+		return self._core.get("maxObjectsInSet") or 500
+
+	@staticmethod
+	def _chunks(items: list[Any], size: int) -> Iterator[list[Any]]:
+		"""Yields ``items`` in lists of at most ``size``."""
+
+		for i in range(0, len(items), size):
+			yield items[i : i + size]
+
+	@staticmethod
+	def _chunk_dict(d: dict[str, Any], size: int) -> Iterator[dict[str, Any]]:
+		"""Yields ``d`` in sub-dicts of at most ``size`` entries."""
+
+		keys = list(d)
+		for i in range(0, len(keys), size):
+			yield {k: d[k] for k in keys[i : i + size]}
+
+	# --- transport ---------------------------------------------------------
+
+	def _fail(self, detail: str) -> None:
+		"""Logs the real Stalwart error and raises a generic message so it is never shown to the user."""
+
+		log_mail_error(title=_("Stalwart {0} request failed").format(self.type), message=detail)
+		frappe.throw(_(GENERIC_ERROR))
+
+	def _validate_capabilities(self) -> None:
+		"""Ensures the connected account can use the management capability.
+
+		The management capability is advertised per-account (in ``primaryAccounts``), not in the
+		server-wide ``capabilities`` block.
+		"""
+
+		if MANAGEMENT_CAPABILITY not in self.connection.primary_accounts:
+			self._fail(f"Server does not advertise {MANAGEMENT_CAPABILITY} in primaryAccounts.")
+
+	def _method(self, action: str) -> str:
+		"""Returns the ``x:``-prefixed JMAP method name for ``action`` (e.g. ``x:Account/get``)."""
+
+		return f"x:{self.type}/{action}"
+
+	def _call(self, method_calls: list[list]) -> list[dict]:
+		"""Sends one JMAP request and returns the unwrapped args of each method response in order."""
+
+		self._validate_capabilities()
+
+		try:
+			response = self.connection.request(
+				method="POST",
+				url=self.connection.api_url,
+				headers={"Content-Type": "application/json"},
+				json={"using": [CORE_CAPABILITY, MANAGEMENT_CAPABILITY], "methodCalls": method_calls},
+				return_json=True,
+			)
+		except Exception as e:
+			self._fail(str(e))
+
+		session_state = response.get("sessionState")
+		if session_state and self.connection.state != session_state:
+			self.connection._session_discovery()
+
+		results = []
+		for method_response in response.get("methodResponses", []):
+			name, args = method_response[0], method_response[1]
+			if name == "error":
+				self._fail(frappe.as_json(args))
+			results.append(args)
+
+		return results
+
+	def _invoke(self, action: str, **args) -> dict:
+		"""Runs a single method call for this resource, dropping ``None`` arguments."""
+
+		args = {k: v for k, v in args.items() if v is not None}
+		args["accountId"] = self.account_id
+		return self._call([[self._method(action), args, "0"]])[0]
+
+	def _set(self, **args) -> dict:
+		"""Runs a ``set`` call and raises if the server reports any object it could not mutate."""
+
+		result = self._invoke("set", **args)
+		for key in ("notCreated", "notUpdated", "notDestroyed"):
+			if failures := result.get(key):
+				self._fail(frappe.as_json({key: failures}))
+		return result
+
+	def _resolve_properties(self, properties: list[str] | None) -> list[str] | None:
+		"""Falls back to the resource's ``default_properties`` when ``properties`` is not given."""
+
+		return properties if properties is not None else self.default_properties
+
+	# --- read --------------------------------------------------------------
+
+	def get(self, id: str, properties: list[str] | None = None) -> dict | None:
+		"""Returns a single object by id, or ``None`` if it does not exist."""
+
+		result = self._invoke("get", ids=[id], properties=self._resolve_properties(properties))
+		objects = result.get("list") or []
+		return objects[0] if objects else None
+
+	def get_all(
+		self,
+		filter: dict | None = None,
+		sort: list[dict] | None = None,
+		limit: int | None = None,
+		properties: list[str] | None = None,
+	) -> list[dict]:
+		"""Returns every matching object in a single request.
+
+		With no filter, one ``get`` (ids omitted) returns all objects. With a filter, ``query`` and
+		``get`` are chained through a JMAP result reference so the query's ids feed the get without a
+		second round-trip.
+		"""
+
+		properties = self._resolve_properties(properties)
+
+		if filter is None and sort is None and limit is None:
+			return self._invoke("get", properties=properties).get("list") or []
+
+		query_args = {"accountId": self.account_id}
+		query_args.update({k: v for k, v in {"filter": filter, "sort": sort, "limit": limit}.items() if v is not None})
+		get_args = {
+			"accountId": self.account_id,
+			"#ids": {"resultOf": "q", "name": self._method("query"), "path": "/ids"},
+		}
+		if properties is not None:
+			get_args["properties"] = properties
+
+		responses = self._call(
+			[[self._method("query"), query_args, "q"], [self._method("get"), get_args, "g"]]
+		)
+		return responses[1].get("list") or []
+
+	def query(
+		self,
+		filter: dict | None = None,
+		sort: list[dict] | None = None,
+		position: int = 0,
+		limit: int | None = None,
+		anchor: str | None = None,
+	) -> dict:
+		"""Returns ``{"ids", "total"}`` without fetching the objects, paging until ``limit``/exhausted.
+
+		Pages by offset (``position``) unless the resource is ``cursor_paginated`` or an ``anchor`` is
+		given, in which case each page starts *after* that id — the anchor is exclusive, and the server
+		ignores any offset alongside it.
+		"""
+
+		ids: list[str] = []
+		total: int | None = None
+		page = self.max_objects_in_get
+		by_cursor = self.cursor_paginated or anchor is not None
+		cursor = anchor
+
+		while True:
+			take = page if limit is None else min(page, limit - len(ids))
+			paging = {"anchor": cursor} if by_cursor else {"position": position}
+			result = self._invoke(
+				"query", filter=filter, sort=sort, limit=take, calculateTotal=total is None, **paging
+			)
+
+			batch = result.get("ids") or []
+			ids.extend(batch)
+			if total is None:
+				total = result.get("total")
+
+			if by_cursor:
+				cursor = batch[-1] if batch else cursor
+			else:
+				position += len(batch)
+			done = not batch or (total is not None and len(ids) >= total) or (limit is not None and len(ids) >= limit)
+			if done:
+				break
+
+		return {"ids": ids if limit is None else ids[:limit], "total": total}
+
+	def find(self, filter: dict, properties: list[str] | None = None) -> dict | None:
+		"""Returns the first object matching ``filter``, or ``None``."""
+
+		matches = self.get_all(filter=filter, limit=1, properties=properties)
+		return matches[0] if matches else None
+
+	def list_page(
+		self,
+		filter: dict | None = None,
+		sort: list[dict] | None = None,
+		position: int = 0,
+		limit: int | None = None,
+		properties: list[str] | None = None,
+		anchor: str | None = None,
+	) -> dict:
+		"""Returns ``{"items", "total"}`` — one page of full objects in query order.
+
+		Unlike ``get_all`` (which fetches everything), this pages via ``position``/``limit`` for
+		large collections such as the queue, or via ``anchor`` for cursor-only ones such as the log,
+		and preserves the query's ordering.
+		"""
+
+		page = self.query(filter=filter, sort=sort, position=position, limit=limit, anchor=anchor)
+		ids = page["ids"]
+		items: list[dict] = []
+		if ids:
+			result = self._invoke("get", ids=ids, properties=self._resolve_properties(properties))
+			by_id = {obj["id"]: obj for obj in (result.get("list") or [])}
+			items = [by_id[id] for id in ids if id in by_id]
+
+		return {"items": items, "total": page["total"]}
+
+	# --- write -------------------------------------------------------------
+
+	def _create(self, obj: Serializable) -> dict:
+		"""Creates one object and returns the created object including server-set fields."""
+
+		return self._set(create={"0": obj.to_dict()})["created"]["0"]
+
+	def create(self, obj: Serializable) -> str:
+		"""Creates one object and returns its server-assigned id."""
+
+		return self._create(obj)["id"]
+
+	def create_many(self, objs: list[Serializable]) -> list[str]:
+		"""Creates objects in batches and returns their ids in the same order."""
+
+		created: dict[str, dict] = {}
+		payload = {str(i): obj.to_dict() for i, obj in enumerate(objs)}
+		for batch in self._chunk_dict(payload, self.max_objects_in_set):
+			created.update(self._set(create=batch)["created"])
+
+		return [created[str(i)]["id"] for i in range(len(objs))]
+
+	def update(self, id: str, patch: dict) -> None:
+		"""Applies a partial update. ``patch`` keys may be property names or JSON-pointer paths."""
+
+		self._set(update={id: patch})
+
+	def update_many(self, patches: dict[str, dict]) -> None:
+		"""Applies partial updates to many objects (``{id: patch}``) in batches."""
+
+		for batch in self._chunk_dict(patches, self.max_objects_in_set):
+			self._set(update=batch)
+
+	def set_aliases(self, id: str, aliases: list[Serializable]) -> None:
+		"""Replaces the object's aliases with the given set (index-keyed map on the wire).
+
+		Shared by resources that carry an ``aliases`` map (accounts, groups, mailing lists).
+		"""
+
+		self.update(id, {"aliases": {f"{idx}": alias.to_dict() for idx, alias in enumerate(aliases)}})
+
+	def delete(self, ids: str | list[str]) -> None:
+		"""Deletes one id or a list of ids in batches."""
+
+		ids = [ids] if isinstance(ids, str) else list(ids)
+		for batch in self._chunks(ids, self.max_objects_in_set):
+			self._set(destroy=batch)
+
+	def changes(self, since_state: str) -> dict:
+		"""Returns the objects changed since ``since_state`` for delta sync."""
+
+		return self._invoke("changes", sinceState=since_state)
diff --git a/suite/mail/utils/__init__.py b/suite/mail/utils/__init__.py
index 8afdfdfce2..04bb564a2a 100644
--- a/suite/mail/utils/__init__.py
+++ b/suite/mail/utils/__init__.py
@@ -29,6 +29,9 @@
 	"stalwart_version",
 	"stalwart_cli_version",
 	# Logs
+	"admin_log_file_count",
+	"admin_log_level",
+	"admin_log_max_file_size",
 	"push_log_file_count",
 	"push_log_level",
 	"push_log_max_file_size",
diff --git a/suite/mail/utils/dt.py b/suite/mail/utils/dt.py
index 930d8dbe96..b267f19a50 100644
--- a/suite/mail/utils/dt.py
+++ b/suite/mail/utils/dt.py
@@ -3,7 +3,40 @@
 
 import frappe
 from frappe import _
-from frappe.utils import convert_utc_to_system_timezone
+from frappe.utils import convert_utc_to_system_timezone, get_datetime_str
+
+from suite.utils.dt import convert_to_utc, parse_iso_datetime
+
+# The one timestamp shape the mail APIs accept and return, matching what Stalwart speaks.
+UTC_DATETIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ"
+
+
+def to_utc_z(value: "datetime | str | None") -> str | None:
+	"""Formats a value as the ``2026-07-28T09:02:30Z`` UTC timestamp the mail APIs return.
+
+	Aware values (Stalwart's timestamps, or the ``...Z`` an API was called with) are converted;
+	naive ones are read as system time, which is how Frappe stores datetimes in the database.
+
+	Distinct from ``suite.utils.dt.to_iso8601_z``, which reads a naive value as UTC — wrong for a
+	value that came out of a Frappe field.
+	"""
+
+	if not value:
+		return None
+
+	return convert_to_utc(value).strftime(UTC_DATETIME_FORMAT)
+
+
+def from_utc_z(value: str | None) -> str | None:
+	"""Converts a ``...Z`` timestamp an API was called with to the system-time string Frappe stores.
+
+	Only for values written to Frappe datetime fields; Stalwart's own fields stay in UTC.
+	"""
+
+	if not value:
+		return None
+
+	return get_datetime_str(parse_iso_datetime(value, as_str=False))
 
 
 def parsedate_to_datetime(date_header: str) -> "datetime":
diff --git a/suite/mail/utils/logger.py b/suite/mail/utils/logger.py
index a46af3e28e..267beeb7fa 100644
--- a/suite/mail/utils/logger.py
+++ b/suite/mail/utils/logger.py
@@ -3,7 +3,13 @@
 import frappe
 from frappe.utils import cint
 
-from suite.mail.utils import get_config
+from suite.mail.utils import get_config, log_mail_error
+
+# Used when a subsystem's Mail Settings values are unset, which is the case for every channel added
+# after a site was installed: the Single doc only picks up a new field's default once it is saved.
+DEFAULT_LOG_LEVEL = "INFO"
+DEFAULT_LOG_FILE_COUNT = 10
+DEFAULT_LOG_MAX_FILE_SIZE = 5_000_000
 
 
 class EventLogger:
@@ -37,12 +43,12 @@ class EventLogger:
 	def __init__(self, ctx: dict | None = None) -> None:
 		config = get_config()
 
-		max_size = cint(config[f"{self.config_prefix}_log_max_file_size"])
-		file_count = cint(config[f"{self.config_prefix}_log_file_count"])
+		max_size = cint(config.get(f"{self.config_prefix}_log_max_file_size")) or DEFAULT_LOG_MAX_FILE_SIZE
+		file_count = cint(config.get(f"{self.config_prefix}_log_file_count")) or DEFAULT_LOG_FILE_COUNT
 		self.logger = frappe.logger(
 			self.logger_name, allow_site=True, max_size=max_size, file_count=file_count
 		)
-		self.logger.setLevel(config[f"{self.config_prefix}_log_level"].upper())
+		self.logger.setLevel((config.get(f"{self.config_prefix}_log_level") or DEFAULT_LOG_LEVEL).upper())
 
 		self.ctx = ctx if ctx is not None else {}
 
@@ -93,6 +99,13 @@ class ExchangeLogger(EventLogger):
 	config_prefix = "exchange"
 
 
+class AdminLogger(EventLogger):
+	"""Structured event logger for mail administration ("suite.mail.admin")."""
+
+	logger_name = "suite.mail.admin"
+	config_prefix = "admin"
+
+
 def get_push_logger(ctx: dict | None = None) -> PushLogger:
 	"""Returns a structured event logger for mail push notifications.
 
@@ -131,3 +144,61 @@ def get_exchange_logger(ctx: dict | None = None) -> ExchangeLogger:
 	"""
 
 	return ExchangeLogger(ctx)
+
+
+def get_admin_logger(ctx: dict | None = None) -> AdminLogger:
+	"""Returns a structured event logger for mail administration.
+
+	The returned logger is bound to `ctx` (by reference); mutating that same
+	dict between log calls is reflected in subsequent records.
+	"""
+
+	return AdminLogger(ctx)
+
+
+# Keeps one audit line readable when an action targets a long list of objects.
+MAX_LOGGED_TARGETS = 10
+
+
+def log_admin_action(action: str, target: Any = None) -> None:
+	"""Records who performed an administrative action, and on what.
+
+	Written for accountability, so it names the acting user and the object acted on — never the
+	payload, which can hold passwords and message contents. The line is emitted when the action is
+	authorized, so it records what was attempted; failures are in the Error Log alongside.
+	"""
+
+	fields = {"user": frappe.session.user, "action": action}
+
+	# Absent outside a request (scheduled jobs, bench console).
+	if request_ip := getattr(frappe.local, "request_ip", None):
+		fields["ip"] = request_ip
+
+	if target := _format_target(target):
+		fields["target"] = target
+
+	try:
+		get_admin_logger().info("admin-action", **fields)
+	except Exception:
+		# This runs in the permission gate of every administrative action, so a logging problem is
+		# recorded and swallowed rather than allowed to fail the action itself.
+		log_mail_error(title="Failed to write the admin log", message=frappe.get_traceback())
+
+
+def _format_target(target: Any) -> str:
+	"""Renders an action's target as one short string, capping long collections."""
+
+	if target is None:
+		return ""
+
+	if isinstance(target, str):
+		return target
+
+	if isinstance(target, list | tuple | set):
+		targets = [str(t) for t in target]
+		shown = ", ".join(targets[:MAX_LOGGED_TARGETS])
+		if len(targets) > MAX_LOGGED_TARGETS:
+			shown += f" and {len(targets) - MAX_LOGGED_TARGETS} more"
+		return shown
+
+	return str(target)