First identify the account and the mail provider
Change the password at the provider that actually hosts the mailbox, then update every device or application that uses it. This guide applies only when your accepted Novasean service includes a DirectAdmin-hosted virtual mailbox. If the mailbox is hosted by another provider, use that provider’s account process. Your DirectAdmin panel login, a virtual mailbox such as name@example.com, and DirectAdmin’s system email account are not interchangeable credentials.
Use a known, genuine HTTPS control-panel address reached from your accepted service or account information. Do not enter a mailbox password into a reset page reached from an unexpected email or search advert. If you cannot identify the right service or account, ask Novasean support through your normal authenticated channel before changing anything.
Prepare the owner and connected clients
- Confirm that you are the authorised account owner or have their approval to change this specific mailbox.
- List each phone, desktop mail app, webmail login, website form or application that uses the mailbox credential. A program that sends through authenticated SMTP may use it even if it never reads the inbox.
- Keep a safe way to reach the account owner during the change. A reset message sent only to the mailbox being changed may be inaccessible if the mailbox is already locked out.
- If you suspect the credential was exposed, treat this as an access incident: change it promptly from a trusted device and ask the service operator to check for unexpected access or forwarding. Do not wait to complete a routine device inventory first.
Do not disclose the old or new password in an ordinary support ticket. Use your approved password manager or other authorised secret-sharing process.
Change the virtual mailbox password in the right place
Sign in to the authentic DirectAdmin panel with the authorised hosting account. At User level, open the email accounts for the correct domain, identify the exact virtual mailbox and use its available password-change control. DirectAdmin skins and service settings differ, so the label and location may vary; stop if the page asks you to alter the panel or system account instead. Choose a unique, strong password and save it securely. Do not send it to the mailbox owner in plain email.
DirectAdmin also documents a self-service virtual-mailbox change function that requires the old mailbox password. Use it only if your service operator provides a verified HTTPS route and enables that function. The documentation contains an old HTTP example; do not follow an unencrypted login or password form. The self-service function does not change the main DirectAdmin system-account password.
If the old password is forgotten or the correct control is unavailable, ask the authenticated hosting account owner or service operator for the permitted reset path. Do not guess repeatedly or assume that the public DirectAdmin panel’s forgotten-password page resets a virtual mailbox.
Update every mail client and sender
After the server confirms the change, update the saved password for incoming IMAP or POP access and for outgoing SMTP submission wherever the account is configured. Some clients store these separately. Include phones, desktop clients, tablets and authorised applications or website forms identified before the change. Retire obsolete clients or app connections rather than leaving them repeatedly trying the old password.
Keep the configured hostname and TLS certificate validation intact. A password change is not a reason to disable encryption, accept a certificate warning or switch to a different mail server. Follow your service’s actual connection settings; the secure mail-client setup guide covers host and TLS checks.
Verify the new credential and mail flow
- Open a fresh, direct webmail login or mail-client session with the new mailbox password. A one-click webmail sign-in from DirectAdmin can use single sign-on without entering that password, so it is not sufficient proof on its own.
- Send a small test message from the mailbox to an external address and confirm it arrives.
- Reply from that external address and confirm the response appears in the intended server-side mailbox, then in each authorised client.
- Check the applications and devices that send through the mailbox and confirm they authenticate without repeated prompts or delivery failures.
Keep the test times and any redacted error codes. A successful webmail login proves one route, not that every device or application has been updated.
If access still fails
If direct webmail login works but one mail app fails, verify that app’s saved incoming and outgoing credentials, full mailbox username, server name and TLS settings. If no direct login works, confirm that the password was changed for the intended virtual mailbox at the actual receiving provider. If only sending fails, follow the receive-but-not-send guide; a server sending limit, rejection or account suspension is a different problem.
Give support the domain, mailbox identifier, affected client, time with time zone, redacted exact error and whether fresh direct webmail, incoming and outgoing tests passed. Never send a password, reset token, full private message or unrestricted log. If a client has only a local copy of mail, do not delete and recreate its account as a first diagnostic step; preserve and assess that local data first.
Frequently asked questions
Does changing the DirectAdmin panel password change my mailbox password? Not for an ordinary virtual mailbox. Identify the selected account before changing either credential. Can I use the one-click Roundcube button to test the new password? No: where enabled, that feature can sign in without entering the mailbox password. Use a fresh direct login. Will mail already rejected during the change arrive later? Do not rely on that. Check the sender’s delivery result and ask them to resend a permanently bounced message after access and delivery are restored.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.