Remote access

Remote access opens OpenMail in a browser on your phone or another computer. Your Mac stays the host. Mail, tokens and keys stay on the Mac, and the browser talks to it over your own Tailscale network (your tailnet). Nothing passes through OpenMail servers.

Remote access is off by default.

What you needCopy Anchor Link

• The Tailscale app on your Mac, signed in. OpenMail doesn't install it. Get it from tailscale.com/download. A CLI-only install from Homebrew (brew install tailscale), the standalone tailscaled package or Nix works too. OpenMail looks for tailscale in the Tailscale app, /opt/homebrew/bin, /usr/local/bin, ~/.nix-profile/bin and /run/current-system/sw/bin. It also checks your PATH, but only when OpenMail was started from a terminal. Opened from the Dock or Finder, it gets the system's default PATH, which has none of these.
• MagicDNS and HTTPS Certificates turned on for your tailnet. Both are on the DNS page of the Tailscale admin console.
• The Tailscale app on the other device, signed in to the same tailnet.
• Your Mac awake, with OpenMail open.

Turn it onCopy Anchor Link

1. Open Settings → Remote access on the Mac.
2. Check that the Tailscale section shows your tailnet and no warnings.
3. Turn on Allow access from my tailnet.
4. On the other device, scan the QR code or open the address shown, such as https://macbook-pro.tail1234.ts.net:8443.

OpenMail runs tailscale serve --bg --https=8443 to publish itself on your tailnet. If something else already uses port 8443 on this Mac, OpenMail stops and tells you. It doesn't replace another app's setting. Turning remote access off removes the mapping. Quitting OpenMail removes it too, and the next launch adds it again. If Tailscale isn't running when you turn remote access off, Settings says it couldn't remove the mapping. OpenMail keeps trying in the background, at most every five minutes, until Tailscale responds or you change the setting. It also tries when you open Settings → Remote access or press Check again, and at the next launch.

OpenMail never uses Tailscale Funnel, so the page is never on the public internet.

Who can sign inCopy Anchor Link

Tailscale tells OpenMail which tailnet login each visitor uses. Only logins on the Who can sign in list get in. The list starts with your Mac's own login, such as you@github.

Any of your own devices on the tailnet can open the page. To limit which devices can reach your Mac, use access controls in the Tailscale admin console. For example, allow only your phone to reach the Mac on port 8443.

Your Tailscale login is what lets a browser in. Browsers lists each browser that opened OpenMail. Disconnect closes that browser's connection, but reloading the page connects it again while its login is on the list. To keep someone out, remove their login: their browsers disconnect at once and can't come back. Sessions also end after 12 hours or when OpenMail quits.

What works in the browserCopy Anchor Link

You can read, search, write, send and organise mail, and change mail and reading settings. Sending uses the same outbox and undo send as the Mac.

Some things stay on the Mac:

• Adding accounts and signing in again
• AI keys, AI access and MCP
• Remote access settings
• Opening messages in new windows, printing and saving files on the Mac
• Updates, default mail app and Apple Contacts

Attachments download to the device you are using. Files you attach upload to the Mac, with the same size limits as on the Mac. The Mac takes two uploads at a time; a third waits for you to try again.

Tailscale Service (advanced)Copy Anchor Link

You can publish OpenMail as a Tailscale Service with its own name, such as svc:openmail, instead of port 8443 on this Mac.

1. Define the service in the Tailscale admin console with port tcp:443.
2. Approve this Mac as a host for it. Tailscale may require the Mac to use a tag for this.
3. Enter the name under Advanced: Tailscale Service in Settings.

The address becomes https://openmail.<your-tailnet>.ts.net. Leave the field empty to use this Mac's name.

TroubleshootingCopy Anchor Link

• Tailscale isn't installed. Install the Tailscale app, sign in, then press Check again.
• Couldn't remove the Tailscale mapping. Tailscale wasn't running when you turned remote access off. Open Tailscale. OpenMail removes the mapping as soon as Tailscale responds, or press Check again.
• HTTPS certificates are off. Turn on MagicDNS and HTTPS Certificates in the admin console, then press Check again.
• Something else on this Mac already uses Tailscale Serve on this port. Another tailscale serve setting uses port 8443. Run tailscale serve status to see it, and remove it if you no longer need it.
• The page doesn't load. OpenMail is closed or the Mac is asleep. Quitting OpenMail takes the address offline, and opening it publishes the address again. Open OpenMail on the Mac.
• "Your Mac disconnected this browser." The Mac disconnected it in Browsers, the session expired, or your login was removed. Reload the page. It connects again while your login is still on the list.