I Can’t Log In to Webmail

Most webmail login failures come down to one of: wrong password, wrong username format, expired 2FA, or stale browser cache. Work through this checklist before opening a support ticket — almost every case resolves in the first three steps.

Check 1 — You're using the mailbox password, not the dashboard password

This is the single most common cause. TrekMail has two different passwords:

• Dashboard password — what you use to sign in to trekmail.net/login (where you manage domains, billing, mailboxes).
• Mailbox password — what you use to sign in to webmail (and to set up Outlook, Apple Mail, your phone). One per mailbox.

They are completely separate. If you've been trying your dashboard password in webmail, that's why authentication is failing.

If you don't know your mailbox password, see Forgot Your TrekMail Password? — there are three different recovery paths depending on what you have access to.

Check 2 — Username is the full email address

Webmail's username is your full email address — for example alice@yourcompany.com. Not alice, not alice@. The local-part alone won't authenticate.

Some browsers' password managers store an incomplete value if you originally entered it without the domain. Clear the saved entry, re-type the full address, save again.

Check 3 — Caps Lock / autocorrect

Sounds dumb. Catches plenty of people. iOS Safari auto-capitalises the first letter of the email field on some devices, which makes Alice@yourcompany.com get rejected by the case-sensitive lookup. Re-type from scratch with caps lock off and watch for autocorrect.

Check 4 — Right webmail URL

The standard webmail entry point is https://webmail.trekmail.net. If your provider runs TrekMail under their own brand via White Label Lite, the URL is https://app.yourbrand.com/mail instead — make sure you're going to the right one. The two are visually different (different logo and colours).

If the branded URL gives you a certificate error or "this site can't be reached":

• Don't ignore the cert warning — contact your provider and let them know SSL on their branded domain is broken. They'll need to re-provision the certificate. (Providers: see White Label DNS Troubleshooting.)
• As a fallback, use the canonical https://webmail.trekmail.net URL — your mailbox is reachable there regardless of branded-URL state.

Check 5 — Account or mailbox status

Two cases where a known-correct password still won't let you in:

• Mailbox is paused. An admin can pause individual mailboxes for various reasons. The Mailboxes page in the account dashboard shows a "Paused" badge. Ask your admin to resume the mailbox.
• Account is suspended. If the whole TrekMail account is suspended for billing, abuse, or deliverability concerns, every mailbox on it stops accepting logins. The account owner needs to resolve the suspension (see Fixing Failed Payments for billing-related suspensions).

In both cases the error message you see is generic ("Invalid credentials") because we don't reveal mailbox state to unauthenticated requests — same anti-enumeration policy as the password-reset page.

Check 6 — Too many failed attempts

Webmail's rate limit kicks in after repeated failures from the same IP + email combination:

• After 5 failed attempts, a reCAPTCHA challenge appears below the login form. You'll need to complete it before the next submission goes through.
• After 20 failed attempts, login is hard-blocked with the message "Too many login attempts. Please try again later." — wait 15 minutes for the counter to reset.
• Each failure also adds a progressive delay (1s, 2s, 4s, 8s, up to 16s) so brute-forcing is slow as well as eventually blocked.

If you're being asked for reCAPTCHA: complete it. If you're seeing "Too many attempts", wait 15 minutes — there's no manual override.

If you keep tripping the rate limit because you genuinely don't remember the password, switch to a self-service password reset instead of guessing. The reset flow has its own (separate) rate limit but lets you set a new known-good password in one go.

Check 7 — Browser cache or stale session

Particularly common after a password change, an admin reset, or switching between accounts:

• Clear webmail's cookies in your browser. In Chrome/Edge: open webmail, click the lock icon in the address bar → Cookies and site data → Manage on-device site data → delete entries for webmail.trekmail.net (or your branded domain).
• Hard refresh the login page: Ctrl+Shift+R (Windows/Linux) or Cmd+Shift+R (Mac).
• Try a private/incognito window. If login succeeds there but fails in the main window, it's cache.
• Try a different browser as a confirmation test.

Two-factor authentication (2FA) problems

If your mailbox has 2FA enabled, you'll see a code prompt after entering your password. Here's how to handle issues at that step.

Symptom: 6-digit code rejected even though it looks correct

The most common reason: your phone's clock is even slightly out of sync. TOTP codes regenerate every 30 seconds and require the device's clock to match server time within about ±90 seconds. A phone that's drifted by a minute or two will produce codes that fail validation.

Fix:

• iPhone: Settings → General → Date & Time → Set Automatically ON.
• Android: Settings → System → Date & Time → Use network-provided time ON.

After enabling auto-time, wait ~30 seconds for clock sync, then generate a fresh code and try again.

Symptom: Lost phone, deleted authenticator app

Use one of your recovery codes — the single-use backup codes shown when you first set up 2FA. Enter a recovery code in the authenticator prompt to log in, then go straight to Settings → Security to disable 2FA and re-enable it with your new device. Each recovery code is consumed on use; if you've burned through them, generate fresh codes after re-enabling.

Symptom: Lost recovery codes AND lost authenticator

Contact TrekMail support. Include your mailbox address, when you set up 2FA, and any details that help us verify your identity (recent invoice number, payment method last 4, support ticket history). Identity verification can take a few hours; it's slower than self-service for a reason — we're protecting against impersonation.

Symptom: Not being asked for a code, but 2FA is supposed to be on

Your current session is still valid. 2FA only triggers on new sessions. When the current session expires (or you sign out and back in), you'll be asked for a code.

Symptom: Authenticator app shows codes but webmail says the secret is invalid

Rare, but happens if you scanned the QR for the dashboard account password instead of the webmail one (they're separate). Re-scan with the QR shown specifically for your mailbox, then disable + re-enable.

Error messages decoded

Still stuck

Open a support ticket from the Support page and include:

• The mailbox address you're trying to log into.
• The exact URL you're hitting (webmail.trekmail.net/login vs branded).
• The exact error message you see (or a screenshot).
• Whether the dashboard login at trekmail.net/login works for you (this confirms whether the broader account is healthy).
• What you've already tried from this list.

We can usually pinpoint the issue from server-side auth logs within minutes once we know what to look for.