fix: 修复编辑域名时私钥留空仍报“TLS 私钥和公钥证书必须同时填写”

浏览器提交 textarea 会把换行规范为 CRLF，而证书文件（尤其是一键从
Caddy 导入的）是 LF，导致“证书未修改”的比较失效，私钥留空（保留
现有私钥）时误报必须同时填写。

- handleDomainTLSUpdate 增加 normalizePEM：提交值与磁盘文件统一
  归一化为 LF 后再比较/写入
- 新增 3 个回归测试：CRLF 提交证书未变+私钥留空、CRLF 新证书对
  保存为 LF、证书已变但私钥留空仍应报错

README.md

@@ -108,6 +108,11 @@ ldap_use_tls = false
 max_fail_attempts = 5                    # 登录失败次数阈值
 ban_duration_min = 30                     # 封禁时长（分钟）
 
+[caddy]
+data_dir = ""                             # Caddy 数据目录（含 certificates/ 的那个），
+                                          # 供后台一键导入证书；留空自动探测
+                                          # /var/lib/caddy/.local/share/caddy 等常见位置
+
 [outbound]
 hostname = ""                            # EHLO 主机名，留空使用 [smtp] domain
 poll_interval = 15                       # 外发队列扫描间隔（秒）
@@ -117,6 +122,13 @@ max_recipients = 50                      # 单封邮件最大外部收件人数
 max_per_min = 30                         # 每用户每分钟最大外发数
 max_per_day = 500                        # 每用户每日最大外发数，0 表示禁用外部投递
 connect_timeout = 30                     # 连接远程 MX 超时（秒）
+relay_host = ""                          # 智能主机（smarthost），留空则直投 MX
+relay_port = 587                         # 465 = 隐式 TLS，其他端口按需 STARTTLS
+relay_user = ""                          # 中继认证用户名（AUTH PLAIN）
+relay_password = ""                      # 中继认证密码
+relay_starttls = true                    # 非 465 端口是否使用 STARTTLS
+ip_family = "ipv4"                       # 出站地址族：ipv4（默认）| ipv6 | auto
+source_ip = ""                           # 出站源地址绑定（如静态 IPv6 地址），留空由内核选择
 ```
 
 ---
@@ -200,6 +212,32 @@ tls_key = "/etc/mail_go/certs/server.key"
 > # 私钥路径: /etc/letsencrypt/live/mail.example.com/privkey.pem
 > ```
 
+#### 从 Caddy 一键导入证书
+
+如果本机已用 [Caddy](https://caddyserver.com/) 托管该域名 HTTPS（Caddy 会自动签发并续期证书），
+可在管理后台 **域名管理 → 编辑域名** 页面点击 **“从 Caddy 获取证书”** 按钮，
+一键把 Caddy 存储中的证书与私钥导入邮件服务（自动启用该域名的 TLS），无需手动复制 PEM 文件。
+支持通配符证书（如 `*.example.com` 可匹配 `mail.example.com`）。
+证书支持**热加载**：导入（或手动上传）后立即生效，无需重启服务——SMTP/IMAP/POP3
+每次 TLS 握手会自动检查并重载变化的证书文件。
+
+由于 Caddy 的证书目录仅 `caddy` 用户可读，install.sh 会安装一个 root 权限的证书同步任务
+（`mailgo-caddy-sync.{path,timer}`），把 Caddy 证书树镜像到 `/srv/mail_go/tls/caddy`，
+证书续期后自动同步，mail_go 始终可读；另外还会授予 ACL 权限作为直接读取的兜底。
+安装时自动配置，也可手动执行：
+
+```bash
+sudo ./install.sh setup-caddy-cert          # 自动探测 Caddy 数据目录并配置同步 + ACL
+sudo ./install.sh setup-caddy-cert /path/to/caddy/data   # 或手动指定数据目录
+```
+
+若 Caddy 数据目录不在常见位置，可在配置文件中显式指定：
+
+```toml
+[caddy]
+data_dir = "/var/lib/caddy/.local/share/caddy"
+```
+
 ### 4. 启用 OAuth2 登录（Google 示例）
 
 ```toml
@@ -258,6 +296,30 @@ max_per_day = 500             # 设为 0 可完全禁用外部投递
 每用户每分钟/每日外发数受限；失败邮件会退信到发件人收件箱；
 管理员可在后台「外发队列」查看投递状态、手动重试或取消。
 
+> **IPv4/IPv6**：默认仅使用 IPv4 出站（`ip_family = "ipv4"`），因为很多收件方
+> （如 Gmail）会拒收没有 PTR 的 IPv6 地址，而 IPv4 通常具备正反向一致的 PTR。
+> 如需走 IPv6：请运营商为静态地址配置 PTR（指向 `mail.example.com`），
+> 然后设置 `ip_family = "ipv6"` 并把 `source_ip` 绑定到该静态地址
+> （避免内核使用轮换的临时隐私地址）。
+
+### 7. 通过智能主机（smarthost）中继外发
+
+服务器 IP 属于家庭宽带/动态 IP 段时，常被 Spamhaus PBL 等策略列表收录，
+Microsoft（Outlook/Hotmail）等收件方会直接拒收。此时建议把外发邮件交给
+第三方 SMTP 中继（Mailgun / SendGrid / Amazon SES / 阿里云邮件推送等），
+在 `[outbound]` 中配置即可，所有外部投递自动改走中继：
+
+```toml
+[outbound]
+relay_host = "smtp.example-relay.com"
+relay_port = 587          # 465 为隐式 TLS
+relay_user = "your-api-user"
+relay_password = "your-api-key"
+relay_starttls = true
+```
+
+中继使用 AUTH PLAIN 认证；本地收件人仍走本地投递，不受影响。
+
 ---
 
 ## 端口速查

config/config.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 
 	"github.com/BurntSushi/toml"
 )
@@ -78,6 +79,15 @@ type BanConfig struct {
 	BanDurationMin  int `toml:"ban_duration_min"`  // Default: 30 (minutes)
 }
 
+// CaddyConfig holds settings for importing TLS certificates from a local Caddy.
+type CaddyConfig struct {
+	// DataDir is the Caddy data directory (the one containing the
+	// "certificates/" subdirectory), used by the one-click certificate
+	// import in the admin panel. Leave empty to auto-detect common
+	// locations such as /var/lib/caddy/.local/share/caddy.
+	DataDir string `toml:"data_dir"`
+}
+
 // OutboundConfig holds outbound (external) mail delivery settings.
 type OutboundConfig struct {
 	Hostname       string `toml:"hostname"`        // EHLO 主机名，留空使用 [smtp] domain
@@ -88,6 +98,19 @@ type OutboundConfig struct {
 	MaxPerMin      int    `toml:"max_per_min"`     // 每用户每分钟最大外发数
 	MaxPerDay      int    `toml:"max_per_day"`     // 每用户每日最大外发数，0 表示禁用外部投递
 	ConnectTimeout int    `toml:"connect_timeout"` // 连接远程 MX 超时（秒）
+
+	// Smarthost relay: when relay_host is non-empty, all external mail is
+	// delivered through this relay instead of direct MX delivery. Useful when
+	// the server IP is listed in PBL/blocklists (residential/dynamic IPs).
+	RelayHost     string `toml:"relay_host"`     // 中继服务器地址，留空则直投 MX
+	RelayPort     int    `toml:"relay_port"`     // 465 = 隐式 TLS，其他端口先尝试 STARTTLS
+	RelayUser     string `toml:"relay_user"`     // 中继认证用户名（AUTH PLAIN）
+	RelayPassword string `toml:"relay_password"` // 中继认证密码
+	RelayStartTLS bool   `toml:"relay_starttls"` // 非 465 端口是否使用 STARTTLS
+
+	// IP family and source address binding for outbound connections.
+	IPFamily string `toml:"ip_family"` // ipv4（默认，PTR/SPF 最可靠）| ipv6 | auto
+	SourceIP string `toml:"source_ip"` // 出站源地址绑定（如静态 IPv6），留空由内核选择
 }
 
 // Config is the top-level configuration structure.
@@ -100,6 +123,7 @@ type Config struct {
 	POP3     POP3Config     `toml:"pop3"`
 	Auth     AuthConfig     `toml:"auth"`
 	Ban      BanConfig      `toml:"ban"`
+	Caddy    CaddyConfig    `toml:"caddy"`
 	Outbound OutboundConfig `toml:"outbound"`
 }
 
@@ -170,6 +194,8 @@ func defaultConfig() *Config {
 			MaxFailAttempts: 5,
 			BanDurationMin:  30,
 		},
+		// Caddy: 留空则自动探测常见数据目录，无需配置
+		Caddy: CaddyConfig{},
 		Outbound: OutboundConfig{
 			PollInterval:   15, // 15 秒扫描一次队列
 			MaxAttempts:    12, // 最多尝试 12 次
@@ -177,7 +203,10 @@ func defaultConfig() *Config {
 			MaxRecipients:  50, // 单封最多 50 个外部收件人
 			MaxPerMin:      30, // 每用户每分钟 30 封
 			MaxPerDay:      500,
-			ConnectTimeout: 30, // 连接远程 MX 超时 30 秒
+			ConnectTimeout: 30,  // 连接远程 MX 超时 30 秒
+			RelayPort:      587, // smarthost 默认提交端口
+			RelayStartTLS:  true,
+			IPFamily:       "ipv4",
 		},
 	}
 }
@@ -260,6 +289,12 @@ func mergeDefaults(cfg *Config, defaults *Config) *Config {
 	if cfg.Outbound.ConnectTimeout == 0 {
 		cfg.Outbound.ConnectTimeout = defaults.Outbound.ConnectTimeout
 	}
+	if cfg.Outbound.RelayPort == 0 {
+		cfg.Outbound.RelayPort = defaults.Outbound.RelayPort
+	}
+	if cfg.Outbound.IPFamily == "" {
+		cfg.Outbound.IPFamily = defaults.Outbound.IPFamily
+	}
 	return cfg
 }
 
@@ -310,6 +345,12 @@ func LoadConfig() (*Config, error) {
 		return nil, fmt.Errorf("解析配置文件失败: %w", err)
 	}
 
+	// relay_starttls defaults to true for safety; the raw file is checked
+	// because TOML decoding cannot distinguish an absent bool from false.
+	if !strings.Contains(string(data), "relay_starttls") {
+		cfg.Outbound.RelayStartTLS = defaults.Outbound.RelayStartTLS
+	}
+
 	// Merge defaults for any missing fields
 	merged := mergeDefaults(cfg, defaults)
 

install.sh

@@ -214,6 +214,20 @@ do_install() {
     # 4. 拉取代码并编译
     build_binary
 
+    # 4.5 配置 Caddy 证书同步（若检测到 Caddy），供后台一键导入使用
+    local caddy_data
+    caddy_data="$(find_caddy_data_dir 2>/dev/null || true)"
+    if [[ -n "${caddy_data}" ]]; then
+        info "检测到 Caddy（${caddy_data}），配置证书同步任务 ..."
+        if install_caddy_sync "${caddy_data}"; then
+            ok "Caddy 证书同步已配置（后台可一键导入证书）"
+        else
+            warn "Caddy 证书同步配置失败，可稍后手动执行: sudo $0 setup-caddy-cert"
+        fi
+        # ACL 兜底（失败不影响使用）
+        command -v setfacl &>/dev/null && setup_caddy_acls "${caddy_data}" || true
+    fi
+
     # 5. 部署文件
     deploy_files
 
@@ -250,6 +264,153 @@ do_install() {
     warn "⚠ 请登录后立即修改默认密码！"
 }
 
+# ======================== Caddy 证书同步 ========================
+# mail_go 后台有一键“从 Caddy 获取证书”功能：从 Caddy 的证书存储读取
+# 域名证书与私钥并导入邮件服务。Caddy 证书目录默认仅 caddy 用户可读
+# （0700/0600），且证书续期后文件会被替换（权限重置），因此安装一个
+# root 权限的 systemd path/timer 同步任务，把 Caddy 证书树镜像到
+# mail_go 可读的 <storage>/tls/caddy 目录，续期后自动更新；
+# 同时授予 ACL 作为直接读取的兜底。用法: sudo ./install.sh setup-caddy-cert [caddy数据目录]
+
+# 探测 Caddy 数据目录（包含 certificates/ 子目录的那个目录）
+find_caddy_data_dir() {
+    local candidates=(
+        "/var/lib/caddy/.local/share/caddy"
+        "/root/.local/share/caddy"
+        "/home/caddy/.local/share/caddy"
+    )
+    local d
+    for d in "${candidates[@]}"; do
+        if [[ -d "${d}/certificates" ]]; then
+            echo "${d}"
+            return 0
+        fi
+    done
+    # systemd 服务可能配置了自定义 HOME
+    local home
+    home=$(systemctl show caddy -p Environment --value 2>/dev/null | grep -oP '(?<=HOME=)[^ ]+' || true)
+    if [[ -n "${home}" && -d "${home}/.local/share/caddy/certificates" ]]; then
+        echo "${home}/.local/share/caddy"
+        return 0
+    fi
+    return 1
+}
+
+# 用 ACL 授予 mail_go 用户读取 Caddy 证书的权限（幂等，兜底用：
+# 续期后 caddy 以 0600 重建文件，ACL 可能失效，靠同步任务保障）
+setup_caddy_acls() {
+    local data_dir="${1:-$(find_caddy_data_dir 2>/dev/null || true)}"
+    [[ -n "${data_dir}" ]] || return 1
+    local certs_dir="${data_dir}/certificates"
+    [[ -d "${certs_dir}" ]] || return 1
+
+    command -v setfacl &>/dev/null || return 1
+
+    # 各级父目录需要 x（遍历）权限
+    local p="${data_dir}"
+    while [[ "${p}" != "/" ]]; do
+        setfacl -m "u:${SERVICE_USER}:x" "${p}" 2>/dev/null
+        p="$(dirname "${p}")"
+    done
+    setfacl -R -m "u:${SERVICE_USER}:rX" "${certs_dir}" 2>/dev/null
+    setfacl -R -m "d:u:${SERVICE_USER}:rX" "${certs_dir}" 2>/dev/null
+    return 0
+}
+
+# 安装证书同步脚本 + systemd path/timer 单元，并立即同步一次
+install_caddy_sync() {
+    local data_dir="$1"
+    local sync_script="/usr/local/sbin/mailgo-caddy-cert-sync.sh"
+    local sync_dir="${DATA_DIR}/tls/caddy"
+    local certs_dir="${data_dir}/certificates"
+
+    # 同步脚本（把数据目录固化进去）
+    cat > "${sync_script}" <<EOF
+#!/usr/bin/env bash
+# MailGo - 将 Caddy 证书存储镜像到 mail_go 可读目录（root 运行，
+# 由 mailgo-caddy-sync.{path,timer} 触发），供后台一键导入使用。
+set -euo pipefail
+SRC="${certs_dir}"
+SYNC="${sync_dir}"
+[[ -d "\${SRC}" ]] || exit 0
+mkdir -p "\${SYNC}"
+rm -rf "\${SYNC}/.certs.tmp"
+cp -a "\${SRC}" "\${SYNC}/.certs.tmp"
+chown -R "${SERVICE_USER}:${SERVICE_USER}" "\${SYNC}/.certs.tmp"
+chmod -R u+rwX,go-rwx "\${SYNC}/.certs.tmp"
+rm -rf "\${SYNC}/certificates"
+mv "\${SYNC}/.certs.tmp" "\${SYNC}/certificates"
+EOF
+    chmod 700 "${sync_script}"
+
+    cat > /etc/systemd/system/mailgo-caddy-sync.service <<EOF
+[Unit]
+Description=MailGo - 同步 Caddy 证书到 mail_go TLS 目录
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=${sync_script}
+EOF
+
+    cat > /etc/systemd/system/mailgo-caddy-sync.path <<EOF
+[Unit]
+Description=MailGo - 监视 Caddy 证书目录变化并触发同步
+
+[Path]
+PathChanged=${certs_dir}
+PathChanged=${certs_dir}/*/*
+Unit=mailgo-caddy-sync.service
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    cat > /etc/systemd/system/mailgo-caddy-sync.timer <<EOF
+[Unit]
+Description=MailGo - 定期同步 Caddy 证书（开机 + 每日兜底）
+
+[Timer]
+OnBootSec=1min
+OnUnitActiveSec=1d
+Unit=mailgo-caddy-sync.service
+
+[Install]
+WantedBy=timers.target
+EOF
+
+    systemctl daemon-reload
+    systemctl enable --now mailgo-caddy-sync.path mailgo-caddy-sync.timer >/dev/null
+    systemctl start mailgo-caddy-sync.service
+    return 0
+}
+
+do_setup_caddy_cert() {
+    check_root
+    local data_dir="${2:-}"
+    if [[ -z "${data_dir}" ]]; then
+        data_dir="$(find_caddy_data_dir || true)"
+        if [[ -z "${data_dir}" ]]; then
+            error "未检测到 Caddy 数据目录（/var/lib/caddy 等），请手动指定: sudo $0 setup-caddy-cert <caddy数据目录>"
+        fi
+        info "检测到 Caddy 数据目录: ${data_dir}"
+    elif [[ ! -d "${data_dir}/certificates" ]]; then
+        error "目录 ${data_dir} 下未找到 certificates/ 子目录，请确认传入的是 Caddy 数据目录"
+    fi
+
+    info "安装证书同步任务（systemd path + timer，续期后自动同步）..."
+    install_caddy_sync "${data_dir}"
+    ok "证书同步任务已安装并完成首次同步"
+
+    if command -v setfacl &>/dev/null && setup_caddy_acls "${data_dir}"; then
+        ok "已授予 ${SERVICE_USER} 用户直接读取 Caddy 证书的 ACL 权限（兜底）"
+    else
+        warn "未配置 ACL 兜底（不影响使用，同步镜像始终可读）"
+    fi
+
+    ok "现在可在管理后台“编辑域名”页点击“从 Caddy 获取证书”一键导入"
+}
+
 # ======================== 卸载 ========================
 do_uninstall() {
     info "========== 卸载 ${SERVICE_NAME} =========="
@@ -352,21 +513,24 @@ do_status() {
 
 # ======================== 入口 ========================
 case "${1:-}" in
-    install)   do_install   ;;
+    install)           do_install           ;;
-    uninstall) do_uninstall ;;
+    uninstall)         do_uninstall         ;;
-    start)     do_start     ;;
+    start)             do_start             ;;
-    stop)      do_stop      ;;
+    stop)              do_stop              ;;
-    restart)   do_restart   ;;
+    restart)           do_restart           ;;
-    status)    do_status    ;;
+    status)            do_status            ;;
+    setup-caddy-cert)  do_setup_caddy_cert  ;;
     *)
-        echo "用法: sudo $0 {install|uninstall|start|stop|restart|status}"
+        echo "用法: sudo $0 {install|uninstall|start|stop|restart|status|setup-caddy-cert}"
         echo ""
-        echo "  install   — 完整安装/更新（拉代码+编译+部署+启动+开机自启）"
+        echo "  install          — 完整安装/更新（拉代码+编译+部署+启动+开机自启）"
-        echo "  uninstall — 卸载服务（可选保留数据）"
+        echo "  uninstall        — 卸载服务（可选保留数据）"
-        echo "  start     — 启动服务"
+        echo "  start            — 启动服务"
-        echo "  stop      — 停止服务"
+        echo "  stop             — 停止服务"
-        echo "  restart   — 重启服务"
+        echo "  restart          — 重启服务"
-        echo "  status    — 查看服务状态"
+        echo "  status           — 查看服务状态"
+        echo "  setup-caddy-cert — 授予 mail_go 读取本机 Caddy 证书的 ACL 权限"
+        echo "                     （后台“从 Caddy 获取证书”按钮的前置条件）"
         exit 1
         ;;
 esac

internal/caddycert/caddycert.go

@@ -0,0 +1,243 @@
+// Package caddycert 从本机 Caddy 的证书存储中查找并读取某个域名
+// 的 TLS 证书与私钥，供 MailGo 一键导入使用。
+//
+// Caddy（certmagic）将 ACME 证书保存在其数据目录下的
+//
+//	<data>/certificates/<CA 目录>/<域名>/<域名>.crt
+//	<data>/certificates/<CA 目录>/<域名>/<域名>.key
+//
+// 数据目录默认是 $HOME/.local/share/caddy（systemd 服务通常是
+// /var/lib/caddy/.local/share/caddy），可通过配置 caddy.data_dir 覆盖。
+package caddycert
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"os"
+	"os/user"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+)
+
+// DefaultDataDirs 是未显式配置时依次探测的 Caddy 数据目录。
+var DefaultDataDirs = []string{
+	"/var/lib/caddy/.local/share/caddy", // Debian/Ubuntu 软件包的 systemd 服务默认 HOME
+	"/root/.local/share/caddy",          // 直接以 root 运行的 caddy
+	"/home/caddy/.local/share/caddy",
+}
+
+// Cert 是从 Caddy 存储中找到的一对证书与私钥（PEM 编码）。
+type Cert struct {
+	CertPEM []byte // 证书链（含叶子证书）
+	KeyPEM  []byte // 私钥
+	Source  string // 来源 .crt 文件的绝对路径
+}
+
+// Fetch 在给定的 Caddy 证书数据目录中查找 domain 的证书与私钥。
+//
+// dataDirs 按优先级从高到低排列，每个目录都是包含 certificates/ 子目录的
+// Caddy 数据目录（如 /var/lib/caddy/.local/share/caddy，或 mail_go 的同步
+// 镜像目录 /srv/mail_go/tls/caddy）；空字符串项被忽略。dataDirs 为空时仅
+// 探测 DefaultDataDirs 及当前进程用户的数据目录。
+//
+// 返回的证书保证：能组成有效的密钥对、尚未过期、且证书 SAN 覆盖 domain
+// （支持通配符证书，例如 *.example.com 的证书可匹配 mail.example.com）。
+func Fetch(domain string, dataDirs []string) (*Cert, error) {
+	domain = strings.ToLower(strings.TrimSpace(domain))
+	if domain == "" {
+		return nil, fmt.Errorf("域名为空")
+	}
+
+	roots := dataRoots(dataDirs)
+
+	var (
+		permDenied []string
+		seen       []string // 找到同名/相关文件但证书无效的来源
+	)
+	for _, root := range roots {
+		cert, found, invalid, err := searchRoot(domain, root)
+		if err != nil {
+			if os.IsPermission(err) {
+				permDenied = append(permDenied, root)
+				continue
+			}
+			continue
+		}
+		if found {
+			return cert, nil
+		}
+		seen = append(seen, invalid...)
+	}
+
+	msg := fmt.Sprintf("在 Caddy 证书存储中未找到域名 %q 的证书（请确认 Caddy 已为该域名签发证书）", domain)
+	if len(seen) > 0 {
+		msg += fmt.Sprintf("；发现相关文件但证书无效/已过期/不匹配域名: %s", strings.Join(seen, "、"))
+	}
+	if len(permDenied) > 0 {
+		msg += fmt.Sprintf("；另有目录因权限不足未能检查: %s，可运行 install.sh 的 setup-caddy-cert 授予 %s 用户读取权限",
+			strings.Join(permDenied, "、"), currentUsername())
+	}
+	return nil, fmt.Errorf("%s", msg)
+}
+
+// dataRoots 返回要探测的候选数据目录列表（去重，保留优先级顺序）。
+func dataRoots(dataDirs []string) []string {
+	var roots []string
+	seen := map[string]bool{}
+	add := func(p string) {
+		p = strings.TrimRight(filepath.Clean(p), string(filepath.Separator))
+		if p == "" || seen[p] {
+			return
+		}
+		seen[p] = true
+		roots = append(roots, p)
+	}
+
+	for _, d := range dataDirs {
+		add(d)
+	}
+	for _, d := range DefaultDataDirs {
+		add(d)
+	}
+	if home, err := os.UserHomeDir(); err == nil && home != "" {
+		add(filepath.Join(home, ".local", "share", "caddy"))
+	}
+	return roots
+}
+
+// searchRoot 在单个数据目录中查找 domain 的证书。
+// 返回 (证书, 是否找到, 找到但无效的来源列表, 错误)。
+func searchRoot(domain, root string) (*Cert, bool, []string, error) {
+	// 允许把 certificates/ 目录本身当作 data_dir 传入
+	certsDir := root
+	if filepath.Base(certsDir) != "certificates" {
+		certsDir = filepath.Join(root, "certificates")
+	}
+
+	info, err := os.Stat(certsDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, false, nil, nil
+		}
+		return nil, false, nil, err
+	}
+	if !info.IsDir() {
+		return nil, false, nil, nil
+	}
+
+	caDirs, err := os.ReadDir(certsDir)
+	if err != nil {
+		return nil, false, nil, err
+	}
+
+	var invalid []string
+
+	// 1) 直接路径: certificates/<CA>/<domain>/<domain>.crt|.key
+	for _, ca := range caDirs {
+		if !ca.IsDir() {
+			continue
+		}
+		cert, found, bad, err := readDomainDir(filepath.Join(certsDir, ca.Name(), domain), domain)
+		if err != nil {
+			return nil, false, nil, err
+		}
+		if found {
+			return cert, true, nil, nil
+		}
+		invalid = append(invalid, bad...)
+	}
+
+	// 2) 全量扫描，处理通配符证书（如 *.example.com 目录）等情况
+	for _, ca := range caDirs {
+		if !ca.IsDir() {
+			continue
+		}
+		caPath := filepath.Join(certsDir, ca.Name())
+		domDirs, err := os.ReadDir(caPath)
+		if err != nil {
+			return nil, false, nil, err
+		}
+		for _, d := range domDirs {
+			if !d.IsDir() {
+				continue
+			}
+			cert, found, bad, err := readDomainDir(filepath.Join(caPath, d.Name()), domain)
+			if err != nil {
+				return nil, false, nil, err
+			}
+			if found {
+				return cert, true, nil, nil
+			}
+			invalid = append(invalid, bad...)
+		}
+	}
+
+	sort.Strings(invalid)
+	return nil, false, invalid, nil
+}
+
+// readDomainDir 读取 Caddy 某个域名目录下的 <name>.crt 与 <name>.key，
+// 校验其是否为 domain 的有效证书。bad 返回“存在但无效”的来源路径。
+func readDomainDir(dirPath, domain string) (*Cert, bool, []string, error) {
+	name := filepath.Base(dirPath)
+	certPath := filepath.Join(dirPath, name+".crt")
+	keyPath := filepath.Join(dirPath, name+".key")
+
+	certPEM, err := os.ReadFile(certPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, false, nil, nil
+		}
+		return nil, false, nil, err
+	}
+	keyPEM, err := os.ReadFile(keyPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, false, nil, nil
+		}
+		return nil, false, nil, err
+	}
+
+	// 只有与目标域名相关的目录才值得报“无效”，否则静默跳过
+	related := strings.TrimSuffix(name, "."+domain) == domain ||
+		name == domain || strings.HasPrefix(name, "*.") && strings.HasSuffix(domain, name[1:])
+
+	if !validPair(certPEM, keyPEM, domain) {
+		if related {
+			return nil, false, []string{certPath}, nil
+		}
+		return nil, false, nil, nil
+	}
+
+	return &Cert{CertPEM: certPEM, KeyPEM: keyPEM, Source: certPath}, true, nil, nil
+}
+
+// validPair 校验证书/私钥是否组成有效密钥对、未过期且 SAN 覆盖 domain。
+func validPair(certPEM, keyPEM []byte, domain string) bool {
+	pair, err := tls.X509KeyPair(certPEM, keyPEM)
+	if err != nil {
+		return false
+	}
+	if len(pair.Certificate) == 0 {
+		return false
+	}
+	leaf, err := x509.ParseCertificate(pair.Certificate[0])
+	if err != nil {
+		return false
+	}
+	if time.Now().After(leaf.NotAfter) {
+		return false
+	}
+	return leaf.VerifyHostname(domain) == nil
+}
+
+// currentUsername 返回当前进程的运行用户（错误提示用）。
+func currentUsername() string {
+	if u, err := user.Current(); err == nil && u.Username != "" {
+		return u.Username
+	}
+	return os.Getenv("USER")
+}

internal/caddycert/caddycert_test.go

@@ -0,0 +1,176 @@
+package caddycert
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// makeCert 生成一份自签名证书（含指定 SAN），返回 PEM 编码的证书与私钥。
+func makeCert(t *testing.T, dnsNames []string, notBefore, notAfter time.Time) (certPEM, keyPEM []byte) {
+	t.Helper()
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("生成私钥失败: %v", err)
+	}
+
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: dnsNames[0]},
+		DNSNames:     dnsNames,
+		NotBefore:    notBefore,
+		NotAfter:     notAfter,
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatalf("生成证书失败: %v", err)
+	}
+
+	certPEM = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	keyPEM = pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
+	return certPEM, keyPEM
+}
+
+// writeSite 在 Caddy 风格目录结构中写入某个域名的证书。
+func writeSite(t *testing.T, dataDir, domain string, certPEM, keyPEM []byte) {
+	t.Helper()
+	dir := filepath.Join(dataDir, "certificates", "acme-v02.api.letsencrypt.org-directory", domain)
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		t.Fatalf("创建目录失败: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, domain+".crt"), certPEM, 0600); err != nil {
+		t.Fatalf("写入证书失败: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, domain+".key"), keyPEM, 0600); err != nil {
+		t.Fatalf("写入私钥失败: %v", err)
+	}
+}
+
+func TestFetchExactDomain(t *testing.T) {
+	dataDir := t.TempDir()
+	certPEM, keyPEM := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-time.Hour), time.Now().Add(24*time.Hour))
+	writeSite(t, dataDir, "mail.example.com", certPEM, keyPEM)
+
+	got, err := Fetch("mail.example.com", []string{dataDir})
+	if err != nil {
+		t.Fatalf("Fetch 失败: %v", err)
+	}
+	if string(got.CertPEM) != string(certPEM) {
+		t.Error("返回的证书与写入的不一致")
+	}
+	if string(got.KeyPEM) != string(keyPEM) {
+		t.Error("返回的私钥与写入的不一致")
+	}
+}
+
+func TestFetchWildcardCoversSubdomain(t *testing.T) {
+	dataDir := t.TempDir()
+	certPEM, keyPEM := makeCert(t, []string{"*.example.com", "example.com"}, time.Now().Add(-time.Hour), time.Now().Add(24*time.Hour))
+	writeSite(t, dataDir, "*.example.com", certPEM, keyPEM)
+
+	got, err := Fetch("mail.example.com", []string{dataDir})
+	if err != nil {
+		t.Fatalf("通配符证书应覆盖子域名，Fetch 失败: %v", err)
+	}
+	if got.Source == "" {
+		t.Error("Source 不应为空")
+	}
+}
+
+func TestFetchSkipsExpiredCert(t *testing.T) {
+	dataDir := t.TempDir()
+	certPEM, keyPEM := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-48*time.Hour), time.Now().Add(-24*time.Hour))
+	writeSite(t, dataDir, "mail.example.com", certPEM, keyPEM)
+
+	_, err := Fetch("mail.example.com", []string{dataDir})
+	if err == nil {
+		t.Fatal("过期证书不应被返回")
+	}
+	if !strings.Contains(err.Error(), "无效") {
+		t.Errorf("错误信息应说明证书无效，实际: %v", err)
+	}
+}
+
+func TestFetchNotExist(t *testing.T) {
+	dataDir := t.TempDir()
+
+	_, err := Fetch("nobody.example.com", []string{dataDir})
+	if err == nil {
+		t.Fatal("不存在的域名应返回错误")
+	}
+	if !strings.Contains(err.Error(), "未找到") {
+		t.Errorf("错误信息应包含“未找到”，实际: %v", err)
+	}
+}
+
+func TestFetchUppercaseDomainIsLowercased(t *testing.T) {
+	dataDir := t.TempDir()
+	certPEM, keyPEM := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-time.Hour), time.Now().Add(24*time.Hour))
+	writeSite(t, dataDir, "mail.example.com", certPEM, keyPEM)
+
+	if _, err := Fetch("MAIL.Example.COM", []string{dataDir}); err != nil {
+		t.Fatalf("域名大小写应被归一化，Fetch 失败: %v", err)
+	}
+}
+
+func TestFetchCertificatesDirAsDataDir(t *testing.T) {
+	dataDir := t.TempDir()
+	certPEM, keyPEM := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-time.Hour), time.Now().Add(24*time.Hour))
+	writeSite(t, dataDir, "mail.example.com", certPEM, keyPEM)
+
+	// 把 certificates 目录本身当作 data_dir 传入
+	certsDir := filepath.Join(dataDir, "certificates")
+	if _, err := Fetch("mail.example.com", []string{certsDir}); err != nil {
+		t.Fatalf("data_dir 直接指向 certificates 目录时应可用: %v", err)
+	}
+}
+
+func TestFetchPrefersFirstDataDir(t *testing.T) {
+	// 模拟“同步镜像目录优先”：两个目录都有该域名证书时，应返回第一个的
+	dirA := t.TempDir()
+	dirB := t.TempDir()
+	certA, keyA := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-time.Hour), time.Now().Add(48*time.Hour))
+	certB, keyB := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-time.Hour), time.Now().Add(24*time.Hour))
+	writeSite(t, dirA, "mail.example.com", certA, keyA)
+	writeSite(t, dirB, "mail.example.com", certB, keyB)
+
+	got, err := Fetch("mail.example.com", []string{dirA, dirB})
+	if err != nil {
+		t.Fatalf("Fetch 失败: %v", err)
+	}
+	if string(got.CertPEM) != string(certA) {
+		t.Error("应按优先级返回第一个目录中的证书")
+	}
+}
+
+func TestFetchPermissionDeniedHint(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root 用户不受文件权限限制，跳过")
+	}
+	dataDir := t.TempDir()
+	certPEM, keyPEM := makeCert(t, []string{"mail.example.com"}, time.Now().Add(-time.Hour), time.Now().Add(24*time.Hour))
+	writeSite(t, dataDir, "mail.example.com", certPEM, keyPEM)
+	if err := os.Chmod(dataDir, 0000); err != nil {
+		t.Fatalf("chmod 失败: %v", err)
+	}
+	defer os.Chmod(dataDir, 0700)
+
+	_, err := Fetch("mail.example.com", []string{dataDir})
+	if err == nil {
+		t.Fatal("无权限时应返回错误")
+	}
+	if !strings.Contains(err.Error(), "权限不足") {
+		t.Errorf("错误信息应提示权限不足，实际: %v", err)
+	}
+}

internal/imap_server/server.go

@@ -7,6 +7,7 @@ import (
 
 	"mail_go/config"
 	"mail_go/internal/store"
+	"mail_go/internal/tlsutil"
 
 	"github.com/emersion/go-imap/backend"
 	imapserver "github.com/emersion/go-imap/server"
@@ -14,27 +15,27 @@ import (
 
 // IMAPServer wraps a go-imap Server and provides mailbox access capability.
 type IMAPServer struct {
-	stores *store.Stores
+	stores    *store.Stores
-	cfg    config.IMAPConfig
+	cfg       config.IMAPConfig
+	tlsLoader *tlsutil.Loader
 }
 
-// NewIMAPServer creates a new IMAP server instance.
+// NewIMAPServer creates a new IMAP server instance. tlsLoader may be nil
-func NewIMAPServer(cfg config.IMAPConfig, stores *store.Stores) *IMAPServer {
+// when TLS is not configured.
+func NewIMAPServer(cfg config.IMAPConfig, stores *store.Stores, tlsLoader *tlsutil.Loader) *IMAPServer {
 	return &IMAPServer{
-		stores: stores,
+		stores:    stores,
-		cfg:    cfg,
+		cfg:       cfg,
+		tlsLoader: tlsLoader,
 	}
 }
 
 func (s *IMAPServer) tlsConfig() (*tls.Config, error) {
-	if s.cfg.TLSCert == "" || s.cfg.TLSKey == "" {
+	if s.tlsLoader == nil {
 		return nil, fmt.Errorf("IMAP TLS certificate or key not configured")
 	}
-	cert, err := tls.LoadX509KeyPair(s.cfg.TLSCert, s.cfg.TLSKey)
+	// GetCertificate 每次握手按需重载证书，证书更新后无需重启服务
-	if err != nil {
+	return &tls.Config{GetCertificate: s.tlsLoader.GetCertificate}, nil
-		return nil, fmt.Errorf("failed to load IMAP TLS certificate: %w", err)
-	}
-	return &tls.Config{Certificates: []tls.Certificate{cert}}, nil
 }
 
 // newServer creates a configured imapserver.Server with the given address.

internal/outbound/mailer.go

@@ -3,12 +3,14 @@
 // Messages queued for external recipients are stored in the outbound_messages
 // table and delivered by the Manager's background worker: MX lookup, SMTP
 // transaction over port 25 with opportunistic STARTTLS, exponential backoff
-// retries, permanent-failure bounces and DKIM signing.
+// retries, permanent-failure bounces and DKIM signing. A smarthost relay can
+// be configured for servers whose own IP is blocklisted (e.g. PBL).
 package outbound
 
 import (
 	"context"
 	"crypto/tls"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"net"
@@ -45,10 +47,22 @@ func newPermError(format string, args ...interface{}) *DeliveryError {
 	return &DeliveryError{Permanent: true, Msg: fmt.Sprintf(format, args...)}
 }
 
-// Mailer performs direct MX delivery of a single message.
+// RelayConfig describes a smarthost through which all external mail is sent.
+type RelayConfig struct {
+	Host     string
+	Port     int    // 465 = implicit TLS; other ports may use STARTTLS
+	Username string // AUTH PLAIN credentials (empty = no authentication)
+	Password string
+	StartTLS bool // use STARTTLS on non-465 ports
+}
+
+// Mailer performs direct MX delivery (or smarthost relay) of a single message.
 type Mailer struct {
 	Hostname       string // EHLO hostname presented to remote servers
 	Port           int    // destination port, 0 means the default SMTP port 25
+	Relay          *RelayConfig
+	IPFamily       string // "ipv4" (default), "ipv6" or "auto"
+	SourceIP       string // optional source address to bind (e.g. a static IPv6)
 	ConnectTimeout time.Duration
 }
 
@@ -68,17 +82,22 @@ func (m *Mailer) port() int {
 	return m.Port
 }
 
-// Deliver sends one message to one recipient via the recipient domain's MX.
+// Deliver sends one message to one recipient. When a relay is configured the
-// It returns the final SMTP response text on success and a *DeliveryError on
+// message goes through the smarthost; otherwise the recipient domain's MX is
-// failure.
+// used. It returns the final SMTP response text on success and a
+// *DeliveryError on failure.
 func (m *Mailer) Deliver(from, to string, data []byte) (string, error) {
+	if m.Relay != nil && m.Relay.Host != "" {
+		return m.deliverViaRelay(from, to, data)
+	}
+
 	at := strings.LastIndex(to, "@")
 	if at < 0 || at == len(to)-1 {
 		return "", newPermError("invalid recipient address: %s", to)
 	}
 	domain := strings.ToLower(strings.TrimSpace(to[at+1:]))
 
-	mxHosts, err := lookupMX(domain)
+	mxHosts, err := lookupMX(domain, m.IPFamily)
 	if err != nil {
 		var de *DeliveryError
 		if errors.As(err, &de) {
@@ -111,6 +130,18 @@ func (m *Mailer) Deliver(from, to string, data []byte) (string, error) {
 	return "", lastErr
 }
 
+// deliverViaRelay sends the message through the configured smarthost.
+func (m *Mailer) deliverViaRelay(from, to string, data []byte) (string, error) {
+	port := m.Relay.Port
+	if port == 0 {
+		port = 587
+	}
+	implicitTLS := port == 465
+	return m.smtpTransaction(m.Relay.Host, port, implicitTLS,
+		m.Relay.StartTLS && !implicitTLS,
+		m.Relay.Username, m.Relay.Password, from, to, data)
+}
+
 // smtpClient wraps a textproto connection to a remote SMTP server.
 type smtpClient struct {
 	conn net.Conn
@@ -191,15 +222,37 @@ func (c *smtpClient) hello(hostname string) error {
 	return nil
 }
 
+// authPlain performs AUTH PLAIN with the initial-response form, falling back
+// to the two-step form when the server asks for credentials separately.
+func (c *smtpClient) authPlain(username, password string) error {
+	b64 := base64.StdEncoding.EncodeToString([]byte("\x00" + username + "\x00" + password))
+	code, msg, err := c.cmd(235, "AUTH PLAIN %s", b64)
+	if err != nil {
+		if code == 334 {
+			_, _, err = c.cmd(235, "%s", b64)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	_ = msg
+	return nil
+}
+
 // deliverToHost performs a full SMTP transaction with a single MX host.
 func (m *Mailer) deliverToHost(host, from, to string, data []byte) (string, error) {
-	addr := net.JoinHostPort(host, strconv.Itoa(m.port()))
+	return m.smtpTransaction(host, m.port(), false, false, "", "", from, to, data)
+}
+
+// smtpTransaction performs one complete SMTP session: connect, greeting,
+// optional implicit TLS / STARTTLS, optional AUTH PLAIN, MAIL/RCPT/DATA/QUIT.
+func (m *Mailer) smtpTransaction(host string, port int, implicitTLS, startTLS bool, username, password, from, to string, data []byte) (string, error) {
+	addr := net.JoinHostPort(host, strconv.Itoa(port))
 
 	ctx, cancel := context.WithTimeout(context.Background(), m.ConnectTimeout)
 	defer cancel()
 
-	dialer := &net.Dialer{Timeout: m.ConnectTimeout}
+	conn, err := m.dialSMTP(ctx, addr)
-	conn, err := dialer.DialContext(ctx, "tcp", addr)
 	if err != nil {
 		return "", newTempError("connect to %s failed: %v", addr, err)
 	}
@@ -212,26 +265,50 @@ func (m *Mailer) deliverToHost(host, from, to string, data []byte) (string, erro
 		return "", classifyResponse(err, msg)
 	}
 
-	if err := c.hello(m.Hostname); err != nil {
+	tlsServerName := host
-		return "", err
+	if ip := net.ParseIP(host); ip != nil {
+		tlsServerName = "" // no SNI for IP literals
 	}
 
-	// Opportunistic STARTTLS (RFC 3207): only when the server advertises it.
+	if implicitTLS {
-	if _, ok := c.exts["STARTTLS"]; ok {
+		tlsConn, err := tlsClientHandshake(ctx, conn, tlsServerName, host)
-		if _, _, err := c.cmd(220, "STARTTLS"); err != nil {
+		if err != nil {
 			return "", err
 		}
-		tlsConn := tls.Client(conn, &tls.Config{
-			ServerName:         host,
-			InsecureSkipVerify: true, // remote MX certificates often cannot be verified
-		})
-		if err := tlsConn.HandshakeContext(ctx); err != nil {
-			return "", newTempError("TLS handshake with %s failed: %v", host, err)
-		}
 		c.txt = textproto.NewConn(tlsConn)
 		if err := c.hello(m.Hostname); err != nil {
 			return "", err
 		}
+	} else {
+		if err := c.hello(m.Hostname); err != nil {
+			return "", err
+		}
+		// Opportunistic STARTTLS: only when the server advertises it, unless
+		// startTLS is explicitly requested (smarthost), in which case a
+		// non-advertising server is an error.
+		_, adv := c.exts["STARTTLS"]
+		if adv || startTLS {
+			if !adv && startTLS {
+				return "", newTempError("%s does not advertise STARTTLS", host)
+			}
+			if _, _, err := c.cmd(220, "STARTTLS"); err != nil {
+				return "", err
+			}
+			tlsConn, err := tlsClientHandshake(ctx, conn, tlsServerName, host)
+			if err != nil {
+				return "", err
+			}
+			c.txt = textproto.NewConn(tlsConn)
+			if err := c.hello(m.Hostname); err != nil {
+				return "", err
+			}
+		}
+	}
+
+	if username != "" {
+		if err := c.authPlain(username, password); err != nil {
+			return "", fmt.Errorf("AUTH PLAIN with %s failed: %w", host, err)
+		}
 	}
 
 	// MAIL FROM with BODY=8BITMIME when the message contains 8-bit bytes and
@@ -276,6 +353,58 @@ func (m *Mailer) deliverToHost(host, from, to string, data []byte) (string, erro
 	return fmt.Sprintf("%d %s", code, msg), nil
 }
 
+// tlsClientHandshake upgrades a plain connection to TLS.
+func tlsClientHandshake(ctx context.Context, conn net.Conn, serverName, host string) (net.Conn, error) {
+	tlsConn := tls.Client(conn, &tls.Config{
+		ServerName:         serverName,
+		InsecureSkipVerify: true, // remote MX certificates often cannot be verified
+	})
+	if err := tlsConn.HandshakeContext(ctx); err != nil {
+		return nil, newTempError("TLS handshake with %s failed: %v", host, err)
+	}
+	return tlsConn, nil
+}
+
+// dialSMTP connects to a remote SMTP server, honoring the configured IP
+// family and optional source address binding.
+//
+// The default is IPv4-only: many receiving systems (e.g. Gmail) reject mail
+// from IPv6 addresses without PTR records, and the IPv4 address of a mail
+// host usually has a forward-confirmed PTR and a matching SPF entry. Switch
+// IPFamily to "ipv6"/"auto" after the ISP has configured a PTR for the
+// source address and SourceIP binds the connection to that static address.
+func (m *Mailer) dialSMTP(ctx context.Context, addr string) (net.Conn, error) {
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil, err
+	}
+
+	network := "tcp4"
+	if ip := net.ParseIP(host); ip != nil {
+		// Literal destination: pick the matching family.
+		if ip.To4() == nil {
+			network = "tcp6"
+		}
+	} else {
+		switch strings.ToLower(m.IPFamily) {
+		case "ipv6":
+			network = "tcp6"
+		case "auto":
+			network = "tcp"
+		default: // "ipv4" and anything unrecognized
+			network = "tcp4"
+		}
+	}
+
+	dialer := &net.Dialer{Timeout: m.ConnectTimeout}
+	if m.SourceIP != "" {
+		if ip := net.ParseIP(m.SourceIP); ip != nil {
+			dialer.LocalAddr = &net.TCPAddr{IP: ip}
+		}
+	}
+	return dialer.DialContext(ctx, network, net.JoinHostPort(host, port))
+}
+
 // is8Bit reports whether the data contains any byte >= 0x80.
 func is8Bit(data []byte) bool {
 	for _, b := range data {
@@ -288,8 +417,9 @@ func is8Bit(data []byte) bool {
 
 // lookupMX resolves the MX hosts for a domain, sorted by preference.
 // Per RFC 5321 section 5.1, when no MX record exists the domain itself is
-// used as an implicit MX with preference 0.
+// used as an implicit MX with preference 0. ipFamily controls the ordering
-func lookupMX(domain string) ([]string, error) {
+// of the A/AAAA fallback ("ipv6" puts IPv6 first, otherwise IPv4 first).
+func lookupMX(domain, ipFamily string) ([]string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
@@ -308,9 +438,19 @@ func lookupMX(domain string) ([]string, error) {
 		if err != nil {
 			return nil, err
 		}
-		hosts := make([]string, 0, len(ips))
+		var hosts []string
+		var v6 []string
 		for _, ip := range ips {
-			hosts = append(hosts, ip.String())
+			if ip.IP.To4() != nil {
+				hosts = append(hosts, ip.IP.String())
+			} else {
+				v6 = append(v6, ip.IP.String())
+			}
+		}
+		if strings.EqualFold(ipFamily, "ipv6") {
+			hosts = append(v6, hosts...)
+		} else {
+			hosts = append(hosts, v6...)
 		}
 		if len(hosts) == 0 {
 			return nil, fmt.Errorf("no MX or A records for %s", domain)

internal/outbound/mailer_test.go

@@ -2,6 +2,7 @@ package outbound
 
 import (
 	"bufio"
+	"encoding/base64"
 	"net"
 	"strings"
 	"testing"
@@ -225,3 +226,117 @@ func TestMailerPermanentFailure(t *testing.T) {
 	}
 	<-done
 }
+
+func TestMailerSmarthostRelay(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	defer ln.Close()
+
+	type result struct {
+		gotData  []byte
+		authLine string
+	}
+	ch := make(chan result, 1)
+
+	go func() {
+		conn, err := ln.Accept()
+		if err != nil {
+			ch <- result{}
+			return
+		}
+		defer conn.Close()
+		r := bufio.NewReader(conn)
+		w := bufio.NewWriter(conn)
+		_, _ = w.WriteString("220 relay.test ESMTP\r\n")
+		_ = w.Flush()
+
+		var authLine string
+		var got []byte
+		for {
+			line, err := r.ReadString('\n')
+			if err != nil {
+				break
+			}
+			trimmed := strings.TrimRight(line, "\r\n")
+			up := strings.ToUpper(trimmed)
+			switch {
+			case strings.HasPrefix(up, "EHLO"):
+				_, _ = w.WriteString("250-relay.test\r\n250-8BITMIME\r\n250 AUTH PLAIN\r\n")
+				_ = w.Flush()
+			case strings.HasPrefix(up, "AUTH PLAIN"):
+				authLine = trimmed
+				_, _ = w.WriteString("235 2.0.0 ok\r\n")
+				_ = w.Flush()
+			case strings.HasPrefix(up, "MAIL FROM"):
+				if authLine == "" {
+					_, _ = w.WriteString("530 5.7.0 auth required\r\n")
+					_ = w.Flush()
+					break
+				}
+				_, _ = w.WriteString("250 ok\r\n")
+				_ = w.Flush()
+			case strings.HasPrefix(up, "RCPT TO"):
+				_, _ = w.WriteString("250 ok\r\n")
+				_ = w.Flush()
+			case strings.HasPrefix(up, "DATA"):
+				_, _ = w.WriteString("354 go\r\n")
+				_ = w.Flush()
+				for {
+					dl, err := r.ReadString('\n')
+					if err != nil {
+						break
+					}
+					if strings.TrimRight(dl, "\r\n") == "." {
+						break
+					}
+					if strings.HasPrefix(dl, "..") {
+						dl = dl[1:]
+					}
+					got = append(got, []byte(dl)...)
+				}
+				_, _ = w.WriteString("250 queued\r\n")
+				_ = w.Flush()
+			case strings.HasPrefix(up, "QUIT"):
+				_, _ = w.WriteString("221 bye\r\n")
+				_ = w.Flush()
+				ch <- result{gotData: got, authLine: authLine}
+				return
+			}
+		}
+		ch <- result{}
+	}()
+
+	m := NewMailer("mail.lmve.net", 10*time.Second)
+	m.Relay = &RelayConfig{
+		Host:     "127.0.0.1",
+		Port:     ln.Addr().(*net.TCPAddr).Port,
+		Username: "relay-user",
+		Password: "relay-pass",
+		StartTLS: false,
+	}
+
+	// The recipient domain does not even exist — with a relay configured,
+	// no MX lookup happens and the relay still receives the message.
+	input := []byte("From: a@lmve.net\r\nTo: b@bogus-domain.invalid\r\nSubject: relay\r\n\r\nbody\r\n")
+	resp, err := m.Deliver("a@lmve.net", "b@bogus-domain.invalid", input)
+	if err != nil {
+		t.Fatalf("Deliver via relay: %v", err)
+	}
+	if !strings.HasPrefix(resp, "250") {
+		t.Fatalf("unexpected relay response: %q", resp)
+	}
+
+	res := <-ch
+	if res.authLine == "" {
+		t.Fatal("relay did not receive AUTH PLAIN")
+	}
+	wantAuth := "AUTH PLAIN " + base64.StdEncoding.EncodeToString([]byte("\x00relay-user\x00relay-pass"))
+	if res.authLine != wantAuth {
+		t.Fatalf("auth line mismatch: got %q want %q", res.authLine, wantAuth)
+	}
+	if string(res.gotData) != string(input) {
+		t.Fatalf("relay data mismatch.\ngot:  %q\nwant: %q", res.gotData, input)
+	}
+}

internal/outbound/manager.go

@@ -56,6 +56,22 @@ func NewManager(cfg config.OutboundConfig, hostname string, stores *store.Stores
 		lim:      make(map[uint]*userWindow),
 		batch:    50,
 	}
+	m.mailer.IPFamily = cfg.IPFamily
+	m.mailer.SourceIP = cfg.SourceIP
+	if cfg.SourceIP != "" {
+		log.Printf("outbound: binding source address %s (ip_family=%s)", cfg.SourceIP, cfg.IPFamily)
+	}
+
+	if cfg.RelayHost != "" {
+		m.mailer.Relay = &RelayConfig{
+			Host:     cfg.RelayHost,
+			Port:     cfg.RelayPort,
+			Username: cfg.RelayUser,
+			Password: cfg.RelayPassword,
+			StartTLS: cfg.RelayStartTLS,
+		}
+		log.Printf("outbound: using smarthost relay %s:%d", cfg.RelayHost, cfg.RelayPort)
+	}
 	return m
 }
 

internal/pop3_server/server.go

@@ -14,30 +14,30 @@ import (
 	"mail_go/config"
 	"mail_go/internal/db"
 	"mail_go/internal/store"
+	"mail_go/internal/tlsutil"
 )
 
 // POP3Server implements a simple POP3 mail server over TCP.
 type POP3Server struct {
-	listener net.Listener
+	listener  net.Listener
-	stores   *store.Stores
+	stores    *store.Stores
-	cfg      config.POP3Config
+	cfg       config.POP3Config
-	wg       sync.WaitGroup
+	tlsLoader *tlsutil.Loader
+	wg        sync.WaitGroup
 }
 
-// NewPOP3Server creates a new POP3 server instance.
+// NewPOP3Server creates a new POP3 server instance. tlsLoader may be nil
-func NewPOP3Server(cfg config.POP3Config, stores *store.Stores) *POP3Server {
+// when TLS is not configured.
-	return &POP3Server{stores: stores, cfg: cfg}
+func NewPOP3Server(cfg config.POP3Config, stores *store.Stores, tlsLoader *tlsutil.Loader) *POP3Server {
+	return &POP3Server{stores: stores, cfg: cfg, tlsLoader: tlsLoader}
 }
 
 func (s *POP3Server) tlsConfig() (*tls.Config, error) {
-	if s.cfg.TLSCert == "" || s.cfg.TLSKey == "" {
+	if s.tlsLoader == nil {
 		return nil, fmt.Errorf("POP3 TLS certificate or key not configured")
 	}
-	cert, err := tls.LoadX509KeyPair(s.cfg.TLSCert, s.cfg.TLSKey)
+	// GetCertificate 每次握手按需重载证书，证书更新后无需重启服务
-	if err != nil {
+	return &tls.Config{GetCertificate: s.tlsLoader.GetCertificate}, nil
-		return nil, fmt.Errorf("load POP3 TLS certificate failed: %w", err)
-	}
-	return &tls.Config{Certificates: []tls.Certificate{cert}}, nil
 }
 
 // Start starts the POP3 server on the configured plain-text port.

internal/smtp_server/server.go

@@ -15,6 +15,7 @@ import (
 	"mail_go/internal/outbound"
 	"mail_go/internal/storage"
 	"mail_go/internal/store"
+	"mail_go/internal/tlsutil"
 
 	"github.com/emersion/go-message/mail"
 	"github.com/emersion/go-sasl"
@@ -31,27 +32,25 @@ const (
 
 // SMTPServer wraps go-smtp servers and provides local mail delivery.
 type SMTPServer struct {
-	stores   *store.Stores
+	stores    *store.Stores
-	storage  *storage.AttachmentStorage
+	storage   *storage.AttachmentStorage
-	outbound *outbound.Manager
+	outbound  *outbound.Manager
-	cfg      config.SMTPConfig
+	cfg       config.SMTPConfig
+	tlsLoader *tlsutil.Loader
 }
 
-// NewSMTPServer creates a new SMTP server instance.
+// NewSMTPServer creates a new SMTP server instance. tlsLoader may be nil
-func NewSMTPServer(cfg config.SMTPConfig, stores *store.Stores, attStorage *storage.AttachmentStorage, ob *outbound.Manager) *SMTPServer {
+// when TLS is not configured.
-	return &SMTPServer{stores: stores, storage: attStorage, outbound: ob, cfg: cfg}
+func NewSMTPServer(cfg config.SMTPConfig, stores *store.Stores, attStorage *storage.AttachmentStorage, ob *outbound.Manager, tlsLoader *tlsutil.Loader) *SMTPServer {
+	return &SMTPServer{stores: stores, storage: attStorage, outbound: ob, cfg: cfg, tlsLoader: tlsLoader}
 }
 
 func (s *SMTPServer) tlsConfig() (*tls.Config, error) {
-	if s.cfg.TLSCert == "" || s.cfg.TLSKey == "" {
+	if s.tlsLoader == nil {
 		return nil, fmt.Errorf("SMTP TLS certificate or key not configured")
 	}
-
+	// GetCertificate 每次握手按需重载证书，证书更新后无需重启服务
-	cert, err := tls.LoadX509KeyPair(s.cfg.TLSCert, s.cfg.TLSKey)
+	return &tls.Config{GetCertificate: s.tlsLoader.GetCertificate}, nil
-	if err != nil {
-		return nil, fmt.Errorf("failed to load SMTP TLS certificate: %w", err)
-	}
-	return &tls.Config{Certificates: []tls.Certificate{cert}}, nil
 }
 
 func (s *SMTPServer) newServer(addr string, mode smtpMode, tlsConfig *tls.Config) *smtp.Server {
@@ -285,7 +284,14 @@ type parsedSMTPMessage struct {
 	textBody    string
 	htmlBody    string
 	date        time.Time
-	attachments []*db.Attachment
+	attachments []*parsedAttachment
+}
+
+// parsedAttachment holds an extracted MIME attachment part.
+type parsedAttachment struct {
+	fileName    string
+	contentType string
+	data        []byte
 }
 
 func parseSMTPMessage(data []byte) (*parsedSMTPMessage, error) {
@@ -346,10 +352,10 @@ func parseSMTPMessage(data []byte) (*parsedSMTPMessage, error) {
 				log.Printf("SMTP: error reading attachment part: %v", readErr)
 				continue
 			}
-			msg.attachments = append(msg.attachments, &db.Attachment{
+			msg.attachments = append(msg.attachments, &parsedAttachment{
-				FileName:    filename,
+				fileName:    filename,
-				ContentType: contentType,
+				contentType: contentType,
-				FileSize:    int64(len(buf)),
+				data:        buf,
 			})
 		}
 	}
@@ -376,7 +382,32 @@ func (s *smtpSession) saveMessage(userID uint, folder string, parsed *parsedSMTP
 		IsFlagged: false,
 		Date:      parsed.date,
 	}
-	return s.backend.server.stores.Mails.Create(msg)
+	if err := s.backend.server.stores.Mails.Create(msg); err != nil {
+		return err
+	}
+
+	// Persist attachments to disk and link them to the message so that the
+	// Web mail UI can list/download them and quota accounting stays correct.
+	for _, att := range parsed.attachments {
+		relPath, err := s.backend.server.storage.Save(att.fileName, att.data)
+		if err != nil {
+			log.Printf("SMTP: failed to save attachment %s: %v", att.fileName, err)
+			continue
+		}
+		rec := &db.Attachment{
+			MessageID:   msg.ID,
+			FileName:    att.fileName,
+			FilePath:    relPath,
+			ContentType: att.contentType,
+			FileSize:    int64(len(att.data)),
+		}
+		if err := s.backend.server.stores.Attachments.Create(rec); err != nil {
+			log.Printf("SMTP: failed to create attachment record: %v", err)
+			continue
+		}
+		_ = s.backend.server.stores.Users.UpdateUsedBytes(userID, rec.FileSize)
+	}
+	return nil
 }
 
 // Reset clears the session state for the next message on the same connection.

internal/smtp_server/server_test.go

@@ -0,0 +1,115 @@
+package smtp_server
+
+import (
+	"bytes"
+	"fmt"
+	"testing"
+
+	"mail_go/internal/db"
+	"mail_go/internal/storage"
+	"mail_go/internal/store"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+// testMultipartMessage builds an RFC 5322 message with one text part and one
+// base64 attachment.
+func testMultipartMessage() []byte {
+	const boundary = "X"
+	return []byte(fmt.Sprintf(
+		"From: sender@example.com\r\n"+
+			"To: rcpt@lmve.net\r\n"+
+			"Subject: with attachment\r\n"+
+			"MIME-Version: 1.0\r\n"+
+			"Content-Type: multipart/mixed; boundary=\"%s\"\r\n"+
+			"\r\n"+
+			"--%s\r\n"+
+			"Content-Type: text/plain; charset=utf-8\r\n"+
+			"\r\n"+
+			"hello body\r\n"+
+			"--%s\r\n"+
+			"Content-Type: text/plain; name=\"test.txt\"\r\n"+
+			"Content-Transfer-Encoding: base64\r\n"+
+			"Content-Disposition: attachment; filename=\"test.txt\"\r\n"+
+			"\r\n"+
+			"aGVsbG8gd29ybGQ=\r\n"+
+			"--%s--\r\n",
+		boundary, boundary, boundary, boundary))
+}
+
+func TestParseSMTPMessageExtractsAttachmentData(t *testing.T) {
+	parsed, err := parseSMTPMessage(testMultipartMessage())
+	if err != nil {
+		t.Fatalf("parseSMTPMessage: %v", err)
+	}
+	if parsed.textBody != "hello body" {
+		t.Fatalf("unexpected text body: %q", parsed.textBody)
+	}
+	if len(parsed.attachments) != 1 {
+		t.Fatalf("expected 1 attachment, got %d", len(parsed.attachments))
+	}
+	att := parsed.attachments[0]
+	if att.fileName != "test.txt" {
+		t.Fatalf("unexpected filename: %q", att.fileName)
+	}
+	if string(att.data) != "hello world" {
+		t.Fatalf("unexpected attachment data: %q", att.data)
+	}
+}
+
+func TestSaveMessagePersistsAttachments(t *testing.T) {
+	gdb, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	if err := gdb.AutoMigrate(&db.User{}, &db.Domain{}, &db.Message{}, &db.Attachment{}, &db.BanEntry{}, &db.OutboundMessage{}); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	stores := store.NewStores(gdb)
+
+	attStorage := storage.NewAttachmentStorage(t.TempDir())
+	srv := &SMTPServer{stores: stores, storage: attStorage}
+	sess := &smtpSession{backend: &smtpBackend{server: srv}}
+
+	data := testMultipartMessage()
+	parsed, err := parseSMTPMessage(data)
+	if err != nil {
+		t.Fatalf("parseSMTPMessage: %v", err)
+	}
+
+	user := &db.User{Username: "rcpt", PasswordHash: "x", DomainID: 0, IsActive: true}
+	if err := stores.Users.Create(user); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+
+	if err := sess.saveMessage(user.ID, "INBOX", parsed, data, false); err != nil {
+		t.Fatalf("saveMessage: %v", err)
+	}
+
+	msgs, err := stores.Mails.ListAllByUserAndFolder(user.ID, "INBOX")
+	if err != nil || len(msgs) != 1 {
+		t.Fatalf("expected 1 inbox message, got %d (err=%v)", len(msgs), err)
+	}
+
+	atts, err := stores.Attachments.ListByMessage(msgs[0].ID)
+	if err != nil {
+		t.Fatalf("ListByMessage: %v", err)
+	}
+	if len(atts) != 1 {
+		t.Fatalf("expected 1 attachment record, got %d", len(atts))
+	}
+	att := atts[0]
+	if att.FileName != "test.txt" || att.FileSize != int64(len("hello world")) {
+		t.Fatalf("unexpected attachment record: %+v", att)
+	}
+
+	// The file must exist on disk with the original content.
+	content, err := attStorage.Read(att.FilePath)
+	if err != nil {
+		t.Fatalf("read attachment from disk: %v", err)
+	}
+	if !bytes.Equal(content, []byte("hello world")) {
+		t.Fatalf("attachment content mismatch: %q", content)
+	}
+}

internal/tlsutil/tlsutil.go

@@ -0,0 +1,127 @@
+// Package tlsutil 提供 TLS 证书热加载：每次 TLS 握手时按需检查
+// 证书路径与文件内容是否变化，变化则自动重载，证书更新后无需重启
+// 服务即可生效。
+package tlsutil
+
+import (
+	"crypto/tls"
+	"fmt"
+	"os"
+	"sync"
+	"time"
+)
+
+// retryInterval 是重载失败后的最小重试间隔，避免证书文件损坏时
+// 每个握手都重复做无意义的磁盘读取。
+const retryInterval = 5 * time.Second
+
+// Source 返回当前应使用的证书路径。路径可能随时间变化（例如管理后台
+// 一键导入证书后切换到新的域名证书）；返回空路径表示暂无可用证书。
+type Source func() (certPath, keyPath string)
+
+// Loader 管理一对可热加载的证书。所有方法均并发安全。
+type Loader struct {
+	mu       sync.Mutex
+	source   Source
+	certPath string
+	keyPath  string
+	cert     *tls.Certificate
+	certMod  time.Time
+	keyMod   time.Time
+	lastTry  time.Time
+	logf     func(format string, args ...interface{})
+}
+
+// NewLoader 立即加载并校验证书，失败返回错误（保持启动时 fail-fast）。
+// source 为 nil 时证书路径固定不变，仅检测文件内容变化。
+func NewLoader(certPath, keyPath string, source Source, logf func(string, ...interface{})) (*Loader, error) {
+	if certPath == "" || keyPath == "" {
+		return nil, fmt.Errorf("TLS 证书路径为空")
+	}
+	l := &Loader{
+		source:   source,
+		certPath: certPath,
+		keyPath:  keyPath,
+		logf:     logf,
+	}
+	if err := l.load(); err != nil {
+		return nil, err
+	}
+	return l, nil
+}
+
+// GetCertificate 实现 tls.Config.GetCertificate：
+// 每次 TLS 握手时检查证书路径与文件是否有变化，有则自动重载；
+// 重载失败时继续使用上一次成功加载的证书，避免中断现有服务。
+func (l *Loader) GetCertificate(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	certPath, keyPath := l.certPath, l.keyPath
+	if l.source != nil {
+		certPath, keyPath = l.source()
+	}
+	if certPath == "" || keyPath == "" {
+		// 暂无证书可用：继续使用旧证书（若有）
+		return l.current()
+	}
+
+	changed := certPath != l.certPath || keyPath != l.keyPath
+	if !changed {
+		changed = l.filesChanged(certPath, keyPath)
+	}
+
+	// 仅在重载失败后节流（避免证书文件损坏时每个握手都重复读盘）；
+	// 成功后清零节流，保证正常的连续更新立即生效。
+	if changed && time.Since(l.lastTry) >= retryInterval {
+		l.lastTry = time.Now()
+		l.certPath, l.keyPath = certPath, keyPath
+		if err := l.load(); err != nil {
+			if l.logf != nil {
+				l.logf("TLS 证书重载失败 (%s, %s): %v，继续使用旧证书", certPath, keyPath, err)
+			}
+		} else {
+			l.lastTry = time.Time{}
+			if l.logf != nil {
+				l.logf("TLS 证书已热加载: %s", certPath)
+			}
+		}
+	}
+
+	return l.current()
+}
+
+// current 返回当前已加载的证书。
+func (l *Loader) current() (*tls.Certificate, error) {
+	if l.cert == nil {
+		return nil, fmt.Errorf("TLS 证书不可用")
+	}
+	return l.cert, nil
+}
+
+// filesChanged 判断证书/私钥文件自上次加载后是否被修改。
+// 文件暂时不可读（如正在原子替换）时视为已变化，触发重载尝试。
+func (l *Loader) filesChanged(certPath, keyPath string) bool {
+	stC, errC := os.Stat(certPath)
+	stK, errK := os.Stat(keyPath)
+	if errC != nil || errK != nil {
+		return true
+	}
+	return !stC.ModTime().Equal(l.certMod) || !stK.ModTime().Equal(l.keyMod)
+}
+
+// load 从当前路径加载证书对并记录文件修改时间。
+func (l *Loader) load() error {
+	cert, err := tls.LoadX509KeyPair(l.certPath, l.keyPath)
+	if err != nil {
+		return err
+	}
+	if stC, err := os.Stat(l.certPath); err == nil {
+		l.certMod = stC.ModTime()
+	}
+	if stK, err := os.Stat(l.keyPath); err == nil {
+		l.keyMod = stK.ModTime()
+	}
+	l.cert = &cert
+	return nil
+}

internal/tlsutil/tlsutil_test.go

@@ -0,0 +1,241 @@
+package tlsutil
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+	"time"
+)
+
+// writeCertPair 生成一对自签名证书并写入文件，返回叶子证书序列号。
+func writeCertPair(t *testing.T, certPath, keyPath string, serial int64) {
+	t.Helper()
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("生成私钥失败: %v", err)
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(serial),
+		Subject:      pkix.Name{CommonName: "test"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		DNSNames:     []string{"localhost"},
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatalf("生成证书失败: %v", err)
+	}
+
+	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
+
+	if err := os.MkdirAll(filepath.Dir(certPath), 0700); err != nil {
+		t.Fatalf("创建目录失败: %v", err)
+	}
+	if err := os.WriteFile(certPath, certPEM, 0600); err != nil {
+		t.Fatalf("写入证书失败: %v", err)
+	}
+	if err := os.WriteFile(keyPath, keyPEM, 0600); err != nil {
+		t.Fatalf("写入私钥失败: %v", err)
+	}
+}
+
+func leafSerial(t *testing.T, cert *x509.Certificate) *big.Int {
+	t.Helper()
+	return cert.SerialNumber
+}
+
+func TestNewLoaderFailsFast(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+	os.WriteFile(certPath, []byte("garbage"), 0600)
+	os.WriteFile(keyPath, []byte("garbage"), 0600)
+
+	if _, err := NewLoader(certPath, keyPath, nil, nil); err == nil {
+		t.Fatal("无效证书应返回错误")
+	}
+}
+
+func TestReloadOnFileChange(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+
+	writeCertPair(t, certPath, keyPath, 1)
+	l, err := NewLoader(certPath, keyPath, nil, nil)
+	if err != nil {
+		t.Fatalf("NewLoader 失败: %v", err)
+	}
+
+	c1, err := l.GetCertificate(nil)
+	if err != nil {
+		t.Fatalf("GetCertificate 失败: %v", err)
+	}
+	if c1.Leaf == nil {
+		if parsed, err := x509.ParseCertificate(c1.Certificate[0]); err == nil {
+			c1.Leaf = parsed
+		}
+	}
+	if leafSerial(t, c1.Leaf).Int64() != 1 {
+		t.Fatalf("初始证书序列号应为 1")
+	}
+
+	// 替换文件内容（模拟证书更新），无需重启
+	time.Sleep(10 * time.Millisecond) // 确保 mtime 变化
+	writeCertPair(t, certPath, keyPath, 2)
+
+	c2, err := l.GetCertificate(nil)
+	if err != nil {
+		t.Fatalf("更新后 GetCertificate 失败: %v", err)
+	}
+	if parsed, err := x509.ParseCertificate(c2.Certificate[0]); err == nil {
+		c2.Leaf = parsed
+	}
+	if leafSerial(t, c2.Leaf).Int64() != 2 {
+		t.Fatal("文件更新后应自动加载新证书（序列号 2）")
+	}
+}
+
+func TestStaleCertOnInvalidReload(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+
+	writeCertPair(t, certPath, keyPath, 1)
+	l, err := NewLoader(certPath, keyPath, nil, nil)
+	if err != nil {
+		t.Fatalf("NewLoader 失败: %v", err)
+	}
+
+	// 写入损坏的证书：重载失败时应继续使用旧证书
+	time.Sleep(10 * time.Millisecond)
+	os.WriteFile(certPath, []byte("broken"), 0600)
+
+	c, err := l.GetCertificate(nil)
+	if err != nil {
+		t.Fatalf("重载失败时不应返回错误: %v", err)
+	}
+	if parsed, err := x509.ParseCertificate(c.Certificate[0]); err == nil {
+		c.Leaf = parsed
+	}
+	if leafSerial(t, c.Leaf).Int64() != 1 {
+		t.Fatal("重载失败时应继续使用旧证书")
+	}
+}
+
+func TestSourcePathSwitch(t *testing.T) {
+	dir := t.TempDir()
+	certA := filepath.Join(dir, "a", "cert.pem")
+	keyA := filepath.Join(dir, "a", "key.pem")
+	certB := filepath.Join(dir, "b", "cert.pem")
+	keyB := filepath.Join(dir, "b", "key.pem")
+	writeCertPair(t, certA, keyA, 1)
+	writeCertPair(t, certB, keyB, 2)
+
+	// 初始用 A，source 后续切换到 B（模拟后台导入新域名证书）
+	source := func() (string, string) { return certB, keyB }
+	l, err := NewLoader(certA, keyA, source, nil)
+	if err != nil {
+		t.Fatalf("NewLoader 失败: %v", err)
+	}
+
+	c, err := l.GetCertificate(nil)
+	if err != nil {
+		t.Fatalf("GetCertificate 失败: %v", err)
+	}
+	if parsed, err := x509.ParseCertificate(c.Certificate[0]); err == nil {
+		c.Leaf = parsed
+	}
+	if leafSerial(t, c.Leaf).Int64() != 2 {
+		t.Fatal("source 切换路径后应自动加载新证书")
+	}
+}
+
+func TestRapidSuccessiveChanges(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+
+	writeCertPair(t, certPath, keyPath, 1)
+	l, err := NewLoader(certPath, keyPath, nil, nil)
+	if err != nil {
+		t.Fatalf("NewLoader 失败: %v", err)
+	}
+
+	serialOf := func() int64 {
+		t.Helper()
+		c, err := l.GetCertificate(nil)
+		if err != nil {
+			t.Fatalf("GetCertificate 失败: %v", err)
+		}
+		parsed, err := x509.ParseCertificate(c.Certificate[0])
+		if err != nil {
+			t.Fatalf("解析证书失败: %v", err)
+		}
+		return parsed.SerialNumber.Int64()
+	}
+
+	// 5 秒内连续两次更新，两次都应立即生效（节流只针对失败重载）
+	time.Sleep(10 * time.Millisecond)
+	writeCertPair(t, certPath, keyPath, 2)
+	if got := serialOf(); got != 2 {
+		t.Fatalf("第一次更新后应加载序列号 2，实际 %d", got)
+	}
+
+	time.Sleep(10 * time.Millisecond)
+	writeCertPair(t, certPath, keyPath, 3)
+	if got := serialOf(); got != 3 {
+		t.Fatalf("第二次快速更新后应立即加载序列号 3，实际 %d", got)
+	}
+}
+
+func TestConcurrentGetCertificate(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+	writeCertPair(t, certPath, keyPath, 1)
+
+	l, err := NewLoader(certPath, keyPath, nil, nil)
+	if err != nil {
+		t.Fatalf("NewLoader 失败: %v", err)
+	}
+
+	var wg sync.WaitGroup
+	stop := make(chan struct{})
+	// 并发读
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for {
+				select {
+				case <-stop:
+					return
+				default:
+					if _, err := l.GetCertificate(nil); err != nil {
+						t.Errorf("并发 GetCertificate 失败: %v", err)
+						return
+					}
+				}
+			}
+		}()
+	}
+	// 同时反复替换证书文件（模拟续期）
+	for i := int64(2); i < 6; i++ {
+		writeCertPair(t, certPath, keyPath, i)
+		time.Sleep(20 * time.Millisecond)
+	}
+	close(stop)
+	wg.Wait()
+}

internal/web/handlers/admin.go

@@ -5,12 +5,14 @@ import (
 	"fmt"
 	"log"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
 
+	"mail_go/internal/caddycert"
 	"mail_go/internal/db"
 	"mail_go/internal/dkim"
 	"mail_go/internal/outbound"
@@ -23,16 +25,17 @@ import (
 
 // AdminHandler handles admin-related routes (dashboard, domain/user management).
 type AdminHandler struct {
-	stores   *store.Stores
+	stores       *store.Stores
-	storage  *storage.AttachmentStorage
+	storage      *storage.AttachmentStorage
-	tlsDir   string
+	tlsDir       string
-	outbound *outbound.Manager
+	caddyDataDir string
+	outbound     *outbound.Manager
 }
 
 // NewAdminHandler creates a new AdminHandler with the given stores, attachment
-// storage, TLS directory and outbound delivery manager.
+// storage, TLS directory, Caddy data directory and outbound delivery manager.
-func NewAdminHandler(stores *store.Stores, attStorage *storage.AttachmentStorage, tlsDir string, ob *outbound.Manager) *AdminHandler {
+func NewAdminHandler(stores *store.Stores, attStorage *storage.AttachmentStorage, tlsDir string, caddyDataDir string, ob *outbound.Manager) *AdminHandler {
-	return &AdminHandler{stores: stores, storage: attStorage, tlsDir: tlsDir, outbound: ob}
+	return &AdminHandler{stores: stores, storage: attStorage, tlsDir: tlsDir, caddyDataDir: caddyDataDir, outbound: ob}
 }
 
 // Dashboard renders the admin dashboard with summary statistics.
@@ -209,6 +212,16 @@ func (h *AdminHandler) EditDomain(c *gin.Context) {
 	}
 
 	currentUser, _ := c.Get("currentUser")
+
+	caddyMsg, caddyMsgType := "", ""
+	if c.Query("caddy_err") != "" {
+		caddyMsg = c.Query("caddy_err")
+		caddyMsgType = "error"
+	} else if c.Query("caddy_ok") == "1" {
+		caddyMsg = "✅ 已从 Caddy 获取证书并保存到域名 TLS 目录，同时已启用该域名的 TLS；证书已热加载，无需重启服务。"
+		caddyMsgType = "success"
+	}
+
 	c.HTML(200, "admin_domain_form", gin.H{
 		"currentUser":       currentUser,
 		"activeFolder":      "domains",
@@ -217,6 +230,8 @@ func (h *AdminHandler) EditDomain(c *gin.Context) {
 		"domain":            domain,
 		"tlsPublicCert":     readTLSCert(domain.TlsCertPath),
 		"tlsCertConfigured": domain.TlsCertPath != "" && domain.TlsKeyPath != "",
+		"caddyMsg":          caddyMsg,
+		"caddyMsgType":      caddyMsgType,
 	})
 }
 
@@ -264,6 +279,78 @@ func (h *AdminHandler) UpdateDomain(c *gin.Context) {
 	c.Redirect(http.StatusFound, "/admin/domains")
 }
 
+// FetchCaddyCert 尝试从本机 Caddy 的证书存储中获取该域名的证书与私钥，
+// 保存到 MailGo 的域名 TLS 目录并更新数据库记录。结果通过查询参数回显到
+// 编辑页面（caddy_ok=1 成功 / caddy_err=<消息> 失败）。
+func (h *AdminHandler) FetchCaddyCert(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.String(http.StatusBadRequest, "无效的域名ID")
+		return
+	}
+
+	domain, err := h.stores.Domains.GetByID(uint(id))
+	if err != nil {
+		c.String(http.StatusNotFound, "域名不存在")
+		return
+	}
+
+	editURL := fmt.Sprintf("/admin/domains/%d/edit", domain.ID)
+	fail := func(msg string) {
+		log.Printf("从 Caddy 获取证书失败 domain=%s: %s", domain.Name, msg)
+		c.Redirect(http.StatusFound, editURL+"?caddy_err="+url.QueryEscape(msg))
+	}
+
+	cert, err := caddycert.Fetch(domain.Name, h.caddyCertRoots())
+	if err != nil {
+		fail(fmt.Sprintf("从 Caddy 获取证书失败: %v", err))
+		return
+	}
+
+	// 保存到域名 TLS 目录（与手动上传证书的位置一致）
+	domainTLSDir := filepath.Join(h.tlsDir, strconv.FormatUint(uint64(domain.ID), 10))
+	if err := os.MkdirAll(domainTLSDir, 0700); err != nil {
+		fail(fmt.Sprintf("创建 TLS 证书目录失败: %v", err))
+		return
+	}
+
+	certPath := filepath.Join(domainTLSDir, "cert.pem")
+	keyPath := filepath.Join(domainTLSDir, "key.pem")
+	if err := os.WriteFile(certPath, cert.CertPEM, 0644); err != nil {
+		fail(fmt.Sprintf("保存 TLS 公钥证书失败: %v", err))
+		return
+	}
+	if err := os.WriteFile(keyPath, cert.KeyPEM, 0600); err != nil {
+		fail(fmt.Sprintf("保存 TLS 私钥失败: %v", err))
+		return
+	}
+
+	domain.TlsCertPath = certPath
+	domain.TlsKeyPath = keyPath
+	domain.TlsEnabled = true
+	if err := h.stores.Domains.Update(domain); err != nil {
+		fail(fmt.Sprintf("更新域名记录失败: %v", err))
+		return
+	}
+
+	log.Printf("已从 Caddy 导入域名 %s 的证书 (%s)，热加载生效", domain.Name, cert.Source)
+	c.Redirect(http.StatusFound, editURL+"?caddy_ok=1")
+}
+
+// caddyCertRoots 返回按优先级排列的证书来源目录：
+//  1. MailGo 的同步镜像目录 <storage>/tls/caddy —— 由 install.sh 安装的
+//     systemd path 同步任务以 root 权限从 Caddy 证书存储镜像而来，
+//     mail_go 始终可读，证书续期后自动更新；
+//  2. 配置文件 caddy.data_dir 指定的目录（可选）；
+//
+// 其余默认位置由 caddycert.Fetch 自行探测。
+func (h *AdminHandler) caddyCertRoots() []string {
+	return []string{
+		filepath.Join(filepath.Dir(h.tlsDir), "caddy"),
+		h.caddyDataDir,
+	}
+}
+
 func readTLSCert(path string) string {
 	if path == "" {
 		return ""
@@ -276,7 +363,20 @@ func readTLSCert(path string) string {
 	return string(data)
 }
 
+// normalizePEM 统一 PEM 文本的换行为 LF：浏览器提交 textarea 时会把
+// 换行规范为 CRLF，而证书文件里通常是 LF，直接比较会误判“证书已修改”
+// （表现为：私钥留空保留现有私钥时仍报“必须同时填写”）。
+func normalizePEM(s string) string {
+	s = strings.ReplaceAll(s, "\r\n", "\n")
+	s = strings.ReplaceAll(s, "\r", "\n")
+	return s
+}
+
 func (h *AdminHandler) handleDomainTLSUpdate(domain *db.Domain, publicCert, privateKey string) error {
+	// 归一化换行，保证与磁盘文件一致，避免表单往返时被误判为已修改
+	publicCert = normalizePEM(strings.TrimSpace(publicCert))
+	privateKey = normalizePEM(strings.TrimSpace(privateKey))
+
 	if !domain.TlsEnabled {
 		return nil
 	}
@@ -288,7 +388,7 @@ func (h *AdminHandler) handleDomainTLSUpdate(domain *db.Domain, publicCert, priv
 		}
 		return fmt.Errorf("启用 TLS 时必须填写 TLS 私钥和公钥证书")
 	}
-	if hasExistingCert && privateKey == "" && strings.TrimSpace(readTLSCert(domain.TlsCertPath)) == publicCert {
+	if hasExistingCert && privateKey == "" && normalizePEM(strings.TrimSpace(readTLSCert(domain.TlsCertPath))) == publicCert {
 		return nil
 	}
 	if publicCert == "" || privateKey == "" {

internal/web/handlers/admin_tls_test.go

@@ -0,0 +1,126 @@
+package handlers
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"mail_go/internal/db"
+)
+
+// makeTestCertPair 生成一对自签名证书（PEM），可选 LF/CRLF 换行。
+func makeTestCertPair(t *testing.T, lineEnding string) (certPEM, keyPEM string) {
+	t.Helper()
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("生成私钥失败: %v", err)
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "test"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		DNSNames:     []string{"mail.example.com"},
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatalf("生成证书失败: %v", err)
+	}
+
+	certPEM = string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}))
+	if lineEnding == "crlf" {
+		certPEM = strings.ReplaceAll(certPEM, "\n", "\r\n")
+	}
+	keyPEM = string(pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)}))
+	if lineEnding == "crlf" {
+		keyPEM = strings.ReplaceAll(keyPEM, "\n", "\r\n")
+	}
+	return certPEM, keyPEM
+}
+
+// writeExistingCert 模拟已有证书文件（LF 换行）并返回 domain。
+func writeExistingCert(t *testing.T, tlsDir string, certPEM, keyPEM string) *db.Domain {
+	t.Helper()
+	dir := filepath.Join(tlsDir, "1")
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		t.Fatalf("创建目录失败: %v", err)
+	}
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+	if err := os.WriteFile(certPath, []byte(certPEM+"\n"), 0644); err != nil {
+		t.Fatalf("写入证书失败: %v", err)
+	}
+	if err := os.WriteFile(keyPath, []byte(keyPEM+"\n"), 0600); err != nil {
+		t.Fatalf("写入私钥失败: %v", err)
+	}
+	return &db.Domain{
+		ID:          1,
+		Name:        "mail.example.com",
+		TlsEnabled:  true,
+		TlsCertPath: certPath,
+		TlsKeyPath:  keyPath,
+	}
+}
+
+// TestHandleDomainTLSUpdateUnchangedCertCRLF 复现用户报告的 bug：
+// 浏览器把 textarea 的 LF 换成 CRLF 提交，私钥留空（保留现有私钥），
+// 证书内容未变，此时保存不应报“必须同时填写”。
+func TestHandleDomainTLSUpdateUnchangedCertCRLF(t *testing.T) {
+	certLF, keyLF := makeTestCertPair(t, "lf")
+	h := &AdminHandler{tlsDir: t.TempDir()}
+	domain := writeExistingCert(t, h.tlsDir, certLF, keyLF)
+
+	submittedCert := strings.ReplaceAll(certLF, "\n", "\r\n") // 模拟浏览器提交
+	if err := h.handleDomainTLSUpdate(domain, submittedCert, ""); err != nil {
+		t.Fatalf("证书未修改且私钥留空时应保留现有私钥，实际报错: %v", err)
+	}
+}
+
+// TestHandleDomainTLSUpdateNewPairCRLF 新证书+私钥（CRLF 提交）应正常保存，
+// 且写入文件为 LF 换行、能组成有效密钥对。
+func TestHandleDomainTLSUpdateNewPairCRLF(t *testing.T) {
+	certCRLF, keyCRLF := makeTestCertPair(t, "crlf")
+	h := &AdminHandler{tlsDir: t.TempDir()}
+	domain := &db.Domain{ID: 1, Name: "mail.example.com", TlsEnabled: true}
+
+	if err := h.handleDomainTLSUpdate(domain, certCRLF, keyCRLF); err != nil {
+		t.Fatalf("CRLF 提交的新证书应保存成功，实际报错: %v", err)
+	}
+
+	data, err := os.ReadFile(domain.TlsCertPath)
+	if err != nil {
+		t.Fatalf("读取保存的证书失败: %v", err)
+	}
+	if strings.Contains(string(data), "\r") {
+		t.Error("保存的证书文件不应包含 CR")
+	}
+	if _, err := tls.LoadX509KeyPair(domain.TlsCertPath, domain.TlsKeyPath); err != nil {
+		t.Fatalf("保存的证书对无效: %v", err)
+	}
+}
+
+// TestHandleDomainTLSUpdateChangedCertWithoutKey 证书确实被修改但私钥留空，
+// 应报“必须同时填写”（防止用不匹配的私钥）。
+func TestHandleDomainTLSUpdateChangedCertWithoutKey(t *testing.T) {
+	certA, keyA := makeTestCertPair(t, "lf")
+	certB, _ := makeTestCertPair(t, "lf")
+	h := &AdminHandler{tlsDir: t.TempDir()}
+	domain := writeExistingCert(t, h.tlsDir, certA, keyA)
+
+	err := h.handleDomainTLSUpdate(domain, certB, "")
+	if err == nil || !strings.Contains(err.Error(), "必须同时填写") {
+		t.Fatalf("修改证书但私钥留空应报“必须同时填写”，实际: %v", err)
+	}
+}

internal/web/server.go

@@ -38,14 +38,15 @@ func formatBytes(b int64) string {
 
 // WebServer wraps the Gin engine and its dependencies.
 type WebServer struct {
-	engine     *gin.Engine
+	engine       *gin.Engine
-	stores     *store.Stores
+	stores       *store.Stores
-	storage    *storage.AttachmentStorage
+	storage      *storage.AttachmentStorage
-	cfg        config.WebConfig
+	cfg          config.WebConfig
-	storageCfg config.StorageConfig
+	storageCfg   config.StorageConfig
-	authCfg    config.AuthConfig
+	authCfg      config.AuthConfig
-	banCfg     config.BanConfig
+	banCfg       config.BanConfig
-	outbound   *outbound.Manager
+	caddyDataDir string
+	outbound     *outbound.Manager
 }
 
 // templateFuncs returns custom template functions for rendering.
@@ -84,7 +85,7 @@ func templateFuncs() template.FuncMap {
 
 // NewWebServer creates a new WebServer, initializes the Gin engine,
 // configures sessions, middleware, and registers all routes.
-func NewWebServer(cfg config.WebConfig, stores *store.Stores, attStorage *storage.AttachmentStorage, storageCfg config.StorageConfig, authCfg config.AuthConfig, banCfg config.BanConfig, ob *outbound.Manager) *WebServer {
+func NewWebServer(cfg config.WebConfig, stores *store.Stores, attStorage *storage.AttachmentStorage, storageCfg config.StorageConfig, authCfg config.AuthConfig, banCfg config.BanConfig, caddyCfg config.CaddyConfig, ob *outbound.Manager) *WebServer {
 	gin.SetMode(gin.ReleaseMode)
 	engine := gin.New()
 	engine.Use(gin.Logger())
@@ -107,14 +108,15 @@ func NewWebServer(cfg config.WebConfig, stores *store.Stores, attStorage *storag
 	engine.SetHTMLTemplate(tmpl)
 
 	ws := &WebServer{
-		engine:     engine,
+		engine:       engine,
-		stores:     stores,
+		stores:       stores,
-		storage:    attStorage,
+		storage:      attStorage,
-		cfg:        cfg,
+		cfg:          cfg,
-		storageCfg: storageCfg,
+		storageCfg:   storageCfg,
-		authCfg:    authCfg,
+		authCfg:      authCfg,
-		banCfg:     banCfg,
+		banCfg:       banCfg,
-		outbound:   ob,
+		caddyDataDir: caddyCfg.DataDir,
+		outbound:     ob,
 	}
 
 	ws.registerRoutes()
@@ -125,7 +127,7 @@ func NewWebServer(cfg config.WebConfig, stores *store.Stores, attStorage *storag
 func (ws *WebServer) registerRoutes() {
 	authHandler := handlers.NewAuthHandler(ws.stores, ws.authCfg, ws.banCfg)
 	mailHandler := handlers.NewMailHandler(ws.stores, ws.storage, ws.outbound)
-	adminHandler := handlers.NewAdminHandler(ws.stores, ws.storage, filepath.Join(ws.storageCfg.BaseDir, "tls", "domains"), ws.outbound)
+	adminHandler := handlers.NewAdminHandler(ws.stores, ws.storage, filepath.Join(ws.storageCfg.BaseDir, "tls", "domains"), ws.caddyDataDir, ws.outbound)
 
 	// Apply BanMiddleware globally before public routes
 	ws.engine.Use(middleware.BanMiddleware(ws.stores))
@@ -175,6 +177,7 @@ func (ws *WebServer) registerRoutes() {
 		admin.GET("/domains/:id/edit", adminHandler.EditDomain)
 		admin.POST("/domains/:id", adminHandler.UpdateDomain)
 		admin.POST("/domains/:id/delete", adminHandler.DeleteDomain)
+		admin.POST("/domains/:id/fetch-caddy-cert", adminHandler.FetchCaddyCert)
 		admin.GET("/domains/:id/dns", adminHandler.DNSHint)
 		admin.GET("/users", adminHandler.ListUsers)
 		admin.GET("/users/new", adminHandler.NewUser)

internal/web/templates/admin/domain_form.html

@@ -24,6 +24,7 @@
                 <div class="card">
                     <h2 style="margin-bottom:16px;">{{if .isEdit}}编辑域名{{else}}新增域名{{end}}</h2>
                     {{if .error}}<div class="alert alert-error">{{.error}}</div>{{end}}
+                    {{if .caddyMsg}}<div class="alert {{if eq .caddyMsgType "success"}}alert-success{{else}}alert-error{{end}}">{{.caddyMsg}}</div>{{end}}
                     <form method="POST" action="{{if .isEdit}}/admin/domains/{{.domain.ID}}{{else}}/admin/domains{{end}}">
                         <div class="form-group">
                             <label>域名</label>
@@ -63,12 +64,40 @@
                                 <label>TLS 公钥证书 PEM</label>
                                 <textarea name="tls_public_cert" rows="8" placeholder="-----BEGIN CERTIFICATE-----&#10;...&#10;-----END CERTIFICATE-----" style="font-family:monospace;">{{.tlsPublicCert}}</textarea>
                                 {{if .tlsCertConfigured}}
-                                <p style="color:#27ae60;font-size:12px;margin-top:4px;">✅ TLS 证书已配置；上传新证书后需重启服务生效。</p>
+                                <p style="color:#27ae60;font-size:12px;margin-top:4px;">✅ TLS 证书已配置；上传新证书后自动热加载生效。</p>
                                 {{else}}
                                 <p style="color:#e67e22;font-size:12px;margin-top:4px;">⚠️ TLS 证书未配置，启用 TLS 时必须同时填写私钥和证书。</p>
                                 {{end}}
                             </div>
                         </div>
+                        <div class="form-group" style="margin-top:4px;">
+                            <label>从 Caddy 获取证书</label>
+                            <p style="color:#7f8c8d;font-size:12px;margin-top:2px;margin-bottom:8px;">若该域名已由本机 Caddy 托管 HTTPS（自动签发证书），可一键导入其证书与私钥，并自动启用 TLS；证书热加载，无需重启服务。</p>
+                            <button type="button" class="btn" id="btn_fetch_caddy" onclick="fetchCaddyCert()" style="background:#2e86de;color:#fff;">🔒 从 Caddy 获取证书</button>
+                            <span id="caddy_fetch_msg" style="margin-left:10px;font-size:12px;color:#7f8c8d;"></span>
+                            <script>
+                            async function fetchCaddyCert() {
+                                var btn = document.getElementById('btn_fetch_caddy');
+                                var msg = document.getElementById('caddy_fetch_msg');
+                                btn.disabled = true;
+                                var oldText = btn.textContent;
+                                btn.textContent = '获取中…';
+                                msg.textContent = '';
+                                try {
+                                    var resp = await fetch('/admin/domains/{{.domain.ID}}/fetch-caddy-cert', { method: 'POST' });
+                                    if (resp.redirected) {
+                                        window.location.href = resp.url;
+                                        return;
+                                    }
+                                    msg.textContent = '获取失败: ' + await resp.text();
+                                } catch (e) {
+                                    msg.textContent = '请求失败: ' + e;
+                                }
+                                btn.disabled = false;
+                                btn.textContent = oldText;
+                            }
+                            </script>
+                        </div>
                         {{end}}
                         <script>
                         function togglePorts() {

main.go

@@ -12,6 +12,7 @@ import (
 	"net"
 	"os"
 	"path/filepath"
+	"sync"
 	"time"
 
 	"mail_go/config"
@@ -22,6 +23,7 @@ import (
 	"mail_go/internal/smtp_server"
 	"mail_go/internal/storage"
 	"mail_go/internal/store"
+	"mail_go/internal/tlsutil"
 	"mail_go/internal/web"
 
 	"golang.org/x/crypto/bcrypt"
@@ -35,7 +37,7 @@ func applyDomainTLSConfig(stores *store.Stores, cfg *config.Config) {
 
 	applied := applyTLSCertPaths(cfg, domain.TlsCertPath, domain.TlsKeyPath)
 	if applied {
-		log.Printf("使用域名 %s 的 TLS 证书；更新证书后需重启服务生效", domain.Name)
+		log.Printf("使用域名 %s 的 TLS 证书；证书更新后自动热加载，无需重启服务", domain.Name)
 	}
 }
 
@@ -59,6 +61,49 @@ func applyTLSCertPaths(cfg *config.Config, certPath, keyPath string) bool {
 	return applied
 }
 
+// tlsSource 返回证书路径来源：协议在 toml 中显式配置的证书优先；
+// 否则取第一个启用 TLS 且有证书的域名（管理后台一键导入证书后自动
+// 切换，无需重启）。结果缓存 10 秒，避免每次握手都查询数据库。
+func tlsSource(explicitCert, explicitKey string, stores *store.Stores) tlsutil.Source {
+	var (
+		mu         sync.Mutex
+		lastCheck  time.Time
+		cachedCert string
+		cachedKey  string
+	)
+	return func() (string, string) {
+		mu.Lock()
+		defer mu.Unlock()
+		if time.Since(lastCheck) < 10*time.Second {
+			return cachedCert, cachedKey
+		}
+		lastCheck = time.Now()
+		if explicitCert != "" && explicitKey != "" {
+			cachedCert, cachedKey = explicitCert, explicitKey
+		} else if d, err := stores.Domains.GetFirstTLSEnabledWithCert(); err == nil {
+			cachedCert, cachedKey = d.TlsCertPath, d.TlsKeyPath
+		} else {
+			cachedCert, cachedKey = "", ""
+		}
+		return cachedCert, cachedKey
+	}
+}
+
+// newTLSCertLoader 创建带热加载的 TLS 证书加载器（每次握手自动重载）。
+// 初始路径取显式配置或启动时填充的路径；source 允许后续动态切换
+// 证书来源。加载失败返回 nil，对应协议将不启用 TLS。
+func newTLSCertLoader(explicitCert, explicitKey, initCert, initKey string, stores *store.Stores, proto string) *tlsutil.Loader {
+	if initCert == "" || initKey == "" {
+		initCert, initKey = explicitCert, explicitKey
+	}
+	loader, err := tlsutil.NewLoader(initCert, initKey, tlsSource(explicitCert, explicitKey, stores), log.Printf)
+	if err != nil {
+		log.Printf("%s TLS 证书初始化失败: %v（该协议将不启用 TLS）", proto, err)
+		return nil
+	}
+	return loader
+}
+
 func ensureSelfSignedTLSConfig(cfg *config.Config) {
 	if cfg.SMTP.TLSCert != "" && cfg.SMTP.TLSKey != "" && cfg.IMAP.TLSCert != "" && cfg.IMAP.TLSKey != "" && cfg.POP3.TLSCert != "" && cfg.POP3.TLSKey != "" {
 		return
@@ -168,9 +213,21 @@ func main() {
 
 	// 5. Initialize attachment storage
 	attStorage := storage.NewAttachmentStorage(cfg.Storage.AttachDir)
+
+	// 记录 toml 中显式配置的证书路径；此后 applyDomainTLSConfig 会用
+	// 域名证书填充空值，需要原始值来判断“显式配置优先”。
+	explicitSMTPCert, explicitSMTPKey := cfg.SMTP.TLSCert, cfg.SMTP.TLSKey
+	explicitIMAPCert, explicitIMAPKey := cfg.IMAP.TLSCert, cfg.IMAP.TLSKey
+	explicitPOP3Cert, explicitPOP3Key := cfg.POP3.TLSCert, cfg.POP3.TLSKey
+
 	applyDomainTLSConfig(stores, cfg)
 	ensureSelfSignedTLSConfig(cfg)
 
+	// 证书热加载器：每次 TLS 握手自动重载证书文件，证书更新后无需重启
+	smtpTLS := newTLSCertLoader(explicitSMTPCert, explicitSMTPKey, cfg.SMTP.TLSCert, cfg.SMTP.TLSKey, stores, "SMTP")
+	imapTLS := newTLSCertLoader(explicitIMAPCert, explicitIMAPKey, cfg.IMAP.TLSCert, cfg.IMAP.TLSKey, stores, "IMAP")
+	pop3TLS := newTLSCertLoader(explicitPOP3Cert, explicitPOP3Key, cfg.POP3.TLSCert, cfg.POP3.TLSKey, stores, "POP3")
+
 	// 6. Outbound delivery manager (external mail queue + worker)
 	outboundMgr := outbound.NewManager(cfg.Outbound, cfg.SMTP.Domain, stores)
 	if outboundMgr.Enabled() {
@@ -181,7 +238,7 @@ func main() {
 	}
 
 	// 7. Start SMTP server
-	smtpSrv := smtp_server.NewSMTPServer(cfg.SMTP, stores, attStorage, outboundMgr)
+	smtpSrv := smtp_server.NewSMTPServer(cfg.SMTP, stores, attStorage, outboundMgr, smtpTLS)
 	go func() {
 		if err := smtpSrv.Start(); err != nil {
 			log.Printf("SMTP 服务启动失败: %v", err)
@@ -202,7 +259,7 @@ func main() {
 	}
 
 	// 7. Start IMAP server
-	imapSrv := imap_server.NewIMAPServer(cfg.IMAP, stores)
+	imapSrv := imap_server.NewIMAPServer(cfg.IMAP, stores, imapTLS)
 	go func() {
 		if err := imapSrv.Start(); err != nil {
 			log.Printf("IMAP 服务启动失败: %v", err)
@@ -218,7 +275,7 @@ func main() {
 	}
 
 	// 8. Start POP3 server
-	pop3Srv := pop3_server.NewPOP3Server(cfg.POP3, stores)
+	pop3Srv := pop3_server.NewPOP3Server(cfg.POP3, stores, pop3TLS)
 	go func() {
 		if err := pop3Srv.Start(); err != nil {
 			log.Printf("POP3 服务启动失败: %v", err)
@@ -234,7 +291,7 @@ func main() {
 	}
 
 	// 10. Start Web server
-	webServer := web.NewWebServer(cfg.Web, stores, attStorage, cfg.Storage, cfg.Auth, cfg.Ban, outboundMgr)
+	webServer := web.NewWebServer(cfg.Web, stores, attStorage, cfg.Storage, cfg.Auth, cfg.Ban, cfg.Caddy, outboundMgr)
 	fmt.Printf("Web 服务启动在 %s\n", cfg.Web.Addr)
 	go func() {
 		if err := webServer.Start(); err != nil {